5 ms·

Text of tweet by @archiveis: "Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent leve

Text of tweet by @archiveis: "Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as invalid.

arghwhat 8y ago
For additional context, here is the Cloudflare explanation about EDNS client subnets: > EDNS Client Subnet > >1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers. Cloudflare's requests are of course perfectly valid, with @archiveis actively deciding not to service them.
- zzzcpan 8y ago
  It has nothing to do with privacy, as the next thing following DNS resolution is establishing a TCP connection which always leaks full IP address to the same person or organization controlling authoritative servers. Basically EDNS is just a convenient way for DNS-based CDNs to provide a better edge node. But this is directly competing with Cloudflare, so Cloudflare invents excuses not to implement something that helps other CDNs.
  - judge2020 8y ago
    See the CEO's comment: https://news.ycombinator.com/item?id=19828702 https://news.ycombinator.com/item?id=19828702 > We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1. So it's not just "Cloudflare benefits from pushing anycast" (even if that's part of it).
    - zzzcpan 8y ago
      So, what he claims is that state actors monitor traffic at certain locations, extract subnet information from DNS packets that only large centralized DNS resolvers include when query some authoritative servers that where probed to support that feature. That subnet is not a subnet of an end user IP address, but an IP address of a recursive resolver of that user's ISP. They have to correlate that information with a connection made from that ISP to a web server to track the user. What 1.1.1.1 brings here? State actors now can correlate an actual IP address sending data to 1.1.1.1, with a clear text DNS query going out of it, making tracking more reliable and simple and worse for privacy. And still worse for other CDNs. Don't take Cloudflare's PR seriously, they are completely full of it. They used to be more honest, but those days are long gone.
      - MrStonedOne 8y ago
        1.1.1.1 supports dns/https. It is entirely possible to make a request to 1.1.1.1 for an ip and have nobody be able to know what you made the request for. There is no guarantee the name server they are querying is the same as the server in the A result, and the idea is to reduce the number of points where people other than the A result and the client know that they plan to talk to each other. It's not bullshit.
        zzzcpan 8y ago
        > There is no guarantee the name server they are querying is the same as the server in the A result That's ok. Let me try to explain a bit more: Queries to 1.1.1.1 are going over public internet. And even though they are encrypted, they also carry metadata with them, including IP addresses of who is doing them, precise time, rough size, various OS specific stuff, etc. And packets going out to authoritative servers from 1.1.1.1 are in clear text. There is a very tiny window of possible queries out of 1.1.1.1 for encrypted data coming in from some IP address and therefore only a tiny number of possible responses from authoritative servers. Given that and enough intercepted data all over the world it is easy to correlate clear text DNS responses with IP addresses or who got responses from cache and on which popular website ended up, etc.
        8y ago
  - codexon 8y ago
    That's not true. Many setups proxy everything but dns traffic. That's why this topic is a thing. https://trac.torproject.org/projects/tor/wiki/doc/Preventing_Tor_DNS_Leaks https://trac.torproject.org/projects/tor/wiki/doc/Preventing...
  - tambre 8y ago
    The fallback should be to do GeoDNS based on the resolver's IP. In case of Cloudflare that's certainly good enough, since they've got 150+ POPs.
  - stordoff 8y ago
    > the next thing following DNS resolution is establishing a TCP connection which always leaks full IP address to the same person or organization controlling authoritative servers Depends who runs the authoritative servers - if you hit the authoritative DNS services for most of my domains, you are providing your information to 123-Reg (or, increasingly, Google), if you start a TCP connection, you are providing it to me.
viraptor 8y ago
> requests come from causes so many troubles Given they serve their pages over tor, I don't buy that explanation at all. Assuming location of client == location of CloudFlare source would give them a rough match in most cases. In tor they're almost guaranteed to be wrong.
Aeolun 8y ago
Ah yes, the huge trouble of a website that is a few MS slower as opposed to just not working at all. I’m not sure I see what kind of logic goes into this argument.

