17 ms·

Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)

320 points by ikeboy 8y ago

I noticed I couldn't connect to archive.is, eventually I figured out it was an issue with cloudflare DNS, 1.1.1.1. Checking nslookup confirms this: nslookup archive.is 1.1.1.1 Server: 1.1.1.1 Address: 1.1.1.1#53 Non-authoritative answer: Name: archive.is Address: 127.0.0.4 nslookup archive.is 8.8.8.8 Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: archive.is Address: 94.16.117.236 Cloudflare is returning a localhost address which prevents you from accessing the website.

regnerba 8y ago
Cloudflare returns a proper response for me. nslookup archive.is 1.1.1.1 Server: 1.1.1.1 Address: 1.1.1.1#53 Non-authoritative answer: Name: archive.is Address: 134.119.220.26
- akerro 8y ago
  dig @1.1.1.1 archive.is ; <<>> DiG 9.14.1 <<>> @1.1.1.1 archive.is ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46862 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1452 ;; QUESTION SECTION: ;archive.is. IN A ;; ANSWER SECTION: archive.is. 2998 IN A 127.0.0.4 ;; Query time: 52 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) ;; WHEN: Sat May 04 21:03:36 CEST 2019 ;; MSG SIZE rcvd: 55 dig @8.8.8.8 archive.is ; <<>> DiG 9.14.1 <<>> @8.8.8.8 archive.is ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5893 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;archive.is. IN A ;; ANSWER SECTION: archive.is. 299 IN A 94.16.117.236 ;; Query time: 79 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Sat May 04 21:04:28 CEST 2019 ;; MSG SIZE rcvd: 55
- 1f60c 8y ago
  Not for me: Server: 1.1.1.1 Address: 1.1.1.1#53 Non-authoritative answer: Name: archive.is Address: 127.0.0.4
- V99 8y ago
  It's possible your ISP is intercepting all traffic for port 53 and sending it to their own nameservers (which do send client subset) instead of you actually taking to cloudflare's 1.1.1.1 at all.
  - abtinf 8y ago
    Links for documented instances of this practice?
    - V99 8y ago
      I don't know of any particular popular concrete instance, but why is it hard to believe? It's trivial to implement and would be brought to you by the same people who think serving ads for NXDOMAIN is a good idea. https://www.dnsleaktest.com/what-is-transparent-dns-proxy.html https://www.dnsleaktest.com/what-is-transparent-dns-proxy.ht...
      - abtinf 8y ago
        That link was useful, thank you. I don't find it hard to believe technically, but it strikes me as a fundamentally different practice than what I'd head of before. If I request for traffic to go to a certain IP, I expect it to be sent to that IP. MITMing and manipulating that traffic is bad, but not delivering it at all is qualitatively different. I suspect it could be grounds for a serious civil or criminal action.
        LogicX 8y ago
        I can confirm we run across transparent dns proxying with customers at DNSFilter all the time. Mobile carriers are the worst for doing this. A few days ago it was a customers compromised router doing it.
    - AndyMcConachie 8y ago
      https://labs.ripe.net/Members/babak_farrokhi/operator-level-dns-redirection https://labs.ripe.net/Members/babak_farrokhi/operator-level-...
- logixlemon 8y ago
  If you don't mind could you look through: https://ooni.torproject.org/about/risks/ https://ooni.torproject.org/about/risks/ And if they sound acceptable run https://ooni.torproject.org/install/ https://ooni.torproject.org/install/ It'll show you more about likely interception of your traffic.
derimagia 8y ago
I remember reading this a while back. It sounded more that archive.is was blocking Cloudflare (or at least not supporting it): https://community.cloudflare.com/t/archive-is-error-1001/18227 https://community.cloudflare.com/t/archive-is-error-1001/182...
- ignoranceprior 8y ago
  Does anyone know why archive.is would block Cloudflare? Is it a technical issue, or does the owner of archive.is have some kind of grudge against them?
  - stevekemp 8y ago
    Hard to tell from the outside, but archive.is did blacklist the whole of Finland a while back - due to personal grudge.
    - wolco 8y ago
      Who runs archive.is? Sounds childish without knowing any of the facts.
      - stevekemp 8y ago
        Has some notes on the topic: https://en.wikipedia.org/wiki/Archive.today#Finland https://en.wikipedia.org/wiki/Archive.today#Finland
  - altfredd 8y ago
