5 ms·

This is obviously not Cloudflare's fault, but I wonder why they don't just mask their identity (e.g. by using a random AWS IP address) when querying archive.is?

This is obviously not Cloudflare's fault, but I wonder why they don't just mask their identity (e.g. by using a random AWS IP address) when querying archive.is? AFAICT this wouldn't "violate the integrity of DNS and the privacy and security promises we made to our users" and would solve a big pain point of using 1.1.1.1.

freedomben 3y ago
I'm not affiliated with CF at all, but if I were I would oppose that idea on a couple levels. Philosophically I think that lacks respect for the site owner and it would be wrong to deceive them and go against their wishes. Pragmatically that sounds like a giant maintenance pain in the ass to manage, and not worth the time/money to make somebody's site work who actively doesn't want it to work.
eastdakota 3y ago
We’ve tried. The owner of Archive.is actively monitors and then returns bad results. This is true even if we recurse through another recursor. It’s a very odd hill to die on.
- dataflow 3y ago
  I think I'm missing something, but is there a way you can pass along some some sort of vague location info for caching purposes without revealing too much? From their tweet they mentioned even continent level information isn't available, which I can understand. Is there really no middle ground that works here?
  - afavour 3y ago
    From another post the CEO made it sounds like they could do a bunch of things but don’t think they should. Which I understand. Once you start adding workarounds for specific domains I can imagine the whole thing spiralling quickly. The owner of archive.is doesn’t want the traffic, CF probably shouldn’t move heaven and earth in response.
    - dataflow 3y ago
      I don't see what I proposed as a domain specific workaround, it should be done for all domains I think.
  - xnyanta 3y ago
    Continent-level information doesn't exist. EDNS Client Subnet doesn't send a location, it sends a subnet. Its "location" then has to be looked up in geolocation databases which may or may not be accurate. There's no subnet that will map to a continent.
    - DanAtC 3y ago
      Network blocks are issued by regional registries: https://upload.wikimedia.org/wikipedia/commons/9/95/Regional_Internet_Registries_world_map.svg https://upload.wikimedia.org/wikipedia/commons/9/95/Regional...
- diogocp 3y ago
  That's as annoying as it is impressive.
- Fabricio20 3y ago
  Have you guys considered just having the resolver not return anything? Such that my system would fallback to another resolver (such as Google or Quad9) and I wouldn't have issues accessing the site? I guess that still has the privacy implications.. but at least it would work!
  - dreadlordbone 3y ago
    The whole point is that they don't want to break any core DNS functionality with a band aid fix just because one website doesn't like it.

freedomben 3y ago

I'm not affiliated with CF at all, but if I were I would oppose that idea on a couple levels. Philosophically I think that lacks respect for the site owner and it would be wrong to deceive them and go against their wishes. Pragmatically that sounds like a giant maintenance pain in the ass to manage, and not worth the time/money to make somebody's site work who actively doesn't want it to work.

eastdakota 3y ago

We’ve tried. The owner of Archive.is actively monitors and then returns bad results. This is true even if we recurse through another recursor. It’s a very odd hill to die on.

dataflow 3y ago
I think I'm missing something, but is there a way you can pass along some some sort of vague location info for caching purposes without revealing too much? From their tweet they mentioned even continent level information isn't available, which I can understand. Is there really no middle ground that works here?
- afavour 3y ago
  From another post the CEO made it sounds like they could do a bunch of things but don’t think they should. Which I understand. Once you start adding workarounds for specific domains I can imagine the whole thing spiralling quickly. The owner of archive.is doesn’t want the traffic, CF probably shouldn’t move heaven and earth in response.
  - dataflow 3y ago
    I don't see what I proposed as a domain specific workaround, it should be done for all domains I think.
- xnyanta 3y ago
  Continent-level information doesn't exist. EDNS Client Subnet doesn't send a location, it sends a subnet. Its "location" then has to be looked up in geolocation databases which may or may not be accurate. There's no subnet that will map to a continent.
  - DanAtC 3y ago
    Network blocks are issued by regional registries: https://upload.wikimedia.org/wikipedia/commons/9/95/Regional_Internet_Registries_world_map.svg https://upload.wikimedia.org/wikipedia/commons/9/95/Regional...
diogocp 3y ago
That's as annoying as it is impressive.
Fabricio20 3y ago
Have you guys considered just having the resolver not return anything? Such that my system would fallback to another resolver (such as Google or Quad9) and I wouldn't have issues accessing the site? I guess that still has the privacy implications.. but at least it would work!
- dreadlordbone 3y ago
  The whole point is that they don't want to break any core DNS functionality with a band aid fix just because one website doesn't like it.