8 ms·
So, the traffic is being sniffed and analyzed, and that service was advertised as privacy-oriented?
by wielebny 9y ago
So, the traffic is being sniffed and analyzed, and that service was advertised as privacy-oriented?
- tonyztan 9y ago> "Under the terms of a cooperative agreement, APNIC will have limited access to query the transaction data for the purpose of conducting research related to the operation of the DNS system." https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
- LeoPanthera 9y ago"The service" is the DNS service. If you send random garbage to random IP addresses I think you waive the right to privacy.
- decisiveness 9y ago>APNIC gets to see the noise as well as the DNS traffic >Huston emphasised that APNIC intends to protect users' privacy. "DNS is remarkably informative about what users do, if you inspect it closely, and none of us are interested in doing that," he said. Maybe it is reasonable to take them at their word as they seem trustworthy, but we should at least consider the fact that at least some of this DNS traffic is indeed being analyzed.
- Arnt 9y agoNo, wait. Users of the DNS service get the privacy guarantee. Non-users do not. If you floodping 1.1.1.1 you are not a user of the DNS service and the privacy terms don't apply to you. Rather you're a member of the Misconfiguration Club, and the site you're pinging has the usual right to analyse your pings.
- comboy 9y agoWhat if somebody has a bad DNS resolver and what he qualifies as a valid DNS request, researchers do not. I get the general idea, but having "user-privacy oriented" and "we collect everything and make it available to many researchers" services under the same IP may lead to some issues.
- cesarb 9y agoEven a bad DNS resolver will still send to port 53. The privacy policy probably applies to anything on ports 53, 80, and 443.
- walrus01 9y agoand the DNS over TLS port, 853
- Arnt 9y agoOh, in that case you can apply those issues to all of Cloudflare. They serve many thousands of websites from each node. God only knows how many different privacy policies may apply depending on which bytes you send to TCP port 80.
- krelian 9y agoI'm pretty sure that all the traffic is being analyzed. The only thing they publicly committed to is not saving your Ip address.
- eastdakota 9y agoDNS traffic, no. Random garbage traffic misdirected to 1.1.1.1, APNIC is studying.
- cpeterso 9y agoDoes all this garbage traffic affect the performance of Cloudflare's servers? There must be some cost (performance and $$$) to filter this traffic. Was that a consideration when deciding whether to use 1.1.1.1 instead of some other IP address? :)
- StreamBright 9y agoVendors like Cloudflare have usually really easy to use and cheap measures to drop traffic otherwise they would not be able to provide DDOS protection. Usually they have BGP or other means to propagate blacklisted IP ranges to peers meaning that not even their peers will route the garbage towards them. This is how you can survive DDOS that is bigger than your pipe while serving legit traffic (coming from different ranges than the ones you blacklisted).
- eastdakota 9y agoNo. We have a lot of capacity. A lot.
- walrus01 9y agoFor ordinary singlehomed users who don't get the "a lot". As an example cloudflare has 40Gbps of capacity to the SIX in Seattle. I would guess that they also have direct, at minimum, 10Gbps PNI peering sessions with other huge ISPs in the Pacific Northwest which never see the SIX fabric. So probably add another 20 individual 10GbE circuits at bare minimum to that 40 figure. All of which helps spread the traffic load out rather than shoving it all down a few pipes.
- pyvpx 9y agohttps://peeringdb.com/net/4224 https://peeringdb.com/net/4224 that's just the public stuff!
- _eht 9y agoIt was reworded enough times to make their promise vague and not well defined.
- eastdakota 9y agoI’m Cloudflare’s CEO. What questions do you have? I’ll start: do we ever store 1.1.1.1’s users’ IPs? No. They’re never written to disk. And APNIC never has access to them. What data do you provide to APNIC? We give APNIC reports on non-DNS data that’s hitting 1.1.1.1. It includes information like: what protocols are sending data to the IP, what’s the volume, where it it coming from? For DNS users of 1.1.1.1, we never provide APNIC any identifying information. We don’t upload any data to them. While they can query for questions like: “How many queries came from India in the last 24 hours?” they can’t query anything on a specific user. If you have concerns, ask them here. I’ll answer.
- lulmerchant 9y agoHow do you know where the requests came from without IP addresses? Do you log ASN or something?
- eastdakota 9y agoWe keep IPs in memory to help stop abuse and debugging ng other issue, but we promise to purge all logs within 24 hours or less.
- kuschku 9y agoI expect that no human from APNIC or Cloudflare will ever look at raw data from 1.1.1.1, nor will any of it be recorded, or used in aggregated data that retains any personal information. As personal information count full IP addresses, the content of requests, or any set of data that can be used to recover these. That is what "we respect your privacy" means.
- eastdakota 9y agoNeither we nor APNIC can query “what” or “how many” requests from any IP have been made. We can query things like: 1. How much query traffic is from Africa? 2. What’s the peak time of query traffic? 3. What are the most popular DNS authoritative servers? If you have specific concerns, please raise them here.