    Cloudflare uses "privacy" and "caring about users" as excuses to sabotage competing CDNs (including whatever CDN is used by archive.is). Most recursive DNS severs on Internet can be categorized in two groups: local DNS servers, offered by Internet providers to their users, and enormous "generic" DNS like Google's 8.8.8.8. When someone makes a DNS request to those servers, they will in turn forward it to DNS servers of web page you are requesting. Content Delivery Networks use DNS to determine, which server should serve your request: if your DNS request arrived from Africa, CDN's DNS server will return IP in Africa. Of course, _users_ don't send DNS requests to CDN's server — recursive DNS servers do. In the past almost everyone used DNS, offered by their Internet provider, — CDN's had to use GeoIP or even static lists of providers to determine origin of that request. When world-wide DNS servers like Google's 8.8.8.8 started to gain popularity, that approach was broken, so EDNS was developed. Cloudflare is a CDN. They are selling their CDN services for money. At the same time they are encouraging end users to use free DNS server, that does not support EDNS on purpose (they admit so on their website). In effect they are creating a situation, when competing CDNs are at disadvantage and can't determine, what country user comes from. Cloudflare itself does not suffer from that disadvantage, because they control both 1.1.1.1 and DNS, used by their clients' websites.
ikeboy 8y ago
Looks like it's a known issue https://community.cloudflare.com/t/archive-is-error-1001/18227/4 https://community.cloudflare.com/t/archive-is-error-1001/182..., yet not been fixed for at least a year
- floatingatoll 8y ago
  In response to that "unfixed" issue, they noted - in a timely manner, last year - that archive.is is returning bad IPs to them, which is preventing them from serving good IPs: https://community.cloudflare.com/t/archive-is-error-1001/18227/3 https://community.cloudflare.com/t/archive-is-error-1001/182... > Nameservers responsible for archive.is (ben.archive.is, anna.archive.is) are returning answers tailored to the IP address of the requestor. And indicate that anyone who knows how to contact archive.is can ask them to resolve the issue: > If you have a contact on the domain owner, you can ask them to fix this. EDIT: This is knowingly blocked by archive.is. Reasoning and discussion elsewhere in post comments. No need to contact archive.is about it, they’re clearly aware.
  - ikeboy 8y ago
    Just like we consider it the kernel's fault if user applications break due to a change, I think it's the DNS resolver's fault if they're using a protocol that some popular sites don't support. As soon as I realized they were causing this issue I just switched away. Other DNS providers don't have this issue.
    - akerl_ 8y ago
      It doesn’t really seem to be the resolvers “using a protocol that [archive.is] doesn’t support”; it seems that archive.is responds to queries from Cloudflare’s systems with an incorrect response. How is Cloudflare meant to work around that kind of behavior?
      - ikeboy 8y ago
        https://twitter.com/archiveis/status/999788186904576002 https://twitter.com/archiveis/status/999788186904576002 claims that cloudflare isn't supporting a protocol that would enable it to work with their servers.
systemcluster 8y ago
Previous discussion here: https://news.ycombinator.com/item?id=17742457 https://news.ycombinator.com/item?id=17742457
deleted 8y ago
[deleted]
netsharc 8y ago
TIL that Cloudflare is (Edit: was, article is a few years old) Nazi-friendly anyway... https://www.sfchronicle.com/business/article/How-San-Francisco-s-Cloudflare-helps-serve-up-11122855.php https://www.sfchronicle.com/business/article/How-San-Francis... > Cloudflare also has an added appeal to sites such as the Daily Stormer. It turns over to the hate sites the personal information of people who criticize their content. For instance, when a reader figures out that Cloudflare is the Internet company serving sites like the Daily Stormer, he or she sometimes write to the company to protest. Cloudflare, per its policy, then relays the name and email address of the person complaining to the hate site, often to the surprise and regret of the person complaining. > This has led to campaigns of harassment against those writing in to protest the offensive material. People have been threatened and harassed. [...] > Andrew Anglin, the owner of the Daily Stormer, has been candid about how he feels about people reporting his site for its content. > “We need to make it clear to all of these people that there are consequences for messing with us,” Anglin wrote in one online post. “We are not a bunch of babies to be kicked around. We will take revenge. And we will do it now.”
- darawk 8y ago
  ...you know that Cloudflare terminated their service, right? https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/
  - fmhul 8y ago
    And even if they hadn't, how would that make them "Nazi-friendly"? I've always supposed Cloudflare is meant to be neutral. They only kicked out DS because they were stupid enough to pretend CF was endorsing them. And well, in any case this is unrelated to this thread...
