26 ms·

1.1.1.1 for Families

414 points by jgrahamc 7y ago

nreece 7y ago
So '1.1.1.1 for Families' is actually 1.1.1.2 or 1.1.1.3. Bit confusing, for non-tech-savvy families. Why not just call it 1.1.1.2 (viz version 2).
- buzzerbetrayed 7y ago
  1.1.1.2 is no more confusing than 1.1.1.1 to someone who has no idea what dns is. Both are completely meaningless.
  - anamexis 7y ago
    The confusing part is that the name of 1.1.1.2 is “1.1.1.1 for families.”
    - rrix2 7y ago
      Because 1.1.1.1 is a Brand to them
      - kempbellt 7y ago
        It's just an IP to me. I see OPs point. Thinking of your IP address as a brand is confusing. At least with a word like Apple, the capital "A" designates it as a proper noun and can easily be recognized as a brand or company name in most cases.
Thaxll 7y ago
Having different DNS for different purpose is imo not a great solution for not tech people.
- throwanem 7y ago
  This is aimed at tech people who support nontechnical family members.
- iso1631 7y ago
  It's great, I can stick 1.3 on the dhcp serevr for the kids vlan and keep 1.1 on the office vlan.
  - mdszy 7y ago
    You do realize that the comment you're replying to said "not tech people", right? Do you really think a person that isn't a "tech person" would understand any of the acronyms or terms in this sentence?
    - iso1631 7y ago
      It's great for my kids, who aren't tech people.
      - rrix2 7y ago
        Okay, so non-technical households?
  - heisenbit 7y ago
    If you believe your kids can't figure out tech nor their friends friends can then maybe 1.3 may be safer on your office vlan.
    - warhorse10_9 7y ago
      If you have vlans set up at your house you might have a decent firewall that can block dns requests to unauthorized servers, so there's that.
      - iso1631 7y ago
bilal4hmed 7y ago
any idea on what it means as malware?
- whatshisface 7y ago
  Or "Adult Content?"
  - woofcat 7y ago
    Adult content I think would be an easier category to filter on. However I would love it if they released the list of their blocked domains.
    - aidenn0 7y ago
      Adult content is notoriously hard to filter on since nobody can agree what qualifies, and pretty much any site with user-generated content has content that is objectionable to someone. Do you filter Wikipedia as "adult content"? Certainly one of these[1] images qualifies under most standards? 1: NSFW https://en.wikipedia.org/wiki/MediaWiki:Bad_image_list https://en.wikipedia.org/wiki/MediaWiki:Bad_image_list
      - Cyberdog 7y ago
        There are lots more examples than Wikipedia, although that's a good one. Reddit, Twitter, and YouTube are other examples where you can find adult content if you're looking for it, but if you block the whole site, you block a whole bunch of useful and in some cases educational content along with it. Now all that being said, this is a decent enough way to at least block the obvious stuff like Pornhub. For some, that might be good enough.
      - aurbano 7y ago
        Well this was one rabbit hole I would've preferred not to have visited...!
      - petronio 7y ago
deleted 7y ago
[deleted]
pergadad 7y ago
Adult content - is this * Just porn * Erotic content (eg lingerie shops) * Any sexual content (eg Wikipedia article on anal sex) * Or also e.g. medically relevant (sex ed, abortion provider sites, ...) * Gore, violence, videos of people dying ... * Information on or shops for drugs * Content on terrorism, weapons, manuals to build bombs * Content on Al Qaeda, Scientology and other extreme/dangerous religious stuff * ... ?
- ainiriand 7y ago
  Things that are not for kids. I think it is a broad category. What element is not fitting there for you?
  - Kuraj 7y ago
    Disclosure - I am not a parent. But blocking your kid from having access to sexual education does not sit right with me, and I can imagine how they might not have proper sex ed at school or not be comfortable discussing it with their parents.
    - lallysingh 7y ago
      I think the answer is different if the kid is 5 or 15.
      - notRobot 7y ago
        5 year olds shouldn't have unrestricted access to the internet anyway. For children that young you should be using whitelists, not blacklists.
  - deleted 7y ago
    [deleted]
  - detaro 7y ago
    So is wikipedia supposed to be blocked or not? Twitter? Reddit?
  - 7y ago
jawns 7y ago
I'd love to hear the pros/cons of filtering adult content at the DNS resolver level. I'm assuming the (current) lack of whitelists, along with a black-box algorithm to decide what constitutes adult content, reduces the usefulness.
- JdeBP 7y ago
  The pros are obvious. The cons, irrespective of what is blocked, are very similar to the problems with DNS hijacking that ISPs and others have done over the years. It affects all protocols, not just HTTP(S). It affects everything from turning IP addresses in logfiles into domain names, through double-reverse-lookup checks in TCP services, to SMTP electronic mail. Block advertising this way, and one hits the further problem that one often wants to operate based upon more than just the domain part of the URL. Or one wants to do things like make temporary redirects to static placeholder images. Fiddling with DNS service cannot achieve these. * http://jdebp.uk./FGA/verisign-internet-coup.html http://jdebp.uk./FGA/verisign-internet-coup.html
ryandvm 7y ago
Sadly, the trend for browsers to bypass system-level DNS resolution in favor of DNS-over-HTTPS means this kind of filtering is quickly becoming obsolete.
- moviuro 7y ago
  There is a canary domain in Firefox to prevent it from switching to DoH: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
  - warhorse10_9 7y ago
    You could also user a policy.json for Firefox to permanently disable it. I don't see Firefox dropping this option as it is important for enterprise users. https://github.com/mozilla/policy-templates https://github.com/mozilla/policy-templates
  - tssva 7y ago
    1.1.1.1 for Families doesn't seem to support the canary domain so by default Firefox would bypass this service. Also the canary domain only works if Firefox is not explicitly set to use DoH. If using DoH has explicitly been set by the user than the canary domain has no effect. Edit: Some testing seems to show that Mozilla has lumped these in with a select few others and will not bypass them when DoH is the default instead of explicitly selected even though they don't report the canary domain as an error. It will bypass them when DoH is explicitly enabled.
- woofcat 7y ago
  They offer this service as DoH as well. So in theory you could configure those apps to leverage this.
therealmarv 7y ago
Stopped using Cloudflare's DNS some weeks ago. I got from time to time errors (no page showing, forgot the exact error message) which never happened with Google's DNS. FYI I'm using DoT (DNS over TLS) on the router exclusively and I'm not living in USA.
- jgrahamc 7y ago
  Did you report this to us? Would be interested to know why.
  - hmahncke 7y ago
    (I’m not the OP) My experience was that 1.1.1.1 didn’t interact well with captive.apple.com so I had a lot of confusing experiences on planes and airports, and eventually had to stop using it.
    - zackbloom 7y ago
      How long ago was that, if I can ask?
  - therealmarv 7y ago
    Op here. No, never reported it. But I think I've read somewhere (this is only unvalidated speculation now) that Google DNS and regular DNS do more fallbacks and are working also with not well configured DNSes where as Cloudflare is more strict but I don't have time to validate that. For me it's easier to just switch my DNS and go on.
- vxNsr 7y ago
  If you had any cisco hardware in your network stack that is likely the reason. Our company's captive portal still takes you to 1.1.1.1
