Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1 for Families

blog.cloudflare.com

Post reply on HN
Print view View original

141–150 of 171 posts

Re: 1.1.1.1 for Families

#141

Post by tomklein »

fragmede wrote: post #140
consumer451 wrote: post #66

Earlier quoted context omitted.

Is there any non-conspiratorial reason for archive.is's position on this?

Yes. From a technical standpoint, archive.is' stance is that it's actually important useful data that, more importantly, isn't a privacy violation. How much you agree with archive.is depends on a very technical understanding of the subject, or barring that, it depends on how much you buy Cloudflare's reasoning. Cloudflare's business would prefer you pay for Cloudflare (at large but specifically their anycast) instead…

I coded a GeoDNS for a couple of my sites and Cloudflare‘s IPs are always geolocated to the nearest datacenters and works great in a GeoDNS setting.

Also, what about DNS resolvers that don’t support EDNS at all?

Re: 1.1.1.1 for Families

#143

Post by kjaftaedi »

cnst wrote: post #26
kjaftaedi wrote: post #20

Earlier quoted context omitted.

So if archive.is decided to also return garbage DNS results to Quad9 you would stop using them too? I get your sentiment, but allowing one single webpage on the internet to dictate who you are allowed to use for DNS is going too far in the other direction, IMHO

It's a little ironic complaining about a single webpage on the internet, when you're suggesting that we use a single resolver on the internet instead of a distributed resolver system that we have otherwise. FWIIW, I use the resolver of my ISP, and 100% happy with the results. If your ISP provides incorrect and fake data to make extra money on advertising, maybe you should vote with your wallet and change the ISP.

I'm not quite sure I get your point.

I use the resolver of my ISP also, and they must recurse to cloudflare, because by default archive.is is broken for me at home.

I am not going to change my ISP and not going to bow down to a single website that chooses to go against the good faith of distributed systems.

I just don't visit their site anymore because that is the decision that they have made.

Re: 1.1.1.1 for Families

#144

Post by nkrisc »

yabones wrote: post #101
nkrisc wrote: post #84

Any tips/ideas for configurations for selective content blocking by device? I'd like to block content on the kids' devices, but not for the adults in the household. I'm not concerned about circumvention at this point. I'm currently using a pi-hole for ad blocking, so I'd like to configure something at that level, unless there's a better way.

Put those devices on a separate subnet would be the easiest way. In order of technical complexity: * Buy a second router, plug it into your existing one, set the DHCP options to point to 1.1.1.2 * Reconfigure your existing router to add a second subnet (192.168.2.0/24 etc) with its own SSID * Use DHCP reservations to push 1.1.1.1 to known devices (adults) and 1.1.1.2 to all others; it could be done the other way, but…

Thanks for the ideas, it gives me somewhere to start investigating. I already have several subnets for other reasons, so I might try that route.

Re: 1.1.1.1 for Families

#145

Post by zenexer »

BatteryMountain wrote: post #109

Well one of my domains resolves to some dodgy russian website when using cloudflare's dns. I did everything in my power, including trying to contact them, but it still resolves to the russian host. On any other dns server it resolves correctly to gandi's parking page. Cloudflare did send me an email within 10 seconds to say that no support ticket can/will be logged since I'm not a paying customer (or just customer on…

This is a very serious security issue if the cause is on Cloudflare’s end. Would you be willing to disclose the domain name?

Re: 1.1.1.1 for Families

#147

Post by tinus_hn »

BatteryMountain wrote: post #112
BatteryMountain wrote: post #109

Well one of my domains resolves to some dodgy russian website when using cloudflare's dns. I did everything in my power, including trying to contact them, but it still resolves to the russian host. On any other dns server it resolves correctly to gandi's parking page. Cloudflare did send me an email within 10 seconds to say that no support ticket can/will be logged since I'm not a paying customer (or just customer on…

And the reason why it pissed me off was, I thought my mikrotik router or raspberry pi + pihole got compromised. I spent two hours trying to track down the problem, reset all dns setting on gandi, resetting and updating the router etc... just to find that it worked fine on my phone on MNO's network...then I digged further and found if I switch my dns to anything other than 1.1.1.1, it worked fine. So I don't care what…

If you are using dnssec this should be impossible, right?

Re: 1.1.1.1 for Families

#148

Post by jgrahamc »

BatteryMountain wrote: post #109

Well one of my domains resolves to some dodgy russian website when using cloudflare's dns. I did everything in my power, including trying to contact them, but it still resolves to the russian host. On any other dns server it resolves correctly to gandi's parking page. Cloudflare did send me an email within 10 seconds to say that no support ticket can/will be logged since I'm not a paying customer (or just customer on…

I am Cloudflare's CTO. Email is jgc@cloudflare. Please email me and let me know what domain is involved so I can investigate.

Re: 1.1.1.1 for Families

#149

Post by tinus_hn »

legrande wrote: post #114

Who bears the brunt of the task of collecting every adult/NSFW domain out there? Doesn't such a list grow by huge numbers each day? What is the name of this list, and where can I get it?

I’m pretty sure adult sites register themselves for inclusion on this kind of blocklists because they have not a whole lot to gain and a lot to lose when serving their content to children.

Re: 1.1.1.1 for Families

#150

Post by saurik »

ViViDboarder wrote: post #120
saurik wrote: post #110

Earlier quoted context omitted.

Can you explain the attack a bit more? One would (naively) expect that the process of the user connecting to my web server would expose their IP address (associated with their intent) to many more relevant actors (including "nationstate actors") than Cloudflare connecting to my DNS server... is the issue that the specific nationstate actor you have been concerned with is explicitly able to target and achieve surveill…

Because DNS is still largely unencrypted. Nation state actors can read that information and map who is making requests for what domains. It’s not so much a concern of the site host from getting the users IP, because the user is presumably going to visit it. This is an issue with Archive.is because they host their own DNS, not their web server.

I am sorry, can you explain this to me step by step? My computer makes a DNS request through Cloudflare, which forwards a request to archive.is's DNS server which is apparently going out of its way to carefully prevent anyone from figuring out that I wanted to access archive.is... and then my computer ruins all of that by making a direct connection to archive.is's web server. If you are a "nationstate actor" able to randomly sniff traffic in various places, the DNS request doesn't seem to add any value over the web request. What is the actual attack? Be more specific.
Post reply on HN