- dang 8y ago
  "Eschew flamebait. Don't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
irtefa 8y ago
This has been a known issue for a while. Unfortunately, Archive.is has to fix it from their nameservers and we cannot do anything from our side. You can ready more about it here: https://community.cloudflare.com/t/archive-is-error-1001/18227/8 https://community.cloudflare.com/t/archive-is-error-1001/182... Disclaimer: I work at Cloudflare
- 9HZZRfNlpR 8y ago
  The person or persons running the site have a history of very stubborn behaviour. I do appreciate the service they are running. One time they blocked the whole Finland because the owner had problems with customs and somehow related the incident with Russia while saying Finnish gov and bur businesses can never be independent.
deleted 8y ago
[deleted]
miyuru 8y ago
Cloudflare DNS does not support EDNS Client Subnet[1], so archive.is returns invalid IP address for Cloudflare IPs[2] [1] https://developers.cloudflare.com/1.1.1.1/nitty-gritty-details/ https://developers.cloudflare.com/1.1.1.1/nitty-gritty-detai... [2] https://twitter.com/archiveis/status/1018691421182791680 https://twitter.com/archiveis/status/1018691421182791680
judge2020 8y ago
The problem is the archive.is (and other TLDs) server not returning any Good IP if the EDNS client subnet isn't present. Would like to point out that Cloudflare's resolver is EDNS compliant, it just doesn't send the client subnet. See: https://twitter.com/archiveis/status/1018691421182791680 https://twitter.com/archiveis/status/1018691421182791680 (picture of tweet https://aws1.discourse-cdn.com/cloudflare/optimized/3X/8/2/82f80904fab6661263389595d60ef7d9b7f16eaa_2_442x500.png https://aws1.discourse-cdn.com/cloudflare/optimized/3X/8/2/8... ) Based on that tweet, the owner has a personal grudge against Cloudflare and is choosing to return bad results.
- floatingatoll 8y ago
  Text of tweet by @archiveis: "Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as invalid.
  - arghwhat 8y ago
    For additional context, here is the Cloudflare explanation about EDNS client subnets: > EDNS Client Subnet > >1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers. Cloudflare's requests are of course perfectly valid, with @archiveis actively deciding not to service them.
    - zzzcpan 8y ago
      It has nothing to do with privacy, as the next thing following DNS resolution is establishing a TCP connection which always leaks full IP address to the same person or organization controlling authoritative servers. Basically EDNS is just a convenient way for DNS-based CDNs to provide a better edge node. But this is directly competing with Cloudflare, so Cloudflare invents excuses not to implement something that helps other CDNs.
Jerry2 8y ago
I tried Cloudflare's DNS for a week or so and noticed lots of sites that were blocked. I ended up creating my own DNS server that I run on a VPS.
LogicX 8y ago
For those curious about what is going on here... Cloudflare has decided for privacy reasons they will not relay eDNS0 client subnet data - which yes, can reveal a portion of the IP of the requestor - but is used by CDN services in order to provide nearest servers or (in some cases) country specific content. My guess here is archive.is feels they have some need to restrict what content is provided to where in the world, and as a result, without ECS in the request, takes you to a cname which essentially null routes you back to your local loop interface. Source: Founder of DNSFilter.com - we support ECS, I coded it.
- Thorrez 8y ago
  >My guess here is archive.is feels they have some need to restrict what content is provided to where in the world Couldn't that be done later, by blocking the actual HTTP TCP connections instead of blocking the DNS requests? Maybe it's an efficiency issue, that they want the higher-efficiency blocking by DNS rather than lower-efficiency blocking during HTTP TCP, but that seems a little strange to me.
eastdakota 8y ago
We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. The archive.is owner has explained that he returns bad results to us because we don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users. This is especially problematic as we work to encrypt more DNS traffic since the request from Resolver to Authoritative DNS is typically unencrypted. We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1. EDNS IP subsets can be used to better geolocate responses for services that use DNS-based load balancing. However, 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets. We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security. Those conversations have been productive and are ongoing. If archive.is has suggestions along these lines, we’d be happy to consider them.
