Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 210 posts

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#41

Post by Thorrez »

LogicX wrote: post #23

For those curious about what is going on here... Cloudflare has decided for privacy reasons they will not relay eDNS0 client subnet data - which yes, can reveal a portion of the IP of the requestor - but is used by CDN services in order to provide nearest servers or (in some cases) country specific content. My guess here is archive.is feels they have some need to restrict what content is provided to where in the worl…

>My guess here is archive.is feels they have some need to restrict what content is provided to where in the world

Couldn't that be done later, by blocking the actual HTTP TCP connections instead of blocking the DNS requests? Maybe it's an efficiency issue, that they want the higher-efficiency blocking by DNS rather than lower-efficiency blocking during HTTP TCP, but that seems a little strange to me.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#42

Post by DanielDent »

eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

An example of something that Cloudflare's approach provides some protection from: http://dnscookie.com/

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#43

Post by zzzcpan »

arghwhat wrote: post #31
floatingatoll wrote: post #22

Earlier quoted context omitted.

Text of tweet by @archiveis: "Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as invalid.

For additional context, here is the Cloudflare explanation about EDNS client subnets: > EDNS Client Subnet > >1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers. Cloudflare's requests are of course perfectly valid, with @archiveis actively deciding not to service them.

It has nothing to do with privacy, as the next thing following DNS resolution is establishing a TCP connection which always leaks full IP address to the same person or organization controlling authoritative servers. Basically EDNS is just a convenient way for DNS-based CDNs to provide a better edge node. But this is directly competing with Cloudflare, so Cloudflare invents excuses not to implement something that helps other CDNs.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#44

Post by eastdakota »

ikeboy wrote: post #39
eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

Are there any other known sites that don't work with 1.1.1.1 but work fine on other resolvers?

Typically, if you experience that, it’s because DNSSEC fails. 1.1.1.1 enforces DNSSEC. As does 8.8.8.8 in most, but not all, cases. Many other DNS resolvers do not enforce DNSSEC. Archive.is (and its directly affiliated sites) are the only exception like this I am aware of. And, to be clear, as a policy the 1.1.1.1 DNS does not block any sites from resolution.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#45

Post by tambre »

ikeboy wrote: post #37
akerl_ wrote: post #33

Earlier quoted context omitted.

This diverges pretty hard from your earlier comparison, between this scenario and the Linux kernel breaking userspace. If a dev updates their code so it won’t run unless an kernel flag is enabled, the kernel hasn’t broken userspace, and kernel devs are unlikely to add a “fake-enabled-flag” to trick the userspace program, even if it’s popular. Likewise, I don’t expect my DNS resolver to add in custom behavior if upstr…

Besides, my reading is: Every other resolver supports EDNS Archive.is only works with resolvers that support EDNS Cloudflare decided not to support EDNS That itself is a defendable decision but I do feel for a popular site they could implement some sort of fix.

Cloudflare does support EDNS. They just don't forward the client's subnet due to being privacy-oriented, doing which is optional and perfectly valid.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#46

Post by kitchenkarma »

judge2020 wrote: post #18

The problem is the archive.is (and other TLDs) server not returning any Good IP if the EDNS client subnet isn't present. Would like to point out that Cloudflare's resolver is EDNS compliant, it just doesn't send the client subnet. See: https://twitter.com/archiveis/status/1018691421182791680 (picture of tweet https://aws1.discourse-cdn.com/cloudflare/optimized/3X/8/2/8... ) Based on that tweet, the owner has a person…

Could they send "generic" subnet or even better could they let user choose the subnet?

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#47

Post by kitchenkarma »

eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

Could you use your own subnet in the EDNS that matches client's country or could you let user configure what data would be shared?

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#48

Post by wolfgang42 »

ikeboy wrote: post #39
eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

Are there any other known sites that don't work with 1.1.1.1 but work fine on other resolvers?

I (random HN user) happen to know of lancaster.ac.uk (there was a comment thread a while back where this was mentioned).

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#49

Post by jlg23 »

eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

Ongoing work with big companies to replace existing technologies don't convince me. Though, neither does whining when the authoritative nameserver itself is returning bogus responses.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#50

Post by codexon »

eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

Why not just send the subnet of the machine at cloudflare doing the querying?
Post reply on HN