Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 210 posts

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#141

Post by altfredd »

Xylakant wrote: post #76
deathanatos wrote: post #70

Earlier quoted context omitted.

Say you remove/don't proxy the ECS information, and I get some generic, non-geo-location aware response back. In the majority of cases, wouldn't my next step be to open a TCP connection to the IP in the response, and immediately leak my full IP address to the other end? While I get (and appreciate!) the concern for the user's privacy, I'm having a hard time seeing what practical effect not proxying the subnet the use…

> Say you remove/don't proxy the ECS information, and I get some generic, non-geo-location aware response back. In the majority of cases, wouldn't my next step be to open a TCP connection to the IP in the response, and immediately leak my full IP address to the other end? That assumes that the nameserver and the actual server are run by the same party which quite often is not the case.

> That assumes that the nameserver and the actual server are run by the same party which quite often is not the case.

Cloudflare can check if nameserver and the actual server are run by different parties, and if so omit subnet information from EDNS response. It is not hard to implement — Google and OpenDNS used to require manual whitelisting to receive EDNS subnet responses (not sure if they still do).

Cloudflare's CDN leaks user's full online identity to Google via reCaptcha, especially when you use Tor. Maybe they should ask Google to be satisfied with client's subnet too?

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#142

Post by fxfan »

eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

Wow, I'm totallly not on the x company awesome today- x company terrible tomorrow with x = cloudflare but I'm impressed that you guys are doing due diligence!

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#143

Post by notyourday »

eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

Alternatively:

Cloudflare simply is making a subversive play against their competitor CDNs. Client subnet of a DNS request is used for initial rough mapping by Cloudflare competitors such as Akamai (definitely) and I believe Fastly ( and probably others) . Stripping it easily adds at least a few milliseconds to the time to first byte and most likely results a request re-routing on the second or third request.

After all, no other CDN is operating a well used public resolver.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#144

Post by CodeWriter23 »

eastdakota wrote: post #63
CodeWriter23 wrote: post #58

Earlier quoted context omitted.

@eastdakota what about just failing without response on archive.is calls so the second resolver address configured in the client will be used? I understand this is also a DNS integrity violation, however the result for the end user would be either the same if they don’t have a second resolver configured or enhanced if they do. The current effect is I stop using 1.1.1.1 when I need archive.is (often) and set it back t…

DNS either has integrity or it doesn’t. We get a response from an Authoritative server and, as a Resolver, we believe our responsibility is to return it. If we start making exceptions because of bad PR, how can you trust us to do the right thing when the stakes are even higher (e.g., nationstate pressure)? As an aside, I used to think that when Emerson said that “a foolish consistency is the hobgoblin of little minds…

My take on the Emerson quote you mention is to be mindful instead of mindless when it comes to consistency. I respect the commitment to consistency you convey (and I do think it is mindful).

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#145

Post by [deleted] »

eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

[deleted]

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#146

Post by Aeolun »

syshum wrote: post #126
HNthrow22 wrote: post #122

Earlier quoted context omitted.

archive.is is a very important tool in online extremism research and you've taken money from far-right extremists, your explanation for why it's inaccessible seems incomplete. This is probably where I get banned from Hn but it has to be said - to posture as if you care about end users while in the same breath taking money from extremists and turning over personal identifiable information to far-right outlets like Dai…

This is amusing, They Banned the DailyStormer which I why I will never support them. While I disagree 100% with the DailyStormer it is not up to cloudflare to decide who can and can not speak, who can and can not access the internet. The concept of Free Speech is the most important right we have as humanity, while I may not agree with some peoples words I will fight for their right to say those words And do not even…

Yes, I want them to censor lies and misleading speech. People or services that feed the public dangerous misinformation should be silenced.

I realize that’s a slippery slope, but I just don’t trust the public to filter for themselves any more.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#147

Post by Aeolun »

floatingatoll wrote: post #22
judge2020 wrote: post #18

The problem is the archive.is (and other TLDs) server not returning any Good IP if the EDNS client subnet isn't present. Would like to point out that Cloudflare's resolver is EDNS compliant, it just doesn't send the client subnet. See: https://twitter.com/archiveis/status/1018691421182791680 (picture of tweet https://aws1.discourse-cdn.com/cloudflare/optimized/3X/8/2/8... ) Based on that tweet, the owner has a person…

Text of tweet by @archiveis: "Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as invalid.

Ah yes, the huge trouble of a website that is a few MS slower as opposed to just not working at all.

I’m not sure I see what kind of logic goes into this argument.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#148

Post by Aeolun »

zzzcpan wrote: post #101
MrStonedOne wrote: post #83

Earlier quoted context omitted.

1.1.1.1 supports dns/https. It is entirely possible to make a request to 1.1.1.1 for an ip and have nobody be able to know what you made the request for. There is no guarantee the name server they are querying is the same as the server in the A result, and the idea is to reduce the number of points where people other than the A result and the client know that they plan to talk to each other. It's not bullshit.

> There is no guarantee the name server they are querying is the same as the server in the A result That's ok. Let me try to explain a bit more: Queries to 1.1.1.1 are going over public internet. And even though they are encrypted, they also carry metadata with them, including IP addresses of who is doing them, precise time, rough size, various OS specific stuff, etc. And packets going out to authoritative servers fr…

Not quite as easy as when you just have to intercept traffic at one of the intermediate nodes though, it seems.

I think that makes the privacy argument a fairly valid thing.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#149

Post by TheGoddessInari »

notyourday wrote: post #143
eastdakota wrote: post #36

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the…

Alternatively: Cloudflare simply is making a subversive play against their competitor CDNs. Client subnet of a DNS request is used for initial rough mapping by Cloudflare competitors such as Akamai (definitely) and I believe Fastly ( and probably others) . Stripping it easily adds at least a few milliseconds to the time to first byte and most likely results a request re-routing on the second or third request. After a…

Google has its own public DNS and CDN, I'm pretty sure that counts.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#150

Post by andreareina »

abtinf wrote: post #52
V99 wrote: post #35

Earlier quoted context omitted.

It's possible your ISP is intercepting all traffic for port 53 and sending it to their own nameservers (which do send client subset) instead of you actually taking to cloudflare's 1.1.1.1 at all.

Links for documented instances of this practice?

ISPs in several countries I've been to do this to blacklist "objectionable" sites (which apparently includes reddit now) at the DNS level. Turning on DNS-over-HTTPS solves that.
Post reply on HN