- propogandist 7y ago
  Why not use 9.9.9.9 ? The project is from IBM and few other companies, and includes threat data from major players in the security space Https://quad9.net
ddevault 7y ago
This would have been better if it was a joke. Big welcome to our new moral police, now encoded in two bits of a vanity IP address! Not a word spared for what kind of content is filtered, how they evaluate websites, any kind of appeals process... they did manage to portray it as helping the COVID-19 pandemic relief, though. Edit: I missed this text: > In the coming months, we will provide the ability to define additional configuration settings for 1.1.1.1 for Families. This will include options to create specific whitelists and blacklists of certain sites. You will be able to set the times of the day when categories, such as social media, are blocked and get reports on your household's Internet usage. Regardless, I am still opposed to this service, and opposed to all forms of internet censorship and spyware. CloudFlare is already really bad for the internet, and this isn't helping their case.
- benatkin 7y ago
  Any domain that hosts user uploaded content is gonna be banned, unless they're big like twitter or facebook. This is the worst. I'm glad I never gave Cloudflare a dime.
- junaru 7y ago
  Policing content is nothing new for Cloudflare, the 8chan events showed just how easily they succumb to public pressure.
  - meowface 7y ago
    After the second or third (people debate if the third originated there) white supremacism-motivated mass shooting was announced on one of their many "National Socialist" boards shortly before it took place, with the owners refusing to do anything about it, removing them as a customer is more than understandable. The original creator (Hotwheels) had vehemently disavowed and condemned the site and its owners at that point. Aside from the business impact of tons of customers and the media (rightfully) condemning Cloudflare, and all the potential legal implications, dropping them was the only ethical thing to do. I'm a staunch defender of free speech and opposer of censorship, but when people are being mass-murdered, with more people at risk of being mass-murdered in the future, it's no longer just about speech. At the time of the mass shootings, the majority of boards and posters on the site were supportive of or affiliated with violent extremism and domestic terrorism, and their admins made no efforts to curb that (even if they didn't endorse it). Show me a single US or European company who would still provide infrastructure/networking for them after that point. Considering their only two incidents of stepping in were that and The Daily Stormer, I'd say they probably have one of the best track records when it comes to freedom of speech and acting as a neutral traffic carrier.
Symbiote 7y ago
$ host www.sex.com www.sex.com is an alias for dmz01.cdn.live. dmz01.cdn.live has address 15.222.131.21 $ host www.sex.com 1.1.1.3 Host www.sex.com not found: 5(REFUSED) $ host www.nothing 1.1.1.3 Host www.nothing not found: 3(NXDOMAIN) I hadn't noticed a DNS REFUSED response before. That seems reasonable, although a web browser's error message doesn't differ between REFUSED and NXDOMAIN.
- andyjpb 7y ago
  The error may differ if the zone is signed with DNSSEC. NXDOMAIN is a valid response that won't pass a signature verification. REFUSED just means that DNS Server can't or won't provide a response at this time.
  - psz 7y ago
    "Can't provide a response" should be SERVFAIL.
ChrisArchitect 7y ago
ha, had to include a "this is not a joke" April Fool's disclaimer at bottom. Why not just release it tomorrow?
- ajay-d 7y ago
  I think tradition, 1.1.1.1 was released on April 1st (4/1, four one).
- Hamuko 7y ago
  Launching 1.1.1.1 stuff on April first has been kinda their marketing strategy for the 4 x 1 factor.
bedah 7y ago
"No Advertisement and No Tracking" would be nice. Right now I keep Web Advertisment low with a manually installed anti-advertisement hosts file.
- specto 7y ago
  Check out nextdns (pi-hole like service)
vowelless 7y ago
My friends who grew up in the middle east: Remember how our ISPs used to block "adult content". Did that stop anyone? It just lead to repression and a black market. On the bright side, circumventing those blocks as a kid got me interested in computers in the first place. Regardless, it is an interesting service. I would imagine that corporations, who have the tech support and need, will find this more useful than non-technical families. Examples: https://www.vpn-accounts.com/blog/how-to-open-blocked-sites-in-saudi-arabia-2/ https://www.vpn-accounts.com/blog/how-to-open-blocked-sites-... https://www.jakarta100bars.com/2019/10/porn-websites-blocked-dubai-uae-unblock.html https://www.jakarta100bars.com/2019/10/porn-websites-blocked...
- thomascgalvin 7y ago
  > On the bright side, circumventing those blocks as a kid got me interested in computers in the first place. Porn really is the driver of many technical innovations. Home movies and online financial transactions, for example, wouldn't be where they are today if people weren't so dedicated to watching other people smush.
rshurts 7y ago
While anyone technical can easily get around DNS filter it is a nice option for helping prevent accidental exposure to pornography. I'm looking forward to when the customization options are available as an alternative/addition to OpenDNS. The morality police argument doesn't seem to hold much water if they are going to let you whitelist or blacklist anything you want or turn categories on or off.
- basch 7y ago
  Have you used https://nextdns.io/ https://nextdns.io/ ?
  - rshurts 7y ago
    No. But I'll have to check it out. Do you use it and the mobile apps? Do you have problems with connecting to public wifi when running the app? I've noticed setting the DNS locally on a computer throws off the local library wifi that has the captive page that makes you agree to terms before proceeding.
    - basch 7y ago
      On Android I set it as custom DoH. Have not used the app. Unfortunately, as with all DNS based blocking, you run into random pages that dont resolve, and need to turn it off. Due to the infinitely many knobs, I dont know which list is blocking it from the error page, just that the page cant be founbd. Yesterday it was http://www.futureus.com/ http://www.futureus.com/
- tootie 7y ago
  I can imagine some impatient parents will start black listing Kidz Bop videos or anything else that bothers them. It will also lead to some very creative punishments. Like blocking online gaming.
  - 411111111111111 7y ago
    some work without dns though! battle.net comes to mind... that always connected, even if my providers DNS failed.
imafish 7y ago
Nice April's fool. :) Edit: Ok, I guess not. But how?
kick 7y ago
On one hand, this is really ridiculous. On the other hand, it might lead to the next generation of children who kick their technical careers off by figuring out how to circumvent censorship and that despise the companies enforcing it. Maybe not, though.
- tc313 7y ago
  On the other hand, my solution to subverting AOL parental controls was to... log into my mom's account.
- TechBro8615 7y ago
  You joke, but pretty sure this happened to me. I accidentally found some porn sites when I was in 3rd grade, so my mom had her police officer friend come over and install "net nanny" on my computer. Every now and then my mom would have him "check my computer." It worked for a while, but by 6th grade I wanted to find the stuff for myself. As a result, I have massive distrust of authority figures and learned very early how to circumvent technical controls...
- k3liutZu 7y ago
