1.1.1.1: Fast, privacy-first consumer DNS service • Hacker News Board

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#551

Post by snuxoll » Mon, Apr 02, 2018, 2:09 AM UTC

cthalupa wrote: post #326

hartator wrote: post #320

Earlier quoted context omitted.

If you are on ethernet, I am able to get 1-2ms pings. On same AT&T Fiber Gigabit. Wifi ruins both bandwidth and latency for me.

You should invest in some better wifi gear, it sounds like! On a Unifi nano hd, with moderate signal, my latency only goes up 1ms. Getting ~3.5 ms on wifi to 1.1.1.1, ~2.5ms ethernet

Man, wish I could ever get pings this low - the link from my VDSL2 model to the local CenturyLink CO alone is 8-15ms depending on the day.

Sucks that VDSL2 no longer supports fastpath, not that I could use it on an ADSL line due to bonding anyway :/

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#552

Post by twr » Mon, Apr 02, 2018, 2:11 AM UTC

ComputerGuru wrote: post #71

This is bad, bad, bad advice. You don't set the DNS on your local machine. That breaks things. The DNS needs to be set at the gateway. If you change your PC/mac's DNS to an external service, you won't be able to resolve any addresses on the local network. Come on, CloudFlare. You guys know better than that. Please stop breaking the (local) internet.

Unbound lets you forward queries to nameservers matched by the query (sub-)domain.

*.internal queries can be sent to the local nameserver, for example, while others can be forwarded to the public nameserver.

Minimal unbound.conf example:

    forward-zone:
        name: "."
        forward-addr: 1.1.1.1
    forward-zone:
        name: "internal"
        forward-addr: 10.0.0.1

Unbound also supports DNS-over-TLS, although stubby's implementation is much better. It's usually ideal to forward to a local stubby instance instead.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#553

Post by rqs » Mon, Apr 02, 2018, 2:12 AM UTC

huxflux wrote: post #547

Timeout from Shanghai, China on China Unicom. Pinging 1.1.1.1 with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 1.1.1.1: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

China Mobile here, same result. Not sure whether or not it already been blocked. LOL

UPDATE: Maybe the routing is not ready yet, let's wait for a moment and check it out later.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#554

Post by [deleted] » Mon, Apr 02, 2018, 2:15 AM UTC

ori_b wrote: post #501

chimera77 wrote: post #202

Earlier quoted context omitted.

One of the use cases for DNS-over-HTTPS given in the draft was to allow web applications access to DNS directly via existing browser APIs.

I've implemented DNS before. Doing this saves an entire 300 lines of code. At the same time, it makes the DNS server much more complicated. On top of that, implementing a compliant posix libc will now either use a completely different code path, or pull in a huge amount of code to implement HTTP, HTTP/2, and QUIC. If the simpler, cleaner, and more performant route is taken, it willgbreak when someone screws up "legac…

[deleted]

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#555

Post by sesutton » Mon, Apr 02, 2018, 2:16 AM UTC

f2n wrote: post #548

sesutton wrote: post #525

Earlier quoted context omitted.

I think AT&T's fiber modems are using 1.1.1.1. I'm getting < 1ms ping times and according to Cloudflare's website there's no data center close enough to me for that to be possible without violating the speed of light.

what happens if you go to https://1.1.1.1 in a browser? It should have a valid TLS cert and have a big banner that says, among other things, "Introducing 1.1.1.1". If your ISP's CPE or anything else is fucking with traffic to that IP, it wont load/display that

I just get connection refused.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#556

Post by jasongill » Mon, Apr 02, 2018, 2:22 AM UTC

shaklee3 wrote: post #550

matthberg wrote: post #536

Earlier quoted context omitted.

Ping from University of Rochester, over wifi: Cloudflare: 64 bytes from 1.1.1.1: icmp_seq=0 ttl=128 time=2 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=128 time=2 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=128 time=2 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=128 time=9 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=128 time=2 ms Google: 64 bytes from 8.8.8.8: icmp_seq=0 ttl=54 time=12 ms 64 bytes from 8.8.8.8: icmp_seq=1 ttl=54 t…

It might be your isp caching the DNS in a local data center after you first request it

There is no DNS involved when you're connecting directly to an IP address

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#557

Post by asd » Mon, Apr 02, 2018, 2:23 AM UTC

f2n wrote: post #548

sesutton wrote: post #525

Earlier quoted context omitted.

I think AT&T's fiber modems are using 1.1.1.1. I'm getting < 1ms ping times and according to Cloudflare's website there's no data center close enough to me for that to be possible without violating the speed of light.

what happens if you go to https://1.1.1.1 in a browser? It should have a valid TLS cert and have a big banner that says, among other things, "Introducing 1.1.1.1". If your ISP's CPE or anything else is fucking with traffic to that IP, it wont load/display that

Here's what I'm seeing.

https://i.imgur.com/piisG5D.jpg

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#558

Post by ktosobcy » Mon, Apr 02, 2018, 2:26 AM UTC

Chile, Temuco:

--- 1.1.1.1 ping statistics --- 26 packets transmitted, 26 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 56.440/62.916/106.933/10.084 ms

--- 8.8.8.8 ping statistics --- 10 packets transmitted, 10 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 27.454/30.733/33.344/1.456 ms

--- 9.9.9.9 ping statistics --- 13 packets transmitted, 13 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 29.041/35.952/75.558/11.780 ms

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#559

Post by dannyw » Mon, Apr 02, 2018, 2:30 AM UTC

matthberg wrote: post #536

chrissnell wrote: post #317

Earlier quoted context omitted.

Where are you testing from? I'm going to guess: a datacenter. Residential customers won't see anything this fast. I'm in a small town in Kansas, connected by 1 Gbit ATT fiber. I'm getting ~26ms to 1.1.1.1 and ~19ms to my private DNS resolver that I host in a datacenter in Dallas. Google DNS comes in around 19ms. I suspect that Cloudflare and Google DNS both have POPs in Dallas, which accounts for the similar numbers…

Ping from University of Rochester, over wifi: Cloudflare: 64 bytes from 1.1.1.1: icmp_seq=0 ttl=128 time=2 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=128 time=2 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=128 time=2 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=128 time=9 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=128 time=2 ms Google: 64 bytes from 8.8.8.8: icmp_seq=0 ttl=54 time=12 ms 64 bytes from 8.8.8.8: icmp_seq=1 ttl=54 t…

It could be a technique they use to filter out all the junk traffic.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#560

Post by rootusrootus » Mon, Apr 02, 2018, 2:34 AM UTC

jasongill wrote: post #556

shaklee3 wrote: post #550

Earlier quoted context omitted.

It might be your isp caching the DNS in a local data center after you first request it

There is no DNS involved when you're connecting directly to an IP address

Unless you tell it not to, ping will try a reverse lookup on the IP you are pinging in order to display that to you in the output. It's a good idea to keep that in mind when you ping something, especially if you notice the first ping is abnormally slow.