4 ms·

In order for Cloudflare (or anyone) to be a part of this program they have to comply with a particular set of rules. Limiting data. Your DNS data can reveal a

In order for Cloudflare (or anyone) to be a part of this program they have to comply with a particular set of rules. Limiting data. Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not be retained for longer than 24 hours, and cannot be sold, shared, or licensed to other parties. Yes, governments can secret around this with intelligence orders, just like they can do with any of the ISPs that will keep all of the data indefinitely instead of for 24 hours.

corford 7y ago
Kind of sad when you need a private company to give your citizens the basic privacy they want (doubly so when you have to simply trust said company that the partners they are working with are honest). Maybe the US's privacy laws need a 21st Century make over?
the8472 7y ago
> just like they can do with any of the ISPs There is a 3rd option: Operating your own recursive resolver.
- kadoban 7y ago
  Doesn't that just move the problem one step away?
  - the8472 7y ago
    It removes a 3rd party that is a juicy target for TLAs. There is only you and the remote hosts that you're talking to. But yes, it would be really nice if we also had encryption between recursive resolvers and authoritative servers to remove the last place where they could harvest data.
- kyuudou 7y ago
  I've found this harder and harder over the years. My usual MOD was installing and configuring the caching-nameserver BIND package in rpm-based RHEL-downstream distros and MaraDNS in everything else. I've just kind of given up because reasons but I'm still very supportive of any of these kinds of efforts.
  - the8472 7y ago
    unbound is much easier to configure than BIND in my experience

corford 7y ago

Kind of sad when you need a private company to give your citizens the basic privacy they want (doubly so when you have to simply trust said company that the partners they are working with are honest). Maybe the US's privacy laws need a 21st Century make over?

the8472 7y ago

> just like they can do with any of the ISPs There is a 3rd option: Operating your own recursive resolver.

kadoban 7y ago
Doesn't that just move the problem one step away?
- the8472 7y ago
  It removes a 3rd party that is a juicy target for TLAs. There is only you and the remote hosts that you're talking to. But yes, it would be really nice if we also had encryption between recursive resolvers and authoritative servers to remove the last place where they could harvest data.
kyuudou 7y ago
I've found this harder and harder over the years. My usual MOD was installing and configuring the caching-nameserver BIND package in rpm-based RHEL-downstream distros and MaraDNS in everything else. I've just kind of given up because reasons but I'm still very supportive of any of these kinds of efforts.
- the8472 7y ago
  unbound is much easier to configure than BIND in my experience