10 ms·

Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019)

181 points by jahnu 5y ago

jeffalo 5y ago
Woah, that's a nice domain.
trevorishere 5y ago
It's important to remember, at least for corporate environments, that EDNS Client Subnet is important when working with services such as Exchange Online where the local resolver is what determines your EXO Front Door. If you're using a service like 1.1.1.1, you may be routed to an incorrect Front Door causing increased latency (primarily with search and archive mailboxes which aren't cached). Quad9 does have a service which provides EDNS Client Subnet support, should you want to leverage it.
- beezischillin 5y ago
  I have Quad9's DNSCrypt configured with ECS on my Pi-Hole and it returns the IPs for archive.is and archive.today. Just tested it.
- dknecht 5y ago
  Cloudflare has worked providers to make sure they can efficiently route. If you find case where this isn’t the case please let us know.
  - ComputerGuru 5y ago
    Cloudflare DNS does not route efficiently with AWS CloudFront anycast DNS. I tracked down insanely slow `rustup update` downloads to incorrect selection of ideal routes to the AWS resources caused by using CF to resolve the DNS. Switching to a different resolver that works with anycast and EDNS fixed it. CF saying “we break standard DNS geo routing but work with providers to route things right” isn’t very inspiring.
    - elithrar 5y ago
      > Cloudflare DNS does not route efficiently with AWS CloudFront anycast DNS. I tracked down insanely slow `rustup update` downloads to incorrect selection of ideal routes to the AWS resources caused by using CF to resolve the DNS. Please send me details (silverlock at cloudflare) here - AWS has our geofeed. If you can include resolution details - e.g. dig @1.1.1.1 <cloudfront-host> +nsid - with the incorrect CF results, we can provide them to AWS. Folks did geo-routing with DNS long before ECS was included, and there’s a privacy trade-off to be had. We’re exploring ways to make this better but there is no free lunch.
      - ComputerGuru 5y ago
        Thanks for providing your info. I stopped using CF for resolution because of this almost two years ago; I don’t have a reason to think the situation changed but if I get a chance I can try to reproduce it and get back to you.
deadalus 5y ago
Archive.is is unironically one of the most important websites in the world. I hope this mess gets fixed but I am not holding my breath because we are in the same position for years now. Interesting read on the probable owner of the site : https://webapps.stackexchange.com/a/149405 https://webapps.stackexchange.com/a/149405
- Cthulhu_ 5y ago
  That reads a lot like doxxing; if someone isn't open about their identity, they don't want it out, and doing sleuthing work like this (or linking to it) can be considered doxxing. If archive.is hosts content that has been removed due to oppressive regimes' policies (including western ones), exposing their identity may put them at risk.
  - deleted 5y ago
    [deleted]
  - sweetbitter 5y ago
    That would be security by obscurity- something which the creator of such an important website does not have the privilege of relying on.
    - kube-system 5y ago
      The parent comment is pointing out the moral/etiquette/guideline issue, not making a judgement about security posture.
  - deleted 5y ago
    [deleted]
  - formerly_proven 5y ago
    I find this highly implausible, all of the accounts archive.is is "logged into" would have to be put there in a very explicit manner. I'd assume that all of the accounts are fake or appropriated accounts. For example @volth on Github - as a person - is still around in other places, so I'm guessing that account was stolen and they don't have a way to get it back.
CaliforniaKarl 5y ago
(2019)
deleted 5y ago
[deleted]
mosselman 5y ago
It doesn't. At least I can view it while using 1.1.1.1
deleted 5y ago
[deleted]
Hamuko 5y ago
Archive.is used to geoblock all Finnish IP addresses at one point because of some alleged dispute with the Finnish government. As far as I remember, he got a takedown request from a Finnish government and then had some incident at the Finnish border, saying that they were linked (as in, the company in question could order the Finnish government to harrass him). Works now though but it gives me doubts about the management of the site.
