Earlier quoted context omitted.
Yes, just select "Cloudflare" in the list. It's been available in the public list for quite some time already.
I see it on the list, but is it referring to the 1.1.1.1 server?
Yes, this is it.
1.1.1.1: Fast, privacy-first consumer DNS service
421–430 of 695 posts
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#422>"And we wanted to put our money where our mouth was, so we committed to retaining KPMG, the well-respected auditing firm, to audit our code and practices annually and publish a public report confirming we're doing what we said we would." It's worth pointing out that KPMG was Wells Fargo's independent auditor while the bank recently committed fraud on a massive scale by creating more than a million fake deposit accou…
> the bank recently committed fraud on a massive scale by creating more than a million fake deposit accounts and 560,000 credit card applications for customers without their knowledge or approval. Suppose you were a Wells Fargo depositor and a Wells Fargo teller opened a fake account in your name without consulting you. What harm did you suffer? How massive is this fraud if you measure it in a more useful way than "n…
The harm to consumers is phony credit history and random fees on many of those fake accounts.
The harm to WF shareholders was inflated metrics inflating the value of the company.
The whole point of KPMG was to validate these types of metrics for shareholders.
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#423From someone that takes DNS for granted every day, can someone shed some light on why the current state of DNS has been called archaic and needs to be replaced with something better?
It basically comes down to being insecure.
It's all plain-text over UDP. This is easily exploited for various purposes: spoofing (DDoS attacks), surveillance (such as by ISPs), hijacking/tampering, censorship, privacy concerns, and so on.
As everything else relies on DNS, the DNS must also be secure.
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#424DNS-over-HTTPS doesn’t make as much sense to me as DNS-over-TLS. They are effectively the same thing, but HTTPS has the added overhead of the HTTP headers per request. If you look at the currently in progress RFC, https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-04 , this is quite literally the only difference. The DNS request is encoded as a standard serialized DNS packet. The article mentions QUIC as being…
>The article mentions QUIC as being something that might make HTTPS faster than standard TLS. Even with TLS 1.3 0-RTT?
yes, quic will make dns over https more resillient to packet loss than a tls based approach.
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#425Is this an April Fool's joke since Cloudflare overtly hates privacy (see stance on TOR)?
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#426Not accessible from Buenos Aires, Argentina on Fibertel.
ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#427Earlier quoted context omitted.
The most useful case for this shortcut is 127.1 -> 127.0.0.1
0 , which is a shorthand for 0.0.0.0 is likely the most code-golf-y way to write localhost , as many [EDIT: Linux] systems alias 0.0.0.0 to 127.0.0.1: $ ping 0 PING 0 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.032 ms Of course, don't expect this to work universally. A lot of software will try to be clever with input validation, and fail. Tangentially related: https://fosdem.or…
0.0.0.0 is not localhost. It's "any address".
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#428And look at these ping times: CloudFlare Google DNS Quad9 OpenDNS NewYork 2 msec 1 msec 2 msec 19 msec Toronto 2 msec 28 msec 17 msec 27 msec Atlanta 1 msec 2 msec 1 msec 19 msec Dallas 1 msec 9 msec 1 msec 7 msec San Francisco 3 msec 21 msec 15 msec 20 msec London 1 msec 12 msec 1 msec 14 msec Amsterdam 2 msec 6 msec 1 msec 6 msec Frankfurt 1 msec 9 msec 2 msec 9 msec Tokyo 2 msec 2 msec 81 msec 77 msec Singapore 2…
It looks like you are testing either from centers where cloudflare has servers or exchanging traffic with, which is likely true in a data center given the traffic it transports. What most users want is the ping time from home/office.
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#429Earlier quoted context omitted.
Speaking as a former KPMG employee who did infosec, the financial audit and controls people are far removed from anyone with technical skill in this domain. It may be cold comfort, but these kinds of special purpose attestations may as well be done by a different company (insert BearingPoint joke here).
Right, that's why it's amusing to think we're supposed to believe that KPMG are going to audit a code base and logging infrastructure.
Agreed. Anecdotal but...
We have had to supply information to KPMG “IT Auditors” at a client due to some software we wrote.
In most cases the auditors are young grads who have never worked in an actual IT/software dev team. So they have very naive view and never ask the right questions. If one wanted to hide something it would be super easy.
Re: 1.1.1.1: Fast, privacy-first consumer DNS service
#430And look at these ping times: CloudFlare Google DNS Quad9 OpenDNS NewYork 2 msec 1 msec 2 msec 19 msec Toronto 2 msec 28 msec 17 msec 27 msec Atlanta 1 msec 2 msec 1 msec 19 msec Dallas 1 msec 9 msec 1 msec 7 msec San Francisco 3 msec 21 msec 15 msec 20 msec London 1 msec 12 msec 1 msec 14 msec Amsterdam 2 msec 6 msec 1 msec 6 msec Frankfurt 1 msec 9 msec 2 msec 9 msec Tokyo 2 msec 2 msec 81 msec 77 msec Singapore 2…
Keep in mind that ping time isn't the only factor in DNS lookup speed. For me (sonic.net in Palo Alto): ping 1.1.1.1: ~22ms ping 8.8.8.8: ~19ms dig @1.1.1.1: ~45ms dig @8.8.8.8: ~70ms Disclaimer: Eyeballed averages over a few samples. A more rigorous test of DNS lookup times would be cool to see. Disclosure: I work for Cloudflare, but not on DNS.
I'm guessing Google's resolvers are a little busier than Cloudflare's right now, because pretty much nobody not on HN right now is hitting them. Will be a more interesting comparison in 6 months.