6 ms·

Does anyone know why I can't reach archive.is anymore from The Netherlands these days?

CameronNemo 5y ago
Are you using Cloudflare DNS? https://jarv.is/notes/cloudflare-dns-archive-is-blocked/ https://jarv.is/notes/cloudflare-dns-archive-is-blocked/
- kevincox 5y ago
  I have Cloudflare with fallback to Google and I need to refresh a few times to make it fallback and work. This spat is kinda ridiculous.
  - true_religion 5y ago
    I’m not really understanding the crux of it. Even if archive.is doesn’t get your location via DNS, won’t they get it anyways immediately one millisecond later when you issue an HTTP GET request?
    - cyounkins 5y ago
      Yes, the receiving webserver will get the IP with the HTTP GET, but it's mostly too late to be useful for serving users from a server with minimal latency. The EDNS client subnet feature reveals the clients subnet (but not entire IP) to the nameserver that answers the DNS query, which is then cached by Cloudflare/Google. This allows the nameserver to do geolocation at the DNS stage and direct the end user to a server with minimal latency. Without EDNS client subnet, you could get the IP for an archive.is frontend in a different continent and have a slow site experience. While the frontend server will get your IP, it's too late to do much about it under normal circumstances. An HTTP redirect would cost time, and you'd have to have different domains for each data center/region which is one thing you can avoid with the client subnet feature to start with.
      - CameronNemo 5y ago
        Frankly they (archive.is) wouldn't have this issue if they used BGP anycast. DNS was never designed to facilitate regional load balancing.
        NickNameNick 5y ago
        I thought anycast wasn't reliable for TCP sessions? You can serve UDP services (eg DNS) by anycast, but if you hosted a tcp service, there's no guarantee the same server would receive consecutive packets from the tcp stream
        CameronNemo 5y ago
        It is rarely an issue in practice. There are workarounds to minimize connection resets. Using ECMP hashing on routers and a tiered load balancing topology are important. https://vincent.bernat.ch/en/blog/2018-multi-tier-loadbalancer https://vincent.bernat.ch/en/blog/2018-multi-tier-loadbalanc... https://blog.cloudflare.com/high-availability-load-balancers-with-maglev/ https://blog.cloudflare.com/high-availability-load-balancers... https://engineering.linkedin.com/network-performance/tcp-over-ip-anycast-pipe-dream-or-reality https://engineering.linkedin.com/network-performance/tcp-ove...
        sterlind 5y ago
        Seems like LinkedIn had to do some finessing and still couldn't go with global anycast. How do CDNs work without controlling DNS resolution by source subnet?
        CameronNemo 5y ago
        Presumably a CDN has better and more direct peerings with ISPs than LinkedIn, or admittedly archive.is.
        diroussel 5y ago
        Cloudflare uses any cast, and they deal with it by making every external node able to handle every public IP that they have. If packets in a TCP stream end up going to different nodes, then they deal with that in their infrastructure.
    - dngray 5y ago
      > won’t they get it anyways immediately one millisecond later when you issue an HTTP GET request? Not if you're using a VPN in addition to Cloudflare servers.
      - true_religion 5y ago
        True. In that case, why wouldn’t you send all traffic via the VPN including your DNS?
  - lugged 5y ago
    Is this a Mac thing? You're not meant to use DNS fallback for different providers.
    - gumby 5y ago
      I can't see what a Mac has to do with this at all. Also I can't imagine why you might think that "You're not meant to use DNS fallback for different providers." That was precisely the point it was originally designed for. The whole point of multiple resolvers is to have diversity of risk. If both your resolvers are from the same organization there's a higher chance that whatever took one out took the other out as well.
  - dngray 5y ago
    It's not Cloudflare's fault. In any case in order to maintain privacy I use https://dnscrypt.info https://dnscrypt.info it has an anonymized DNS option https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D... I then just use unbound and forward that to DNSCrypt on my router. https://wiki.archlinux.org/title/DNSCrypt#Unbound https://wiki.archlinux.org/title/DNSCrypt#Unbound
- stingraycharles 5y ago
  Oh man this explains so many issues I have had with archive.is, I couldn’t pinpoint the problem. Thanks for sharing this, things finally make sense now.
- anothernewdude 5y ago
  I'm surprised Cloudflare don't provide security by obfuscating EDNS info.
entropicgravity 5y ago
I can't reach it from Canada either right now.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]