- fragmede 5y ago
  The people that run the Pirate Bay went to prison for operating that site, despite not hosting any illegal content there themselves. Archive.is faces similar impedance mismatch with what different people and courts believe about intellectual property. When's the last time you went to prison for something you believe in?
  - Hamuko 5y ago
    What does the Pirate Bay have to do with anything? Who went to prison here?
    - ceejayoz 5y ago
      The point is more about what could happen when breaking laws in other countries than what did happen in this particular case.
      - Hamuko 5y ago
        So it's a completely pointless non-sequitur then. The border agents could've shot him to death where he stood for all that it matters.
  - fragmede 5y ago
    Tbc, I haven't, but I'm also not the one throwing shade at the site's management.
dimensi0nal 5y ago
amazing how cloudflare has framed this anticompetitve move as a privacy thing. it doesn't matter if your dns resolver leaks part of your ip address to archive.is's dns servers when you're about to connect to archive.is from your ip address anyway. the only thing dropping the edns client subnet does is prevent services you use from giving you a server that's closer to you when you do the dns lookup. this performance issue, of course, does not affect sites using cloudflare.
- luckylion 5y ago
  Can we not call literally everything "anticompetitive"? archive.is isn't a competitor of Cloudflare. Cloudflare doesn't treat them differently from any other site, they're not doing anything "to keep them down", their DNS product just has a focus that isn't compatible with archive.is' hunger for data. That you might connect to archive.is directly isn't of any concern. You might also not do that, and they've decided that leaking data about the user isn't what they want to do. It's not anticompetitive. It's not evil.
  - dimensi0nal 5y ago
    archive.is doesn't compete with cloudflare, but they (or other websites) might want to spend money on improving their performance. cloudflare's dns resolver being popular makes one non-cloudflare option for improving website performance less appealing.
  - fragmede 5y ago
    > Cloudflare doesn't treat them differently from any other site Did we read the same article? Cloudflare is treating them, and anybody else that makes the same choices wrt EDNS, differently from the rest of the Internet.
    - metalliqaz 5y ago
      I read the article, I'm pretty sure you are mistaken.
    - 5y ago
opan 5y ago
I have long hated Cloudflare, so it's hard to be on their side here. They MitM large parts of the web and often trap you in long or even infinite loops with their horrendous checker that some sites unfortunately use. It's especially bad on less common browsers. In two cases I had to spoof my useragent or it would literally never pass the check, locking me out of several sites. Even if the block was without reason, I would've thought "fair enough, Cloudflare sucks". It's weird to me how many people willingly use Google or Cloudflare DNS. I would have to be in quite the pinch to rely on either, like a site I need is blocked and I happen to remember their simple IPs, and also I can't use something like an ssh tunnel instead for some reason.
- BenjiWiebe 5y ago
  CloudFlare DNS is not the part that gives you the annoying anti bot checks. Those are from website operators who have opted in to the CDN and anti-DDoS services that CloudFlare offers.
tus89 5y ago
I can't resolve with either 8.8.8.8 or 1.1.1.1.
- tus89 5y ago
  I switched Chrome to use secure DNS with neither Croogle or CloudBlare (used OpenDNS) and now it works fine. Fuck the megacorps.
  - jordemort 5y ago
    OpenDNS is owned by Cisco; it's not exactly a mom-and-pop operation.
koboll 5y ago
Out of curiosity - not defending the behavior - what kind of problems could omitting EDNS cause? What is the steelman case for Archive.is here? The author says Archive.is's claim that it causes problems is "questionable", but he doesn't mention what those purported problems are or address why they're illegitimate, so it's hard to evaluate whether that's accurate.
- judge2020 5y ago
