1.1.1.1: Fast, privacy-first consumer DNS service • Hacker News Board

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#521

Post by rattray » Sun, Apr 01, 2018, 11:50 PM UTC

minxomat wrote: post #465

avip wrote: post #393

Earlier quoted context omitted.

I've worked with KPMG subsidiary for security audit. This is an E&Y kind of company, where you pay x4 to work with the least competent people because you need a familiar name stamped on some report.

KPMG has earned a few nickname acronyms because of this in Germany: "Keiner Prüft Mehr Genau" or "Kinder Prüfen Meine Gesellschaft" ("no one audits carefully anymore" and "children audit my company" respectively). We have a few former KPMG employees. They have many stories to tell, about everything from glass ceilings to harassment.

I don't do business in Germany, but I'm curious; which firms would you say are most-respected there?

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#522

Post by reledi » Sun, Apr 01, 2018, 11:52 PM UTC

bogomipz wrote: post #376

>"And we wanted to put our money where our mouth was, so we committed to retaining KPMG, the well-respected auditing firm, to audit our code and practices annually and publish a public report confirming we're doing what we said we would." It's worth pointing out that KPMG was Wells Fargo's independent auditor while the bank recently committed fraud on a massive scale by creating more than a million fake deposit accou…

Definitely worth pointing out, but I don't take issue with their wording. KPMG has a worldwide presence and is an incredibly popular auditing firm. It's certainly possible for KPMG to be a "well-respected auditing firm" in the public's perception and for them to fail to detect all unethical practices during an audit.

While hiring them doesn't prove that Cloudflare's code and practices are sound, it does reduce the risk that they aren't.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#523

Post by minxomat » Sun, Apr 01, 2018, 11:58 PM UTC

rattray wrote: post #521

minxomat wrote: post #465

Earlier quoted context omitted.

KPMG has earned a few nickname acronyms because of this in Germany: "Keiner Prüft Mehr Genau" or "Kinder Prüfen Meine Gesellschaft" ("no one audits carefully anymore" and "children audit my company" respectively). We have a few former KPMG employees. They have many stories to tell, about everything from glass ceilings to harassment.

I don't do business in Germany, but I'm curious; which firms would you say are most-respected there?

All in all, KPMG is still well respected (so is E&Y and smaller firms).

We regularly receive government grants, and the best audit experiences I've had was with the small, EU-funded auditors. They have a high level of integrity and technical/financial knowledge. But that is a very specific niche.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#524

Post by spludge » Sun, Apr 01, 2018, 11:58 PM UTC

Nition wrote: post #457

markbnj wrote: post #407

Earlier quoted context omitted.

Comcast in Northern NJ USA about 45 MI from NYC $ ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data. 64 bytes from 1.1.1.1: icmp_seq=1 ttl=56 time=10.8 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=56 time=11.3 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=56 time=10.7 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=56 time=10.9 ms PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=60 time=10.7…

From a residential connection in New Zealand: $ ping 1.1.1.1 Pinging 1.1.1.1 with 32 bytes of data: Reply from 1.1.1.1: bytes=32 time=4ms TTL=60 Reply from 1.1.1.1: bytes=32 time=4ms TTL=60 Reply from 1.1.1.1: bytes=32 time=4ms TTL=60 Reply from 1.1.1.1: bytes=32 time=4ms TTL=60 $ ping 8.8.8.8 Pinging 8.8.8.8 with 32 bytes of data: Reply from 8.8.8.8: bytes=32 time=27ms TTL=60 Reply from 8.8.8.8: bytes=32 time=27ms T…

Fastest Bigpipe residential connection available in the middle of Auckland:

  $ ping -c 4 1.1.1.1

  PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
  64 bytes from 1.1.1.1: icmp_seq=1 ttl=56 time=29.0 ms
  64 bytes from 1.1.1.1: icmp_seq=2 ttl=56 time=27.7 ms
  64 bytes from 1.1.1.1: icmp_seq=3 ttl=56 time=30.5 ms
  64 bytes from 1.1.1.1: icmp_seq=4 ttl=56 time=28.6 ms
  
  --- 1.1.1.1 ping statistics ---
  4 packets transmitted, 4 received, 0% packet loss, time 3004ms
  rtt min/avg/max/mdev = 27.731/28.993/30.573/1.028 ms

  $ ping -c 4 8.8.8.8

  PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
  64 bytes from 8.8.8.8: icmp_seq=1 ttl=55 time=27.7 ms
  64 bytes from 8.8.8.8: icmp_seq=2 ttl=55 time=30.7 ms
  64 bytes from 8.8.8.8: icmp_seq=3 ttl=55 time=28.5 ms
  64 bytes from 8.8.8.8: icmp_seq=4 ttl=55 time=30.6 ms

  --- 8.8.8.8 ping statistics ---
  4 packets transmitted, 4 received, 0% packet loss, time 3005ms
  rtt min/avg/max/mdev = 27.772/29.409/30.710/1.280 ms

I'm starting to feel I should change ISPs...

