4 ms·

As neutrally as possible: Cloudflare doesn't support the DNS Extension that sends part of clients' IPs to the upstream resolver (https://en.m.wikipedia.org/wik

As neutrally as possible: Cloudflare doesn't support the DNS Extension that sends part of clients' IPs to the upstream resolver (https://en.m.wikipedia.org/wiki/EDNS_Client_Subnet https://en.m.wikipedia.org/wiki/EDNS_Client_Subnet). Cloudflare believes this is better for privacy. Archive.is doesn't like this (because it prevents DNS-based CDN routing), and thus has a hardcoded exception to intentionally return bogus results to Cloudflare's resolvers.

tomrod 3y ago
> thus has a hardcoded exception to intentionally return bogus results to Cloudflare's resolvers. This is a bad practice.
- giancarlostoro 3y ago
  why in the world are they doing that I wonder.
  - sccxy 3y ago
    Personal hate against big tech companies?
  - wlonkly 3y ago
    Explanation is here: https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=36971650
- kljsdflkjsaf 3y ago
  [flagged]
542458 3y ago
I think it's also worth noting that Cloudflare's implementation is EDNS compliant. The EDNS extension for sending the client subnet is explicitly optional in the standard.
eli 3y ago
It prevents DNS-based CDN routing in the particular way Archive wants to do it.
silotis 3y ago
Cloudflare's lack of EDNS doesn't prevent DNS based routing. It can still be done based on the DNS request's source address. This will be the IP of the Cloudflare POP closest to the client. Lack of EDNS only makes DNS based routing slightly worse if your CDN has a POP density similar-or-greater-than Cloudflare's.
- Scaevolus 3y ago
  Correct. Cloudflare's POP routing is quite extensive, and I'd be shocked if archive.is had more than a handful of backends it's routing to. Even so, why would an extra few dozen ms matter at all? Archive.is appears to be spindle-limited, is a client with marginally higher RTT an issue? The admin is silly. https://www.cloudflare.com/network/ https://www.cloudflare.com/network/
  - jrochkind1 3y ago
    It seems so silly and mysterious that it makes me wonder if archive.today wants exact client IP addresses for some other unstated reason. (It's not clear how/if archive.today, a possibly illegal site, brings in revenue?). The whole thing is very odd.
    - arkadiyt 3y ago
      > it makes me wonder if archive.today wants exact client IP addresses for some other unstated reason They still get the client ip from the request to the service itself (unless you're using a VPN, but if you're using a VPN then archive wouldn't get your ip from your DNS request either).
    - depr 3y ago
      There is another reason but it is stated here: https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=36971650 (routing people to the nearest server _outside_ their own country).
  - mike_d 3y ago
    Do you happen to have a mapping of Cloudflare IP space to physical POPs? To the best of my knowledge they do not publish this, which makes it quite a chore to track all their edge locations manually.
andrewla 3y ago
If I understand this correctly, that's hilarious -- Cloudflare is essentially saying that nobody can layer their own cloudflare-like offering on top of their DNS. Edge-routing is their bread and butter! If you want to use the client's IP geolocation to resolve a CNAME to an edge server, this blocks you from doing so. You have to buy Cloudflare's products to get this benefit, and use their edge servers.
- NicoJuicy 3y ago
  No, they don't, please read this before making unresearched guesses ( note: I had the same reaction at first a couple of years ago). They forward every info that is required for cdn's to function, that's why no other cdn's are complaining. See the statement of the CEO: https://news.ycombinator.com/item?id=19828317 https://news.ycombinator.com/item?id=19828317 Tldr: > We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets. We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security.
  - andrewla 3y ago
    Thanks for the clarification and link! I do think that this has the effect of locking customers into Cloudflare's geoip data, which seems a little sketchy. The operator of archive.is claims that the data itself is bad[1] but I can't speak to his biases or motivations. If the data is incomplete or bad, then you gain an advantage by using Cloudflare's services over rolling your own or using a competitor if a large number of customers are using their DNS, so I think the original point does stand. And if you are a competitor, your ability to compete with greater edge capacity or more targeted edge capacity is nonexistent. [1] https://twitter.com/archiveis/status/1018691421182791680 https://twitter.com/archiveis/status/1018691421182791680
handsclean 3y ago
There are two missing facts here that change the story quite a bit: - In addition to not supporting EDNS, Cloudflare sends DNS requests from effectively random PoPs, so the recipient doesn’t know even the visitor’s nationality. - The reason archive.is doesn’t like this is it makes them vulnerable to DoS attack. Source and details: https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=36971650

tomrod 3y ago

> thus has a hardcoded exception to intentionally return bogus results to Cloudflare's resolvers. This is a bad practice.