  Archive.is uses ECS (edns client subnet, which sends the client IP's /24 to the authoritative resolver) for geo-based load balancing. The problem is that all IPs in a /24 are highly likely to belong to the same city for residential connections, so plugging it into a geoip service is likely to show the actual city & state that a request originates from (the entire point of ECS). https://twitter.com/archiveis/status/1018691421182791680 https://twitter.com/archiveis/status/1018691421182791680 (screenshot: https://aws1.discourse-cdn.com/cloudflare/original/3X/8/2/82f80904fab6661263389595d60ef7d9b7f16eaa.png https://aws1.discourse-cdn.com/cloudflare/original/3X/8/2/82... )
  - saurik 5y ago
    But when the user goes to use the IP address they got back, even more detailed information is going to be given to the endpoint; I can see this maybe being a benefit for TXT records or something? Hiding ECS from DNS queries seems to mostly just further create imbalances between companies that can afford routing at the IP level over companies that want to do cheaper routing at the DNS level. (And like, if you attempt to directly mitigate the final IP problem by using a VPN or CG-NAT or something, that same solution will work for the DNS resolver, so I really am seeing no benefit.)
    - Hamuko 5y ago
      You can still do routing at DNS-level as long as you have a less dense infrastructure than Cloudflare. >1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results.
deleted 5y ago
[deleted]
Dylan16807 5y ago
> I wrote the following reply to Matthew, praising his team's focus on the big picture Okay great, but: > 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. > massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come The problem isn't really EDNS. And someone is either lying or very incorrect. This should be resolvable. The two sides don't want incompatible things. Has there been zero progress since?
- raxi 5y ago
  >> 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. Cloudflare makes an exception to this rule for Archive.{today,is,...} domains. All requests for this domains come from Amazon EC2 in the U.S., not the 180 edges of Cloudflare. This was on blog.archive.today. Why? Who knows. But the decision to break up is made by both parties, not just the archive. Source https://blog.archive.today/post/623568857709395968/i-from-the-region-which-block-archive-today-and https://blog.archive.today/post/623568857709395968/i-from-th...
dogsgobork 5y ago
I noticed a few days ago that it didn't work for me, but used a site up/down checker that also said it was down. Figured they were having issues and didn't think any more about it. I just added a static entry to my pihole, so it works for me now.
craigc 5y ago
> Sure, it's annoying that I'll need to use a VPN or change my DNS resolvers to use a pretty slick (and otherwise convenient) website archiver. You can alternatively look up the IP address using something other than Cloudflare DNS and add entries to your /etc/hosts file for archive.is and archive.today.
deleted 5y ago
[deleted]
jbreitbart 5y ago
In case you use pihole and want to use cloudflare for everything, but archive.is you can create the following file cat /etc/dnsmasq.d/02-archive.is.conf server=/archive.is/8.8.8.8 server=/archive.is/8.8.4.4 server=/archive.li/8.8.8.8 server=/archive.li/8.8.4.4 server=/archive.to/8.8.8.8 server=/archive.to/8.8.4.4
- jbreitbart 5y ago
  Fixed formating, sorry. cat -p /etc/dnsmasq.d/02-archive.is.conf server=/archive.is/8.8.8.8 server=/archive.is/8.8.4.4 server=/archive.li/8.8.8.8 server=/archive.li/8.8.4.4 server=/archive.to/8.8.8.8 server=/archive.to/8.8.4.4
  - retox 5y ago
    There are quite a few different TLDs that the site uses (for resilience I presume). .vn is another, .today may still be in use.
- creddit 5y ago
  I never even thought of configuring my pihole to allow this. Thanks! Much appreciated!!
- madars 5y ago
  Similar for dnscrypt-proxy: add "forwarding_rules = '/etc/dnscrypt-proxy/forwarding_rules.txt'" to /etc/dnscrypt-proxy/dnscrypt-proxy.toml and then populate the forwarding_rules.txt with lines like "archive.is 8.8.8.8".
m463 5y ago
archive.is has some sketchy tracking built into it. I still use (the discontinued) umatrix with firefox and any archive.is request makes a lot of specific-to-you tracking pixels. like *.pixel.archive.is that drill down to your browser address
dang 5y ago
