Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

Post by akerl_ » Sat, May 04, 2019, 7:51 PM UTC

ikeboy wrote: post #37

akerl_ wrote: post #33

Earlier quoted context omitted.

This diverges pretty hard from your earlier comparison, between this scenario and the Linux kernel breaking userspace. If a dev updates their code so it won’t run unless an kernel flag is enabled, the kernel hasn’t broken userspace, and kernel devs are unlikely to add a “fake-enabled-flag” to trick the userspace program, even if it’s popular. Likewise, I don’t expect my DNS resolver to add in custom behavior if upstr…

Besides, my reading is: Every other resolver supports EDNS Archive.is only works with resolvers that support EDNS Cloudflare decided not to support EDNS That itself is a defendable decision but I do feel for a popular site they could implement some sort of fix.

Post by judge2020 » Sat, May 04, 2019, 7:52 PM UTC

zzzcpan wrote: post #43

arghwhat wrote: post #31

Earlier quoted context omitted.

For additional context, here is the Cloudflare explanation about EDNS client subnets: > EDNS Client Subnet > >1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers. Cloudflare's requests are of course perfectly valid, with @archiveis actively deciding not to service them.

It has nothing to do with privacy, as the next thing following DNS resolution is establishing a TCP connection which always leaks full IP address to the same person or organization controlling authoritative servers. Basically EDNS is just a convenient way for DNS-based CDNs to provide a better edge node. But this is directly competing with Cloudflare, so Cloudflare invents excuses not to implement something that help…

Post by judge2020 » Sat, May 04, 2019, 7:54 PM UTC

wolfgang42 wrote: post #48

ikeboy wrote: post #39

Earlier quoted context omitted.

Are there any other known sites that don't work with 1.1.1.1 but work fine on other resolvers?

I (random HN user) happen to know of lancaster.ac.uk (there was a comment thread a while back where this was mentioned).

Post by jakejarvis » Sat, May 04, 2019, 7:56 PM UTC

eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

Post by tambre » Sat, May 04, 2019, 7:58 PM UTC

zzzcpan wrote: post #43

arghwhat wrote: post #31

Earlier quoted context omitted.

For additional context, here is the Cloudflare explanation about EDNS client subnets: > EDNS Client Subnet > >1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers. Cloudflare's requests are of course perfectly valid, with @archiveis actively deciding not to service them.

It has nothing to do with privacy, as the next thing following DNS resolution is establishing a TCP connection which always leaks full IP address to the same person or organization controlling authoritative servers. Basically EDNS is just a convenient way for DNS-based CDNs to provide a better edge node. But this is directly competing with Cloudflare, so Cloudflare invents excuses not to implement something that help…