259
submitted 1 year ago by dingus@lemmy.ml to c/technology@beehaw.org

tl;dr: No. Quite the opposite, actually — Archive.is’s owner is intentionally blocking 1.1.1.1 users.

CloudFlare's CEO had this to say on HackerNews:

We don’t block archive.is or any other domain via 1.1.1.1. [...] Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. [...] The archive.is owner has explained that he returns bad results to us because we don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users.

I am mainly making this post so that admins/moderators at BeeHaw will consider using archive.org or ghostarchive.org links instead of archive.today links.

Because anyone using CloudFlare's DNS for privacy is being denied access to archive.today links.

https://ghostarchive.org/archive/PmSkp

you are viewing a single comment's thread
view the rest of the comments
[-] DzikiMarian@lemmy.sdf.org 13 points 1 year ago

That's really weird explanation on part of CF CEO, as just after DNS request you usually connect to the site which address you requested and site gets a lot more details including full IP address anyway.

[-] dingus@lemmy.ml 57 points 1 year ago* (last edited 1 year ago)

https://news.ycombinator.com/item?id=19828702

Here's the full comment on HackerNews, the article quoting him only had the snippet. The larger comment makes more sense. Emphasis mine.

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service.

Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service.

The archive.is owner has explained that he returns bad results to us because we don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users. This is especially problematic as we work to encrypt more DNS traffic since the request from Resolver to Authoritative DNS is typically unencrypted. We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1.

EDNS IP subsets can be used to better geolocate responses for services that use DNS-based load balancing. However, 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets.

We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security. Those conversations have been productive and are ongoing. If archive.is has suggestions along these lines, we’d be happy to consider them.

So it's really more about metadata related to the IP, like geolocation.

[-] DzikiMarian@lemmy.sdf.org 5 points 1 year ago

Interesting, thanks

[-] nyan@lemmy.cafe 4 points 1 year ago

That . . . really looks like a game of DNS chicken. In Cloudflare's place, I'd just shrug, provide garbage EDNS data that meets the technical requirements (probably pointing at archive.is's own location), and move on, but they're apparently too wrapped up in their principles to blink first.

[-] jarfil@beehaw.org 4 points 1 year ago

We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results.

Couldn't they just put that as the EDNS?

[-] LinkOpensChest_wav@lemmy.one 3 points 1 year ago

This is all disappointing, to say the least, but I'm convinced. I won't be using archive.today anymore.

[-] KairuByte@lemmy.dbzer0.com 16 points 1 year ago

A DNS query is not inherently followed by a connection to the server.

[-] SaltySalamander@kbin.social 2 points 1 year ago
[-] KairuByte@lemmy.dbzer0.com 7 points 1 year ago

And the 5% of the time it isn’t, is what is being talked about here.

[-] flumph@programming.dev 12 points 1 year ago

And? My DNS provider shouldn't be leaking my information even if I immediately use the info they gave me to connect to the site.

[-] redcalcium@lemmy.institute 5 points 1 year ago

To be fair, they use a dns-based load balancer / cdn, so they want to know your ip address so their dns server can geolocate you and reply with the nearest server's IP address. I guess this is probably easier to setup or less costly than using anycast like most cdn services.

[-] nuke@yah.lol 4 points 1 year ago* (last edited 1 year ago)

Wouldn't it make a difference in cases where the nameserver and host are not the same entity?

this post was submitted on 30 Aug 2023
259 points (100.0% liked)

Technology

37739 readers
869 users here now

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:


This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago
MODERATORS