Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare's new DNS attracting 'gigabits per second' of rubbish

zdnet.com

Post reply on HN
Print view View original

71–80 of 206 posts

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#71

Post by walrus01 »

jakeogh wrote: post #69
walrus01 wrote: post #56

Earlier quoted context omitted.

And people wonder why https everywhere is such a necessity now. It should not be necessary to treat your last mile ISP as a hostile entity , but sadly, it often is.

I canceled my decade old COX account last time that happened. Even asked nicely not to "help" by editing traffic, the runaround was fun. At the end they offered to take my ~$90/mo to ~$70; re-confirming they had no idea what I was unhappy about.

A $12/hour call center customer retention worker in rural TN has no idea what you're complaining about, their job is simply to meet some retention metrics on a weekly basis.

Even if you can actually reach the people who run the ASN of your ISPs, if it something big like Cox, charter, Shaw, etc, they'll be politically unable to confirm or deny anything, and won't want to talk to you. You might get a straight answer if you are in a similarly senior position at an equivalent sized ISP that has mutual settlement free peering, such as between RCN and Charter.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#72

Post by cjg »

walrus01 wrote: post #66
RobertRoberts wrote: post #2

Awesome, the worlds biggest honeypot? There is literally a finite amount of bandwidth in the existance, let Cloudflare have as much cruft as it wants.

I have no idea where you get the idea there is a finite amount of bandwidth available. It is not coal or molybdenum. ISPs are continually being expanded.

Just because it is expanding, doesn't mean it isn't finite.

The current bandwidth is finite. The future bandwidth is finite. Even if we use all the resources available to us, expanding at the speed of light to capture those resources, it's still finite.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#73

Post by lathiat »

nextgens wrote: post #45
eastdakota wrote: post #18

Earlier quoted context omitted.

I’m Cloudflare’s CEO. What questions do you have? I’ll start: do we ever store 1.1.1.1’s users’ IPs? No. They’re never written to disk. And APNIC never has access to them. What data do you provide to APNIC? We give APNIC reports on non-DNS data that’s hitting 1.1.1.1. It includes information like: what protocols are sending data to the IP, what’s the volume, where it it coming from? For DNS users of 1.1.1.1, we never…

Are you aware that your public resolvers are actively breaking DNS-based GeoIP (striping EDNS0-ECN and not using source IPs geo-localized as the requester would be)? and if so, what is the rationale for it?

Yeah I tested it out and switched back, it made performance to Twitch in particular quite bad for me. I don't get that issue with Google DNS though.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#74

Post by rusk »

walrus01 wrote: post #67
aviv wrote: post #63

Earlier quoted context omitted.

Worse. Some very large carriers don't even look at the supporting documentation (bill, LOA) submitted with port orders unless there's a rejection from the losing carrier and they want to double check the address entered or something. Hijacking numbers is crazy simple. Same for hijacking the SMS functionality of any number in the US (voice traffic remains untouched). In about 10 minutes you can start receiving SMS dir…

SS7 was designed in an era of huge Monopoly telecoms that all trusted each other. Worked fine. Needs to be burnt to the ground, the ashes stomped around on a bit, and rebuilt with the same level of thought that has gone into the development of TLS1.3 for modern use. Won't happen though due to the sheerly massive installed base of telecom gear worldwide.

Yes, sunk costs mean that while those costs are amortized these technologies will remain in place. Upside is there's plenty of business in the area of plugging the holes in the meantime!

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#75

Post by walrus01 »

cjg wrote: post #72
walrus01 wrote: post #66

Earlier quoted context omitted.

I have no idea where you get the idea there is a finite amount of bandwidth available. It is not coal or molybdenum. ISPs are continually being expanded.

Just because it is expanding, doesn't mean it isn't finite. The current bandwidth is finite. The future bandwidth is finite. Even if we use all the resources available to us, expanding at the speed of light to capture those resources, it's still finite.

From a pure physics perspective, yes. But do take the time to familiarize yourself with the many THz of bandwidth that is available in one singlemode strand, and how many coherent modulated, 400GbE links can fit in a typical dwdm bandplan.

The internet is continually expanding at OSI layer 1. It is a construction project. The bandwidth is growing faster than our ability to fill it.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#76

Post by jakobegger »

icebraining wrote: post #48
Reason077 wrote: post #29

I noticed an issue with several public WiFi hotspots after setting 1.1.1.1 as my primary DNS: The login/"landing" page when connecting to these hotspots would not load. Changing back to 8.8.8.8 fixed the problem.

That means they're intercepting requests to 8.8.8.8 (even if only before login), probably because of its popularity. It's a shame we still have to use these hacks to login; there's a solution for that in RFC7710 (which sends the captive portal information in DHCP), but who knows if and when it'll be adopted by most hotspots. https://tools.ietf.org/html/rfc7710

I thought the way these Wifi hotspots worked was that they intercepted all DNS traffic? How else would they work with legacy systems?

Modern OSes detect these login pages by making a DNS lookup of a known domain, eg. macOS/iOS lookup "captive.apple.com", and if the answer is not in the 17.0.0.0/8 subnet they know someone is intercepting DNS and show the Wifi login window.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#77

Post by walrus01 »

eastdakota wrote: post #43
cpeterso wrote: post #21

Earlier quoted context omitted.

Does all this garbage traffic affect the performance of Cloudflare's servers? There must be some cost (performance and $$$) to filter this traffic. Was that a consideration when deciding whether to use 1.1.1.1 instead of some other IP address? :)

No. We have a lot of capacity. A lot.

For ordinary singlehomed users who don't get the "a lot". As an example cloudflare has 40Gbps of capacity to the SIX in Seattle. I would guess that they also have direct, at minimum, 10Gbps PNI peering sessions with other huge ISPs in the Pacific Northwest which never see the SIX fabric. So probably add another 20 individual 10GbE circuits at bare minimum to that 40 figure. All of which helps spread the traffic load out rather than shoving it all down a few pipes.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#78

Post by lucb1e »

constantlm wrote: post #64
jedberg wrote: post #16

> AT&T Gigapower using 1.1.1.1 on an internal interface on at least one model of router-gateway, the Pace 5268AC Yup. I can't use 1.1.1.1 because my AT&T router is responding to it.

"Whatever just use 1.1.1.1! Nobody will ever use that address!"

Because 10.1.1.1 is so hard to type or remember and is totally not a private range which is perfect for the purpose.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#79

Post by lucb1e »

icebraining wrote: post #48
Reason077 wrote: post #29

I noticed an issue with several public WiFi hotspots after setting 1.1.1.1 as my primary DNS: The login/"landing" page when connecting to these hotspots would not load. Changing back to 8.8.8.8 fixed the problem.

That means they're intercepting requests to 8.8.8.8 (even if only before login), probably because of its popularity. It's a shame we still have to use these hacks to login; there's a solution for that in RFC7710 (which sends the captive portal information in DHCP), but who knows if and when it'll be adopted by most hotspots. https://tools.ietf.org/html/rfc7710

> That means they're intercepting requests to 8.8.8.8

No, it means their hotspot uses 1.1.1.1 as internal IP. I've seen this in a bunch of places.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#80

Post by jakobegger »

From a marketing point of view, I think it was a brilliant move from Cloudflare to get the 1.1.1.1 address. Clearly better than 8.8.8.8!

But from a user perspective, why couldn't they have just let that address be... So many things are going to break just because Cloudflare wants a pretty IP. Sure, the things that break were using a hack, but in my opinion that doesn't automatically make it okay to break it.

Now I'm just waiting for a startup to launch a Stack Overflow competitor on example.com...

Post reply on HN