Live data from Hacker News

Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

jarv.is

31–40 of 128 posts

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#31
post #4

Archive.is is unironically one of the most important websites in the world. I hope this mess gets fixed but I am not holding my breath because we are in the same position for years now. Interesting read on the probable owner of the site : https://webapps.stackexchange.com/a/149405

Everything on archive.is is on archive.org. I would say 99% of stuff.

If archive.is goes down we have webcitation.org, etched.page, ghostarchive.org, webrecorder.net, etc....

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#32
> I wrote the following reply to Matthew, praising his team's focus on the big picture

Okay great, but:

> 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results.

> massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come

The problem isn't really EDNS. And someone is either lying or very incorrect.

This should be resolvable. The two sides don't want incompatible things. Has there been zero progress since?

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#33
post #27

Out of curiosity - not defending the behavior - what kind of problems could omitting EDNS cause? What is the steelman case for Archive.is here? The author says Archive.is's claim that it causes problems is "questionable", but he doesn't mention what those purported problems are or address why they're illegitimate, so it's hard to evaluate whether that's accurate.

Archive.is uses ECS (edns client subnet, which sends the client IP's /24 to the authoritative resolver) for geo-based load balancing. The problem is that all IPs in a /24 are highly likely to belong to the same city for residential connections, so plugging it into a geoip service is likely to show the actual city & state that a request originates from (the entire point of ECS).

https://twitter.com/archiveis/status/1018691421182791680 (screenshot: https://aws1.discourse-cdn.com/cloudflare/original/3X/8/2/82... )

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#34

amazing how cloudflare has framed this anticompetitve move as a privacy thing. it doesn't matter if your dns resolver leaks part of your ip address to archive.is's dns servers when you're about to connect to archive.is from your ip address anyway. the only thing dropping the edns client subnet does is prevent services you use from giving you a server that's closer to you when you do the dns lookup. this performance i…

Can we not call literally everything "anticompetitive"? archive.is isn't a competitor of Cloudflare. Cloudflare doesn't treat them differently from any other site, they're not doing anything "to keep them down", their DNS product just has a focus that isn't compatible with archive.is' hunger for data. That you might connect to archive.is directly isn't of any concern. You might also not do that, and they've decided t…

> Cloudflare doesn't treat them differently from any other site

Did we read the same article? Cloudflare is treating them, and anybody else that makes the same choices wrt EDNS, differently from the rest of the Internet.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#35
post #31
post #4

Archive.is is unironically one of the most important websites in the world. I hope this mess gets fixed but I am not holding my breath because we are in the same position for years now. Interesting read on the probable owner of the site : https://webapps.stackexchange.com/a/149405

Everything on archive.is is on archive.org. I would say 99% of stuff. If archive.is goes down we have webcitation.org, etched.page, ghostarchive.org, webrecorder.net, etc....

archive.org obeys the robots.txt exclusion but archive.today doesn't. This means that many websites(like 4chan) cannot be archived with archive.org.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#36

Earlier quoted context omitted.

That reads a lot like doxxing; if someone isn't open about their identity, they don't want it out, and doing sleuthing work like this (or linking to it) can be considered doxxing. If archive.is hosts content that has been removed due to oppressive regimes' policies (including western ones), exposing their identity may put them at risk.

That would be security by obscurity- something which the creator of such an important website does not have the privilege of relying on.

The parent comment is pointing out the moral/etiquette/guideline issue, not making a judgement about security posture.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#38
post #22

Earlier quoted context omitted.

Just so we’re on the same page: Cloudflare decided globally not to include client IP in the EDNS data. Then archive.is decided to block Cloudflare’s resolvers from getting accurate records for their site. To circumvent this, Cloudflare would have to reverse their global stance or make a special exception to satisfy archive.is. It’s unclear how we could draw “anticompetitive” from this.

Understood, but why? Privacy is not an acceptable answer for the reasons OP stated. If Cloudflare gave a coherent, understandable reason, I'd probably be more on their side. "Trust us, our network is big enough it will route right" is both not a good answer, nor true.

Privacy isn’t an absolute pass/fail. Giving authoritative nameservers my IP via EDNS leaks my IP. Sure, other things also leak my IP, but that doesn’t mean we should throw in the towel and accept any new way to leak user data.

In many cases, DNS logs aren’t going to the same place as web server logs, so this keeps my data in fewer log files owned by fewer people.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#39
post #13

Earlier quoted context omitted.

Linked in Profile does not exit anymore. But "Bachelor of Engineering Bachelor at the Humboldt University of Berlin." This sounds fishy. I am not sure that you can get an Engineering degree at this University.

Is “Informatics” a Bachelor of Engineering? https://www.informatik.hu-berlin.de/de/studium/Master

Informatics is roughly what's called computer science in the US.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#40
post #4

Archive.is is unironically one of the most important websites in the world. I hope this mess gets fixed but I am not holding my breath because we are in the same position for years now. Interesting read on the probable owner of the site : https://webapps.stackexchange.com/a/149405

That reads a lot like doxxing; if someone isn't open about their identity, they don't want it out, and doing sleuthing work like this (or linking to it) can be considered doxxing. If archive.is hosts content that has been removed due to oppressive regimes' policies (including western ones), exposing their identity may put them at risk.

[deleted]
Post reply on HN