There have been at least two past threads about this: Tell HN: Unexpected errors with Archive.is on Cloudflare 1.1.1.1 DNS - https://news.ycombinator.com/item?id=23315640 https://news.ycombinator.com/item?id=23315640 - May 2020 (10 comments) Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1) - https://news.ycombinator.com/item?id=19828317 https://news.ycombinator.com/item?id=19828317 - May 2019 (197 comments) as well as god knows how many comments...
voldacar 5y ago
I don't fully understand how archive.is operates. They don't remove copyrighted content (which I like, since it provides a useful service), they must have probably terabytes upon terabytes of data in some datacenter somewhere, yet they never seem to be shut down by the govt or their datacenter/cloud provider. Am I just naive to be surprised by this? How does all this work exactly?
- oenetan 5y ago
  Fair use applies i think.
  - voldacar 5y ago
    Things on archive.org get DMCA'ed all the time
    - urthor 5y ago
      I'm almost certain the actual reason is producing all the infrastructure to DMCA content on Google/Facebook/Twitter/Youtube and other "mainstream" Web 2.0 platforms is expensive. Copyright enforcement is a lot stricter on Youtube, than say, Reddit video. It's all down to the engagement of the IP owners. My guess is they just haven't gotten around to chasing Archive.is down that hard.
      - tinus_hn 5y ago
        It’s a value proposition. Archive.is doesn’t host Hollywood blockbusters. If it is hard to take them down, nobody is going to do that as long as they don’t cause to much real damage.
  - kelnos 5y ago
    I don't think retaining and publishing complete copies of copyrighted works falls under even the most generous interpretation of fair use.
  - contravariant 5y ago
HandstandMick 5y ago
There are a lot of emotions in the comments here today. CloudFlare provides a clear response and it has merit. Archive.is surely is not 100 reliant on this single mechanism to load share or determine correct routing to cache locations, I agree with the poster - I can't see a reason why they would block this via Cloudflare when so many other mechanisms they should already be deploying to satisfy their requirements across multiple layers in the stack exist. Edit: The position makes or made no sense and smells fishy.
wodenokoto 5y ago
There is so much I do not know about dns. I thought: I ask dns server about domain, they return an IP address. I connect to IP address and they in turn can see mine. So why does cloud flare need to a) query domain for IP address on my behalf? Can’t they just do it on their own behalf and cache the results? B) why do they need to hide my IP address information from the domain? Aren’t I going to visit the destination regardless?
- blibble 5y ago
  some people use the IP from the DNS query to return a server closer to you that's pretty much it
mercora 5y ago
i have no trouble to resolve www.archive.is via 1.1.1.1 at all... however, i noticed archive.is has a CNAME record pointing to www.archive.is while CNAME RR on apex domains are usually not allowed in DNS... what make this even more interesting, i only see the CNAME RR when querying via 1.1.1.1 and not when querying authoritative servers for archive.is (EDIT: while repeating the query via 1.1.1.1 i also saw both A and CNAME record for archive.is in the response :S) maybe the initial issue is just gone already? considering this is apparently happening in 2019 that does not seem too unlikely...
indianets 5y ago
I had a similar issue with VoWiFi on my network due to EDNS, and it's rightly pointed out by msilverlock in forum. # dig vowifi.jio.com @1.1.1.1 A ;; ANSWER SECTION: vowifi.jio.com. 5 IN A 49.45.63.1 vowifi.jio.com. 5 IN A 49.45.63.2 ;; SERVER: 1.1.1.1#53(1.1.1.1) # dig vowifi.jio.com @8.8.8.8 A ;; ANSWER SECTION: vowifi.jio.com. 4 IN A 49.44.59.36 vowifi.jio.com. 4 IN A 49.44.59.38 ;; SERVER: 8.8.8.8#53(8.8.8.8) https://community.cloudflare.com/t/vowifi-issues-due-to-possibly-bad-resolution/292568 https://community.cloudflare.com/t/vowifi-issues-due-to-poss... As the article links to and says "privacy versus convenience", and I am happy that CloudFlare chose the former.
- nora-puchreiner 5y ago
  That million Firefox users who chose Cloudflare DNS must know that chose "privacy versus convenience" too and be happy with that.
sebow 5y ago
(In case you need one) Quad9 DNS is far better imo than CF. Granted my ISP doesn't block many things already and it's fast, so the only concern for me is privacy, which the stated alternative seems to prioritize more than the others.

