Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1: Fast, privacy-first consumer DNS service

blog.cloudflare.com

Post reply on HN
Print view View original

661–670 of 695 posts

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#661

Post by danellis »

icedchai wrote: post #109
danellis wrote: post #80

Earlier quoted context omitted.

How many people have local DNS at home? Not many, I'd wager. How many know how to access their router? Also not many. Besides, "In your router’s configuration page, locate the DNS server settings."

I've been running my own DNS servers since 1996, when I had my first dedicated connection (an ISDN line.) I never use my ISP's DNS.

You're not typical of the average consumer, though. Don't forget that HN is a particularly technical crowd, so you can't use it to judge how technically competent Internet users are.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#662

Post by [deleted] »

anielsen wrote: post #605
Tree1993 wrote: post #549

Earlier quoted context omitted.

Beijing: PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=52 time=241.529 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=52 time=318.034 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=52 time=337.291 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=52 time=255.748 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=52 time=247.765 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=52 time=235.611 ms 64 bytes from 1.1.1.1: icmp_seq…

Copenhagen: PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=55 time=14.053 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=55 time=12.715 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=55 time=13.615 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=55 time=14.018 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=55 time=12.261 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=55 time=11.428 ms 64 bytes from 1.1.1.1: icmp_seq=6…

[deleted]

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#663

Post by rashomon »

MarcysVonEylau wrote: post #653
anielsen wrote: post #605

Earlier quoted context omitted.

Copenhagen: PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=55 time=14.053 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=55 time=12.715 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=55 time=13.615 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=55 time=14.018 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=55 time=12.261 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=55 time=11.428 ms 64 bytes from 1.1.1.1: icmp_seq=6…

Pinging 1.1.1.1 with 32 bytes of data: Reply from 89.228.6.1: Destination net unreachable. Reply from 89.228.6.1: Destination net unreachable. Reply from 89.228.6.1: Destination net unreachable. Reply from 89.228.6.1: Destination net unreachable. Any idea why my ISP redirects this IP?

Maybe an advertisement re-direct for NXDOMAINS?

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#664

Post by eastdakota »

eastdakota wrote: post #378
rdsubhas wrote: post #84

> We will never sell your data or use it to target ads. Period. Won't sell != Won't collect > We will never log your IP address (the way other companies identify you) Never log IP != Never log anything Bonus: The way other companies identify you ~= There are other ways Edit: Looks like many people assume I'm nitpicking. So here are more specific questions: * Is logging a hashcode of the IP considered as "not logging…

I'm fine with nitpicking. Let me try and be clear: We're not logging IPs. We inherently receive them when they connect to the service, but we don't write them to disk and flush them quickly (i.e., seconds or minutes). We're not logging hashes of IPs. We're not logging ASNs of the IPs connecting to the service. We do log the other parts of a DNS query in order to help prevent abuse and debug issues. However, we've com…

One edit: team corrected me that we do log ASNs in some cases in order to debug issues with networks that may have trouble connecting or have been blocked.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#665

Post by michaelmurfy »

spludge wrote: post #524
Nition wrote: post #457

Earlier quoted context omitted.

From a residential connection in New Zealand: $ ping 1.1.1.1 Pinging 1.1.1.1 with 32 bytes of data: Reply from 1.1.1.1: bytes=32 time=4ms TTL=60 Reply from 1.1.1.1: bytes=32 time=4ms TTL=60 Reply from 1.1.1.1: bytes=32 time=4ms TTL=60 Reply from 1.1.1.1: bytes=32 time=4ms TTL=60 $ ping 8.8.8.8 Pinging 8.8.8.8 with 32 bytes of data: Reply from 8.8.8.8: bytes=32 time=27ms TTL=60 Reply from 8.8.8.8: bytes=32 time=27ms T…

Fastest Bigpipe residential connection available in the middle of Auckland: $ ping -c 4 1.1.1.1 PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data. 64 bytes from 1.1.1.1: icmp_seq=1 ttl=56 time=29.0 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=56 time=27.7 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=56 time=30.5 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=56 time=28.6 ms --- 1.1.1.1 ping statistics --- 4 packets transmitted, 4 receiv…

BigPipe, Spark, Skinny and Vodafone don't believe in peering and thus don't peer with Cloudflare at APE. If you wanted the best performance then 2degrees, Orcon, Voyager or Slingshot are the best for this since they peer.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#666

Post by notamy »

jhanschoo wrote: post #269
notamy wrote: post #266

Earlier quoted context omitted.

Sadly, binary / octal don't work: https://0b1000000010000000100000001 / https://0o100200401

Octal works, with the older 0-prefix convention: https://0100200401

Ah, I had completely forgotten about that. Thanks!

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#667

Post by tyingq »

ori_b wrote: post #392
tyingq wrote: post #242

Earlier quoted context omitted.

Sorry, confused. Https requests are prolific, while encrypted DNS requests aren't. Why isn't the former less hard to detect?

How would you tell that an encrypted chunk of data is HTTPS instead of DNS? The best you'd be able to do is guess based on behavior that it's DNS.

Destination port might be easy to differentiate dns over tls vs dns over https :)

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#668

Post by cmurf »

RKearney wrote: post #360
cmurf wrote: post #335

A big PITA for me right now with friends and family is changing DNS. They all have these Xfinity cable modem boxes that have integrated WiFi and Ethernet. It's not possible to change the DNS through the web interface. So I have to convince everyone to buy a separate AP or a 3rd party (but ISP approved) cable modem, and then what ensues is I'm now responsible for that device because Xfinity washes their hands entirely…

I'm not sure which modem you have, but the Cisco modem I used to use with the built-in WiFi just as you describe absolutely has the ability to go in and edit the DNS servers assigned by DHCP under Connection > Local IP Network. I also have the remote access enabled for my family members so I can diagnose and make changes like this directly on their modem.

ARRIS Group, Inc. TG1682G less than a year old. This is what everyone has in Denver, as far as I'm aware. Most of the devices settings aren't managable by its own web interface, I have to go to xfinity.com/myxfi and login to the account, and then it pushes changes to the cable modem/AP. This includes the login password for the device's web interface. Thoroughly screwy in my opinion.

Anyway, there is a Connection > Local IP Network. But no DNS settings anywhere.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#669

Post by [deleted] »

nodesocket wrote: post #656
dragonwriter wrote: post #654

Earlier quoted context omitted.

That's probably because AT&T is using 1.1.1.1 for something internal and breaking the public internet for it's users: you get a really fast ping on 1.1.1.1, but it's not the 1.1.1.1 you are trying to reach.

Is this just speculation or can anybody confirm? traceroute to 1.1.1.1 (1.1.1.1), 64 hops max, 52 byte packets 1 1dot1dot1dot1.cloudflare-dns.com (1.1.1.1) 1.117 ms 0.710 ms 0.727 ms

[deleted]

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#670

Post by hueving »

ksk wrote: post #595
hueving wrote: post #497

Earlier quoted context omitted.

An auditing company is pointless if they can't find fraud on such a massive scale or recognize that something is being hidden from them.

Thats like saying Linux is a useless project because of giant security holes that stay hidden for decades. I prefer to live in the real world, which is a lot more nuanced, and my question still stands.

That's a bad analogy because the Linux project isn't dedicated to auditing the Linux project.

It's like calling a home security system pointless if it doesn't detect any forced entries.

Post reply on HN