Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 210 posts

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#21

Post by ikeboy »

akerl_ wrote: post #13
ikeboy wrote: post #9

Earlier quoted context omitted.

Just like we consider it the kernel's fault if user applications break due to a change, I think it's the DNS resolver's fault if they're using a protocol that some popular sites don't support. As soon as I realized they were causing this issue I just switched away. Other DNS providers don't have this issue.

It doesn’t really seem to be the resolvers “using a protocol that [archive.is] doesn’t support”; it seems that archive.is responds to queries from Cloudflare’s systems with an incorrect response. How is Cloudflare meant to work around that kind of behavior?

https://twitter.com/archiveis/status/999788186904576002 claims that cloudflare isn't supporting a protocol that would enable it to work with their servers.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#22

Post by floatingatoll »

judge2020 wrote: post #18

The problem is the archive.is (and other TLDs) server not returning any Good IP if the EDNS client subnet isn't present. Would like to point out that Cloudflare's resolver is EDNS compliant, it just doesn't send the client subnet. See: https://twitter.com/archiveis/status/1018691421182791680 (picture of tweet https://aws1.discourse-cdn.com/cloudflare/optimized/3X/8/2/8... ) Based on that tweet, the owner has a person…

Text of tweet by @archiveis:

"Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as invalid.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#23

Post by LogicX »

For those curious about what is going on here...

Cloudflare has decided for privacy reasons they will not relay eDNS0 client subnet data - which yes, can reveal a portion of the IP of the requestor - but is used by CDN services in order to provide nearest servers or (in some cases) country specific content.

My guess here is archive.is feels they have some need to restrict what content is provided to where in the world, and as a result, without ECS in the request, takes you to a cname which essentially null routes you back to your local loop interface.

Source: Founder of DNSFilter.com - we support ECS, I coded it.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#24

Post by Chlorus »

akerl_ wrote: post #13
ikeboy wrote: post #9

Earlier quoted context omitted.

Just like we consider it the kernel's fault if user applications break due to a change, I think it's the DNS resolver's fault if they're using a protocol that some popular sites don't support. As soon as I realized they were causing this issue I just switched away. Other DNS providers don't have this issue.

It doesn’t really seem to be the resolvers “using a protocol that [archive.is] doesn’t support”; it seems that archive.is responds to queries from Cloudflare’s systems with an incorrect response. How is Cloudflare meant to work around that kind of behavior?

>"it seems that archive.is responds to queries from Cloudflare’s systems with an incorrect response."

What makes the response incorrect? I was under the impression that DNS implementations were under no "practical" obligation to return consistent queries to differing requester IP addresses (hence stuff like split-horizon DNS and EDNS: https://developers.google.com/speed/public-dns/docs/ecs )

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#25

Post by akerl_ »

ikeboy wrote: post #21
akerl_ wrote: post #13

Earlier quoted context omitted.

It doesn’t really seem to be the resolvers “using a protocol that [archive.is] doesn’t support”; it seems that archive.is responds to queries from Cloudflare’s systems with an incorrect response. How is Cloudflare meant to work around that kind of behavior?

https://twitter.com/archiveis/status/999788186904576002 claims that cloudflare isn't supporting a protocol that would enable it to work with their servers.

That’s not an accurate read of archive.is’s behavior. EDNS is an optional feature.

archive.is has configured their nameservers to return invalid (127.0.0.0/8, from the looks of it) responses to Cloudflare requests because they’re protesting Cloudflare’s lack of EDNS, not because EDNS is somehow required to handle the requests.

For context: EDNS sends the origin IP address of the DNS client through the resolver. Cloudflare has it disabled because of the privacy implications of sending it along.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#26

Post by stevekemp »

ignoranceprior wrote: post #20
derimagia wrote: post #3

I remember reading this a while back. It sounded more that archive.is was blocking Cloudflare (or at least not supporting it): https://community.cloudflare.com/t/archive-is-error-1001/182...

Does anyone know why archive.is would block Cloudflare? Is it a technical issue, or does the owner of archive.is have some kind of grudge against them?

Hard to tell from the outside, but archive.is did blacklist the whole of Finland a while back - due to personal grudge.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#27

Post by akerl_ »

Chlorus wrote: post #24
akerl_ wrote: post #13

Earlier quoted context omitted.

It doesn’t really seem to be the resolvers “using a protocol that [archive.is] doesn’t support”; it seems that archive.is responds to queries from Cloudflare’s systems with an incorrect response. How is Cloudflare meant to work around that kind of behavior?

>"it seems that archive.is responds to queries from Cloudflare’s systems with an incorrect response." What makes the response incorrect? I was under the impression that DNS implementations were under no "practical" obligation to return consistent queries to differing requester IP addresses (hence stuff like split-horizon DNS and EDNS: https://developers.google.com/speed/public-dns/docs/ecs )

Sorry, to clarify: when archive.is receives a DNS lookup from Cloudflare’s resolvers, they reply with an IP in the 127.0.0.0/8 range, so the origin client is unable to connect (since those IPs aren’t routable over the internet).

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#28

Post by Chlorus »

judge2020 wrote: post #18

The problem is the archive.is (and other TLDs) server not returning any Good IP if the EDNS client subnet isn't present. Would like to point out that Cloudflare's resolver is EDNS compliant, it just doesn't send the client subnet. See: https://twitter.com/archiveis/status/1018691421182791680 (picture of tweet https://aws1.discourse-cdn.com/cloudflare/optimized/3X/8/2/8... ) Based on that tweet, the owner has a person…

I take back every bad thing I have ever said about mailing lists - at least it was easier to follow the drama than these damn twitter links.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#29

Post by ikeboy »

akerl_ wrote: post #25
ikeboy wrote: post #21

Earlier quoted context omitted.

https://twitter.com/archiveis/status/999788186904576002 claims that cloudflare isn't supporting a protocol that would enable it to work with their servers.

That’s not an accurate read of archive.is’s behavior. EDNS is an optional feature. archive.is has configured their nameservers to return invalid (127.0.0.0/8, from the looks of it) responses to Cloudflare requests because they’re protesting Cloudflare’s lack of EDNS, not because EDNS is somehow required to handle the requests. For context: EDNS sends the origin IP address of the DNS client through the resolver. Cloud…

The right thing for cloudflare to do then is fake the EDNS field so that they get a valid response.

Maybe cloudflare doesn't want to code an ad-hoc solution just to fix one site. But that doesn't matter to the customer, who just wants it to work.

Re: Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

#30

Post by Chlorus »

Chlorus wrote: post #24
akerl_ wrote: post #13

Earlier quoted context omitted.

It doesn’t really seem to be the resolvers “using a protocol that [archive.is] doesn’t support”; it seems that archive.is responds to queries from Cloudflare’s systems with an incorrect response. How is Cloudflare meant to work around that kind of behavior?

>"it seems that archive.is responds to queries from Cloudflare’s systems with an incorrect response." What makes the response incorrect? I was under the impression that DNS implementations were under no "practical" obligation to return consistent queries to differing requester IP addresses (hence stuff like split-horizon DNS and EDNS: https://developers.google.com/speed/public-dns/docs/ecs )

Thanks for the clarification on here + and the other posts, that makes perfect sense.
Post reply on HN