arghwhat 8y ago

For additional context, here is the Cloudflare explanation about EDNS client subnets: > EDNS Client Subnet > >1.1.1.1 is a privacy centric resolver so it does not send any client IP information and does not send the EDNS Client Subnet Header to authoritative servers. Cloudflare's requests are of course perfectly valid, with @archiveis actively deciding not to service them.

zzzcpan 8y ago
It has nothing to do with privacy, as the next thing following DNS resolution is establishing a TCP connection which always leaks full IP address to the same person or organization controlling authoritative servers. Basically EDNS is just a convenient way for DNS-based CDNs to provide a better edge node. But this is directly competing with Cloudflare, so Cloudflare invents excuses not to implement something that helps other CDNs.
- judge2020 8y ago
  See the CEO's comment: https://news.ycombinator.com/item?id=19828702 https://news.ycombinator.com/item?id=19828702 > We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1. So it's not just "Cloudflare benefits from pushing anycast" (even if that's part of it).
  - zzzcpan 8y ago
    So, what he claims is that state actors monitor traffic at certain locations, extract subnet information from DNS packets that only large centralized DNS resolvers include when query some authoritative servers that where probed to support that feature. That subnet is not a subnet of an end user IP address, but an IP address of a recursive resolver of that user's ISP. They have to correlate that information with a connection made from that ISP to a web server to track the user. What 1.1.1.1 brings here? State actors now can correlate an actual IP address sending data to 1.1.1.1, with a clear text DNS query going out of it, making tracking more reliable and simple and worse for privacy. And still worse for other CDNs. Don't take Cloudflare's PR seriously, they are completely full of it. They used to be more honest, but those days are long gone.
    - MrStonedOne 8y ago
      1.1.1.1 supports dns/https. It is entirely possible to make a request to 1.1.1.1 for an ip and have nobody be able to know what you made the request for. There is no guarantee the name server they are querying is the same as the server in the A result, and the idea is to reduce the number of points where people other than the A result and the client know that they plan to talk to each other. It's not bullshit.
      - zzzcpan 8y ago
        > There is no guarantee the name server they are querying is the same as the server in the A result That's ok. Let me try to explain a bit more: Queries to 1.1.1.1 are going over public internet. And even though they are encrypted, they also carry metadata with them, including IP addresses of who is doing them, precise time, rough size, various OS specific stuff, etc. And packets going out to authoritative servers from 1.1.1.1 are in clear text. There is a very tiny window of possible queries out of 1.1.1.1 for encrypted data coming in from some IP address and therefore only a tiny number of possible responses from authoritative servers. Given that and enough intercepted data all over the world it is easy to correlate clear text DNS responses with IP addresses or who got responses from cache and on which popular website ended up, etc.
        8y ago
- codexon 8y ago
  That's not true. Many setups proxy everything but dns traffic. That's why this topic is a thing. https://trac.torproject.org/projects/tor/wiki/doc/Preventing_Tor_DNS_Leaks https://trac.torproject.org/projects/tor/wiki/doc/Preventing...
- tambre 8y ago
  The fallback should be to do GeoDNS based on the resolver's IP. In case of Cloudflare that's certainly good enough, since they've got 150+ POPs.
- stordoff 8y ago
  > the next thing following DNS resolution is establishing a TCP connection which always leaks full IP address to the same person or organization controlling authoritative servers Depends who runs the authoritative servers - if you hit the authoritative DNS services for most of my domains, you are providing your information to 123-Reg (or, increasingly, Google), if you start a TCP connection, you are providing it to me.

viraptor 8y ago

> requests come from causes so many troubles Given they serve their pages over tor, I don't buy that explanation at all. Assuming location of client == location of CloudFlare source would give them a rough match in most cases. In tor they're almost guaranteed to be wrong.

Aeolun 8y ago

Ah yes, the huge trouble of a website that is a few MS slower as opposed to just not working at all. I’m not sure I see what kind of logic goes into this argument.