- givinguflac 8y ago
  Thanks for the detailed response! I think your team is handling this the right way.
- DanielDent 8y ago
  An example of something that Cloudflare's approach provides some protection from: http://dnscookie.com/ http://dnscookie.com/
- 8y ago
darkhorn 8y ago
https://developers.cloudflare.com/1.1.1.1/nitty-gritty-details/ https://developers.cloudflare.com/1.1.1.1/nitty-gritty-detai... >EDNS Client Subnet >1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers. What does this mean?
- AndyMcConachie 8y ago
  https://tools.ietf.org/html/rfc7871 https://tools.ietf.org/html/rfc7871
darkhorn 8y ago
In Firefox I'm using DNS over HTTPS ( https://mozilla.cloudflare-dns.com/dns-query https://mozilla.cloudflare-dns.com/dns-query ) and there is no issue accessing archive.is. Actually I wanted to query archive.is manually but I don't know how to do it in DoH.
- rmdoss 8y ago
  Firefox is likely falling back to your local resolver (the default) when it can't find a domain.
v0v 8y ago
So much talk about DNS and no one suggested simple workaround for this :-) If anyone wants to use 1.1.1.1 and still access arhive.is, simply add this line to your /etc/hosts file. 134.119.220.26 archive.is
z3t4 8y ago
I don't get why people use 1.1.1.1 8.8.8.8 etc, for more then debugging. Why tell Google et.al about every site you visit !? And get slightly slower, less accurate and less resilient DNS lookups ...
- gspetr 8y ago
  I use it because I'd rather tell Google than my government, which is not on friendly terms with either US or Google.
- NKosmatos 8y ago
  Because in certain countries the ISP has to respect the legal regulations and so the DNS server provided/defined by each provider will block/redirect certain web sites. These could be torrent trackers, subtitle distribution sites, political and/or religious sites and so on... In some parts of the world alternate DNS servers allow people to access all sites :-)
  - celsoazevedo 8y ago
    Not to mention that some ISPs redirect users to pages full of ads when a domain doesn't exist or use DNS to MITM users and inject ads into pages.
- kermitismyhero 8y ago
  Many people are otherwise using their ISP's DNS servers, which are often even worse with regards to performance and reliability. Long ago I did tech support for an ISP, and I'd say that 9/10ths of our "outages" were due to our overworked ancient DNS servers failing. I'd go off-script when I took calls during those kinds of outages, and just help people set 4.2.2.2 in their router's DNS settings the moment I saw a strong signal in the line test and hosts not resolving. Managers made snide comments about that not being the official procedure and "not displaying confidence in $ISP", but it fixed the problem.
- 1f60c 8y ago
  I’m curious. What DNS server do you use? Or do you just memorize the IPs of the websites you want to visit? :P
sverige 8y ago
archive.org works fine with 1^4. What is the advantage of using archive.is?
- Faark 8y ago
  Because you usually want to use the service that has the snapshot you want to view. And that isn't always archive.org. But it is my first place to go as well.
- dredmorbius 8y ago
  Archive.org, the Internet Archive, and archive.is, a webpage capture service that seems to have a primary name of "Archive.today", are wholly separate concerns, offerring different services.
  - jolmg 7y ago
    Interesting, I thought archive.is was an alternate domain of the Internet Archive, but it seems they are completely different people[1]. [1] https://en.wikipedia.org/wiki/Archive.today https://en.wikipedia.org/wiki/Archive.today
  - sverige 7y ago
    Yes, but what is the difference between the two? That's really my question. Sorry if it wasn't clear.
agumonkey 8y ago
oh I thought my local pdns instance was misconfigured.. interesting
rmdoss 8y ago
Archive.is is very interesting. I was checking and they block (by responding back with 127.0.0.3): - 1.1.1.1 - Neustar DNS - AdGuard DNS But they don't block Quad9 or CleanBrowsing that also do not send the EDNS subnet. Very curious way of blocking itself out of the Internet. OpenDNS blocks it (sends to their block page): https://dnsblacklist.org/?domain=archive.is https://dnsblacklist.org/?domain=archive.is Would love to hear from someone from archive.is what is going on.
jsizzle 7y ago
Why doesn’t archive.is return a valid alternate IP for DNS queries that don’t have the EDNS0 information? They can host an apology page on that IP that tells the user why they aren’t getting the content they are looking for and suggest solutions for using a different open DNS service if the user is willing to use one that provides their client subnet.

