 |
| 5 users recommended this comment. What they said: |
|
subeadia Oct 20, 2023 | on: OpenAI in Talks for Deal That Would Value Company at $80B | context
It’s very strange. I went down this rabbit hole a few months ago and this HN comment (https://news.ycombinator.com/item?id=19828702) was the best summary I could find of the situation. TLDR: archive.is doesn’t play nice with its DNS results and Cloudflare refuses to fix it on their end. |
|
Brian_K_White Apr 5, 2024 | on: Jon Stewart Says Apple Told Him Not to Interview FTC's Lina… | context
No. It's a long annoying dickfight between the two. And the reason it's annoying is they are both right, ish. Actually Cloudflare is solidly more right, both because of what they are doing, why, and how they are open to finding some sort of compromise, and it's Archive.is who both have the weaker case to justify what they want, and explicitly give no fucks and unwilling to bother working with the other party on any sort of solution, and also what they are doing at the technical level is just technically wrong violating specs vs what cloudflare is doing is not. archive.is wants the users ip for geo load balancing, cloudflare does not supply the users ip for privacy. archive.is returns intentionally and artificially incorrect results to lookups that come from cloudflare. It's been the same for years now. I am no Cloudflare fanboi even though I am using their dns obviously. It's just how all the factors shake out as far as I can tell. https://news.ycombinator.com/item?id=19828702 This is told by Cloudflare ceo from their side, but it is also sort of the definitive explaination of the situation. But if you google cloudflare archive.is you can find countless other discussions and explainations. Surely somewhere archive.is must have written up a version that paints themselves as righteous and blameless, but in the end I don't see how you can get around the base facts of who is doing what. The actions are how you tell the difference between the two sides. |
|
codezero Jun 19, 2019 | on: DNS Cookies – Identify Related Network Flows | context
Someone linked this on a great thread about how dns can leak info. https://news.ycombinator.com/item?id=19828769 The parent thread is really interesting too. |
|
freedomben Aug 2, 2023 | on: Does Cloudflare’s 1.1.1.1 DNS Block Archive.is? (2019) | context
Cloudflare CEO Matthew Prince answered this directly on HN: https://news.ycombinator.com/item?id=19828702 Honestly it's that type of thing (the frankness, the presence on HN, willingness to participate, the principled stand on privacy) that got me into Cloudflare products. I now generate hundreds per month in revenue for them and that will likely be thousands in the next year or two. His time/effort on HN directly led to customer acquisition and revenue. That said I do worry about the incentives Cloudflare has to their big customers. CF is a great tool for site owners, but like any tool has the potential to be a great evil (against the user) if the principles ever wane. It's already being used by a lot of sites to make life a living hell for people behind a VPN. |
|
rainbowzootsuit Dec 10, 2023 | on: 65% increase in "significant" Air Traffic Control incidents… | context
This is a relevant explanation from the perspective of cloudflare |
We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service.
Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service.
The archive.is owner has explained that he returns bad results to us because we don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users. This is especially problematic as we work to encrypt more DNS traffic since the request from Resolver to Authoritative DNS is typically unencrypted. We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1.
EDNS IP subsets can be used to better geolocate responses for services that use DNS-based load balancing. However, 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets.
We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security. Those conversations have been productive and are ongoing. If archive.is has suggestions along these lines, we’d be happy to consider them.