Are you using Cloudflare DNS? https://jarv.is/notes/cloudflare-dns-archive-is-blocked/ https://jarv.is/notes/cloudflare-dns-archive-is-blocked/

kevincox 5y ago
I have Cloudflare with fallback to Google and I need to refresh a few times to make it fallback and work. This spat is kinda ridiculous.
- true_religion 5y ago
  I’m not really understanding the crux of it. Even if archive.is doesn’t get your location via DNS, won’t they get it anyways immediately one millisecond later when you issue an HTTP GET request?
  - cyounkins 5y ago
    Yes, the receiving webserver will get the IP with the HTTP GET, but it's mostly too late to be useful for serving users from a server with minimal latency. The EDNS client subnet feature reveals the clients subnet (but not entire IP) to the nameserver that answers the DNS query, which is then cached by Cloudflare/Google. This allows the nameserver to do geolocation at the DNS stage and direct the end user to a server with minimal latency. Without EDNS client subnet, you could get the IP for an archive.is frontend in a different continent and have a slow site experience. While the frontend server will get your IP, it's too late to do much about it under normal circumstances. An HTTP redirect would cost time, and you'd have to have different domains for each data center/region which is one thing you can avoid with the client subnet feature to start with.
    - CameronNemo 5y ago
      Frankly they (archive.is) wouldn't have this issue if they used BGP anycast. DNS was never designed to facilitate regional load balancing.
      - NickNameNick 5y ago
        I thought anycast wasn't reliable for TCP sessions? You can serve UDP services (eg DNS) by anycast, but if you hosted a tcp service, there's no guarantee the same server would receive consecutive packets from the tcp stream
        CameronNemo 5y ago
        It is rarely an issue in practice. There are workarounds to minimize connection resets. Using ECMP hashing on routers and a tiered load balancing topology are important. https://vincent.bernat.ch/en/blog/2018-multi-tier-loadbalancer https://vincent.bernat.ch/en/blog/2018-multi-tier-loadbalanc... https://blog.cloudflare.com/high-availability-load-balancers-with-maglev/ https://blog.cloudflare.com/high-availability-load-balancers... https://engineering.linkedin.com/network-performance/tcp-over-ip-anycast-pipe-dream-or-reality https://engineering.linkedin.com/network-performance/tcp-ove...
        sterlind 5y ago
        Seems like LinkedIn had to do some finessing and still couldn't go with global anycast. How do CDNs work without controlling DNS resolution by source subnet?
        CameronNemo 5y ago
        Presumably a CDN has better and more direct peerings with ISPs than LinkedIn, or admittedly archive.is.
        diroussel 5y ago
        Cloudflare uses any cast, and they deal with it by making every external node able to handle every public IP that they have. If packets in a TCP stream end up going to different nodes, then they deal with that in their infrastructure.
  - dngray 5y ago
    > won’t they get it anyways immediately one millisecond later when you issue an HTTP GET request? Not if you're using a VPN in addition to Cloudflare servers.
    - true_religion 5y ago
      True. In that case, why wouldn’t you send all traffic via the VPN including your DNS?
- lugged 5y ago
  Is this a Mac thing? You're not meant to use DNS fallback for different providers.
  - gumby 5y ago
    I can't see what a Mac has to do with this at all. Also I can't imagine why you might think that "You're not meant to use DNS fallback for different providers." That was precisely the point it was originally designed for. The whole point of multiple resolvers is to have diversity of risk. If both your resolvers are from the same organization there's a higher chance that whatever took one out took the other out as well.
- dngray 5y ago
  It's not Cloudflare's fault. In any case in order to maintain privacy I use https://dnscrypt.info https://dnscrypt.info it has an anonymized DNS option https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D... I then just use unbound and forward that to DNSCrypt on my router. https://wiki.archlinux.org/title/DNSCrypt#Unbound https://wiki.archlinux.org/title/DNSCrypt#Unbound
stingraycharles 5y ago
Oh man this explains so many issues I have had with archive.is, I couldn’t pinpoint the problem. Thanks for sharing this, things finally make sense now.
anothernewdude 5y ago
I'm surprised Cloudflare don't provide security by obfuscating EDNS info.

entropicgravity 5y ago

I can't reach it from Canada either right now.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]