320 points by ikeboy 8y ago

regnerba 8y ago

Cloudflare returns a proper response for me. nslookup archive.is 1.1.1.1 Server: 1.1.1.1 Address: 1.1.1.1#53 Non-authoritative answer: Name: archive.is Address: 134.119.220.26

akerro 8y ago
dig @1.1.1.1 archive.is ; <<>> DiG 9.14.1 <<>> @1.1.1.1 archive.is ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46862 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1452 ;; QUESTION SECTION: ;archive.is. IN A ;; ANSWER SECTION: archive.is. 2998 IN A 127.0.0.4 ;; Query time: 52 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) ;; WHEN: Sat May 04 21:03:36 CEST 2019 ;; MSG SIZE rcvd: 55 dig @8.8.8.8 archive.is ; <<>> DiG 9.14.1 <<>> @8.8.8.8 archive.is ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5893 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;archive.is. IN A ;; ANSWER SECTION: archive.is. 299 IN A 94.16.117.236 ;; Query time: 79 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Sat May 04 21:04:28 CEST 2019 ;; MSG SIZE rcvd: 55
1f60c 8y ago
Not for me: Server: 1.1.1.1 Address: 1.1.1.1#53 Non-authoritative answer: Name: archive.is Address: 127.0.0.4
V99 8y ago
It's possible your ISP is intercepting all traffic for port 53 and sending it to their own nameservers (which do send client subset) instead of you actually taking to cloudflare's 1.1.1.1 at all.
- abtinf 8y ago
  Links for documented instances of this practice?
  - V99 8y ago
    I don't know of any particular popular concrete instance, but why is it hard to believe? It's trivial to implement and would be brought to you by the same people who think serving ads for NXDOMAIN is a good idea. https://www.dnsleaktest.com/what-is-transparent-dns-proxy.html https://www.dnsleaktest.com/what-is-transparent-dns-proxy.ht...
    - abtinf 8y ago
      That link was useful, thank you. I don't find it hard to believe technically, but it strikes me as a fundamentally different practice than what I'd head of before. If I request for traffic to go to a certain IP, I expect it to be sent to that IP. MITMing and manipulating that traffic is bad, but not delivering it at all is qualitatively different. I suspect it could be grounds for a serious civil or criminal action.
      - LogicX 8y ago
        I can confirm we run across transparent dns proxying with customers at DNSFilter all the time. Mobile carriers are the worst for doing this. A few days ago it was a customers compromised router doing it.
  - AndyMcConachie 8y ago
    https://labs.ripe.net/Members/babak_farrokhi/operator-level-dns-redirection https://labs.ripe.net/Members/babak_farrokhi/operator-level-...
logixlemon 8y ago
If you don't mind could you look through: https://ooni.torproject.org/about/risks/ https://ooni.torproject.org/about/risks/ And if they sound acceptable run https://ooni.torproject.org/install/ https://ooni.torproject.org/install/ It'll show you more about likely interception of your traffic.

derimagia 8y ago

I remember reading this a while back. It sounded more that archive.is was blocking Cloudflare (or at least not supporting it): https://community.cloudflare.com/t/archive-is-error-1001/18227 https://community.cloudflare.com/t/archive-is-error-1001/182...