  My dad at some point put a password on the BIOS to restrict my PC usage. That's when I learned the motherboard has a standard "watch" battery which when taken out does reset all of the BIOS' settings.
andrewjf 7y ago
I have unbound at my house providing normal DNS -> DoH to Cloudflare DNS. I don't see any IPv6 endpoints published for the 1.1.1.2 and 1.1.1.3 equivalents, do they exist?
- irtefa 7y ago
  You can see the IPv6 addresses here: https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/ https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-famili... For malware: * 2606:4700:4700::1112 * 2606:4700:4700::1002 For malware and adult: * 2606:4700:4700::1113 * 2606:4700:4700::1003
msla 7y ago
$ host www.glaad.org 1.1.1.3 Using domain server: Name: 1.1.1.3 Address: 1.1.1.3#53 Aliases: Host www.glaad.org not found: 5(REFUSED) Looks like some things don't change. This is the kind of shit Peacefire was exposing back in the 1990s: Completely innocuous GLBTQ+ content being labeled as "inappropriate" by content censors. And Cloudflare doesn't even have the figleaf excuse of having a financial incentive to dance to the tune of the kinds of people who think GLAAD is somehow inherently bad. http://www.peacefire.org/ http://www.peacefire.org/ Also: $ host www.peacefire.org 1.1.1.3 Using domain server: Name: 1.1.1.3 Address: 1.1.1.3#53 Aliases: www.peacefire.org is an alias for peacefire.org. peacefire.org has address 65.181.125.58 peacefire.org mail is handled by 10 mail.peacefire.org. This verges on the comedic.
- Symbiote 7y ago
  Even worse: Host www.thetrevorproject.org not found: 5(REFUSED) That's a site for teenagers with "trained counselors are here to support you 24/7. If you are a young person in crisis, feeling suicidal, or in need of a safe and judgment-free place to talk, call …" It's also exactly the type of site that's first on the list of examples of what not to block, by any privacy / anti-censorship group. It should have been an easy test before launching.
  - dknecht 7y ago
    This should definitely not be the case. We are getting this fixed. We will have a reporting page up shortly to also make it easier to report these type of issues.
    - dknecht 7y ago
      This has been fixed.
      - Symbiote 7y ago
        That is impressively fast! There's a site run by the Open Rights Group in the UK, recording incorrect blocks made by ISP-provided "parental control" filters. They already check against OpenDNS, so I assume they'll add 1.1.1.3. There are lists of overblocked domains: https://www.blocked.org.uk/stats https://www.blocked.org.uk/stats
yalogin 7y ago
I have little kids and don’t want them to accidentally stumble onto malware or porn sites. But I still don’t like this kind of policing happening at the DNS layer. Even more do given his their previous service became a huge success. Btw I see some resemblance with google here. Initially they were all “do no harm”. Only after they captured the whole market we realized we shouldn’t have succumbed to free shit. These guys are following the same model. Give free shit and get traffic, even though they lose money. They themselves claim they only charge businesses not consumers.
- rshurts 7y ago
  > I have little kids and don’t want them to accidentally stumble onto malware or porn sites. But I still don’t like this kind of policing happening at the DNS layer. Where do you set up the filtering or accountability? With so many connected devices in houses I've found DNS is common denominator. It's perhaps the easiest to circumvent, but it covers all the mobile devices, gaming consoles, etc. that are connected to my home network. My kids are too young to circumvent things, but if they start doing that I'll be equal parts proud and preparing for a loving talk.
  - mgalgs 7y ago
    Right, and IMHO by the time they're old enough to start circumventing the filters then they're old enough to see the content. It's a self-enforcing gate. You're not mature enough to see the content until you're mature enough to circumvent the filters :D
- ensignavenger 7y ago
  DNS seems like a good place for this sort of use case. It prevents accidental access while making it easy for anyone who is sufficiently inclined to circumvent it.
seemstome94 7y ago
Thanks Cloudfare, I wouldn't know what a family is without you also pushing the brown man / White woman (with hybrid child) trope in current year.
amelius 7y ago
Why are the people in the illustrations missing eyes?
- seemstome94 7y ago
  So that they can push the race mixing narrative without being too overt. The brown man might not be so racially ambiguous with facial detail.
- rjrjr5699 7y ago
  So that they can push the ubiquitous race-mixing rubbish without being too overt. The brown man might not be so racially ambiguous with facial detail.
vbezhenar 7y ago
Filtering out ad websites would be more useful for me. I'm using https://pgl.yoyo.org/adservers/ https://pgl.yoyo.org/adservers/ with my own DNS, but probably big website like Cloudflare could block even more ad websites.
mantlepro 7y ago
> Cloudflare's business has never involved selling user data or targeted advertising The cloudfare site calls googletagmanager.com, marketo.com, linkedin.com, and bizible.com. Do any of these sell user data or support targeted advertising?
aaron695 7y ago
> Adult Content They don't understand the political world they just entered. Or the amount of work this will take. They have to take a stance so many political issues from here. From a company that prided itself on non-censorship (Minus two cases). This is easy, twice they have broken and been hated for it. Now, the twitter campaigns that will smash them on everything, in a sustained way.....
- JensRex 7y ago
  Cloudflare has never been anti-censorship. This kind of service fits them like a glove. They're going to love being the moral police.
gpvos 7y ago
I read two pages before I realized this was obviously an April 1 joke. Then I got to the "Not A Joke" section. What??? I don't think Cloudflare should be in this business. Also, how are they going to make this configurable like they write? Tie the configuration to the IP address? What if someone has a shared or dynamic IP address?
- djrogers 7y ago
  > Also, how are they going to make this configurable like they write? Tie the configuration to the IP address? What if someone has a shared or dynamic IP address? Likely the same way as opendns, nextdns, and a ton of other dns providers who do the same. It's for home use - if it doesn't fit your home use case, then use another filter.
  - gpvos 7y ago
    Thanks. Interesting, I had no idea this was so much of a thing already.
stabbles 7y ago
On Android you have to specify a hostname for DNS (a bit ironic), which is 1dot1dot1dot1.cloudflare-dns.com. However, it does not seem 1dot1dot1dot3.cloudflare-dns.com works yet.
nimbius 7y ago
this seems like a disturbing trend for the company that often championed the idea of a free and open internet. First they dropped the Daily Stormer as a customer, then 8chan, then chimpmania which was terminated with a change.org petition. Now we have a new service no one asked for that seeks to block lewd websites and "malware"? Whats changed? did Matthew prince suddenly give up on free speech? or is it just another way to identify a target demographic.
rudolph9 7y ago
I was a little put off by this at first but can see why people want it and happy they offer isolated malware filter (what ever that means, still skeptical) and adult + malware filter.
zuck9 7y ago
YouTube says "Some results have been removed because Restricted Mode is enabled by your network administrator." when I'm on the Family DNS. How does this work? How can they know what DNS I'm using?
- filleokus 7y ago
