Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1: Fast, privacy-first consumer DNS service

blog.cloudflare.com

Post reply on HN
Print view View original

621–630 of 695 posts

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#621

Post by dancek »

Operyl wrote: post #303
hsivonen wrote: post #295

Earlier quoted context omitted.

The client sends SNI, so how could the server opt out?

You just solved your own question. Cloudflare creates an opensource client that users install locally.

The client that sends SNI is, AFAIK, the browser or a similar piece of software. Some older browsers don't support SNI so they can only access single-vhost-per-ip over https.

This means you'll have a really hard time trying to get rid of SNI system-wide, what with a lot of minor apps making their own https connections (granted, on Android or iOS they probably use a common API, but not on a computer).

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#622

Post by c8456 »

well.. for ipv6 doesn't perform that well..

== CloudFlare ==

Ping statistics for 1.1.1.1:

    Minimum = 10ms, Maximum = 10ms, Average = 10ms
Ping statistics for 2606:4700:4700::1111

    Minimum = 40ms, Maximum = 40ms, Average = 40ms
== OpenDNS ==

Ping statistics for 208.67.222.222:

    Minimum = 38ms, Maximum = 38ms, Average = 38ms
Ping statistics for 2620:0:ccc::2:

    Minimum = 34ms, Maximum = 34ms, Average = 34ms

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#623

Post by vavrusa »

peterburkimsher wrote: post #604
therealmarv wrote: post #51

Interesting that https://dnsleaktest.com/ does not work with Cloudflare's DNS... that's a first one for me.

https://www.immigration.govt.nz also doesn't work - I just realised when reopening my browser. Thankfully I noticed quickly, so I knew what the problem would be.

As it should fail in any validating resolver. The CNAME signature recently expired: http://dnsviz.net/d/www.immigration.govt.nz/dnssec/

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#624

Post by rsync »

cleanbrowsing wrote: post #299

And look at these ping times: CloudFlare Google DNS Quad9 OpenDNS NewYork 2 msec 1 msec 2 msec 19 msec Toronto 2 msec 28 msec 17 msec 27 msec Atlanta 1 msec 2 msec 1 msec 19 msec Dallas 1 msec 9 msec 1 msec 7 msec San Francisco 3 msec 21 msec 15 msec 20 msec London 1 msec 12 msec 1 msec 14 msec Amsterdam 2 msec 6 msec 1 msec 6 msec Frankfurt 1 msec 9 msec 2 msec 9 msec Tokyo 2 msec 2 msec 81 msec 77 msec Singapore 2…

"And look at these ping times ..."

I would be interested to hear from google (8.8.8.8) how much ping traffic that address gets ...

I know that I will quickly ping 8.8.8.8 as a very quick and dirty test of network up ... its just faster to type than any other address I could test with.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#625

Post by epse »

majewsky wrote: post #331
Operyl wrote: post #303

Earlier quoted context omitted.

You just solved your own question. Cloudflare creates an opensource client that users install locally.

Where's the button to install your own DNS resolver on iOS? Or non-rooted Android, for that matter.

Non-rooted android, you have to set a static IP for every network and then there will be an option to enter DNS names. They default to Google DNS Static IP settings are under advanced.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#626

Post by eastdakota »

feelin_googley wrote: post #586
eastdakota wrote: post #378

Earlier quoted context omitted.

I'm fine with nitpicking. Let me try and be clear: We're not logging IPs. We inherently receive them when they connect to the service, but we don't write them to disk and flush them quickly (i.e., seconds or minutes). We're not logging hashes of IPs. We're not logging ASNs of the IPs connecting to the service. We do log the other parts of a DNS query in order to help prevent abuse and debug issues. However, we've com…

"... a crappy data sharing service." Do you mean OpenDNS?

No. I mean most businesses that are based on sharing data. They are low margin and not very interesting. I was thinking about businesses like Axicom when I wrote the comment.

Have a ton of respect for David Ulevitch and the whole OpenDNS team. While OpenDNS started with an ad-supported business model, they've completely pivoted away from that. Now that they're part of Cisco, I believe their nearly exclusive revenue stream today is their Umbrella product which is a network security product aimed at businesses. While I don't know for sure, I'd be highly surprised if OpenDNS were selling browsing data.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#627

Post by [deleted] »

therealmarv wrote: post #30
yjftsjthsd-h wrote: post #13

Earlier quoted context omitted.

On the contrary, they've taken 2 big steps that are better than ISPs (not sure about Google): * no logging * DNS over HTTPS

Google is one of the first ones using DNS over HTTPS. BTW if you want to use DNS over HTTPS on Linux/Mac I strongly recommend dnscrypt proxy V2 (golang rewrite) https://github.com/jedisct1/dnscrypt-proxy and put e.g. cloudflare in their config toml file to make use of it.

[deleted]

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#628

Post by rsync »

JD557 wrote: post #176

I wish that they talked a bit more about their stance regarding censorship. They have a small paragraph talking about the problem, but they don't talk about the "solution". While Cloudflare has been pretty neutral about censoring sites in the past (notably, pirate sites), the Daily Stormer incident put them in a though spot[1]. They talk a bit about Project Galileo (the link is broken BTW, it should be https://www.cl…

"I wish that they talked a bit more about their stance regarding censorship. They have a small paragraph talking about the problem, but they don't talk about the "solution"."

I think there's a good way to put this to the test - establish a DNS "mixer" that will randomly direct DNS requests to either 1.1.1.1 or 8.8.8.8 or (whatever) and let the public have access to it.

In this way, Cloudflare would bear some small expense from processing these DNS requests (essentially zero) but would receive no information about the initial requestor.

It would be interesting to run this experiment and perhaps see some real traffic on the DNS mixer ... and then see how cloudflare responds.

Would they block the mixer ?

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#629

Post by jerheinze »

cmstoken wrote: post #584
anjbe wrote: post #371

Earlier quoted context omitted.

It’s not like I’d be running everything over Tor. DNS requests for newly‐visited domains would slow down, but unbound’s prefetch feature would keep popular frequently‐used domains cached. Adding one of those advertising domain blacklists might help performance too. The point would be to keep Cloudflare from being able to track my DNS requests.

Why not use a VPN like PIA?

> Why not use a VPN like PIA?

A VPN gives you little protection against browser fingerprinting, which may alone leak enough information about you to identify you. Also privacy-by-policy is in no way near privacy-by-design. If you want privacy, use the Tor Browser.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#630

Post by davewasthere »

In Bendigo Australia, and Steve Gibson's DNSBenchmark tells me that of my 50 optimised resolvers (with 1.1.1.1 and 9.9.9.9 added), the two fastest public DNS services I should use are 9.9.9.9 followed by 8.8.8.8. I also add a couple of others for redundancy..
Post reply on HN