181 points by jahnu 5y ago

Woah, that's a nice domain.

It's important to remember, at least for corporate environments, that EDNS Client Subnet is important when working with services such as Exchange Online where the local resolver is what determines your EXO Front Door. If you're using a service like 1.1.1.1, you may be routed to an incorrect Front Door causing increased latency (primarily with search and archive mailboxes which aren't cached). Quad9 does have a service which provides EDNS Client Subnet support, should you want to leverage it.

beezischillin 5y ago
I have Quad9's DNSCrypt configured with ECS on my Pi-Hole and it returns the IPs for archive.is and archive.today. Just tested it.
dknecht 5y ago
Cloudflare has worked providers to make sure they can efficiently route. If you find case where this isn’t the case please let us know.
- ComputerGuru 5y ago
  Cloudflare DNS does not route efficiently with AWS CloudFront anycast DNS. I tracked down insanely slow `rustup update` downloads to incorrect selection of ideal routes to the AWS resources caused by using CF to resolve the DNS. Switching to a different resolver that works with anycast and EDNS fixed it. CF saying “we break standard DNS geo routing but work with providers to route things right” isn’t very inspiring.
  - elithrar 5y ago
    > Cloudflare DNS does not route efficiently with AWS CloudFront anycast DNS. I tracked down insanely slow `rustup update` downloads to incorrect selection of ideal routes to the AWS resources caused by using CF to resolve the DNS. Please send me details (silverlock at cloudflare) here - AWS has our geofeed. If you can include resolution details - e.g. dig @1.1.1.1 <cloudfront-host> +nsid - with the incorrect CF results, we can provide them to AWS. Folks did geo-routing with DNS long before ECS was included, and there’s a privacy trade-off to be had. We’re exploring ways to make this better but there is no free lunch.
    - ComputerGuru 5y ago
      Thanks for providing your info. I stopped using CF for resolution because of this almost two years ago; I don’t have a reason to think the situation changed but if I get a chance I can try to reproduce it and get back to you.

deadalus 5y ago

Archive.is is unironically one of the most important websites in the world. I hope this mess gets fixed but I am not holding my breath because we are in the same position for years now. Interesting read on the probable owner of the site : https://webapps.stackexchange.com/a/149405 https://webapps.stackexchange.com/a/149405

Cthulhu_ 5y ago
That reads a lot like doxxing; if someone isn't open about their identity, they don't want it out, and doing sleuthing work like this (or linking to it) can be considered doxxing. If archive.is hosts content that has been removed due to oppressive regimes' policies (including western ones), exposing their identity may put them at risk.
- deleted 5y ago
  [deleted]
- sweetbitter 5y ago
  That would be security by obscurity- something which the creator of such an important website does not have the privilege of relying on.
  - kube-system 5y ago
    The parent comment is pointing out the moral/etiquette/guideline issue, not making a judgement about security posture.
- deleted 5y ago
  [deleted]
- formerly_proven 5y ago
  I find this highly implausible, all of the accounts archive.is is "logged into" would have to be put there in a very explicit manner. I'd assume that all of the accounts are fake or appropriated accounts. For example @volth on Github - as a person - is still around in other places, so I'm guessing that account was stolen and they don't have a way to get it back.

CaliforniaKarl 5y ago

(2019)

deleted 5y ago

[deleted]

mosselman 5y ago

It doesn't. At least I can view it while using 1.1.1.1

deleted 5y ago

[deleted]

Hamuko 5y ago

Archive.is used to geoblock all Finnish IP addresses at one point because of some alleged dispute with the Finnish government. As far as I remember, he got a takedown request from a Finnish government and then had some incident at the Finnish border, saying that they were linked (as in, the company in question could order the Finnish government to harrass him). Works now though but it gives me doubts about the management of the site.