ignoranceprior 8y ago
Does anyone know why archive.is would block Cloudflare? Is it a technical issue, or does the owner of archive.is have some kind of grudge against them?
- stevekemp 8y ago
  Hard to tell from the outside, but archive.is did blacklist the whole of Finland a while back - due to personal grudge.
  - wolco 8y ago
    Who runs archive.is? Sounds childish without knowing any of the facts.
    - stevekemp 8y ago
      Has some notes on the topic: https://en.wikipedia.org/wiki/Archive.today#Finland https://en.wikipedia.org/wiki/Archive.today#Finland
- altfredd 8y ago
  Cloudflare uses "privacy" and "caring about users" as excuses to sabotage competing CDNs (including whatever CDN is used by archive.is). Most recursive DNS severs on Internet can be categorized in two groups: local DNS servers, offered by Internet providers to their users, and enormous "generic" DNS like Google's 8.8.8.8. When someone makes a DNS request to those servers, they will in turn forward it to DNS servers of web page you are requesting. Content Delivery Networks use DNS to determine, which server should serve your request: if your DNS request arrived from Africa, CDN's DNS server will return IP in Africa. Of course, _users_ don't send DNS requests to CDN's server — recursive DNS servers do. In the past almost everyone used DNS, offered by their Internet provider, — CDN's had to use GeoIP or even static lists of providers to determine origin of that request. When world-wide DNS servers like Google's 8.8.8.8 started to gain popularity, that approach was broken, so EDNS was developed. Cloudflare is a CDN. They are selling their CDN services for money. At the same time they are encouraging end users to use free DNS server, that does not support EDNS on purpose (they admit so on their website). In effect they are creating a situation, when competing CDNs are at disadvantage and can't determine, what country user comes from. Cloudflare itself does not suffer from that disadvantage, because they control both 1.1.1.1 and DNS, used by their clients' websites.

ikeboy 8y ago

Looks like it's a known issue https://community.cloudflare.com/t/archive-is-error-1001/18227/4 https://community.cloudflare.com/t/archive-is-error-1001/182..., yet not been fixed for at least a year

floatingatoll 8y ago
In response to that "unfixed" issue, they noted - in a timely manner, last year - that archive.is is returning bad IPs to them, which is preventing them from serving good IPs: https://community.cloudflare.com/t/archive-is-error-1001/18227/3 https://community.cloudflare.com/t/archive-is-error-1001/182... > Nameservers responsible for archive.is (ben.archive.is, anna.archive.is) are returning answers tailored to the IP address of the requestor. And indicate that anyone who knows how to contact archive.is can ask them to resolve the issue: > If you have a contact on the domain owner, you can ask them to fix this. EDIT: This is knowingly blocked by archive.is. Reasoning and discussion elsewhere in post comments. No need to contact archive.is about it, they’re clearly aware.
- ikeboy 8y ago
  Just like we consider it the kernel's fault if user applications break due to a change, I think it's the DNS resolver's fault if they're using a protocol that some popular sites don't support. As soon as I realized they were causing this issue I just switched away. Other DNS providers don't have this issue.
  - akerl_ 8y ago
    It doesn’t really seem to be the resolvers “using a protocol that [archive.is] doesn’t support”; it seems that archive.is responds to queries from Cloudflare’s systems with an incorrect response. How is Cloudflare meant to work around that kind of behavior?
    - ikeboy 8y ago
      https://twitter.com/archiveis/status/999788186904576002 https://twitter.com/archiveis/status/999788186904576002 claims that cloudflare isn't supporting a protocol that would enable it to work with their servers.

systemcluster 8y ago

Previous discussion here: https://news.ycombinator.com/item?id=17742457 https://news.ycombinator.com/item?id=17742457

deleted 8y ago

[deleted]

netsharc 8y ago

TIL that Cloudflare is (Edit: was, article is a few years old) Nazi-friendly anyway... https://www.sfchronicle.com/business/article/How-San-Francisco-s-Cloudflare-helps-serve-up-11122855.php https://www.sfchronicle.com/business/article/How-San-Francis... > Cloudflare also has an added appeal to sites such as the Daily Stormer. It turns over to the hate sites the personal information of people who criticize their content. For instance, when a reader figures out that Cloudflare is the Internet company serving sites like the Daily Stormer, he or she sometimes write to the company to protest. Cloudflare, per its policy, then relays the name and email address of the person complaining to the hate site, often to the surprise and regret of the person complaining. > This has led to campaigns of harassment against those writing in to protest the offensive material. People have been threatened and harassed. [...] > Andrew Anglin, the owner of the Daily Stormer, has been candid about how he feels about people reporting his site for its content. > “We need to make it clear to all of these people that there are consequences for messing with us,” Anglin wrote in one online post. “We are not a bunch of babies to be kicked around. We will take revenge. And we will do it now.”

