[deleted]
Cloudflare 1.1.1.1 Incident on July 14, 2025
271–280 of 391 posts
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#272Earlier quoted context omitted.
From their homepage: > How Quad9 protects your privacy? > When your devices use Quad9 normally, no data containing your IP address is ever logged in any Quad9 system. Of course they have some kinds of logs. Aggregating resolved domains without logging client IPs is not what the implication of "Quad9 is reselling the traffic logs" seems to be.
We're not discussing IP addresses, we are discussing whether their logs can leak your secret domain name.
Thats more clear, I get your point now. Again, though, that's not how most people would read the original comment. I've never even contemplated that I might generate some hostnames existence of which might be considered sensitive. It seems like a terrible idea to begin with, as I'm sure there are other avenues for those "secret" domains to be leaked. Perhaps name your secret VMs vm1, vm2, ..., instead of . But yeah, this is not my area of expertise, nor a concern for the vast majority of internet users who want more privacy than their ISP will provide.
I am curious though, do you have any suggestions for alternative DNS that is better?
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#273Earlier quoted context omitted.
Quad9 is reselling the traffic logs, so it means if you connect to secret hosts (like for your work), they will be leaked
We are fully committed to end-user privacy. As a result, Quad9 is intentionally designed to be incapable of capturing end-users' PII. Our privacy policy is clear that queries are never associated with individual persons or IP addresses, and this policy is embedded in the technical (in)capabilities of our systems.
It is about the hostnames themselves like: git.nationalpolice.se but I understand that there is not much choice if you want to keep the service free to use so this is fair
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#274>Even though this release was peer-reviewed by multiple engineers I find it somewhat surprising that none of the multiple engineers who reviewed the original change in June noticed that they had added 1.1.1.0/24 to the list of prefixes that should be rerouted. I wonder what sort of human mistake or malice led to that original error. Perhaps it would be wise to add some hard-coded special-case mitigations to DLS such…
It's probably much simpler, "I trust Jerry, I'm sure this is fine, approved."
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#275Earlier quoted context omitted.
Just pair 1.1.1.1 with 9.9.9.9 (Quad9) so you have fault tolerance in terms of provider as well.
I became a bit disillusioned with quad9 when they started refusing to resolve my website. It's like wetransfer but supporting wget and without the AI scanning or interstitials. A user had uploaded malware and presumably sent the link to a malware scanner. Instead of reporting the malicious upload or blocking the specific URL¹, the whole domain is now blocked on a DNS level. The competing wetransfer.com resolves just…
I've been the victim of similar abuse before, for my mail servers and one of my community forums that I used to run. It's frustrating when you try to do everything right but you're at the mercy of a cold and uncompromising rules engine.
You just convinced me to ditch quad9.
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#276It's no surprise that Cloudflare is having a service issue again. I use Cloudflare at work. Cloudflare has many bugs, and some technical decisions are absurd, such as the worker's cache.delete method, which only clears the cache contents in the data center where the Worker was invoked!!! https://developers.cloudflare.com/workers/runtime-apis/cache... In my experience, Cloudflare support is not helpful at all, trying…
> some technical decisions are absurd, such as the worker's cache.delete method, which only clears the cache contents in the data center where the Worker was invoked!!! The Cache API is a standard taken from browsers. In the browser, cache.delete obviously only deletes that browser's cache, not all other browsers in the world. You could certainly argue that a global purge would be more useful in Workers, but it would…
Just wanted to say, I always appreciate your comments and frankness!
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#277> For many users, not being able to resolve names using the 1.1.1.1 Resolver meant that basically all Internet services were unavailable. Don't you normally have 2 DnS servers listed on any device. So was the second also down, if not why didn't it go to that.
Cloudflare recommends you configure 1.1.1.1 and 1.0.0.1 as DNS servers.
Unfortunately, the configuration mistake that caused this outage disabled Cloudflare's BGP advertisements of both 1.1.1.0/24 and 1.0.0.0/24 prefixes to its peers.
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#278Earlier quoted context omitted.
You can use it, you just need to set the DNS over HTTPS templates correctly, since there's an issue with the defaults it tries to use when mixing providers. The templates you need are: 1.1.1.1: https://cloudflare-dns.com/dns-query 9.9.9.9: https://dns.quad9.net/dns-query 8.8.8.8: https://dns.google/dns-query See https://learn.microsoft.com/en-us/windows-server/networking/... for info on how to set the templates.
Awesome! Thank you!
You're welcome. btw I came across a description of doing it via the GUI here: https://github.com/Curious4Tech/DNS-over-HTTPS-Set-Up
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#279It's no surprise that Cloudflare is having a service issue again. I use Cloudflare at work. Cloudflare has many bugs, and some technical decisions are absurd, such as the worker's cache.delete method, which only clears the cache contents in the data center where the Worker was invoked!!! https://developers.cloudflare.com/workers/runtime-apis/cache... In my experience, Cloudflare support is not helpful at all, trying…
Cloudflare is definitely not perfect (and when they make a change that breaks the existing API contract it always makes for several miserable days for me), but on the whole Cloudflare is pretty reliable.
That said, I don't use workers and don't plan to. I personally try to stay away from non cross-platform stuff because I've been burned too heavily with vendor/platform lock-in in the past.
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#280Earlier quoted context omitted.
Just pair 1.1.1.1 with 9.9.9.9 (Quad9) so you have fault tolerance in terms of provider as well.
I became a bit disillusioned with quad9 when they started refusing to resolve my website. It's like wetransfer but supporting wget and without the AI scanning or interstitials. A user had uploaded malware and presumably sent the link to a malware scanner. Instead of reporting the malicious upload or blocking the specific URL¹, the whole domain is now blocked on a DNS level. The competing wetransfer.com resolves just…
What is your ticket #? Let's see if we can get this resolved for you.