9 ms·

Just so we’re on the same page: Cloudflare decided globally not to include client IP in the EDNS data. Then archive.is decided to block Cloudflare’s resolvers f

by akerl_ 5y ago

Just so we’re on the same page: Cloudflare decided globally not to include client IP in the EDNS data. Then archive.is decided to block Cloudflare’s resolvers from getting accurate records for their site. To circumvent this, Cloudflare would have to reverse their global stance or make a special exception to satisfy archive.is. It’s unclear how we could draw “anticompetitive” from this.

silisili 5y ago
Understood, but why? Privacy is not an acceptable answer for the reasons OP stated. If Cloudflare gave a coherent, understandable reason, I'd probably be more on their side. "Trust us, our network is big enough it will route right" is both not a good answer, nor true.
- akerl_ 5y ago
  Privacy isn’t an absolute pass/fail. Giving authoritative nameservers my IP via EDNS leaks my IP. Sure, other things also leak my IP, but that doesn’t mean we should throw in the towel and accept any new way to leak user data. In many cases, DNS logs aren’t going to the same place as web server logs, so this keeps my data in fewer log files owned by fewer people.
  - cortesoft 5y ago
    It isn’t the actual IP, it is the subnet. Leaks some info, but unless you own the entire subnet it won’t give up your identity. https://en.wikipedia.org/wiki/EDNS_Client_Subnet https://en.wikipedia.org/wiki/EDNS_Client_Subnet
    - judge2020 5y ago
      The entire point of ECS is to give the location, not the actual origin IP, which might be something you'd like to avoid giving away. The main point is that every resolver or network switch in the chain gets the ECS and would be able to combine it with the domain being requested. If you don't only visit Facebook/Google, your ipv4 /24 in combination with some obscure domain only you visit is very likely to give up your identity should an IX or resolver be watching for requests to such domain.
      - cortesoft 5y ago
        Sure, that is true. However, the person I responded to said that EDNS would give the authoritative server your IP address, which isn't true.
      - silisili 5y ago
        I understand that point, to an extent. I mean, your TCP connection in the next step hits how many switches on the way? With which both your actual IP therefore location could be determined. Trying to hide subnet from just a resolver seems...small in the grand scheme. And if that's your goal, why not proxy your dns requests? I'd surely have a VPN or at least DNS proxy if my threat model were that which you're trying to avoid.
metalliqaz 5y ago
He didn't mean anticompetitive towards Archive.is, he meant with all content providers in general. By making them all less capable of delivering low-latency content, it makes Cloudfare appear better by comparison. Not sure how likely that would be but I'm pretty sure that was OP's meaning.
raxi 5y ago
Cloudflare (Matthew Prince personally, here on Hacker News few months ago) said that they do reverse that their global stance for Netflix and some other megacorps. So this is a super-premium feature unavailable to small players. CloudFlare just changed how DNS behaved and charge corps to make it work as it worked before CloudFlare entered the stage.
- akerl_ 5y ago
  Do you have a citation for that? Sourcing from https://news.ycombinator.com/item?id=19828702 https://news.ycombinator.com/item?id=19828702 , they don’t reverse their global stance for large providers. Their stance is ~”Including client IP via EDNS violates our goal of maximizing user data privacy”, and what they’re working on with other large-scale providers is a way to improve geo-resolution without weakening user privacy.
  - raxi 5y ago
    Exactly on your link, just ctrl-F for "Netflix": "We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation". Well, I might be inaccurate in saying "exactly the same protocol as before", but it is clear that what was available to every webmaster via EDNS, now available only to members of a closed club, via good old EDNS or a proprietary alternative. The latter is more likely, not because of privacy-caring, but because they could now charge it as license fee for using private protocol.
    - akerl_ 5y ago
      EDNS is an optional field. Client subnet is an optional part of that optional field. It’s relatively new compared to DNS as a whole, and most “webmasters” don’t make active use of it. The quote you pulled is about Cloudflare’s efforts to build a better standard. They’re talking to the people with the expertise and interest to build that standard. You’ve inferred “proprietary” and “closed club”, and a ton of motive besides, and you’ve copy-pasted that speculation as if it were fact into multiple comment trees.