  Huh! Did some quick Googling: > YouTube Restrict works by re-mapping YouTube IP addresses to the CNAME restrict.youtube.com (or restrictmoderate.youtube.com). It means that instead of visiting YouTube at their normal IP addresses, you will re-route the traffic to a special load balancer provided by Google that will block access to non children friendly videos. I did not know about that https://cleanbrowsing.org/articles/block-youtube-comments-restricted-mode https://cleanbrowsing.org/articles/block-youtube-comments-re...
  - deleted 7y ago
    [deleted]
TheCapn 7y ago
CIRA doing the same thing: https://www.cira.ca/earlyaccess https://www.cira.ca/earlyaccess
anilgulecha 7y ago
If we get a 1.1.1.4 with all of easylist ad blocked.. that would be smashing! Pi-hole for the internet.
abakker 7y ago
As a general response to negativity here (which seems to largely stem around technical concerns over what is implemented and how), I think this is cool and fine. As a kid I would have figured out a way to get around this, and that would have been part of the fun, but, this option adds more choice to the market and that is a good thing.
tinalumfoil 7y ago
DNS isn't appropriate for filtering porn or ads. It's easy to get around and not fine-grained enough. In fact, the largest porn site in the world is unblocked. $ dig @1.1.1.3 reddit.com reddit.com. 298 IN A 151.101.65.140 And the largest advertising and tracking site. $ dig @1.1.1.3 pagead2.googlesyndication.com pagead2.googlesyndication.com. 262 IN CNAME pagead46.l.doubleclick.net. pagead46.l.doubleclick.net. 262 IN A 172.217.7.2
- fenwick67 7y ago
  Yup I was just thinking "where could you easily wander into NLS content" and my first thought was Reddit.
- tomschlick 7y ago
  I'm surprised Reddit hasn't gone the way of Google/YouTube and allowed a safe browsing filter via DNS. All NSFW subreddits are already marked as such (same with many individual posts) so it seems like it would be an easy filter to add if accessed via the "safe browsing" load balancer IP. Edit: Someone below added more info on this for anyone curious: https://cleanbrowsing.org/articles/block-youtube-comments-restricted-mode https://cleanbrowsing.org/articles/block-youtube-comments-re...
  - sneak 7y ago
    Reddit also has a flag inside of their api called `nsfb`: Not Safe For Brand. They'll let you post it, and they'll host it, but they don't want most people to know that they'd host it, so they hide it from public, not-logged-in sections of the site. It's really shameful; they need to stop the hypocrisy and either become a content-neutral host and own the consequences, or censor arbitrarily, and own the consequences. They're trying to have their cake and eat it too, and it's entirely unfair, much in the same way shadowbanning is.
    - BoorishBears 7y ago
      What is shameful about it? It's a realistic approach to navigating the real world where there are bills to pay, Reddit Gold isn't going to cut it, and advertisers don't want their brand associated with random NSFW/NSFL content. I don't get this obsession with browbeating every content provider not living up to these Stallmanistic extremes. Reddit should not have to give up any sort of protection for allowing advertisers to not have their ads show up on certain subreddits, or censoring Nazis. If Reddit of all sites is what we're calling shameful, there is no hope.
anem0neone 7y ago
it's really nice to know that cloudflare for families thinks white supremacist sites like stormfront, the creative movement, national vanguard, and league of the south are family friendly. and troll sites like kiwifarms and encyclopedia dramatica are family friendly. how in athena's name did you come up with this seed list? how on earth did you not have someone review this from the get go?
- gsich 7y ago
  So? What's your point?
yarrel 7y ago
This is an excellent Twitter thread explaining in detail the problems with providing such a service for """families""" - https://twitter.com/SarahJamieLewis/status/1245374377757040640 https://twitter.com/SarahJamieLewis/status/12453743777570406...
yarrel 7y ago
"Families" is a dog whistle.
- BubRoss 7y ago
  This isn't a law, it's a feature you have to seek out.
drummer 7y ago
Where can the public see, in real time, a complete list of exactly which domains are blocked on those servers?
tcd 7y ago
I feel that transparency would be key, to understand what cloudflare considers good/bad. As we can see in this thread, there's already been a mistaken block - expect many, many more of these to come. They will be chasing their tail between their legs for years to come, and they'll only get bad PR from this. It'll be dead and buried in a year after a shit storm hits reddit
soheil 7y ago
I think an all encompassing system like this as a sort of big government watching every move we make for "our benefit". It's probably wiser to install a _tiny_ software that blocks unwanted content that you can uninstall than to give power to a giant entity monitoring every site you visit online. Sure you can change your country at an individual level but why create a problem in the first place.
deleted 7y ago
[deleted]
surround 7y ago
It’s not a good idea to trust a single large organization with your data, even if they make claims to privacy. It’s even worse to let them control what get censored and what gets through. If you care about privacy, I recommend running your own resolver with Unbound, and block ads/tracking/malware/adult content etc. using Pi-Hole. https://nlnetlabs.nl/projects/unbound/about/ https://nlnetlabs.nl/projects/unbound/about/ https://pi-hole.net/ https://pi-hole.net/
gameswithgo 7y ago
gave 1.1.1.3 a try. unfortunately it blocks things like doctors lectures on coronavirus on youtube.
- _-david-_ 7y ago
  This is DNS blocking so it would be blocking all of Youtube or none of it.
LeoPanthera 7y ago
gaycenter.org, a New York LGBTQ community center, is blocked. Stormfront is not. So. That's pretty gross.
- dpbriggs 7y ago
  I would be curious to learn more about how they classify websites. I would imagine they automatically crawl and do some basic keyword matching, so false positives are expected. Curious about stormfront though.
Corrado 7y ago
I'm a network administrator for a small private school and this seems like it would be a good solution for us. We generally try to keep the kids away from the "bad" sites and their systems are mostly locked down (managed iPads and Chromebooks). In the past we used OpenDNS for DNS filtering and it worked pretty well. Then they were purchased by Cisco and the prices went up and functionality went down. If CloudFlare can offer some management capabilities (ie. whitelist / blacklist) we would switch in a minute. I can't wait to see how this product matures.
ehutch79 7y ago
For everyone complaining about the porn filtering, That malware filtering will actually be a godsend for companies. Running an extra internal dns server just to do 'last chance' filtering is extra maintenance i don't want to have to do. I'd much rather let cloudflare do that.
dzhiurgis 7y ago
What are there other solutions for filtering content? My kid is very far from getting any screen time but my imagination always was just block everything except kids wiki and maybe some other sites (dunno yet at this point).
nottorp 7y ago
Hmm. Do they block information about breast cancer because kids shouldn't be exposed to breasts?
knorker 7y ago
Shame on you, cloudflare.
pnako 7y ago
For families of people without eyes, apparently.
totorovirus 7y ago
This is the solution that should have existed in the first place
vlkmn 7y ago
1.1.1.2/1.0.0.2 & 1.1.1.3/1.0.0.3 DNS resolvers incorrectly resolves one of India's largest banks domain name "retail.onlinesbi.com" to 0.0.0.0

