5 ms·

I use CloudFlare because I like their DNS service; I've switched off proxy/caching entirely :|

by JorgeGT 11y ago

adventured 11y ago
Same here. I've had a great experience with their DNS service. Zero cost, and just as good as Amazon's Route 53 in my testing.
nly 11y ago
It's pretty amusing that the DNS has such a distributed design yet everyone wants to centralise their authoritative nameservers on services like Route 53 and Cloudflare. Latency shouldn't really be an argument in the case of DNS because it was designed such that folks would be using their ISPs low-latency caches/recursors In theory, HTTP could have been the same way, if it wasn't for for complete lack of respect caching got once the web moved to dynamic database-driven designs and the temptation for middleboxes to overstep their remit.
- NDizzle 11y ago
  Are you saying that Route 53 and Cloudflare don't have distributed DNS? How could they not be, when my OLD PAL 4.2.2.2 has been distributed since the 90s?
  - nly 11y ago
    I'm sure they have geographically distributed and anycasted servers. I'm talking more the moral or sociological impact, post-Snowden, of relinquishing control of our services to a handful of third parties en masse. It seems that building systems that are designed to be distributed, federated and cooperative isn't actually enough to overcome our natural tendency to want to pool resources and build communal lines of defence against the perceived 'Big Bad'. Broken middleboxes meant HTTP/2 needed to become TLS-only, which now means middleboxes can't be used at all, which means no caching, which means we all go to Cloudflare or another CDN as a professional MITM service. It's all fairly ludicrous. In principle the idea of ISP web caches was a good one, just like how ISP provided DNS caches are essential in keeping the Internet as we know it reliable.
    - manigandham 11y ago
      HTTP/2 is not TLS only and does not require encryption. However if you are using encryption, how do you expect ISP caches to work? Like you said "middleboxes can't be used at all".
  - xorcist 11y ago
    It depends on what you mean by "distributed". There are many servers behind Cloudflare's DNS servers, but they are all controlled by one organization. Best practice is to have your DNS servers in different AS. This is not only to have many servers all over the world, which Cloudflare solves for you, but to have them accessible over different routes, not controlled by the same people. That way a configuration error somewhere (or a bad BGP route, which happens) can not put your DNS out of service. DNS service is cheap and plentiful, and you might even have it included in your ISP deal. You might as well use it. Also note that if you secure your records with DNSSEC, none of your DNS secondaries can tamper with your data. This is by design. You do not need to place trust in the organizations running them, so that part can be left out of your SLA. It is also best practice to have all your public DNS servers mirror your primary master, which is not public. This is to make sure all your public servers are kept running even when you have operations issues with your primary.

I use CloudFlare because I like their DNS service; I've switched off proxy/caching entirely :|

by JorgeGT 11y ago

I use CloudFlare because I like their DNS service; I've switched off proxy/caching entirely :|

Same here. I've had a great experience with their DNS service. Zero cost, and just as good as Amazon's Route 53 in my testing.

nly 11y ago

It's pretty amusing that the DNS has such a distributed design yet everyone wants to centralise their authoritative nameservers on services like Route 53 and Cloudflare. Latency shouldn't really be an argument in the case of DNS because it was designed such that folks would be using their ISPs low-latency caches/recursors In theory, HTTP could have been the same way, if it wasn't for for complete lack of respect caching got once the web moved to dynamic database-driven designs and the temptation for middleboxes to overstep their remit.

NDizzle 11y ago
Are you saying that Route 53 and Cloudflare don't have distributed DNS? How could they not be, when my OLD PAL 4.2.2.2 has been distributed since the 90s?
- nly 11y ago
  I'm sure they have geographically distributed and anycasted servers. I'm talking more the moral or sociological impact, post-Snowden, of relinquishing control of our services to a handful of third parties en masse. It seems that building systems that are designed to be distributed, federated and cooperative isn't actually enough to overcome our natural tendency to want to pool resources and build communal lines of defence against the perceived 'Big Bad'. Broken middleboxes meant HTTP/2 needed to become TLS-only, which now means middleboxes can't be used at all, which means no caching, which means we all go to Cloudflare or another CDN as a professional MITM service. It's all fairly ludicrous. In principle the idea of ISP web caches was a good one, just like how ISP provided DNS caches are essential in keeping the Internet as we know it reliable.
  - manigandham 11y ago
    HTTP/2 is not TLS only and does not require encryption. However if you are using encryption, how do you expect ISP caches to work? Like you said "middleboxes can't be used at all".
- xorcist 11y ago
  It depends on what you mean by "distributed". There are many servers behind Cloudflare's DNS servers, but they are all controlled by one organization. Best practice is to have your DNS servers in different AS. This is not only to have many servers all over the world, which Cloudflare solves for you, but to have them accessible over different routes, not controlled by the same people. That way a configuration error somewhere (or a bad BGP route, which happens) can not put your DNS out of service. DNS service is cheap and plentiful, and you might even have it included in your ISP deal. You might as well use it. Also note that if you secure your records with DNSSEC, none of your DNS secondaries can tamper with your data. This is by design. You do not need to place trust in the organizations running them, so that part can be left out of your SLA. It is also best practice to have all your public DNS servers mirror your primary master, which is not public. This is to make sure all your public servers are kept running even when you have operations issues with your primary.