giancarlostoro 3y ago
why in the world are they doing that I wonder.
- sccxy 3y ago
  Personal hate against big tech companies?
- wlonkly 3y ago
  Explanation is here: https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=36971650
kljsdflkjsaf 3y ago
[flagged]

542458 3y ago

I think it's also worth noting that Cloudflare's implementation is EDNS compliant. The EDNS extension for sending the client subnet is explicitly optional in the standard.

eli 3y ago

It prevents DNS-based CDN routing in the particular way Archive wants to do it.

silotis 3y ago

Cloudflare's lack of EDNS doesn't prevent DNS based routing. It can still be done based on the DNS request's source address. This will be the IP of the Cloudflare POP closest to the client. Lack of EDNS only makes DNS based routing slightly worse if your CDN has a POP density similar-or-greater-than Cloudflare's.

Scaevolus 3y ago
Correct. Cloudflare's POP routing is quite extensive, and I'd be shocked if archive.is had more than a handful of backends it's routing to. Even so, why would an extra few dozen ms matter at all? Archive.is appears to be spindle-limited, is a client with marginally higher RTT an issue? The admin is silly. https://www.cloudflare.com/network/ https://www.cloudflare.com/network/
- jrochkind1 3y ago
  It seems so silly and mysterious that it makes me wonder if archive.today wants exact client IP addresses for some other unstated reason. (It's not clear how/if archive.today, a possibly illegal site, brings in revenue?). The whole thing is very odd.
  - arkadiyt 3y ago
    > it makes me wonder if archive.today wants exact client IP addresses for some other unstated reason They still get the client ip from the request to the service itself (unless you're using a VPN, but if you're using a VPN then archive wouldn't get your ip from your DNS request either).
  - depr 3y ago
    There is another reason but it is stated here: https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=36971650 (routing people to the nearest server _outside_ their own country).
- mike_d 3y ago
  Do you happen to have a mapping of Cloudflare IP space to physical POPs? To the best of my knowledge they do not publish this, which makes it quite a chore to track all their edge locations manually.

andrewla 3y ago

If I understand this correctly, that's hilarious -- Cloudflare is essentially saying that nobody can layer their own cloudflare-like offering on top of their DNS. Edge-routing is their bread and butter! If you want to use the client's IP geolocation to resolve a CNAME to an edge server, this blocks you from doing so. You have to buy Cloudflare's products to get this benefit, and use their edge servers.

NicoJuicy 3y ago
No, they don't, please read this before making unresearched guesses ( note: I had the same reaction at first a couple of years ago). They forward every info that is required for cdn's to function, that's why no other cdn's are complaining. See the statement of the CEO: https://news.ycombinator.com/item?id=19828317 https://news.ycombinator.com/item?id=19828317 Tldr: > We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets. We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security.
- andrewla 3y ago
  Thanks for the clarification and link! I do think that this has the effect of locking customers into Cloudflare's geoip data, which seems a little sketchy. The operator of archive.is claims that the data itself is bad[1] but I can't speak to his biases or motivations. If the data is incomplete or bad, then you gain an advantage by using Cloudflare's services over rolling your own or using a competitor if a large number of customers are using their DNS, so I think the original point does stand. And if you are a competitor, your ability to compete with greater edge capacity or more targeted edge capacity is nonexistent. [1] https://twitter.com/archiveis/status/1018691421182791680 https://twitter.com/archiveis/status/1018691421182791680

handsclean 3y ago

There are two missing facts here that change the story quite a bit: - In addition to not supporting EDNS, Cloudflare sends DNS requests from effectively random PoPs, so the recipient doesn’t know even the visitor’s nationality. - The reason archive.is doesn’t like this is it makes them vulnerable to DoS attack. Source and details: https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=36971650