414 points by jgrahamc 7y ago

So '1.1.1.1 for Families' is actually 1.1.1.2 or 1.1.1.3. Bit confusing, for non-tech-savvy families. Why not just call it 1.1.1.2 (viz version 2).

buzzerbetrayed 7y ago
1.1.1.2 is no more confusing than 1.1.1.1 to someone who has no idea what dns is. Both are completely meaningless.
- anamexis 7y ago
  The confusing part is that the name of 1.1.1.2 is “1.1.1.1 for families.”
  - rrix2 7y ago
    Because 1.1.1.1 is a Brand to them
    - kempbellt 7y ago
      It's just an IP to me. I see OPs point. Thinking of your IP address as a brand is confusing. At least with a word like Apple, the capital "A" designates it as a proper noun and can easily be recognized as a brand or company name in most cases.

Thaxll 7y ago

Having different DNS for different purpose is imo not a great solution for not tech people.

throwanem 7y ago
This is aimed at tech people who support nontechnical family members.
iso1631 7y ago
It's great, I can stick 1.3 on the dhcp serevr for the kids vlan and keep 1.1 on the office vlan.
- mdszy 7y ago
  You do realize that the comment you're replying to said "not tech people", right? Do you really think a person that isn't a "tech person" would understand any of the acronyms or terms in this sentence?
  - iso1631 7y ago
    It's great for my kids, who aren't tech people.
    - rrix2 7y ago
      Okay, so non-technical households?
- heisenbit 7y ago
  If you believe your kids can't figure out tech nor their friends friends can then maybe 1.3 may be safer on your office vlan.
  - warhorse10_9 7y ago
    If you have vlans set up at your house you might have a decent firewall that can block dns requests to unauthorized servers, so there's that.
    - iso1631 7y ago

bilal4hmed 7y ago

any idea on what it means as malware?

whatshisface 7y ago
Or "Adult Content?"
- woofcat 7y ago
  Adult content I think would be an easier category to filter on. However I would love it if they released the list of their blocked domains.
  - aidenn0 7y ago
    Adult content is notoriously hard to filter on since nobody can agree what qualifies, and pretty much any site with user-generated content has content that is objectionable to someone. Do you filter Wikipedia as "adult content"? Certainly one of these[1] images qualifies under most standards? 1: NSFW https://en.wikipedia.org/wiki/MediaWiki:Bad_image_list https://en.wikipedia.org/wiki/MediaWiki:Bad_image_list
    - Cyberdog 7y ago
      There are lots more examples than Wikipedia, although that's a good one. Reddit, Twitter, and YouTube are other examples where you can find adult content if you're looking for it, but if you block the whole site, you block a whole bunch of useful and in some cases educational content along with it. Now all that being said, this is a decent enough way to at least block the obvious stuff like Pornhub. For some, that might be good enough.
    - aurbano 7y ago
      Well this was one rabbit hole I would've preferred not to have visited...!
    - petronio 7y ago

deleted 7y ago

[deleted]

pergadad 7y ago

Adult content - is this * Just porn * Erotic content (eg lingerie shops) * Any sexual content (eg Wikipedia article on anal sex) * Or also e.g. medically relevant (sex ed, abortion provider sites, ...) * Gore, violence, videos of people dying ... * Information on or shops for drugs * Content on terrorism, weapons, manuals to build bombs * Content on Al Qaeda, Scientology and other extreme/dangerous religious stuff * ... ?

ainiriand 7y ago
Things that are not for kids. I think it is a broad category. What element is not fitting there for you?
- Kuraj 7y ago
  Disclosure - I am not a parent. But blocking your kid from having access to sexual education does not sit right with me, and I can imagine how they might not have proper sex ed at school or not be comfortable discussing it with their parents.
  - lallysingh 7y ago
    I think the answer is different if the kid is 5 or 15.
    - notRobot 7y ago
      5 year olds shouldn't have unrestricted access to the internet anyway. For children that young you should be using whitelists, not blacklists.
- deleted 7y ago
  [deleted]
- detaro 7y ago
  So is wikipedia supposed to be blocked or not? Twitter? Reddit?
- 7y ago

jawns 7y ago

I'd love to hear the pros/cons of filtering adult content at the DNS resolver level. I'm assuming the (current) lack of whitelists, along with a black-box algorithm to decide what constitutes adult content, reduces the usefulness.

JdeBP 7y ago
The pros are obvious. The cons, irrespective of what is blocked, are very similar to the problems with DNS hijacking that ISPs and others have done over the years. It affects all protocols, not just HTTP(S). It affects everything from turning IP addresses in logfiles into domain names, through double-reverse-lookup checks in TCP services, to SMTP electronic mail. Block advertising this way, and one hits the further problem that one often wants to operate based upon more than just the domain part of the URL. Or one wants to do things like make temporary redirects to static placeholder images. Fiddling with DNS service cannot achieve these. * http://jdebp.uk./FGA/verisign-internet-coup.html http://jdebp.uk./FGA/verisign-internet-coup.html

ryandvm 7y ago

Sadly, the trend for browsers to bypass system-level DNS resolution in favor of DNS-over-HTTPS means this kind of filtering is quickly becoming obsolete.

moviuro 7y ago
There is a canary domain in Firefox to prevent it from switching to DoH: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
- warhorse10_9 7y ago
  You could also user a policy.json for Firefox to permanently disable it. I don't see Firefox dropping this option as it is important for enterprise users. https://github.com/mozilla/policy-templates https://github.com/mozilla/policy-templates
- tssva 7y ago
  1.1.1.1 for Families doesn't seem to support the canary domain so by default Firefox would bypass this service. Also the canary domain only works if Firefox is not explicitly set to use DoH. If using DoH has explicitly been set by the user than the canary domain has no effect. Edit: Some testing seems to show that Mozilla has lumped these in with a select few others and will not bypass them when DoH is the default instead of explicitly selected even though they don't report the canary domain as an error. It will bypass them when DoH is explicitly enabled.
woofcat 7y ago
They offer this service as DoH as well. So in theory you could configure those apps to leverage this.

therealmarv 7y ago

Stopped using Cloudflare's DNS some weeks ago. I got from time to time errors (no page showing, forgot the exact error message) which never happened with Google's DNS. FYI I'm using DoT (DNS over TLS) on the router exclusively and I'm not living in USA.

