Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

jarv.is

Post reply on HN
Print view View original

101–110 of 128 posts

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#101

Post by cortesoft »

judge2020 wrote: post #82
cortesoft wrote: post #66

Earlier quoted context omitted.

It isn’t the actual IP, it is the subnet. Leaks some info, but unless you own the entire subnet it won’t give up your identity. https://en.wikipedia.org/wiki/EDNS_Client_Subnet

The entire point of ECS is to give the location, not the actual origin IP, which might be something you'd like to avoid giving away. The main point is that every resolver or network switch in the chain gets the ECS and would be able to combine it with the domain being requested. If you don't only visit Facebook/Google, your ipv4 /24 in combination with some obscure domain only you visit is very likely to give up your…

Sure, that is true. However, the person I responded to said that EDNS would give the authoritative server your IP address, which isn't true.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#102

Post by silisili »

judge2020 wrote: post #82
cortesoft wrote: post #66

Earlier quoted context omitted.

It isn’t the actual IP, it is the subnet. Leaks some info, but unless you own the entire subnet it won’t give up your identity. https://en.wikipedia.org/wiki/EDNS_Client_Subnet

The entire point of ECS is to give the location, not the actual origin IP, which might be something you'd like to avoid giving away. The main point is that every resolver or network switch in the chain gets the ECS and would be able to combine it with the domain being requested. If you don't only visit Facebook/Google, your ipv4 /24 in combination with some obscure domain only you visit is very likely to give up your…

I understand that point, to an extent. I mean, your TCP connection in the next step hits how many switches on the way? With which both your actual IP therefore location could be determined. Trying to hide subnet from just a resolver seems...small in the grand scheme.

And if that's your goal, why not proxy your dns requests? I'd surely have a VPN or at least DNS proxy if my threat model were that which you're trying to avoid.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#103

Post by raxi »

akerl_ wrote: post #98
raxi wrote: post #96

Earlier quoted context omitted.

Please, tell me - not a megacorp webmaster - how can I opt-in to Cloudflare program available to Facebook/Netflix, to get what is available freely as the source IP of UDP packet in the absence of planet-wide public resolvers and what Google gives for free trying to mitigate the inconvenience caused by the planet-wide resolver. Indeed, my texts about possible motivation is speculations, but I do understand why webmast…

“We publish the geolocation information of the IPs that we query from”, from the linked comment above. They publish the same info to you and Netflix and me and Amazon. You keep presenting a difference between what “you” get and what a “megacorp” gets, without any evidence that they’re getting something different from you. You also sidestep here into a complaint against “planet wide resolvers”. To a rounding error, no…

> You keep presenting a difference between what “you” get and what a “megacorp” gets, without any evidence that they’re getting something different from you.

I read it in Mattew Prince sentence above

>

> You also sidestep here into a complaint against “planet wide resolvers”. To a rounding error, nobody is running their own recursive resolvers. Everybody uses either their ISP’s DNS provider or one provided by a large network entity, virtually all of which are companies. This has been the case for decades. So anybody relying on the source IP of the UDP packet is just out of luck, and has always been out of luck.

1. It is not sidestep. It is my main point. EDNS-client-ip has sense only for planetwide resolvers, and it is "optional" only because of it. EDNS-client-ip was designed especially for Google DNS. When you use recursive DNS of your ISP in your city, the source of UDP packet is in your city. When Google zeroes 8 bits of IP, the EDNS-client-ip is still your city. It is needless to know your exact IP to select the best server for you. CloudFlare refuses to disclose even that approximate location, which gives their anycast CDN an advantage.

2. There is no "decades" of "5 years" history. There is only two points on this timeline: the first: launching Google DNS - which introduced ENDS-client-IP to mitigate caused inconvenience to webmasters, the second: launching Cloudflare DNS - you know the story. The rest (Quad9, ...) are negligible. Yandex DNS might be comparable big and, like CloudFlare, it does not send EDNS-client-ip - for no privacy-caring stances (my speculation: just out of lazyness), but it is regional, all requests from there can be safely rounded to Moscow. So we can consider there are only three cases over there: Google, CloudFlare (commonly referred as "planetwide resolvers"), and all the rest are regional businesses, whose very network ownership discloses location.

>

> It’s clear you wish this wasn’t the case, but Cloudflare and Google aren’t really changing the game here,

This is ridiculous. The IP I will know from HTTP logs few miliiseconds later, we are talking about getting origin city from DNS query to answer with IP of the nearest HTTP server.

>

> and they don’t owe you optional features because you really want to see user IP data.

So webmasters do not owe to answer when CloudFlare want to see server IP data, ok?

The divorce of indy webmasters with CloudFlare DNS is very natural, I just wonder why it is no massive.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#104

Post by contravariant »

oenetan wrote: post #83
voldacar wrote: post #68

I don't fully understand how archive.is operates. They don't remove copyrighted content (which I like, since it provides a useful service), they must have probably terabytes upon terabytes of data in some datacenter somewhere, yet they never seem to be shut down by the govt or their datacenter/cloud provider. Am I just naive to be surprised by this? How does all this work exactly?

Fair use applies i think.

It should, but I don't think it does in its current form.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#105

Post by raxi »

akerl_ wrote: post #98
raxi wrote: post #96

Earlier quoted context omitted.

