5 ms·

I feel like people forgot about how CloudFlare, Google, et. al. can new effectively censor content they don't agree with: https://fightthefuture.org/article/th

I feel like people forgot about how CloudFlare, Google, et. al. can new effectively censor content they don't agree with: https://fightthefuture.org/article/the-new-era-of-corporate-censorship/ https://fightthefuture.org/article/the-new-era-of-corporate-... ..and even though CloudFlare back pedaled on that particular decision somewhat, it still happened. If you really want something fast and secure, run your own caching DNS that uses root DNS servers.

syshum 9y ago
This is the most alarming thing about this trend that has been happening for the last few years The Internet should be DECENTRALIZED yet it seems we are attempting to do everything in our power to ensure only a handful of companies control access to all information. For what to save 3 ms off a ping time? Facebook is in hot water over privacy issues, but that is just the tip of the ice berg Google, AWS, Cloudflare are IMO are larger threat then facebook ever could be.
- duskwuff 9y ago
  You're barking up the wrong tree here. DNS is already an inherently centralized service -- using one company's resolvers instead of another doesn't change that.
  - syshum 9y ago
    Yes and No the problem with Cloudflare is not simply the fact that DNS is centralized, it is a combination of all their services that is concerning for Cloudflare, between the DDOS Proxy, the CDN, the Other Services, and now DNS that is a lot of services in a single basket, so while it is true that dns is some what centralized, having all traffic and all services dependent upon a single company seems to be a bad idea to me But clearly everyone sees not issue with it provided they "claim" to providing a "privacy first" service for free (ya riiiiiggghhhhttttt and Facebook cares about their users privacy as well) and they have better performance, who cares what the long term effects are... We should be working to make DNS less centralized, or replace it with something less centralized, not moving to DNS over HTTP to a few "cloud" providers who also control all of the content...
plg 9y ago
> If you really want something fast and secure, run your own caching DNS that uses root DNS servers. is there a good tutorial for this somewhere?
- oelmekki 9y ago
  If you want to do it on your local linux system, it's pretty easy: you just need to install bind9 and use `nameserver 127.0.0.1` in your /etc/resolv.conf Bind9 has a poor reputation because of how difficult it is to use it to define zones (manage a domain name), but if you want to use it as a resolver, it's basically plug'n'play. Huge bonus included : if you want to flush the cache, you just need to run `sudo rndc flush`, so you don't have to wait for TTL timeout to test your newly configured domain name when you setup a website (you still have to restart your browser, because most of them do their own dns caching).
  - vertex-four 9y ago
    Honestly, isn’t Unbound a better shout if you’re not going to be fiddling with it? Just install, run, and edit /etc/resolv.conf to point at 127.0.0.1.
    - oelmekki 9y ago
      Well, you're describing exactly how to do it with bind9 :) What make you say Unbound is better?
      - swinglock 9y ago
        Unbound is more lightweight. All it does is recursive lookups, it has no option for being authoritative. If that's all you need then that's better. There are other options too, I don't know what makes Unbound better than PowerDNS Recursor or Knot Resolver.
      - LinuxBender 9y ago
        I prefer Unbound as it lets me set a min-ttl. This of course is taboo and comes with caveats, so you have to know what you are doing and the implications. Unbound has better support for DNSSEC as well.
aesh2Xa1 9y ago
This is some pretty sage advice. I think it's great that Cloudflare is offering the service, but it's relatively simple (and fun!) to setup up our own. There's guide in the link below for using unbound server to do this. Example#1 fits many people. And, if we choose to censor any domains we can always do so on our own service... take a look at Example#2! https://calomel.org/unbound_dns.html https://calomel.org/unbound_dns.html
ocdtrekkie 9y ago
Since a discussion about this topic has been present in every thread about Cloudflare's DNS service, I can quite confidently say "people" didn't forget.
kawsper 9y ago
They also allow for websites to look HTTPs-enabled, but the transfer happens in clear text, e.g.: Client -(HTTPS)> CloudFlare -(HTTP)> Server. For a company that allegedly is privacy first, this is a huge violation of trust. I also know about some people that run websites that can't get Stripe because they can't figure out how to configure SSL for their website, they just plug in CloudFlare in front, and now they can communicate with Stripe, and everything is received in cleartext following the diagram i posted. Cloudflare calls this "Flexible SSL", and it is described here: https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W... I have flagged this for both Cloudflare and Stripe, but none seems to care.
- vimda 9y ago
  The threat model of MiTM attacks leans heavily towards the client side than the Cloudflare -> origin connection. It's not perfect and it would be fantastic if everyone could setup SSL on their origin servers, but in the end there's are more script kiddies in coffeeshops than there are tier1 isps trying to steal your data
  - syshum 9y ago
    Flexiable SSL by Cloudflare should itself be considered a MiTM Attack and should be opposed by all security standards, organizations, and anyone that values privacy or security, this highlights the inherent problem with SSL in the first place.