jgrahamc 7y ago
Did you report this to us? Would be interested to know why.
- hmahncke 7y ago
  (I’m not the OP) My experience was that 1.1.1.1 didn’t interact well with captive.apple.com so I had a lot of confusing experiences on planes and airports, and eventually had to stop using it.
  - zackbloom 7y ago
    How long ago was that, if I can ask?
- therealmarv 7y ago
  Op here. No, never reported it. But I think I've read somewhere (this is only unvalidated speculation now) that Google DNS and regular DNS do more fallbacks and are working also with not well configured DNSes where as Cloudflare is more strict but I don't have time to validate that. For me it's easier to just switch my DNS and go on.
vxNsr 7y ago
If you had any cisco hardware in your network stack that is likely the reason. Our company's captive portal still takes you to 1.1.1.1
propogandist 7y ago
Why not use 9.9.9.9 ? The project is from IBM and few other companies, and includes threat data from major players in the security space Https://quad9.net

ddevault 7y ago

This would have been better if it was a joke. Big welcome to our new moral police, now encoded in two bits of a vanity IP address! Not a word spared for what kind of content is filtered, how they evaluate websites, any kind of appeals process... they did manage to portray it as helping the COVID-19 pandemic relief, though. Edit: I missed this text: > In the coming months, we will provide the ability to define additional configuration settings for 1.1.1.1 for Families. This will include options to create specific whitelists and blacklists of certain sites. You will be able to set the times of the day when categories, such as social media, are blocked and get reports on your household's Internet usage. Regardless, I am still opposed to this service, and opposed to all forms of internet censorship and spyware. CloudFlare is already really bad for the internet, and this isn't helping their case.

benatkin 7y ago
Any domain that hosts user uploaded content is gonna be banned, unless they're big like twitter or facebook. This is the worst. I'm glad I never gave Cloudflare a dime.
junaru 7y ago
Policing content is nothing new for Cloudflare, the 8chan events showed just how easily they succumb to public pressure.
- meowface 7y ago
  After the second or third (people debate if the third originated there) white supremacism-motivated mass shooting was announced on one of their many "National Socialist" boards shortly before it took place, with the owners refusing to do anything about it, removing them as a customer is more than understandable. The original creator (Hotwheels) had vehemently disavowed and condemned the site and its owners at that point. Aside from the business impact of tons of customers and the media (rightfully) condemning Cloudflare, and all the potential legal implications, dropping them was the only ethical thing to do. I'm a staunch defender of free speech and opposer of censorship, but when people are being mass-murdered, with more people at risk of being mass-murdered in the future, it's no longer just about speech. At the time of the mass shootings, the majority of boards and posters on the site were supportive of or affiliated with violent extremism and domestic terrorism, and their admins made no efforts to curb that (even if they didn't endorse it). Show me a single US or European company who would still provide infrastructure/networking for them after that point. Considering their only two incidents of stepping in were that and The Daily Stormer, I'd say they probably have one of the best track records when it comes to freedom of speech and acting as a neutral traffic carrier.

Symbiote 7y ago

$ host www.sex.com www.sex.com is an alias for dmz01.cdn.live. dmz01.cdn.live has address 15.222.131.21 $ host www.sex.com 1.1.1.3 Host www.sex.com not found: 5(REFUSED) $ host www.nothing 1.1.1.3 Host www.nothing not found: 3(NXDOMAIN) I hadn't noticed a DNS REFUSED response before. That seems reasonable, although a web browser's error message doesn't differ between REFUSED and NXDOMAIN.

andyjpb 7y ago
The error may differ if the zone is signed with DNSSEC. NXDOMAIN is a valid response that won't pass a signature verification. REFUSED just means that DNS Server can't or won't provide a response at this time.
- psz 7y ago
  "Can't provide a response" should be SERVFAIL.

ChrisArchitect 7y ago

ha, had to include a "this is not a joke" April Fool's disclaimer at bottom. Why not just release it tomorrow?

ajay-d 7y ago
I think tradition, 1.1.1.1 was released on April 1st (4/1, four one).
Hamuko 7y ago
Launching 1.1.1.1 stuff on April first has been kinda their marketing strategy for the 4 x 1 factor.

bedah 7y ago

"No Advertisement and No Tracking" would be nice. Right now I keep Web Advertisment low with a manually installed anti-advertisement hosts file.

specto 7y ago
Check out nextdns (pi-hole like service)

vowelless 7y ago

My friends who grew up in the middle east: Remember how our ISPs used to block "adult content". Did that stop anyone? It just lead to repression and a black market. On the bright side, circumventing those blocks as a kid got me interested in computers in the first place. Regardless, it is an interesting service. I would imagine that corporations, who have the tech support and need, will find this more useful than non-technical families. Examples: https://www.vpn-accounts.com/blog/how-to-open-blocked-sites-in-saudi-arabia-2/ https://www.vpn-accounts.com/blog/how-to-open-blocked-sites-... https://www.jakarta100bars.com/2019/10/porn-websites-blocked-dubai-uae-unblock.html https://www.jakarta100bars.com/2019/10/porn-websites-blocked...

thomascgalvin 7y ago
> On the bright side, circumventing those blocks as a kid got me interested in computers in the first place. Porn really is the driver of many technical innovations. Home movies and online financial transactions, for example, wouldn't be where they are today if people weren't so dedicated to watching other people smush.

rshurts 7y ago

While anyone technical can easily get around DNS filter it is a nice option for helping prevent accidental exposure to pornography. I'm looking forward to when the customization options are available as an alternative/addition to OpenDNS. The morality police argument doesn't seem to hold much water if they are going to let you whitelist or blacklist anything you want or turn categories on or off.

basch 7y ago
Have you used https://nextdns.io/ https://nextdns.io/ ?
- rshurts 7y ago
  No. But I'll have to check it out. Do you use it and the mobile apps? Do you have problems with connecting to public wifi when running the app? I've noticed setting the DNS locally on a computer throws off the local library wifi that has the captive page that makes you agree to terms before proceeding.
  - basch 7y ago
    On Android I set it as custom DoH. Have not used the app. Unfortunately, as with all DNS based blocking, you run into random pages that dont resolve, and need to turn it off. Due to the infinitely many knobs, I dont know which list is blocking it from the error page, just that the page cant be founbd. Yesterday it was http://www.futureus.com/ http://www.futureus.com/
tootie 7y ago
I can imagine some impatient parents will start black listing Kidz Bop videos or anything else that bothers them. It will also lead to some very creative punishments. Like blocking online gaming.
- 411111111111111 7y ago
  some work without dns though! battle.net comes to mind... that always connected, even if my providers DNS failed.

imafish 7y ago

Nice April's fool. :) Edit: Ok, I guess not. But how?

kick 7y ago

On one hand, this is really ridiculous. On the other hand, it might lead to the next generation of children who kick their technical careers off by figuring out how to circumvent censorship and that despise the companies enforcing it. Maybe not, though.

tc313 7y ago
On the other hand, my solution to subverting AOL parental controls was to... log into my mom's account.
TechBro8615 7y ago
You joke, but pretty sure this happened to me. I accidentally found some porn sites when I was in 3rd grade, so my mom had her police officer friend come over and install "net nanny" on my computer. Every now and then my mom would have him "check my computer." It worked for a while, but by 6th grade I wanted to find the stuff for myself. As a result, I have massive distrust of authority figures and learned very early how to circumvent technical controls...
k3liutZu 7y ago
My dad at some point put a password on the BIOS to restrict my PC usage. That's when I learned the motherboard has a standard "watch" battery which when taken out does reset all of the BIOS' settings.

