Hacker News Reader

Comment by Shank | Hacker News Reader

Archive.is still doesn’t work if you use Cloudflare DNS due to a spat with Cloudflare and the operator. So to me, the continuity and reliability is already a big question. Not only is it a question of sustainability economically, but also ideologically: what happens if another similar decision is made to lock out a portion of users?

View on HN

For reference: the spat is that Cloudflare DNS does not leak geographic information of the queryer through EDNS, and the archive.is fellow is requiring geographic information to provide valid DNS lookups. So he intentionally sends back bad results when it is 1.1.1.1 querying his nameservers.

I love the site, but his stance on this doesn't really make sense to me, and it's a shame that millions and millions of people use 1.1.1.1 daily and archive.is is the one website that doesn't work for those people.

> I love the site, but his stance on this doesn't really make sense to me

would not be surprised if he has some personal axe to grind with cf (they are no sheep either).

also i would be wary of overestimating market penetration of any 3rd-party dns provider; iirc google has total dominance of this segment and is still below 10%.

Millions use 1.1.1.1 ? Any source for that ?

The Android app has 418,000 reviews and over 50 million installs, and the iPhone app has 230,000 reviews. The number of people who use it without an app is probably a lot higher.

HN discussion from 2019 on this topic: https://news.ycombinator.com/item?id=19828317

I'm not sure the term 'leak' applies. It's an anti-cdn play. Refusing to use EDNS correctly makes the web slower for a lot of people. And it adds little to nothing to privacy since the answer IP is going to know your IP at the next step anyways...

As for why archive.is cares so much...that I don't know. Perhaps they rely on such data to give a fast experience, and are tired of this charade...but that's just speculation.

Cloudflare's edge network is sufficiently dense that ECS data is unnecessary in almost all cases. The requesting data center will be close enough to the client that doing geoip on the source IP will have the same results as using ECS.

There's nothing incorrect about what Cloudflare is doing, EDNS does not require ECS data to be included in requests, but for whatever reason the maintainer of Archive.is decided to block 1.1.1.1 over it.

But not sending ECS data harms non-cloudflare CDNs, right?

edit: from here https://news.ycombinator.com/item?id=19828702 I gather that this indeed harms CDNs outside the ones that Cloudflare has a business relationship with.

> EDNS IP subsets can be used to better geolocate responses for services that use DNS-based load balancing. However, 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets.

> We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security. Those conversations have been productive and are ongoing. If archive.is has suggestions along these lines, we’d be happy to consider them.

Cloudflare also often blocks no-JS users.

All-around a huge accessibility impediment.

Cloudflare is not neutral. They blocked 8chan after political pressure from MSM.

CloudFlare really is an enemy of the Free (Libre) open internet.

They are the next Google in terms of "evil companies"

Was MitMing half the web the giveaway?

What is a good alternative to Cloudflare DNS? I've been using 1.1.1.1 since it was launched, but now this makes me want to switch to something better.

Why not your ISP?

Perhaps look at Quad9.

This is kinda irrelevant in a discussion about archive.is blocking cloudflare DNS users and cloudflare DNS servers/ips.

I lost faith in Cloudflare when they switched from being a neutral infrastructure service to yet another politically-motivated big tech company. In their blog post around the ban of 8chan (https://blog.cloudflare.com/terminating-service-for-8chan/), they acknowledged that they didn't know if 8chan broke any laws but they nevertheless decided to pass personal judgment based on a vague notion that 8chan "inspired" a shooting. That's quite an unprincipled way to operate a fundamental network utility that backs 10% of the Fortune 1000 and 20% of the top 10000 websites.

Reply on news.ycombinator.com