darawk 8y ago
...you know that Cloudflare terminated their service, right? https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/
- fmhul 8y ago
  And even if they hadn't, how would that make them "Nazi-friendly"? I've always supposed Cloudflare is meant to be neutral. They only kicked out DS because they were stupid enough to pretend CF was endorsing them. And well, in any case this is unrelated to this thread...
dang 8y ago
"Eschew flamebait. Don't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

irtefa 8y ago

This has been a known issue for a while. Unfortunately, Archive.is has to fix it from their nameservers and we cannot do anything from our side. You can ready more about it here: https://community.cloudflare.com/t/archive-is-error-1001/18227/8 https://community.cloudflare.com/t/archive-is-error-1001/182... Disclaimer: I work at Cloudflare

9HZZRfNlpR 8y ago
The person or persons running the site have a history of very stubborn behaviour. I do appreciate the service they are running. One time they blocked the whole Finland because the owner had problems with customs and somehow related the incident with Russia while saying Finnish gov and bur businesses can never be independent.

deleted 8y ago

[deleted]

miyuru 8y ago

Cloudflare DNS does not support EDNS Client Subnet[1], so archive.is returns invalid IP address for Cloudflare IPs[2] [1] https://developers.cloudflare.com/1.1.1.1/nitty-gritty-details/ https://developers.cloudflare.com/1.1.1.1/nitty-gritty-detai... [2] https://twitter.com/archiveis/status/1018691421182791680 https://twitter.com/archiveis/status/1018691421182791680

judge2020 8y ago

The problem is the archive.is (and other TLDs) server not returning any Good IP if the EDNS client subnet isn't present. Would like to point out that Cloudflare's resolver is EDNS compliant, it just doesn't send the client subnet. See: https://twitter.com/archiveis/status/1018691421182791680 https://twitter.com/archiveis/status/1018691421182791680 (picture of tweet https://aws1.discourse-cdn.com/cloudflare/optimized/3X/8/2/82f80904fab6661263389595d60ef7d9b7f16eaa_2_442x500.png https://aws1.discourse-cdn.com/cloudflare/optimized/3X/8/2/8... ) Based on that tweet, the owner has a personal grudge against Cloudflare and is choosing to return bad results.

floatingatoll 8y ago
Text of tweet by @archiveis: "Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as invalid.
- arghwhat 8y ago
  For additional context, here is the Cloudflare explanation about EDNS client subnets: > EDNS Client Subnet > >1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers. Cloudflare's requests are of course perfectly valid, with @archiveis actively deciding not to service them.
  - zzzcpan 8y ago
    It has nothing to do with privacy, as the next thing following DNS resolution is establishing a TCP connection which always leaks full IP address to the same person or organization controlling authoritative servers. Basically EDNS is just a convenient way for DNS-based CDNs to provide a better edge node. But this is directly competing with Cloudflare, so Cloudflare invents excuses not to implement something that helps other CDNs.

Jerry2 8y ago

I tried Cloudflare's DNS for a week or so and noticed lots of sites that were blocked. I ended up creating my own DNS server that I run on a VPS.

LogicX 8y ago

For those curious about what is going on here... Cloudflare has decided for privacy reasons they will not relay eDNS0 client subnet data - which yes, can reveal a portion of the IP of the requestor - but is used by CDN services in order to provide nearest servers or (in some cases) country specific content. My guess here is archive.is feels they have some need to restrict what content is provided to where in the world, and as a result, without ECS in the request, takes you to a cname which essentially null routes you back to your local loop interface. Source: Founder of DNSFilter.com - we support ECS, I coded it.

Thorrez 8y ago
>My guess here is archive.is feels they have some need to restrict what content is provided to where in the world Couldn't that be done later, by blocking the actual HTTP TCP connections instead of blocking the DNS requests? Maybe it's an efficiency issue, that they want the higher-efficiency blocking by DNS rather than lower-efficiency blocking during HTTP TCP, but that seems a little strange to me.

eastdakota 8y ago

We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. The archive.is owner has explained that he returns bad results to us because we don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users. This is especially problematic as we work to encrypt more DNS traffic since the request from Resolver to Authoritative DNS is typically unencrypted. We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1. EDNS IP subsets can be used to better geolocate responses for services that use DNS-based load balancing. However, 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets. We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security. Those conversations have been productive and are ongoing. If archive.is has suggestions along these lines, we’d be happy to consider them.

givinguflac 8y ago
Thanks for the detailed response! I think your team is handling this the right way.
DanielDent 8y ago
An example of something that Cloudflare's approach provides some protection from: http://dnscookie.com/ http://dnscookie.com/
8y ago

darkhorn 8y ago

https://developers.cloudflare.com/1.1.1.1/nitty-gritty-details/ https://developers.cloudflare.com/1.1.1.1/nitty-gritty-detai... >EDNS Client Subnet >1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers. What does this mean?

