Live data from Hacker News

1.1.1.1 outage explanation

blog.cloudflare.com

61–70 of 87 posts

Re: 1.1.1.1 outage explanation

#61
post #53

I switched to 1.1.1.1 when it was released and since I’ve had multiple issues with free wifis where they would fail to hijack my dns requests to allow me to login to their portal. I Assume this is a good thing but can someone explain to me why this is happening and what’s the state on improving these wifi portals? PS: sorry for hijacking the thread.

Might be unrelated. Always try http://neverssl.com to trigger the captive login on public wifi.

Re: 1.1.1.1 outage explanation

#62
post #53

I switched to 1.1.1.1 when it was released and since I’ve had multiple issues with free wifis where they would fail to hijack my dns requests to allow me to login to their portal. I Assume this is a good thing but can someone explain to me why this is happening and what’s the state on improving these wifi portals? PS: sorry for hijacking the thread.

Set your DNS to 1.0.0.1 and it might be a bit better. Still cloudflare's DNS resolver but used by less stupid Wi-Fi portals.

Re: 1.1.1.1 outage explanation

#64

Earlier quoted context omitted.

In 2000 the answer would be no. In 2018 I think it is. Things change in a time when you would freak getting up in the morning and say google.com did not work.

Humans react, analyze, and communicate at the same speed we did in 2000. Our tools may have gotten better, but that only cuts down on part of the process. Automated processes can only mitigate so many edge cases. Even then, humans need to be involved, and that slows things down.

Disagree. Have you ever seen a toddler use an iPad? More input/stimuli in 2018 = higher capacity to analyze said inputs. Or an overload of capacity which results in the epidemic of mental illnesses and psychotic breakdowns we witness in this post-social media society.

Another example - I can record a video and broadcast internationally, translated on the fly into dozens of languages, effectively communicating with significantly more people than if I could not harness that technical capability. In 2000 that communication process would have been orders of magnitude longer. (Did they have on-the-wire translation then? Idk, just making an assumption to illustrate my point.)

Re: 1.1.1.1 outage explanation

#65

What's interesting here is that the automatic cure (DDoS protection) was worse than the disease (even if there was an attack, blocking all access to the DNS servers is potentially worse than letting them get overloaded). I wonder if it would be possible to express the idea that if a block being applied drops traffic well below expected levels, it must be a mistake?

Is it the block causing the traffic drop, or the DDOS though?

Re: 1.1.1.1 outage explanation

#67

Doesn't seem fixed, still can't resolve archive.is cloudflare is giving off cloudflare DNS web errors. https://i.imgur.com/APpQPTJ.png

That's apparently due to the archive.is servers returning different results based on the requesting IP:

https://community.cloudflare.com/t/archive-is-error-1001/182...

Re: 1.1.1.1 outage explanation

#68
post #53

I switched to 1.1.1.1 when it was released and since I’ve had multiple issues with free wifis where they would fail to hijack my dns requests to allow me to login to their portal. I Assume this is a good thing but can someone explain to me why this is happening and what’s the state on improving these wifi portals? PS: sorry for hijacking the thread.

Cisco shipped some hardware which incorrectly used 1.1.1.1 as an internal interface. The long-term fix will be those networks being correctly configured but that may not happen until that hardware is EOLed.

In the meantime, have you tried adding other addresses such as 1.0.0.1, 8.8.8.8, or 9.9.9.9 to see whether the fallback works?

Re: 1.1.1.1 outage explanation

#69
post #51
post #50

Earlier quoted context omitted.

I read on the Pi-Hole forums that 'fallback' is a misleading term because clients don't work that way - they will happily spread requests between two functioning DNS servers. Can anyone confirm this or provide further insight?

Different OSes handle it differently. Windows tries the primary, waits 1 second and then starts trying secondaries.

glibc tries in order. musl (Alpine Linux) tries all in parallel and returns thebl first resolution (If any).

Re: 1.1.1.1 outage explanation

#70
post #21
post #4

This is a great write up. It's also why the DNS root servers have a policy of surviving DDoS through massively over-provisioned, multi-org, anycasted redundancy rather this sort of smart DDoS mitigation that drops traffic: DNS is so critical that any risk of dropping real traffic is unacceptable. (obviously, such a scale is impractical for 99% of services) A good takeaway from this outage for the average user would b…

Or 9.9.9.9 if you're not as comfortable with Google services.

At least for personal use, OpenNIC is nice and many of the servers say they do not keep logs. I use the 185.121.177.177 (2a05:dfc7:5::53) anycast server and it works well. They are more likely to disappear randomly than the ones run by large companies.

https://servers.opennic.org/

Post reply on HN