Cloudflare's new DNS attracting 'gigabits per second' of rubbish

Post by [deleted] » Fri, Apr 06, 2018, 7:04 AM UTC

eastdakota wrote: post #18

_eht wrote: post #13

Earlier quoted context omitted.

It was reworded enough times to make their promise vague and not well defined.

I’m Cloudflare’s CEO. What questions do you have? I’ll start: do we ever store 1.1.1.1’s users’ IPs? No. They’re never written to disk. And APNIC never has access to them. What data do you provide to APNIC? We give APNIC reports on non-DNS data that’s hitting 1.1.1.1. It includes information like: what protocols are sending data to the IP, what’s the volume, where it it coming from? For DNS users of 1.1.1.1, we never…

Post by Arnt » Fri, Apr 06, 2018, 7:05 AM UTC

decisiveness wrote: post #20

LeoPanthera wrote: post #11

Earlier quoted context omitted.

"The service" is the DNS service. If you send random garbage to random IP addresses I think you waive the right to privacy.

>APNIC gets to see the noise as well as the DNS traffic >Huston emphasised that APNIC intends to protect users' privacy. "DNS is remarkably informative about what users do, if you inspect it closely, and none of us are interested in doing that," he said. Maybe it is reasonable to take them at their word as they seem trustworthy, but we should at least consider the fact that at least some of this DNS traffic is indeed…

Post by mirimir » Fri, Apr 06, 2018, 7:12 AM UTC

eastdakota wrote: post #24

mirimir wrote: post #19

Earlier quoted context omitted.

But that's just a Cloudflare policy, isn't it? Or are you arguing that even Cloudflare couldn't get raw DNS traffic?

That’s our policy and we’ve hired outside auditors to ensure we’re honoring it. If you have suggestions of what else we can do to prove we’re a company of our word, LMK.

Post by tannercollin » Fri, Apr 06, 2018, 7:16 AM UTC

eastdakota wrote: post #26

kuschku wrote: post #23

Earlier quoted context omitted.

I expect that no human from APNIC or Cloudflare will ever look at raw data from 1.1.1.1, nor will any of it be recorded, or used in aggregated data that retains any personal information. As personal information count full IP addresses, the content of requests, or any set of data that can be used to recover these. That is what "we respect your privacy" means.

Neither we nor APNIC can query “what” or “how many” requests from any IP have been made. We can query things like: 1. How much query traffic is from Africa? 2. What’s the peak time of query traffic? 3. What are the most popular DNS authoritative servers? If you have specific concerns, please raise them here.

Post by dannyw » Fri, Apr 06, 2018, 7:20 AM UTC

ChuckMcM wrote: post #4

I've seen some of the papers where people look at big chunks of unused address space and watch the probes etc. It is really quite amazing. Once I screwed myself royally by accidentally turning RIP on for the upstream side of my router (connected to the cable modem) and it advertised 192.168/16 which Comcast accepted and started routing random stuff from the local exchange to my router. It was pretty funny talking to…