AndyMcConachie 8y ago
https://tools.ietf.org/html/rfc7871 https://tools.ietf.org/html/rfc7871

darkhorn 8y ago

In Firefox I'm using DNS over HTTPS ( https://mozilla.cloudflare-dns.com/dns-query https://mozilla.cloudflare-dns.com/dns-query ) and there is no issue accessing archive.is. Actually I wanted to query archive.is manually but I don't know how to do it in DoH.

rmdoss 8y ago
Firefox is likely falling back to your local resolver (the default) when it can't find a domain.

v0v 8y ago

So much talk about DNS and no one suggested simple workaround for this :-) If anyone wants to use 1.1.1.1 and still access arhive.is, simply add this line to your /etc/hosts file. 134.119.220.26 archive.is

z3t4 8y ago

I don't get why people use 1.1.1.1 8.8.8.8 etc, for more then debugging. Why tell Google et.al about every site you visit !? And get slightly slower, less accurate and less resilient DNS lookups ...

gspetr 8y ago
I use it because I'd rather tell Google than my government, which is not on friendly terms with either US or Google.
NKosmatos 8y ago
Because in certain countries the ISP has to respect the legal regulations and so the DNS server provided/defined by each provider will block/redirect certain web sites. These could be torrent trackers, subtitle distribution sites, political and/or religious sites and so on... In some parts of the world alternate DNS servers allow people to access all sites :-)
- celsoazevedo 8y ago
  Not to mention that some ISPs redirect users to pages full of ads when a domain doesn't exist or use DNS to MITM users and inject ads into pages.
kermitismyhero 8y ago
Many people are otherwise using their ISP's DNS servers, which are often even worse with regards to performance and reliability. Long ago I did tech support for an ISP, and I'd say that 9/10ths of our "outages" were due to our overworked ancient DNS servers failing. I'd go off-script when I took calls during those kinds of outages, and just help people set 4.2.2.2 in their router's DNS settings the moment I saw a strong signal in the line test and hosts not resolving. Managers made snide comments about that not being the official procedure and "not displaying confidence in $ISP", but it fixed the problem.
1f60c 8y ago
I’m curious. What DNS server do you use? Or do you just memorize the IPs of the websites you want to visit? :P

sverige 8y ago

archive.org works fine with 1^4. What is the advantage of using archive.is?

Faark 8y ago
Because you usually want to use the service that has the snapshot you want to view. And that isn't always archive.org. But it is my first place to go as well.
dredmorbius 8y ago
Archive.org, the Internet Archive, and archive.is, a webpage capture service that seems to have a primary name of "Archive.today", are wholly separate concerns, offerring different services.
- jolmg 7y ago
  Interesting, I thought archive.is was an alternate domain of the Internet Archive, but it seems they are completely different people[1]. [1] https://en.wikipedia.org/wiki/Archive.today https://en.wikipedia.org/wiki/Archive.today
- sverige 7y ago
  Yes, but what is the difference between the two? That's really my question. Sorry if it wasn't clear.

agumonkey 8y ago

oh I thought my local pdns instance was misconfigured.. interesting

rmdoss 8y ago

Archive.is is very interesting. I was checking and they block (by responding back with 127.0.0.3): - 1.1.1.1 - Neustar DNS - AdGuard DNS But they don't block Quad9 or CleanBrowsing that also do not send the EDNS subnet. Very curious way of blocking itself out of the Internet. OpenDNS blocks it (sends to their block page): https://dnsblacklist.org/?domain=archive.is https://dnsblacklist.org/?domain=archive.is Would love to hear from someone from archive.is what is going on.

jsizzle 7y ago

Why doesn’t archive.is return a valid alternate IP for DNS queries that don’t have the EDNS0 information? They can host an apology page on that IP that tells the user why they aren’t getting the content they are looking for and suggest solutions for using a different open DNS service if the user is willing to use one that provides their client subnet.