Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1: Fast, privacy-first consumer DNS service

blog.cloudflare.com

Post reply on HN
Print view View original

181–190 of 695 posts

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#181

Post by tialaramex »

wtmt wrote: post #147
tbyehl wrote: post #99

Earlier quoted context omitted.

Could be a precursor to launching an OpenDNS competitor.

Is OpenDNS even as relevant as it was earlier, before Google DNS appeared (and then OpenDNS was bought by Cisco)?

Maybe not _as_ relevant, but still a considerable number of clients are configured to trust OpenDNS, and their far more ambiguous stance on what exactly this is for is appealing to some people. For example, OpenDNS says yes, absolutely it is their business what you're looking up, and maybe you are a Concerned Parent™ who wants to ensure their children don't access RedTube, so that feels like a good idea.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#183

Post by brantonb »

ajross wrote: post #164
shimms wrote: post #9

Earlier quoted context omitted.

Yes they have: "Privacy First: Guaranteed. We will never sell your data or use it to target ads. Period. We will never log your IP address (the way other companies identify you). And we’re not just saying that. We’ve retained KPMG to audit our systems annually to ensure that we're doing what we say. Frankly, we don’t want to know what you do on the Internet—it’s none of our business—and we’ve taken the technical step…

Serious question: where is that quote from? The link above is just to the resolver address.

Quote is at: https://1.1.1.1

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#184

Post by sgc »

tscs37 wrote: post #145

I'm probably gonna switch my PiHole over from Google DNS. I trust Cloudflare more than Google to uphold my privacy. Not that I trust either very much. Benchmarking Results for the interested: (sorted worst first, P value is bottom-X-percent) 1.1.1.1: P00.5=48.2ms (55.8ms VPN) P50.0=32.8ms (37.0ms VPN) P95.0=29.1ms (33.0ms VPN) P99.5=29.1ms (32.7ms VPN) 8.8.8.8: P00.5=225.4ms (71.5ms VPN) P50.0=48.0ms (53.6ms VPN) P95…

Where are you located? I am in the rural north Bay Area California and my numbers are shocking:

Ping statistics for 1.1.1.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 1ms, Maximum = 2ms, Average = 1ms

Ping statistics for 8.8.8.8: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 25ms, Maximum = 27ms, Average = 26ms

Ping statistics for 8.8.4.4: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 26ms, Maximum = 28ms, Average = 27ms

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#185

Post by patrickmcmanus »

bluejekyll wrote: post #146

DNS-over-HTTPS doesn’t make as much sense to me as DNS-over-TLS. They are effectively the same thing, but HTTPS has the added overhead of the HTTP headers per request. If you look at the currently in progress RFC, https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-04 , this is quite literally the only difference. The DNS request is encoded as a standard serialized DNS packet. The article mentions QUIC as being…

rfc 8336. h2 coalescing. h2 push. caching. it starts to add up to a very interesting story.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#186

Post by tscs37 »

sgc wrote: post #184
tscs37 wrote: post #145

I'm probably gonna switch my PiHole over from Google DNS. I trust Cloudflare more than Google to uphold my privacy. Not that I trust either very much. Benchmarking Results for the interested: (sorted worst first, P value is bottom-X-percent) 1.1.1.1: P00.5=48.2ms (55.8ms VPN) P50.0=32.8ms (37.0ms VPN) P95.0=29.1ms (33.0ms VPN) P99.5=29.1ms (32.7ms VPN) 8.8.8.8: P00.5=225.4ms (71.5ms VPN) P50.0=48.0ms (53.6ms VPN) P95…

Where are you located? I am in the rural north Bay Area California and my numbers are shocking: Ping statistics for 1.1.1.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 1ms, Maximum = 2ms, Average = 1ms Ping statistics for 8.8.8.8: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 25ms, Maximu…

I'm in Southern Germany, my ISP is a bit of a quack when I'm not using their own ad-riddled DNS (I suspect it's intentional)

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#188

Post by exikyut »

oneweekwonder wrote: post #174
aexaey wrote: post #134

Earlier quoted context omitted.

1.2 -> 1.0.0.2 1.2.3 -> 1.2.0.3 But then, much of software would fail here - Firefox/Chrome for example would both threat that as bareword and redirect to search page.

It work as expected if you give it the http://1.2.3 schema prefix. The input bar is a search bar in modern browsers.

Or if you follow it with a trailing slash, for less typing

  1.1/

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#189

Post by Twirrim »

bluejekyll wrote: post #146

DNS-over-HTTPS doesn’t make as much sense to me as DNS-over-TLS. They are effectively the same thing, but HTTPS has the added overhead of the HTTP headers per request. If you look at the currently in progress RFC, https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-04 , this is quite literally the only difference. The DNS request is encoded as a standard serialized DNS packet. The article mentions QUIC as being…

Some ISPs block outbound DNS from customers to anywhere but their resolvers, filtering based on target port. This is a particularly common trick in countries that attempt to censor the internet.

It's a lot harder to do that with DNS-over-HTTPS because it looks like normal traffic.

That said, in this case ISPs can just null route the IP address of the obvious main resolvers such as 1.1.1.1. I imagine most of the benefit is surely to people who can spin up their own resolvers.

Post reply on HN