andrewjf 7y ago

I have unbound at my house providing normal DNS -> DoH to Cloudflare DNS. I don't see any IPv6 endpoints published for the 1.1.1.2 and 1.1.1.3 equivalents, do they exist?

irtefa 7y ago
You can see the IPv6 addresses here: https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/ https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-famili... For malware: * 2606:4700:4700::1112 * 2606:4700:4700::1002 For malware and adult: * 2606:4700:4700::1113 * 2606:4700:4700::1003

msla 7y ago

$ host www.glaad.org 1.1.1.3 Using domain server: Name: 1.1.1.3 Address: 1.1.1.3#53 Aliases: Host www.glaad.org not found: 5(REFUSED) Looks like some things don't change. This is the kind of shit Peacefire was exposing back in the 1990s: Completely innocuous GLBTQ+ content being labeled as "inappropriate" by content censors. And Cloudflare doesn't even have the figleaf excuse of having a financial incentive to dance to the tune of the kinds of people who think GLAAD is somehow inherently bad. http://www.peacefire.org/ http://www.peacefire.org/ Also: $ host www.peacefire.org 1.1.1.3 Using domain server: Name: 1.1.1.3 Address: 1.1.1.3#53 Aliases: www.peacefire.org is an alias for peacefire.org. peacefire.org has address 65.181.125.58 peacefire.org mail is handled by 10 mail.peacefire.org. This verges on the comedic.

Symbiote 7y ago
Even worse: Host www.thetrevorproject.org not found: 5(REFUSED) That's a site for teenagers with "trained counselors are here to support you 24/7. If you are a young person in crisis, feeling suicidal, or in need of a safe and judgment-free place to talk, call …" It's also exactly the type of site that's first on the list of examples of what not to block, by any privacy / anti-censorship group. It should have been an easy test before launching.
- dknecht 7y ago
  This should definitely not be the case. We are getting this fixed. We will have a reporting page up shortly to also make it easier to report these type of issues.
  - dknecht 7y ago
    This has been fixed.
    - Symbiote 7y ago
      That is impressively fast! There's a site run by the Open Rights Group in the UK, recording incorrect blocks made by ISP-provided "parental control" filters. They already check against OpenDNS, so I assume they'll add 1.1.1.3. There are lists of overblocked domains: https://www.blocked.org.uk/stats https://www.blocked.org.uk/stats

yalogin 7y ago

I have little kids and don’t want them to accidentally stumble onto malware or porn sites. But I still don’t like this kind of policing happening at the DNS layer. Even more do given his their previous service became a huge success. Btw I see some resemblance with google here. Initially they were all “do no harm”. Only after they captured the whole market we realized we shouldn’t have succumbed to free shit. These guys are following the same model. Give free shit and get traffic, even though they lose money. They themselves claim they only charge businesses not consumers.

rshurts 7y ago
> I have little kids and don’t want them to accidentally stumble onto malware or porn sites. But I still don’t like this kind of policing happening at the DNS layer. Where do you set up the filtering or accountability? With so many connected devices in houses I've found DNS is common denominator. It's perhaps the easiest to circumvent, but it covers all the mobile devices, gaming consoles, etc. that are connected to my home network. My kids are too young to circumvent things, but if they start doing that I'll be equal parts proud and preparing for a loving talk.
- mgalgs 7y ago
  Right, and IMHO by the time they're old enough to start circumventing the filters then they're old enough to see the content. It's a self-enforcing gate. You're not mature enough to see the content until you're mature enough to circumvent the filters :D
ensignavenger 7y ago
DNS seems like a good place for this sort of use case. It prevents accidental access while making it easy for anyone who is sufficiently inclined to circumvent it.

seemstome94 7y ago

Thanks Cloudfare, I wouldn't know what a family is without you also pushing the brown man / White woman (with hybrid child) trope in current year.

amelius 7y ago

Why are the people in the illustrations missing eyes?

seemstome94 7y ago
So that they can push the race mixing narrative without being too overt. The brown man might not be so racially ambiguous with facial detail.
rjrjr5699 7y ago
So that they can push the ubiquitous race-mixing rubbish without being too overt. The brown man might not be so racially ambiguous with facial detail.

vbezhenar 7y ago

Filtering out ad websites would be more useful for me. I'm using https://pgl.yoyo.org/adservers/ https://pgl.yoyo.org/adservers/ with my own DNS, but probably big website like Cloudflare could block even more ad websites.

mantlepro 7y ago

> Cloudflare's business has never involved selling user data or targeted advertising The cloudfare site calls googletagmanager.com, marketo.com, linkedin.com, and bizible.com. Do any of these sell user data or support targeted advertising?

aaron695 7y ago

> Adult Content They don't understand the political world they just entered. Or the amount of work this will take. They have to take a stance so many political issues from here. From a company that prided itself on non-censorship (Minus two cases). This is easy, twice they have broken and been hated for it. Now, the twitter campaigns that will smash them on everything, in a sustained way.....

JensRex 7y ago
Cloudflare has never been anti-censorship. This kind of service fits them like a glove. They're going to love being the moral police.

gpvos 7y ago

I read two pages before I realized this was obviously an April 1 joke. Then I got to the "Not A Joke" section. What??? I don't think Cloudflare should be in this business. Also, how are they going to make this configurable like they write? Tie the configuration to the IP address? What if someone has a shared or dynamic IP address?

djrogers 7y ago
> Also, how are they going to make this configurable like they write? Tie the configuration to the IP address? What if someone has a shared or dynamic IP address? Likely the same way as opendns, nextdns, and a ton of other dns providers who do the same. It's for home use - if it doesn't fit your home use case, then use another filter.
- gpvos 7y ago
  Thanks. Interesting, I had no idea this was so much of a thing already.

stabbles 7y ago

On Android you have to specify a hostname for DNS (a bit ironic), which is 1dot1dot1dot1.cloudflare-dns.com. However, it does not seem 1dot1dot1dot3.cloudflare-dns.com works yet.

nimbius 7y ago

this seems like a disturbing trend for the company that often championed the idea of a free and open internet. First they dropped the Daily Stormer as a customer, then 8chan, then chimpmania which was terminated with a change.org petition. Now we have a new service no one asked for that seeks to block lewd websites and "malware"? Whats changed? did Matthew prince suddenly give up on free speech? or is it just another way to identify a target demographic.

rudolph9 7y ago

I was a little put off by this at first but can see why people want it and happy they offer isolated malware filter (what ever that means, still skeptical) and adult + malware filter.

zuck9 7y ago

YouTube says "Some results have been removed because Restricted Mode is enabled by your network administrator." when I'm on the Family DNS. How does this work? How can they know what DNS I'm using?

