4 ms·

In general, yes, that solves the problem for local domains. But anyone who needs to do anything at all complicated is going to have trouble with this, not just

In general, yes, that solves the problem for local domains. But anyone who needs to do anything at all complicated is going to have trouble with this, not just Pi-Hole users. For example, take your average John Doe who uses Firefox. Not particularly technically competent. A new version of Firefox comes out, and all the Archive.is domains break. Who does he blame for that, and how does he solve the problem? What's happening behind the scenes is that Firefox switched his DNS address on him without warning. And Cloudflare (the DNS endpoint used by Firefox by default) returns incorrect IP addresses for the Archive.is domains (because the admin of these domains returns fake addresses to Cloudflare from their authoritative DNS server). Most people are using DNS provided by their ISP, so they haven't seen this problem before. I know about the problem, and my resolver (Unbound) is set to use Cloudflare over TLS for most requests, but sends Archive.is domains to Google's DNS instead. This solves the problem for me. Firefox switching to Cloudflare by default not only breaks sites like this for the average user, it even breaks my workaround that fixes the problem. (I can't currently reproduce the problem, so maybe Archive.is caved and started sending working IP addresses. But it's the sort of problem that can happen when you start messing around with DNS. Your users will blame you if a site doesn't load in your browser, but works in other ones.)

mrpopo 7y ago
> the admin of these domains returns fake addresses to Cloudflare from their authoritative DNS server Why?
- waterfowl 7y ago
  some prior discussion for context -- https://news.ycombinator.com/item?id=19828317 https://news.ycombinator.com/item?id=19828317
- bscphil 7y ago
  They have a beef with Cloudflare over Cloudflare removing EDNS Client Subnet for privacy reasons.
barsonme 7y ago
> the admin of these domains returns fake addresses to Cloudflare from their authoritative DNS server Well, this explains why Archive.is never works...
shawnz 7y ago
And if it happened to be that Archive.is actually had a beef with John Doe's ISP, who's to blame for that default getting picked?
- bscphil 7y ago
  Not Mozilla.
  - shawnz 7y ago
    So in that situation, would Mozilla then be the good guys by adopting DoH and fixing the user's broken network level DNS? So basically whether Mozilla is doing the right thing or not here is entirely dependent on who the archive.is operators decide to target? What about all the services that will be fixed for users after Mozilla makes this change, due to poorly operated DNS from the provider?
    - bscphil 7y ago
      Nah, the lesson is that users are going to blame you when you make low level arbitrary changes that break things when they're not capable of knowing about and fixing the technical problems that arise. The fact that a change might accidentally fix problems sometimes isn't a counter example to that general principle.
      - shawnz 7y ago
        Even when the possibility of things getting fixed is substantially more likely than the possibility of things getting broken? By default Firefox will fall back to the network resolver if DoH can't get the results, so the only way that a situation like this could happen is if someone purposely sabotages the DoH results like with archive.is. Furthermore, what you are saying could basically be used to rationalize putting any kind of potentially breaking change behind an off-by-default configurable. Do you think the web would be the sophisticated application platform it is today if browser vendors actually had that philosophy? Would that actually be better for John Doe, to make them have to learn about the technical aspects of every new web technology before they are able to take advantage of them?

mrpopo 7y ago

> the admin of these domains returns fake addresses to Cloudflare from their authoritative DNS server Why?

waterfowl 7y ago
some prior discussion for context -- https://news.ycombinator.com/item?id=19828317 https://news.ycombinator.com/item?id=19828317
bscphil 7y ago
They have a beef with Cloudflare over Cloudflare removing EDNS Client Subnet for privacy reasons.

barsonme 7y ago

> the admin of these domains returns fake addresses to Cloudflare from their authoritative DNS server Well, this explains why Archive.is never works...

shawnz 7y ago

And if it happened to be that Archive.is actually had a beef with John Doe's ISP, who's to blame for that default getting picked?

bscphil 7y ago
Not Mozilla.
- shawnz 7y ago
  So in that situation, would Mozilla then be the good guys by adopting DoH and fixing the user's broken network level DNS? So basically whether Mozilla is doing the right thing or not here is entirely dependent on who the archive.is operators decide to target? What about all the services that will be fixed for users after Mozilla makes this change, due to poorly operated DNS from the provider?
  - bscphil 7y ago
    Nah, the lesson is that users are going to blame you when you make low level arbitrary changes that break things when they're not capable of knowing about and fixing the technical problems that arise. The fact that a change might accidentally fix problems sometimes isn't a counter example to that general principle.
    - shawnz 7y ago
      Even when the possibility of things getting fixed is substantially more likely than the possibility of things getting broken? By default Firefox will fall back to the network resolver if DoH can't get the results, so the only way that a situation like this could happen is if someone purposely sabotages the DoH results like with archive.is. Furthermore, what you are saying could basically be used to rationalize putting any kind of potentially breaking change behind an off-by-default configurable. Do you think the web would be the sophisticated application platform it is today if browser vendors actually had that philosophy? Would that actually be better for John Doe, to make them have to learn about the technical aspects of every new web technology before they are able to take advantage of them?