Live data from Hacker News

Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

jarv.is

41–50 of 128 posts

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#41
> Sure, it's annoying that I'll need to use a VPN or change my DNS resolvers to use a pretty slick (and otherwise convenient) website archiver.

You can alternatively look up the IP address using something other than Cloudflare DNS and add entries to your /etc/hosts file for archive.is and archive.today.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#42

amazing how cloudflare has framed this anticompetitve move as a privacy thing. it doesn't matter if your dns resolver leaks part of your ip address to archive.is's dns servers when you're about to connect to archive.is from your ip address anyway. the only thing dropping the edns client subnet does is prevent services you use from giving you a server that's closer to you when you do the dns lookup. this performance i…

EDNS is an optional feature in general. Client subnet is even more optional.

There may not be a whole lot of private information in the client subnet, especially since it seems likely that after querying for an A/AAAA record, a client would then send a packet to (one of) the resulting IP(s) and reveal their address, but it's not required to pass it on, and it it seems better to reduce potentially private information passed on.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#43
post #31

Earlier quoted context omitted.

Everything on archive.is is on archive.org. I would say 99% of stuff. If archive.is goes down we have webcitation.org, etched.page, ghostarchive.org, webrecorder.net, etc....

archive.org obeys the robots.txt exclusion but archive.today doesn't. This means that many websites(like 4chan) cannot be archived with archive.org.

That's true, so does webcitation.org, which doesn't obey robots.txt.

4chan has archives dedicated for that site anyway (Warosu, etc.).

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#46
post #16
post #3

It's important to remember, at least for corporate environments, that EDNS Client Subnet is important when working with services such as Exchange Online where the local resolver is what determines your EXO Front Door. If you're using a service like 1.1.1.1, you may be routed to an incorrect Front Door causing increased latency (primarily with search and archive mailboxes which aren't cached). Quad9 does have a servic…

Cloudflare has worked providers to make sure they can efficiently route. If you find case where this isn’t the case please let us know.

Cloudflare DNS does not route efficiently with AWS CloudFront anycast DNS. I tracked down insanely slow `rustup update` downloads to incorrect selection of ideal routes to the AWS resources caused by using CF to resolve the DNS. Switching to a different resolver that works with anycast and EDNS fixed it.

CF saying “we break standard DNS geo routing but work with providers to route things right” isn’t very inspiring.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#47
post #31
post #4

Archive.is is unironically one of the most important websites in the world. I hope this mess gets fixed but I am not holding my breath because we are in the same position for years now. Interesting read on the probable owner of the site : https://webapps.stackexchange.com/a/149405

Everything on archive.is is on archive.org. I would say 99% of stuff. If archive.is goes down we have webcitation.org, etched.page, ghostarchive.org, webrecorder.net, etc....

>Everything on archive.is is on archive.org. I would say 99% of stuff.

Given how a LOT of the stuff today is behind paywalls and Archive.today breaks through most of them and Archive.org doesn't, your "99%" figure is way, way off when it comes to popular stuff.

Anyway, I donate to both the Archive.today and Archive.org. They're extremely valuable to me. I feel like Archive.today is in a dire situation when it comes to funding so I donate more than double to them each month.

If you're able, please donate to these sites. They are running on fumes. And take a look at my profile for a list of other orgs to donate to.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#48
post #4

Archive.is is unironically one of the most important websites in the world. I hope this mess gets fixed but I am not holding my breath because we are in the same position for years now. Interesting read on the probable owner of the site : https://webapps.stackexchange.com/a/149405

That reads a lot like doxxing; if someone isn't open about their identity, they don't want it out, and doing sleuthing work like this (or linking to it) can be considered doxxing. If archive.is hosts content that has been removed due to oppressive regimes' policies (including western ones), exposing their identity may put them at risk.

I find this highly implausible, all of the accounts archive.is is "logged into" would have to be put there in a very explicit manner. I'd assume that all of the accounts are fake or appropriated accounts.

For example @volth on Github - as a person - is still around in other places, so I'm guessing that account was stolen and they don't have a way to get it back.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#49
post #27

Out of curiosity - not defending the behavior - what kind of problems could omitting EDNS cause? What is the steelman case for Archive.is here? The author says Archive.is's claim that it causes problems is "questionable", but he doesn't mention what those purported problems are or address why they're illegitimate, so it's hard to evaluate whether that's accurate.

Archive.is uses ECS (edns client subnet, which sends the client IP's /24 to the authoritative resolver) for geo-based load balancing. The problem is that all IPs in a /24 are highly likely to belong to the same city for residential connections, so plugging it into a geoip service is likely to show the actual city & state that a request originates from (the entire point of ECS). https://twitter.com/archiveis/status/10…

But when the user goes to use the IP address they got back, even more detailed information is going to be given to the endpoint; I can see this maybe being a benefit for TXT records or something?

Hiding ECS from DNS queries seems to mostly just further create imbalances between companies that can afford routing at the IP level over companies that want to do cheaper routing at the DNS level.

(And like, if you attempt to directly mitigate the final IP problem by using a VPN or CG-NAT or something, that same solution will work for the DNS resolver, so I really am seeing no benefit.)

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#50
post #22

amazing how cloudflare has framed this anticompetitve move as a privacy thing. it doesn't matter if your dns resolver leaks part of your ip address to archive.is's dns servers when you're about to connect to archive.is from your ip address anyway. the only thing dropping the edns client subnet does is prevent services you use from giving you a server that's closer to you when you do the dns lookup. this performance i…

Just so we’re on the same page: Cloudflare decided globally not to include client IP in the EDNS data. Then archive.is decided to block Cloudflare’s resolvers from getting accurate records for their site. To circumvent this, Cloudflare would have to reverse their global stance or make a special exception to satisfy archive.is. It’s unclear how we could draw “anticompetitive” from this.

He didn't mean anticompetitive towards Archive.is, he meant with all content providers in general. By making them all less capable of delivering low-latency content, it makes Cloudfare appear better by comparison. Not sure how likely that would be but I'm pretty sure that was OP's meaning.
Post reply on HN