Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

Post by stordoff » Sat, May 04, 2019, 10:53 PM UTC

zzzcpan wrote: post #43

arghwhat wrote: post #31

Earlier quoted context omitted.

For additional context, here is the Cloudflare explanation about EDNS client subnets: > EDNS Client Subnet > >1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers. Cloudflare's requests are of course perfectly valid, with @archiveis actively deciding not to service them.

It has nothing to do with privacy, as the next thing following DNS resolution is establishing a TCP connection which always leaks full IP address to the same person or organization controlling authoritative servers. Basically EDNS is just a convenient way for DNS-based CDNs to provide a better edge node. But this is directly competing with Cloudflare, so Cloudflare invents excuses not to implement something that help…

Post by ummonk » Sat, May 04, 2019, 10:56 PM UTC

CodeWriter23 wrote: post #58

eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

@eastdakota what about just failing without response on archive.is calls so the second resolver address configured in the client will be used? I understand this is also a DNS integrity violation, however the result for the end user would be either the same if they don’t have a second resolver configured or enhanced if they do. The current effect is I stop using 1.1.1.1 when I need archive.is (often) and set it back t…

Post by agumonkey » Sat, May 04, 2019, 11:03 PM UTC

Post by sintaxi » Sat, May 04, 2019, 11:15 PM UTC

twhb wrote: post #67

eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

Thank you for your comment. Since HTTPS traffic already reveals communicating IPs to nation-state actors, could you clarify what attack vector removing user IP info from authoritative DNS queries protects against? In what way does Cloudflare publish its PoP geolocation? Is it a Cloudflare-specific API? Why not fake EDNS subnet info by providing the PoP’s? I notice of course that Google, Facebook, and Netflix still wo…

Post by CodeWriter23 » Sat, May 04, 2019, 11:17 PM UTC

ummonk wrote: post #93

CodeWriter23 wrote: post #58

Earlier quoted context omitted.

@eastdakota what about just failing without response on archive.is calls so the second resolver address configured in the client will be used? I understand this is also a DNS integrity violation, however the result for the end user would be either the same if they don’t have a second resolver configured or enhanced if they do. The current effect is I stop using 1.1.1.1 when I need archive.is (often) and set it back t…

I just added an entry for archive.is in my etc/hosts.