fragmede 5y ago
The people that run the Pirate Bay went to prison for operating that site, despite not hosting any illegal content there themselves. Archive.is faces similar impedance mismatch with what different people and courts believe about intellectual property. When's the last time you went to prison for something you believe in?
- Hamuko 5y ago
  What does the Pirate Bay have to do with anything? Who went to prison here?
  - ceejayoz 5y ago
    The point is more about what could happen when breaking laws in other countries than what did happen in this particular case.
    - Hamuko 5y ago
      So it's a completely pointless non-sequitur then. The border agents could've shot him to death where he stood for all that it matters.
- fragmede 5y ago
  Tbc, I haven't, but I'm also not the one throwing shade at the site's management.

dimensi0nal 5y ago

amazing how cloudflare has framed this anticompetitve move as a privacy thing. it doesn't matter if your dns resolver leaks part of your ip address to archive.is's dns servers when you're about to connect to archive.is from your ip address anyway. the only thing dropping the edns client subnet does is prevent services you use from giving you a server that's closer to you when you do the dns lookup. this performance issue, of course, does not affect sites using cloudflare.

luckylion 5y ago
Can we not call literally everything "anticompetitive"? archive.is isn't a competitor of Cloudflare. Cloudflare doesn't treat them differently from any other site, they're not doing anything "to keep them down", their DNS product just has a focus that isn't compatible with archive.is' hunger for data. That you might connect to archive.is directly isn't of any concern. You might also not do that, and they've decided that leaking data about the user isn't what they want to do. It's not anticompetitive. It's not evil.
- dimensi0nal 5y ago
  archive.is doesn't compete with cloudflare, but they (or other websites) might want to spend money on improving their performance. cloudflare's dns resolver being popular makes one non-cloudflare option for improving website performance less appealing.
- fragmede 5y ago
  > Cloudflare doesn't treat them differently from any other site Did we read the same article? Cloudflare is treating them, and anybody else that makes the same choices wrt EDNS, differently from the rest of the Internet.
  - metalliqaz 5y ago
    I read the article, I'm pretty sure you are mistaken.
  - 5y ago

opan 5y ago

I have long hated Cloudflare, so it's hard to be on their side here. They MitM large parts of the web and often trap you in long or even infinite loops with their horrendous checker that some sites unfortunately use. It's especially bad on less common browsers. In two cases I had to spoof my useragent or it would literally never pass the check, locking me out of several sites. Even if the block was without reason, I would've thought "fair enough, Cloudflare sucks". It's weird to me how many people willingly use Google or Cloudflare DNS. I would have to be in quite the pinch to rely on either, like a site I need is blocked and I happen to remember their simple IPs, and also I can't use something like an ssh tunnel instead for some reason.

BenjiWiebe 5y ago
CloudFlare DNS is not the part that gives you the annoying anti bot checks. Those are from website operators who have opted in to the CDN and anti-DDoS services that CloudFlare offers.

tus89 5y ago

I can't resolve with either 8.8.8.8 or 1.1.1.1.

tus89 5y ago
I switched Chrome to use secure DNS with neither Croogle or CloudBlare (used OpenDNS) and now it works fine. Fuck the megacorps.
- jordemort 5y ago
  OpenDNS is owned by Cisco; it's not exactly a mom-and-pop operation.

koboll 5y ago

Out of curiosity - not defending the behavior - what kind of problems could omitting EDNS cause? What is the steelman case for Archive.is here? The author says Archive.is's claim that it causes problems is "questionable", but he doesn't mention what those purported problems are or address why they're illegitimate, so it's hard to evaluate whether that's accurate.