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#525

Post by sesutton » Mon, Apr 02, 2018, 12:07 AM UTC

chrissnell wrote: post #317

cleanbrowsing wrote: post #299

And look at these ping times: CloudFlare Google DNS Quad9 OpenDNS NewYork 2 msec 1 msec 2 msec 19 msec Toronto 2 msec 28 msec 17 msec 27 msec Atlanta 1 msec 2 msec 1 msec 19 msec Dallas 1 msec 9 msec 1 msec 7 msec San Francisco 3 msec 21 msec 15 msec 20 msec London 1 msec 12 msec 1 msec 14 msec Amsterdam 2 msec 6 msec 1 msec 6 msec Frankfurt 1 msec 9 msec 2 msec 9 msec Tokyo 2 msec 2 msec 81 msec 77 msec Singapore 2…

Where are you testing from? I'm going to guess: a datacenter. Residential customers won't see anything this fast. I'm in a small town in Kansas, connected by 1 Gbit ATT fiber. I'm getting ~26ms to 1.1.1.1 and ~19ms to my private DNS resolver that I host in a datacenter in Dallas. Google DNS comes in around 19ms. I suspect that Cloudflare and Google DNS both have POPs in Dallas, which accounts for the similar numbers…

I think AT&T's fiber modems are using 1.1.1.1. I'm getting < 1ms ping times and according to Cloudflare's website there's no data center close enough to me for that to be possible without violating the speed of light.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#526

Post by jkaplowitz » Mon, Apr 02, 2018, 12:16 AM UTC

kentonv wrote: post #468

nodesocket wrote: post #395

Earlier quoted context omitted.

Note, from Google Compute Engine use 8.8.8.8 as it should always be faster. I'm guessing the 8.8.8.8 service exists in every Google Cloud region. Even better use the default GCE autogenered DNS IP that they configure in /etc/resolv.conf to get instance name resolving magic.

Usually best to use 169.254.169.254, which is the magic "cloud metadata address" that talks directly to the local hypervisor (I think?). That will recurse to public DNS as necessary. https://cloud.google.com/compute/docs/internal-dns

I agree that's usually best, but one exception is worth noting: if you want only publicly resolvable results, don't use 169.254.169.254. That address adds convenient predictable hostnames for your project's instances under the .internal TLD.

Also, no need to hardcode that address - DHCP will happily serve it up. It also has the hostname metadata.google.internal and the (disfavored for security reasons) bare short hostname metadata.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#527

Post by buyx » Mon, Apr 02, 2018, 12:18 AM UTC

sizzle wrote: post #450

buyx wrote: post #435

Earlier quoted context omitted.

KPMG was also implicated in the massive South African "state capture" scandal involving the (now fugitive) Gupta family and former president Jacob Zuma. Among other things, KPMG issued a-later withdrawn-report that was used to undermine the well-respected finance minister, so that a more malleable person could be installed, while also auditing the Guptas during their worst excesses. Lest we choose to dismiss this as…

Sounds interesting, got any sources for further reading?

FT had a lot of coverage, if you're looking for a non-South African source (linking behind the paywall is probably not going to work, but you can Google for it).

https://www.bloomberg.com/news/articles/2017-09-22/kpmg-unde...

https://www.telegraph.co.uk/business/2017/09/15/kpmg-south-a...

https://www.reuters.com/article/us-kpmg-safrica/kpmgs-south-...

http://www.bbc.com/news/business-41283462

It's also been extensively covered in the South African media.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#528

Post by buyx » Mon, Apr 02, 2018, 12:26 AM UTC

JumpCrisscross wrote: post #518

tialaramex wrote: post #455

Earlier quoted context omitted.

As genuine as your question is, there are no good answers. The way we ended up with a Big Four is that the Fifth member of the Big Five (Arthur Andersen) audited Enron, essentially telling everybody that it wasn't an enormous fraud, but it was. All the senior people at AA avoided jail but the audit firm was so obviously untrustworthy it folded. But that doesn't mean the other Four are fine, it just means the "Too Big…

> If we took down one of the Big Four it would probably tank the whole world economy No it wouldn’t.

The "too big to fail" argument is what saved KPMG in South Africa:

https://www.reuters.com/article/us-kpmg-safrica-exclusive/ex...

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#529

Post by [deleted] » Mon, Apr 02, 2018, 12:32 AM UTC

cleanbrowsing wrote: post #299

And look at these ping times: CloudFlare Google DNS Quad9 OpenDNS NewYork 2 msec 1 msec 2 msec 19 msec Toronto 2 msec 28 msec 17 msec 27 msec Atlanta 1 msec 2 msec 1 msec 19 msec Dallas 1 msec 9 msec 1 msec 7 msec San Francisco 3 msec 21 msec 15 msec 20 msec London 1 msec 12 msec 1 msec 14 msec Amsterdam 2 msec 6 msec 1 msec 6 msec Frankfurt 1 msec 9 msec 2 msec 9 msec Tokyo 2 msec 2 msec 81 msec 77 msec Singapore 2…

[deleted]

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#530

Post by buremba » Mon, Apr 02, 2018, 12:44 AM UTC

> DNS resolvers inherently can't use a catchy domain because they are what have to be queried in order to figure out the IP address of a domain. It's a chicken and egg problem. And, if we wanted the service to be of help in times of crisis like the attempted Turkish coup, we needed something easy enough to remember and spraypaint on walls.

In fact, people wrote that DNS address on walls just to get away with the censorship of the government so you wouldn't be helping the government..