syshum 9y ago

This is the most alarming thing about this trend that has been happening for the last few years The Internet should be DECENTRALIZED yet it seems we are attempting to do everything in our power to ensure only a handful of companies control access to all information. For what to save 3 ms off a ping time? Facebook is in hot water over privacy issues, but that is just the tip of the ice berg Google, AWS, Cloudflare are IMO are larger threat then facebook ever could be.

duskwuff 9y ago
You're barking up the wrong tree here. DNS is already an inherently centralized service -- using one company's resolvers instead of another doesn't change that.
- syshum 9y ago
  Yes and No the problem with Cloudflare is not simply the fact that DNS is centralized, it is a combination of all their services that is concerning for Cloudflare, between the DDOS Proxy, the CDN, the Other Services, and now DNS that is a lot of services in a single basket, so while it is true that dns is some what centralized, having all traffic and all services dependent upon a single company seems to be a bad idea to me But clearly everyone sees not issue with it provided they "claim" to providing a "privacy first" service for free (ya riiiiiggghhhhttttt and Facebook cares about their users privacy as well) and they have better performance, who cares what the long term effects are... We should be working to make DNS less centralized, or replace it with something less centralized, not moving to DNS over HTTP to a few "cloud" providers who also control all of the content...

plg 9y ago

> If you really want something fast and secure, run your own caching DNS that uses root DNS servers. is there a good tutorial for this somewhere?

oelmekki 9y ago
If you want to do it on your local linux system, it's pretty easy: you just need to install bind9 and use `nameserver 127.0.0.1` in your /etc/resolv.conf Bind9 has a poor reputation because of how difficult it is to use it to define zones (manage a domain name), but if you want to use it as a resolver, it's basically plug'n'play. Huge bonus included : if you want to flush the cache, you just need to run `sudo rndc flush`, so you don't have to wait for TTL timeout to test your newly configured domain name when you setup a website (you still have to restart your browser, because most of them do their own dns caching).
- vertex-four 9y ago
  Honestly, isn’t Unbound a better shout if you’re not going to be fiddling with it? Just install, run, and edit /etc/resolv.conf to point at 127.0.0.1.
  - oelmekki 9y ago
    Well, you're describing exactly how to do it with bind9 :) What make you say Unbound is better?
    - swinglock 9y ago
      Unbound is more lightweight. All it does is recursive lookups, it has no option for being authoritative. If that's all you need then that's better. There are other options too, I don't know what makes Unbound better than PowerDNS Recursor or Knot Resolver.
    - LinuxBender 9y ago
      I prefer Unbound as it lets me set a min-ttl. This of course is taboo and comes with caveats, so you have to know what you are doing and the implications. Unbound has better support for DNSSEC as well.

aesh2Xa1 9y ago

This is some pretty sage advice. I think it's great that Cloudflare is offering the service, but it's relatively simple (and fun!) to setup up our own. There's guide in the link below for using unbound server to do this. Example#1 fits many people. And, if we choose to censor any domains we can always do so on our own service... take a look at Example#2! https://calomel.org/unbound_dns.html https://calomel.org/unbound_dns.html

ocdtrekkie 9y ago

Since a discussion about this topic has been present in every thread about Cloudflare's DNS service, I can quite confidently say "people" didn't forget.

kawsper 9y ago

They also allow for websites to look HTTPs-enabled, but the transfer happens in clear text, e.g.: Client -(HTTPS)> CloudFlare -(HTTP)> Server. For a company that allegedly is privacy first, this is a huge violation of trust. I also know about some people that run websites that can't get Stripe because they can't figure out how to configure SSL for their website, they just plug in CloudFlare in front, and now they can communicate with Stripe, and everything is received in cleartext following the diagram i posted. Cloudflare calls this "Flexible SSL", and it is described here: https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W... I have flagged this for both Cloudflare and Stripe, but none seems to care.

vimda 9y ago
The threat model of MiTM attacks leans heavily towards the client side than the Cloudflare -> origin connection. It's not perfect and it would be fantastic if everyone could setup SSL on their origin servers, but in the end there's are more script kiddies in coffeeshops than there are tier1 isps trying to steal your data
- syshum 9y ago
  Flexiable SSL by Cloudflare should itself be considered a MiTM Attack and should be opposed by all security standards, organizations, and anyone that values privacy or security, this highlights the inherent problem with SSL in the first place.