Earlier quoted context omitted.
It‘s not a C&C/Botnet
It is C&C -- it instructs their site visitors to DOS a specific site.
A C&C controls a botnet, where is the botnet?
Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
181–190 of 351 posts
Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
#182Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
#183What a crazy timeline this has been.
(1) May 04 2019: "Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)" [https://news.ycombinator.com/item?id=19828317]
eastdakota on May 4, 2019 on: Tell HN: Archive.is inaccessible via Cloudflare DNS...
[Via https://news.ycombinator.com/item?id=19828702]
We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service.
Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service.
The archive.is owner has explained that he returns bad results to us because we don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users. This is especially problematic as we work to encrypt more DNS traffic since the request from Resolver to Authoritative DNS is typically unencrypted. We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1.
EDNS IP subsets can be used to better geolocate responses for services that use DNS-based load balancing. However, 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets.
We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security. Those conversations have been productive and are ongoing. If archive.is has suggestions along these lines, we’d be happy to consider them.
Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
#184Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
#185Earlier quoted context omitted.
1.1.1.2 is their malware-blocking DNS, and 1.1.1.3 is their parental-controls DNS. If you want an unfiltered DNS, use 1.1.1.1 - which resolves archive.today just fine, although archive.today itself refuses to work on Cloudlfare DNS.
I have no idea why anyone would use Cloudflare DNS, much less trust their more filtered versions.
I have no idea why anyone would drink water from a faucet, much less trust their more filtered versions.
Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
#186What a crazy timeline this has been. (1) May 04 2019: "Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)" [ https://news.ycombinator.com/item?id=19828317 ] eastdakota on May 4, 2019 on: Tell HN: Archive.is inaccessible via Cloudflare DNS... [Via https://news.ycombinator.com/item?id=19828702] We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS…
The 1.1.1.1 referred to in the above is Cloudflare's main resolver, 1.1.1.2 & 1.1.1.3 are for those intentionally looking for malware and content blocking.
Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
#187Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
#188Earlier quoted context omitted.
It's not based in "guesswork and fear". It is a first-person account of someone that used their service. A user review, if you will. There's this thing - when you offer a service to the public, the users of your service, can, will, and should review your service. So, yes, I am free to "trash talk" a service that was, frankly, terrible at its job in providing domain name resolution. That works as any other user review…
If you said that they served you cold food because the US government made them do it, yea, I’d think you were nuts.
And that's not what I said?
I offered some possibilities of why they did a shitty job in providing naming resolution. I even speculated what was the most likely one (not the one you mentioned).
But it's okay, at this point I have very little optimism regarding your reading ability.
Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
#189Earlier quoted context omitted.
> 1.1.1.2 is their malware-blocking DNS, and 1.1.1.3 is their parental-controls DNS. ... TIL, thank you. Time to go tweak my pi-hole server...
I'm just curious, given all the other options that respect your privacy and don't put data collection at the center of their business model, why do you use Cloudflare on your pi-hole?
[flagged]
Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
#190Earlier quoted context omitted.
what is the vector here? dns traffic is practically anonymous, there would have to be some very specific and purposeful trickery going on to link dns traffic to an identity. It sounds like something more hypothetical than a tangible threat model
It isn't anonymous. DNS server resolve, IP addresses by hostnames. It cannot then inspect further traffic but it certainly can log your IP address and all URL's a given IP ever hit. Since ISP know your identity, and all it takes is to (request and get) the DNS logs and ISP servitude for all sort of questionable information, you as an identity are giving away all sites domains you visit.
[flagged]