judge2020 5y ago
Archive.is uses ECS (edns client subnet, which sends the client IP's /24 to the authoritative resolver) for geo-based load balancing. The problem is that all IPs in a /24 are highly likely to belong to the same city for residential connections, so plugging it into a geoip service is likely to show the actual city & state that a request originates from (the entire point of ECS). https://twitter.com/archiveis/status/1018691421182791680 https://twitter.com/archiveis/status/1018691421182791680 (screenshot: https://aws1.discourse-cdn.com/cloudflare/original/3X/8/2/82f80904fab6661263389595d60ef7d9b7f16eaa.png https://aws1.discourse-cdn.com/cloudflare/original/3X/8/2/82... )
- saurik 5y ago
  But when the user goes to use the IP address they got back, even more detailed information is going to be given to the endpoint; I can see this maybe being a benefit for TXT records or something? Hiding ECS from DNS queries seems to mostly just further create imbalances between companies that can afford routing at the IP level over companies that want to do cheaper routing at the DNS level. (And like, if you attempt to directly mitigate the final IP problem by using a VPN or CG-NAT or something, that same solution will work for the DNS resolver, so I really am seeing no benefit.)
  - Hamuko 5y ago
    You can still do routing at DNS-level as long as you have a less dense infrastructure than Cloudflare. >1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results.

deleted 5y ago

[deleted]

Dylan16807 5y ago

> I wrote the following reply to Matthew, praising his team's focus on the big picture Okay great, but: > 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. > massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come The problem isn't really EDNS. And someone is either lying or very incorrect. This should be resolvable. The two sides don't want incompatible things. Has there been zero progress since?

raxi 5y ago
>> 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. Cloudflare makes an exception to this rule for Archive.{today,is,...} domains. All requests for this domains come from Amazon EC2 in the U.S., not the 180 edges of Cloudflare. This was on blog.archive.today. Why? Who knows. But the decision to break up is made by both parties, not just the archive. Source https://blog.archive.today/post/623568857709395968/i-from-the-region-which-block-archive-today-and https://blog.archive.today/post/623568857709395968/i-from-th...

dogsgobork 5y ago

I noticed a few days ago that it didn't work for me, but used a site up/down checker that also said it was down. Figured they were having issues and didn't think any more about it. I just added a static entry to my pihole, so it works for me now.

craigc 5y ago

> Sure, it's annoying that I'll need to use a VPN or change my DNS resolvers to use a pretty slick (and otherwise convenient) website archiver. You can alternatively look up the IP address using something other than Cloudflare DNS and add entries to your /etc/hosts file for archive.is and archive.today.

deleted 5y ago

[deleted]

jbreitbart 5y ago

In case you use pihole and want to use cloudflare for everything, but archive.is you can create the following file cat /etc/dnsmasq.d/02-archive.is.conf server=/archive.is/8.8.8.8 server=/archive.is/8.8.4.4 server=/archive.li/8.8.8.8 server=/archive.li/8.8.4.4 server=/archive.to/8.8.8.8 server=/archive.to/8.8.4.4

jbreitbart 5y ago
Fixed formating, sorry. cat -p /etc/dnsmasq.d/02-archive.is.conf server=/archive.is/8.8.8.8 server=/archive.is/8.8.4.4 server=/archive.li/8.8.8.8 server=/archive.li/8.8.4.4 server=/archive.to/8.8.8.8 server=/archive.to/8.8.4.4
- retox 5y ago
  There are quite a few different TLDs that the site uses (for resilience I presume). .vn is another, .today may still be in use.
creddit 5y ago
I never even thought of configuring my pihole to allow this. Thanks! Much appreciated!!
madars 5y ago
Similar for dnscrypt-proxy: add "forwarding_rules = '/etc/dnscrypt-proxy/forwarding_rules.txt'" to /etc/dnscrypt-proxy/dnscrypt-proxy.toml and then populate the forwarding_rules.txt with lines like "archive.is 8.8.8.8".

m463 5y ago

archive.is has some sketchy tracking built into it. I still use (the discontinued) umatrix with firefox and any archive.is request makes a lot of specific-to-you tracking pixels. like *.pixel.archive.is that drill down to your browser address

dang 5y ago

There have been at least two past threads about this: Tell HN: Unexpected errors with Archive.is on Cloudflare 1.1.1.1 DNS - https://news.ycombinator.com/item?id=23315640 https://news.ycombinator.com/item?id=23315640 - May 2020 (10 comments) Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1) - https://news.ycombinator.com/item?id=19828317 https://news.ycombinator.com/item?id=19828317 - May 2019 (197 comments) as well as god knows how many comments...

