1.1.1.1: Fast, privacy-first consumer DNS service • Hacker News Board

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#261

Post by gsnedders » Sun, Apr 01, 2018, 4:30 PM UTC

bluejekyll wrote: post #219

Twirrim wrote: post #189

Earlier quoted context omitted.

Some ISPs block outbound DNS from customers to anywhere but their resolvers, filtering based on target port. This is a particularly common trick in countries that attempt to censor the internet. It's a lot harder to do that with DNS-over-HTTPS because it looks like normal traffic. That said, in this case ISPs can just null route the IP address of the obvious main resolvers such as 1.1.1.1. I imagine most of the benef…

When we add TLS on top of the protocol, ISPs can only filter based on port at that point. We can run DNS on 443 if that helps, but as you said, static well-known IPs can then be blocked. > I imagine most of the benefit is surely to people who can spin up their own resolvers. There are already many easily run DNS resolvers available. Is there a benefit you see in operating them over HTTPS that improves on that?

> When we add TLS on top of the protocol, ISPs can only filter based on port at that point.

And SNI… :(

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#262

Post by anotheryou » Sun, Apr 01, 2018, 4:33 PM UTC

It's april 1st, but I don't get the joke here...

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#263

Post by manigandham » Sun, Apr 01, 2018, 4:33 PM UTC

superkuh wrote: post #93

rdsubhas wrote: post #84

> We will never sell your data or use it to target ads. Period. Won't sell != Won't collect > We will never log your IP address (the way other companies identify you) Never log IP != Never log anything Bonus: The way other companies identify you ~= There are other ways Edit: Looks like many people assume I'm nitpicking. So here are more specific questions: * Is logging a hashcode of the IP considered as "not logging…

And since it's cloudflare if some site's politics don't align with the owner's politics they'll just block it arbitrarily.

It's a private organization with no monopoly and lots of competition. Free speech doesn't apply here.

Also Cloudflare gets vastly more negative opinions that they don't check enough and serve too many unsavory sites so it seems there's no way to win with the HN crowd.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#264

Post by JackNichelson » Sun, Apr 01, 2018, 4:34 PM UTC

Privacy and cloudflare on the same sentence? Bwahahhahahahahaa

Shills

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#265

Post by kentonv » Sun, Apr 01, 2018, 4:34 PM UTC

rdsubhas wrote: post #84

> We will never sell your data or use it to target ads. Period. Won't sell != Won't collect > We will never log your IP address (the way other companies identify you) Never log IP != Never log anything Bonus: The way other companies identify you ~= There are other ways Edit: Looks like many people assume I'm nitpicking. So here are more specific questions: * Is logging a hashcode of the IP considered as "not logging…

Some more details can be found here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#266

Post by notamy » Sun, Apr 01, 2018, 4:35 PM UTC

discreditable wrote: post #243

tux3 wrote: post #122

Earlier quoted context omitted.

You can also use the decimal value of the IP, without the dots: https://16843009

Hex works too: https://0x1010101

Sadly, binary / octal don't work: https://0b1000000010000000100000001 / https://0o100200401

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#267

Post by vinniejames » Sun, Apr 01, 2018, 4:36 PM UTC

How does this service, with DNS-over-HTTPS or DNS-over-TLS, compare to something like DNS Crypt? https://www.opendns.com/about/innovations/dnscrypt/

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#268

Post by tbyehl » Sun, Apr 01, 2018, 4:38 PM UTC

tialaramex wrote: post #181

wtmt wrote: post #147

Earlier quoted context omitted.

Is OpenDNS even as relevant as it was earlier, before Google DNS appeared (and then OpenDNS was bought by Cisco)?

Maybe not _as_ relevant, but still a considerable number of clients are configured to trust OpenDNS, and their far more ambiguous stance on what exactly this is for is appealing to some people. For example, OpenDNS says yes, absolutely it is their business what you're looking up, and maybe you are a Concerned Parent™ who wants to ensure their children don't access RedTube, so that feels like a good idea.

I was thinking more along the lines of their SME offering. DNS filtering is an important layer in network security and CloudFlare’s position of being in the middle of a large portion of Internet traffic, alongside now trying to attract a chunk of general DNS queries, potentially gives them a great deal of insight into who the bad actors are.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#269

Post by jhanschoo » Sun, Apr 01, 2018, 4:42 PM UTC

notamy wrote: post #266

discreditable wrote: post #243

Earlier quoted context omitted.

Hex works too: https://0x1010101

Sadly, binary / octal don't work: https://0b1000000010000000100000001 / https://0o100200401

Octal works, with the older 0-prefix convention: https://0100200401

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#270

Post by JD557 » Sun, Apr 01, 2018, 4:42 PM UTC

kentonv wrote: post #247

JD557 wrote: post #176

I wish that they talked a bit more about their stance regarding censorship. They have a small paragraph talking about the problem, but they don't talk about the "solution". While Cloudflare has been pretty neutral about censoring sites in the past (notably, pirate sites), the Daily Stormer incident put them in a though spot[1]. They talk a bit about Project Galileo (the link is broken BTW, it should be https://www.cl…

There's a pretty big difference between terminating a business relationship (which is what Cloudflare did to Daily Stormer, and which Google also did a couple days before Cloudflare did) and refusing to answer DNS queries for third-party domains with which there is no business relationship. It's hard to imagine how the former could be used as precedent to compel the latter. Cloudflare has no interest in censorship --…

I probably should have made a clearer point instead of linking to TorrentFreak.

I did not mean that I was worried that CloudFlare's DNS would start blocking sites whose content they disagree with (although that would also be worrisome).

I'm worried that copyright holders might be able to use the Daily Stormer case as a precedent to force CloudFlare to stop offering services to infringing sites.

If they are able to do that, I can also see them attempting to force CloudFlare to remove DNS entries as well.