Please, tell me - not a megacorp webmaster - how can I opt-in to Cloudflare program available to Facebook/Netflix, to get what is available freely as the source IP of UDP packet in the absence of planet-wide public resolvers and what Google gives for free trying to mitigate the inconvenience caused by the planet-wide resolver. Indeed, my texts about possible motivation is speculations, but I do understand why webmast…

“We publish the geolocation information of the IPs that we query from”, from the linked comment above. They publish the same info to you and Netflix and me and Amazon. You keep presenting a difference between what “you” get and what a “megacorp” gets, without any evidence that they’re getting something different from you. You also sidestep here into a complaint against “planet wide resolvers”. To a rounding error, no…

I guess you just do not understand what EDNS is, and why it is optional and why its optional-ness is not a pro-CloudFlare argument.

It is very simple:

Query(source IP is an ISP in Paris, no EDNS): gimme IP of "website.com"

WebsiteComDNS: IP of the server closest to Paris

Query(source IP is Google, no-EDNS): gimme IP of "website.com"

WebsiteComDNS: Hm, it is likely Google Cloud, or GoogleBot, answer with IP of own server on Google Cloud

Query(source IP is Google, EDNS: I am acting on behave of an user in Paris): gimme IP of "website.com"

WebsiteComDNS: IP of the server closest to Paris

Query(source IP is Cloudflare, no-EDNS): gimme IP of "website.com"

WebsiteComDNS: where the fuck is CloudFlare? Africa? answer with something random

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#106

Post by merb »

konschubert wrote: post #30
pacman2 wrote: post #13

Earlier quoted context omitted.

Linked in Profile does not exit anymore. But "Bachelor of Engineering Bachelor at the Humboldt University of Berlin." This sounds fishy. I am not sure that you can get an Engineering degree at this University.

Is “Informatics” a Bachelor of Engineering? https://www.informatik.hu-berlin.de/de/studium/Master

no in germany informatics is bachelor of science

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#107

Post by ComputerGuru »

elithrar wrote: post #77
ComputerGuru wrote: post #46

Earlier quoted context omitted.

Cloudflare DNS does not route efficiently with AWS CloudFront anycast DNS. I tracked down insanely slow `rustup update` downloads to incorrect selection of ideal routes to the AWS resources caused by using CF to resolve the DNS. Switching to a different resolver that works with anycast and EDNS fixed it. CF saying “we break standard DNS geo routing but work with providers to route things right” isn’t very inspiring.

> Cloudflare DNS does not route efficiently with AWS CloudFront anycast DNS. I tracked down insanely slow `rustup update` downloads to incorrect selection of ideal routes to the AWS resources caused by using CF to resolve the DNS. Please send me details (silverlock at cloudflare) here - AWS has our geofeed. If you can include resolution details - e.g. dig @1.1.1.1 +nsid - with the incorrect CF results, we can provide…

Thanks for providing your info. I stopped using CF for resolution because of this almost two years ago; I don’t have a reason to think the situation changed but if I get a chance I can try to reproduce it and get back to you.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#108

Post by urthor »

voldacar wrote: post #84
oenetan wrote: post #83

Earlier quoted context omitted.

Fair use applies i think.

Things on archive.org get DMCA'ed all the time

I'm almost certain the actual reason is producing all the infrastructure to DMCA content on Google/Facebook/Twitter/Youtube and other "mainstream" Web 2.0 platforms is expensive.

Copyright enforcement is a lot stricter on Youtube, than say, Reddit video.

It's all down to the engagement of the IP owners.

My guess is they just haven't gotten around to chasing Archive.is down that hard.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#109

Post by akerl_ »

raxi wrote: post #105
akerl_ wrote: post #98

Earlier quoted context omitted.

“We publish the geolocation information of the IPs that we query from”, from the linked comment above. They publish the same info to you and Netflix and me and Amazon. You keep presenting a difference between what “you” get and what a “megacorp” gets, without any evidence that they’re getting something different from you. You also sidestep here into a complaint against “planet wide resolvers”. To a rounding error, no…

I guess you just do not understand what EDNS is, and why it is optional and why its optional-ness is not a pro-CloudFlare argument. It is very simple: Query(source IP is an ISP in Paris, no EDNS): gimme IP of "website.com" WebsiteComDNS: IP of the server closest to Paris Query(source IP is Google, no-EDNS): gimme IP of "website.com" WebsiteComDNS: Hm, it is likely Google Cloud, or GoogleBot, answer with IP of own ser…

I appreciate that you’ve moved from assuming what Cloudflare is doing to assuming what I understand. I think this thread has run its course.

Re: Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

#110

Post by [deleted] »

raxi wrote: post #105
akerl_ wrote: post #98

Earlier quoted context omitted.

“We publish the geolocation information of the IPs that we query from”, from the linked comment above. They publish the same info to you and Netflix and me and Amazon. You keep presenting a difference between what “you” get and what a “megacorp” gets, without any evidence that they’re getting something different from you. You also sidestep here into a complaint against “planet wide resolvers”. To a rounding error, no…

I guess you just do not understand what EDNS is, and why it is optional and why its optional-ness is not a pro-CloudFlare argument. It is very simple: Query(source IP is an ISP in Paris, no EDNS): gimme IP of "website.com" WebsiteComDNS: IP of the server closest to Paris Query(source IP is Google, no-EDNS): gimme IP of "website.com" WebsiteComDNS: Hm, it is likely Google Cloud, or GoogleBot, answer with IP of own ser…

[deleted]
Post reply on HN