filleokus 7y ago
Huh! Did some quick Googling: > YouTube Restrict works by re-mapping YouTube IP addresses to the CNAME restrict.youtube.com (or restrictmoderate.youtube.com). It means that instead of visiting YouTube at their normal IP addresses, you will re-route the traffic to a special load balancer provided by Google that will block access to non children friendly videos. I did not know about that https://cleanbrowsing.org/articles/block-youtube-comments-restricted-mode https://cleanbrowsing.org/articles/block-youtube-comments-re...
- deleted 7y ago
  [deleted]

TheCapn 7y ago

CIRA doing the same thing: https://www.cira.ca/earlyaccess https://www.cira.ca/earlyaccess

anilgulecha 7y ago

If we get a 1.1.1.4 with all of easylist ad blocked.. that would be smashing! Pi-hole for the internet.

abakker 7y ago

As a general response to negativity here (which seems to largely stem around technical concerns over what is implemented and how), I think this is cool and fine. As a kid I would have figured out a way to get around this, and that would have been part of the fun, but, this option adds more choice to the market and that is a good thing.

tinalumfoil 7y ago

DNS isn't appropriate for filtering porn or ads. It's easy to get around and not fine-grained enough. In fact, the largest porn site in the world is unblocked. $ dig @1.1.1.3 reddit.com reddit.com. 298 IN A 151.101.65.140 And the largest advertising and tracking site. $ dig @1.1.1.3 pagead2.googlesyndication.com pagead2.googlesyndication.com. 262 IN CNAME pagead46.l.doubleclick.net. pagead46.l.doubleclick.net. 262 IN A 172.217.7.2

fenwick67 7y ago
Yup I was just thinking "where could you easily wander into NLS content" and my first thought was Reddit.
tomschlick 7y ago
I'm surprised Reddit hasn't gone the way of Google/YouTube and allowed a safe browsing filter via DNS. All NSFW subreddits are already marked as such (same with many individual posts) so it seems like it would be an easy filter to add if accessed via the "safe browsing" load balancer IP. Edit: Someone below added more info on this for anyone curious: https://cleanbrowsing.org/articles/block-youtube-comments-restricted-mode https://cleanbrowsing.org/articles/block-youtube-comments-re...
- sneak 7y ago
  Reddit also has a flag inside of their api called `nsfb`: Not Safe For Brand. They'll let you post it, and they'll host it, but they don't want most people to know that they'd host it, so they hide it from public, not-logged-in sections of the site. It's really shameful; they need to stop the hypocrisy and either become a content-neutral host and own the consequences, or censor arbitrarily, and own the consequences. They're trying to have their cake and eat it too, and it's entirely unfair, much in the same way shadowbanning is.
  - BoorishBears 7y ago
    What is shameful about it? It's a realistic approach to navigating the real world where there are bills to pay, Reddit Gold isn't going to cut it, and advertisers don't want their brand associated with random NSFW/NSFL content. I don't get this obsession with browbeating every content provider not living up to these Stallmanistic extremes. Reddit should not have to give up any sort of protection for allowing advertisers to not have their ads show up on certain subreddits, or censoring Nazis. If Reddit of all sites is what we're calling shameful, there is no hope.

anem0neone 7y ago

it's really nice to know that cloudflare for families thinks white supremacist sites like stormfront, the creative movement, national vanguard, and league of the south are family friendly. and troll sites like kiwifarms and encyclopedia dramatica are family friendly. how in athena's name did you come up with this seed list? how on earth did you not have someone review this from the get go?

gsich 7y ago
So? What's your point?

yarrel 7y ago

This is an excellent Twitter thread explaining in detail the problems with providing such a service for """families""" - https://twitter.com/SarahJamieLewis/status/1245374377757040640 https://twitter.com/SarahJamieLewis/status/12453743777570406...

yarrel 7y ago

"Families" is a dog whistle.

BubRoss 7y ago
This isn't a law, it's a feature you have to seek out.

drummer 7y ago

Where can the public see, in real time, a complete list of exactly which domains are blocked on those servers?

tcd 7y ago

I feel that transparency would be key, to understand what cloudflare considers good/bad. As we can see in this thread, there's already been a mistaken block - expect many, many more of these to come. They will be chasing their tail between their legs for years to come, and they'll only get bad PR from this. It'll be dead and buried in a year after a shit storm hits reddit

soheil 7y ago

I think an all encompassing system like this as a sort of big government watching every move we make for "our benefit". It's probably wiser to install a _tiny_ software that blocks unwanted content that you can uninstall than to give power to a giant entity monitoring every site you visit online. Sure you can change your country at an individual level but why create a problem in the first place.

deleted 7y ago

[deleted]

surround 7y ago

It’s not a good idea to trust a single large organization with your data, even if they make claims to privacy. It’s even worse to let them control what get censored and what gets through. If you care about privacy, I recommend running your own resolver with Unbound, and block ads/tracking/malware/adult content etc. using Pi-Hole. https://nlnetlabs.nl/projects/unbound/about/ https://nlnetlabs.nl/projects/unbound/about/ https://pi-hole.net/ https://pi-hole.net/

gameswithgo 7y ago

gave 1.1.1.3 a try. unfortunately it blocks things like doctors lectures on coronavirus on youtube.

_-david-_ 7y ago
This is DNS blocking so it would be blocking all of Youtube or none of it.

LeoPanthera 7y ago

gaycenter.org, a New York LGBTQ community center, is blocked. Stormfront is not. So. That's pretty gross.

dpbriggs 7y ago
I would be curious to learn more about how they classify websites. I would imagine they automatically crawl and do some basic keyword matching, so false positives are expected. Curious about stormfront though.

Corrado 7y ago

I'm a network administrator for a small private school and this seems like it would be a good solution for us. We generally try to keep the kids away from the "bad" sites and their systems are mostly locked down (managed iPads and Chromebooks). In the past we used OpenDNS for DNS filtering and it worked pretty well. Then they were purchased by Cisco and the prices went up and functionality went down. If CloudFlare can offer some management capabilities (ie. whitelist / blacklist) we would switch in a minute. I can't wait to see how this product matures.

ehutch79 7y ago

For everyone complaining about the porn filtering, That malware filtering will actually be a godsend for companies. Running an extra internal dns server just to do 'last chance' filtering is extra maintenance i don't want to have to do. I'd much rather let cloudflare do that.

dzhiurgis 7y ago

What are there other solutions for filtering content? My kid is very far from getting any screen time but my imagination always was just block everything except kids wiki and maybe some other sites (dunno yet at this point).

nottorp 7y ago

Hmm. Do they block information about breast cancer because kids shouldn't be exposed to breasts?

knorker 7y ago

Shame on you, cloudflare.

pnako 7y ago

For families of people without eyes, apparently.

totorovirus 7y ago

This is the solution that should have existed in the first place

vlkmn 7y ago

1.1.1.2/1.0.0.2 & 1.1.1.3/1.0.0.3 DNS resolvers incorrectly resolves one of India's largest banks domain name "retail.onlinesbi.com" to 0.0.0.0