voldacar 5y ago

I don't fully understand how archive.is operates. They don't remove copyrighted content (which I like, since it provides a useful service), they must have probably terabytes upon terabytes of data in some datacenter somewhere, yet they never seem to be shut down by the govt or their datacenter/cloud provider. Am I just naive to be surprised by this? How does all this work exactly?

oenetan 5y ago
Fair use applies i think.
- voldacar 5y ago
  Things on archive.org get DMCA'ed all the time
  - urthor 5y ago
    I'm almost certain the actual reason is producing all the infrastructure to DMCA content on Google/Facebook/Twitter/Youtube and other "mainstream" Web 2.0 platforms is expensive. Copyright enforcement is a lot stricter on Youtube, than say, Reddit video. It's all down to the engagement of the IP owners. My guess is they just haven't gotten around to chasing Archive.is down that hard.
    - tinus_hn 5y ago
      It’s a value proposition. Archive.is doesn’t host Hollywood blockbusters. If it is hard to take them down, nobody is going to do that as long as they don’t cause to much real damage.
- kelnos 5y ago
  I don't think retaining and publishing complete copies of copyrighted works falls under even the most generous interpretation of fair use.
- contravariant 5y ago

HandstandMick 5y ago

There are a lot of emotions in the comments here today. CloudFlare provides a clear response and it has merit. Archive.is surely is not 100 reliant on this single mechanism to load share or determine correct routing to cache locations, I agree with the poster - I can't see a reason why they would block this via Cloudflare when so many other mechanisms they should already be deploying to satisfy their requirements across multiple layers in the stack exist. Edit: The position makes or made no sense and smells fishy.

wodenokoto 5y ago

There is so much I do not know about dns. I thought: I ask dns server about domain, they return an IP address. I connect to IP address and they in turn can see mine. So why does cloud flare need to a) query domain for IP address on my behalf? Can’t they just do it on their own behalf and cache the results? B) why do they need to hide my IP address information from the domain? Aren’t I going to visit the destination regardless?

blibble 5y ago
some people use the IP from the DNS query to return a server closer to you that's pretty much it

mercora 5y ago

i have no trouble to resolve www.archive.is via 1.1.1.1 at all... however, i noticed archive.is has a CNAME record pointing to www.archive.is while CNAME RR on apex domains are usually not allowed in DNS... what make this even more interesting, i only see the CNAME RR when querying via 1.1.1.1 and not when querying authoritative servers for archive.is (EDIT: while repeating the query via 1.1.1.1 i also saw both A and CNAME record for archive.is in the response :S) maybe the initial issue is just gone already? considering this is apparently happening in 2019 that does not seem too unlikely...

indianets 5y ago

I had a similar issue with VoWiFi on my network due to EDNS, and it's rightly pointed out by msilverlock in forum. # dig vowifi.jio.com @1.1.1.1 A ;; ANSWER SECTION: vowifi.jio.com. 5 IN A 49.45.63.1 vowifi.jio.com. 5 IN A 49.45.63.2 ;; SERVER: 1.1.1.1#53(1.1.1.1) # dig vowifi.jio.com @8.8.8.8 A ;; ANSWER SECTION: vowifi.jio.com. 4 IN A 49.44.59.36 vowifi.jio.com. 4 IN A 49.44.59.38 ;; SERVER: 8.8.8.8#53(8.8.8.8) https://community.cloudflare.com/t/vowifi-issues-due-to-possibly-bad-resolution/292568 https://community.cloudflare.com/t/vowifi-issues-due-to-poss... As the article links to and says "privacy versus convenience", and I am happy that CloudFlare chose the former.

nora-puchreiner 5y ago
That million Firefox users who chose Cloudflare DNS must know that chose "privacy versus convenience" too and be happy with that.

sebow 5y ago

(In case you need one) Quad9 DNS is far better imo than CF. Granted my ISP doesn't block many things already and it's fast, so the only concern for me is privacy, which the stated alternative seems to prioritize more than the others.