151–160 of 210 posts
Earlier quoted context omitted.
If the govt of your jurisdiction (American I assume?) commanded you to censor a certain domain or block of IPs with a court order, what exactly happens? I'm not sure if this has been done on the DNS level before but do you guys have a plan in case it ever does happen?
Or you know you Piss off CloudFare CEO and he directs them to censor a site... Which has happened in the past
Earlier quoted context omitted.
This diverges pretty hard from your earlier comparison, between this scenario and the Linux kernel breaking userspace. If a dev updates their code so it won’t run unless an kernel flag is enabled, the kernel hasn’t broken userspace, and kernel devs are unlikely to add a “fake-enabled-flag” to trick the userspace program, even if it’s popular. Likewise, I don’t expect my DNS resolver to add in custom behavior if upstr…
If every other resolver works, then I expect Cloudflare to work. The kernel hardcodes plenty of hacky things to get specific hardware to work.
Archive.is operators are throwing a temper tantrum. It isn't in Cloud Flare or anyone else's best interest to appease them.
Earlier quoted context omitted.
Alternatively: Cloudflare simply is making a subversive play against their competitor CDNs. Client subnet of a DNS request is used for initial rough mapping by Cloudflare competitors such as Akamai (definitely) and I believe Fastly ( and probably others) . Stripping it easily adds at least a few milliseconds to the time to first byte and most likely results a request re-routing on the second or third request. After a…
Google has its own public DNS and CDN, I'm pretty sure that counts.
archive.org works fine with 1^4. What is the advantage of using archive.is?
Earlier quoted context omitted.
Well no, CloudFlare doesn't get to talk about not "violating the integrity of DNS" after you stopped responding to "any" queries in violation of the standard. You started by doing your own thing and then proposed a change to the standard to fit your business decision. [0] [0] https://www.rfc-editor.org/info/rfc8482
There's a difference between changing results (or adding) and not supporting a feature that is dangerous and rarely used. Kind-of like banning handguns vs. providing unknownly modified guns.
Earlier quoted context omitted.
@eastdakota what about just failing without response on archive.is calls so the second resolver address configured in the client will be used? I understand this is also a DNS integrity violation, however the result for the end user would be either the same if they don’t have a second resolver configured or enhanced if they do. The current effect is I stop using 1.1.1.1 when I need archive.is (often) and set it back t…
DNS either has integrity or it doesn’t. We get a response from an Authoritative server and, as a Resolver, we believe our responsibility is to return it. If we start making exceptions because of bad PR, how can you trust us to do the right thing when the stakes are even higher (e.g., nationstate pressure)? As an aside, I used to think that when Emerson said that “a foolish consistency is the hobgoblin of little minds…
Earlier quoted context omitted.
> Say you remove/don't proxy the ECS information, and I get some generic, non-geo-location aware response back. In the majority of cases, wouldn't my next step be to open a TCP connection to the IP in the response, and immediately leak my full IP address to the other end? That assumes that the nameserver and the actual server are run by the same party which quite often is not the case.
> That assumes that the nameserver and the actual server are run by the same party which quite often is not the case. Cloudflare can check if nameserver and the actual server are run by different parties, and if so omit subnet information from EDNS response. It is not hard to implement — Google and OpenDNS used to require manual whitelisting to receive EDNS subnet responses (not sure if they still do). Cloudflare's C…
How?
I don't get why people use 1.1.1.1 8.8.8.8 etc, for more then debugging. Why tell Google et.al about every site you visit !? And get slightly slower, less accurate and less resilient DNS lookups ...
And because most site visits start with a Google search anyway.
And finally, because I am comfortable with their privacy statement : https://developers.google.com/speed/public-dns/privacy
Earlier quoted context omitted.
Its preventing the DNS authority to know the IP of who is making the request. CloudFlare decided its DNS should be the authority to the end user and Archive.is's DNS should be the authority only to CloudFlare. CloudFlare is breaking the bond between the end user and the Service provider. What CloudFlare is doing is centralizing authority to itself rather allowing authority to be distributed to all owners of the domai…
This is no different than any 3rd party DNS service. If the resolving DNS server you hit doesn't have a cached response, it reaches out to the upstream resolver. It doesn't pass your IP along to the upstream resolver
I don't get why people use 1.1.1.1 8.8.8.8 etc, for more then debugging. Why tell Google et.al about every site you visit !? And get slightly slower, less accurate and less resilient DNS lookups ...
Because what you get is often faster, more accurate and more resilient compared to the junk DNS run by most ISPs. And because most site visits start with a Google search anyway. And finally, because I am comfortable with their privacy statement : https://developers.google.com/speed/public-dns/privacy