by akerl_ 5y ago

silisili 5y ago

Understood, but why? Privacy is not an acceptable answer for the reasons OP stated. If Cloudflare gave a coherent, understandable reason, I'd probably be more on their side. "Trust us, our network is big enough it will route right" is both not a good answer, nor true.

akerl_ 5y ago
Privacy isn’t an absolute pass/fail. Giving authoritative nameservers my IP via EDNS leaks my IP. Sure, other things also leak my IP, but that doesn’t mean we should throw in the towel and accept any new way to leak user data. In many cases, DNS logs aren’t going to the same place as web server logs, so this keeps my data in fewer log files owned by fewer people.
- cortesoft 5y ago
  It isn’t the actual IP, it is the subnet. Leaks some info, but unless you own the entire subnet it won’t give up your identity. https://en.wikipedia.org/wiki/EDNS_Client_Subnet https://en.wikipedia.org/wiki/EDNS_Client_Subnet
  - judge2020 5y ago
    The entire point of ECS is to give the location, not the actual origin IP, which might be something you'd like to avoid giving away. The main point is that every resolver or network switch in the chain gets the ECS and would be able to combine it with the domain being requested. If you don't only visit Facebook/Google, your ipv4 /24 in combination with some obscure domain only you visit is very likely to give up your identity should an IX or resolver be watching for requests to such domain.
    - cortesoft 5y ago
      Sure, that is true. However, the person I responded to said that EDNS would give the authoritative server your IP address, which isn't true.
    - silisili 5y ago
      I understand that point, to an extent. I mean, your TCP connection in the next step hits how many switches on the way? With which both your actual IP therefore location could be determined. Trying to hide subnet from just a resolver seems...small in the grand scheme. And if that's your goal, why not proxy your dns requests? I'd surely have a VPN or at least DNS proxy if my threat model were that which you're trying to avoid.

metalliqaz 5y ago

He didn't mean anticompetitive towards Archive.is, he meant with all content providers in general. By making them all less capable of delivering low-latency content, it makes Cloudfare appear better by comparison. Not sure how likely that would be but I'm pretty sure that was OP's meaning.

raxi 5y ago

Cloudflare (Matthew Prince personally, here on Hacker News few months ago) said that they do reverse that their global stance for Netflix and some other megacorps. So this is a super-premium feature unavailable to small players. CloudFlare just changed how DNS behaved and charge corps to make it work as it worked before CloudFlare entered the stage.

akerl_ 5y ago
Do you have a citation for that? Sourcing from https://news.ycombinator.com/item?id=19828702 https://news.ycombinator.com/item?id=19828702 , they don’t reverse their global stance for large providers. Their stance is ~”Including client IP via EDNS violates our goal of maximizing user data privacy”, and what they’re working on with other large-scale providers is a way to improve geo-resolution without weakening user privacy.
- raxi 5y ago
  Exactly on your link, just ctrl-F for "Netflix": "We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation". Well, I might be inaccurate in saying "exactly the same protocol as before", but it is clear that what was available to every webmaster via EDNS, now available only to members of a closed club, via good old EDNS or a proprietary alternative. The latter is more likely, not because of privacy-caring, but because they could now charge it as license fee for using private protocol.
  - akerl_ 5y ago
    EDNS is an optional field. Client subnet is an optional part of that optional field. It’s relatively new compared to DNS as a whole, and most “webmasters” don’t make active use of it. The quote you pulled is about Cloudflare’s efforts to build a better standard. They’re talking to the people with the expertise and interest to build that standard. You’ve inferred “proprietary” and “closed club”, and a ton of motive besides, and you’ve copy-pasted that speculation as if it were fact into multiple comment trees.