Hacker News Reader

Comment by kevincox | Hacker News Reader

I have Cloudflare with fallback to Google and I need to refresh a few times to make it fallback and work. This spat is kinda ridiculous.

View on HN

I’m not really understanding the crux of it. Even if archive.is doesn’t get your location via DNS, won’t they get it anyways immediately one millisecond later when you issue an HTTP GET request?

Yes, the receiving webserver will get the IP with the HTTP GET, but it's mostly too late to be useful for serving users from a server with minimal latency.

The EDNS client subnet feature reveals the clients subnet (but not entire IP) to the nameserver that answers the DNS query, which is then cached by Cloudflare/Google. This allows the nameserver to do geolocation at the DNS stage and direct the end user to a server with minimal latency.

Without EDNS client subnet, you could get the IP for an archive.is frontend in a different continent and have a slow site experience. While the frontend server will get your IP, it's too late to do much about it under normal circumstances. An HTTP redirect would cost time, and you'd have to have different domains for each data center/region which is one thing you can avoid with the client subnet feature to start with.

Frankly they (archive.is) wouldn't have this issue if they used BGP anycast. DNS was never designed to facilitate regional load balancing.

I thought anycast wasn't reliable for TCP sessions?

You can serve UDP services (eg DNS) by anycast, but if you hosted a tcp service, there's no guarantee the same server would receive consecutive packets from the tcp stream

It is rarely an issue in practice. There are workarounds to minimize connection resets. Using ECMP hashing on routers and a tiered load balancing topology are important.

https://vincent.bernat.ch/en/blog/2018-multi-tier-loadbalanc...

https://blog.cloudflare.com/high-availability-load-balancers...

https://engineering.linkedin.com/network-performance/tcp-ove...

Seems like LinkedIn had to do some finessing and still couldn't go with global anycast.

How do CDNs work without controlling DNS resolution by source subnet?

Presumably a CDN has better and more direct peerings with ISPs than LinkedIn, or admittedly archive.is.

Cloudflare uses any cast, and they deal with it by making every external node able to handle every public IP that they have. If packets in a TCP stream end up going to different nodes, then they deal with that in their infrastructure.

> won’t they get it anyways immediately one millisecond later when you issue an HTTP GET request?

Not if you're using a VPN in addition to Cloudflare servers.

True. In that case, why wouldn’t you send all traffic via the VPN including your DNS?

It's not Cloudflare's fault.

In any case in order to maintain privacy I use https://dnscrypt.info it has an anonymized DNS option https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D...

I then just use unbound and forward that to DNSCrypt on my router. https://wiki.archlinux.org/title/DNSCrypt#Unbound

Is this a Mac thing? You're not meant to use DNS fallback for different providers.

I can't see what a Mac has to do with this at all.

Also I can't imagine why you might think that "You're not meant to use DNS fallback for different providers." That was precisely the point it was originally designed for. The whole point of multiple resolvers is to have diversity of risk. If both your resolvers are from the same organization there's a higher chance that whatever took one out took the other out as well.

Reply on news.ycombinator.com