Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare 1.1.1.1 Incident on July 14, 2025

blog.cloudflare.com

Post reply on HN
Print view View original

331–340 of 391 posts

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#331

Post by hbay »

kccqzy wrote: post #327
cadamsdotcom wrote: post #326

> The way that Cloudflare manages service topologies has been refined over time and currently consist of a combination of a legacy and a strategic system that are synced. This writing is just brilliant. Clear to technical and non-technical readers. Makes the in-progress migration sound way more exciting than it probably is! > We are sorry for the disruption this incident caused for our customers. We are actively maki…

I can't tell if you are being sarcastic, but "legacy" is a term most often used by technical people whereas "strategic" is a term most often used by marketing and non-technical leadership. Mixing them together annoys both kinds of readers.

you were annoyed by that sentence?

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#332

Post by marcusb »

kccqzy wrote: post #327
cadamsdotcom wrote: post #326

> The way that Cloudflare manages service topologies has been refined over time and currently consist of a combination of a legacy and a strategic system that are synced. This writing is just brilliant. Clear to technical and non-technical readers. Makes the in-progress migration sound way more exciting than it probably is! > We are sorry for the disruption this incident caused for our customers. We are actively maki…

I can't tell if you are being sarcastic, but "legacy" is a term most often used by technical people whereas "strategic" is a term most often used by marketing and non-technical leadership. Mixing them together annoys both kinds of readers.

You cannot throw a rock without hitting a product marketer describing everything not-their-product as "legacy."

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#333

Post by rvnx »

notpushkin wrote: post #291
sophacles wrote: post #263

Earlier quoted context omitted.

Im sorry... what is a secret hostname that is publicly resolvable? The very idea strikes me as irresponsible and misguided.

It could be some subdomain that’s hard to guess. You can’t (generally) enumerate all subdomains through DNS, and if you use a wildcard TLS certificate (or self-signed / no cert at all), it won’t be leaked to CT logs either. Secret hostname.

Examples: github.internal.companyname.com or jira.corp.org or jenkins-ci.internal-finance.acme-corp.com or grafana.monitoring.initech.io or confluence.prod.internal.companyx.com etc

These, if you don't know the host, you will not be able to hit the backend service. But if you know, you can start exploiting it, either by lack of auth, or by trying to exploit the software itself

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#334

Post by paradao »

whitehexagon wrote: post #244
homebrewer wrote: post #180

This is a good time to mention that dnsmasq lets you setup several DNS servers, and can race them. The first responder wins. You won't ever notice one of the services being down: all-servers server=8.8.8.8 server=9.9.9.9 server=1.1.1.1

That sounds good in principle, but is there a more private configuration that doesnt send DNS resolutions to cloudfare, google et al. ie. avoid BigTech tracking, and not wanting DOH. dnsmasq with a list of smaller trusted DNS providers sounds perfect, as long as it is not considered bad etiquette to spam multiple DNS providers for every resolution? But where to find a trusted list of privacy focused DNS resolvers. Th…

Using DNSCrypt with anonymized DNS could be an option: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D...

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#335

Post by antonvs »

lxgr wrote: post #324
antonvs wrote: post #204

Earlier quoted context omitted.

It's using DNS over HTTPS, and it doesn't default the URL templates correctly when mixing (some) providers. You can set them manually though, and it works.

Ah, this is for DoH, gotcha! This "URL template" thing seems odd – is Windows doing something like creating a URL out of the DNS IP and a pattern, e.g. 1.1.1.1 + " /foo" rel="nofollow">https:// /foo " would yield https://1.1.1.1/foo ? If so, why not just allow providing an actual URL for each server?

It does allow you to provide a URL for each server. The issue is just that its default behavior doesn't work for all providers. I have another comment in this thread telling the original commenter how to configure it.

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#336

Post by localtoast »

whitehexagon wrote: post #244
homebrewer wrote: post #180

This is a good time to mention that dnsmasq lets you setup several DNS servers, and can race them. The first responder wins. You won't ever notice one of the services being down: all-servers server=8.8.8.8 server=9.9.9.9 server=1.1.1.1

That sounds good in principle, but is there a more private configuration that doesnt send DNS resolutions to cloudfare, google et al. ie. avoid BigTech tracking, and not wanting DOH. dnsmasq with a list of smaller trusted DNS providers sounds perfect, as long as it is not considered bad etiquette to spam multiple DNS providers for every resolution? But where to find a trusted list of privacy focused DNS resolvers. Th…

dnsforge.de comes to mind.

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#337

Post by butlike »

kingnothing wrote: post #316
Polizeiposaune wrote: post #277

Earlier quoted context omitted.

Cloudflare recommends you configure 1.1.1.1 and 1.0.0.1 as DNS servers. Unfortunately, the configuration mistake that caused this outage disabled Cloudflare's BGP advertisements of both 1.1.1.0/24 and 1.0.0.0/24 prefixes to its peers.

A better recommendation is to use Cloudflare for one of your DNS servers and a completely different company for the other.

Yeah but on paper they're never going to recommend using a competitor

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#338

Post by dmitrygr »

Quad9 wrote: post #280
Aachen wrote: post #209

Earlier quoted context omitted.

I became a bit disillusioned with quad9 when they started refusing to resolve my website. It's like wetransfer but supporting wget and without the AI scanning or interstitials. A user had uploaded malware and presumably sent the link to a malware scanner. Instead of reporting the malicious upload or blocking the specific URL¹, the whole domain is now blocked on a DNS level. The competing wetransfer.com resolves just…

What is your ticket #? Let's see if we can get this resolved for you.

Why not address the REAL issue:

> I haven't been able to find any recourse. [...] there seems to be no way to clear my name.

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#339

Post by politelemon »

lxgr wrote: post #171
fs111 wrote: post #158

Earlier quoted context omitted.

No, it is not DNS over HTTPS it is DNS over TLS, which is different.

Android 11 and newer support both DoH and DoT.

Where is this option? How can I distinguish the two, the dialog simply asks for a host name
Post reply on HN