Hacker News Reader

Comment by dsl | Hacker News Reader

It is obvious Cloudflare has no interest in operating a real recursive DNS service. If they did, they would have provided additional backup IPs for users they knew would be impacted by these issues.

Building a production service on what even APNIC refers to as "research space" was foolish. If this was Cloudflares only line of business, they never would have taken such a risk.

View on HN

We (Cloudflare and APNIC) knew exactly what we were getting in to. We knew this was the only way that we'd be able to reclaim the space to be usable. And, in about a month, we've gone from 1.1.1.1 being routable by only 92% of networks to 98.7% of networks — and climbing. Don't accept that you can't change the status quo.

The space is allocated for research. To what end do you imagine it will be "usable", and for whom?

Well, it appears to be usable to 98.7% of networks for DNS lookups;)

No it was not.

1.0.0.0/8 was unassigned space until 2010 when it was assigned to APNIC. It was never "allocated for research" and the reason nobody wanted it is all the cross-talk with internal devices using something they shouldn't have.

Whois literally says 1.1.1.0/24 is a research prefix.

  netnum:        1.1.1.0 - 1.1.1.255
  netname:        APNIC-LABS
  descr:          APNIC and Cloudflare DNS Resolver project
  descr:          Routed globally by AS13335/Cloudflare
  descr:          Research prefix for APNIC Labs

APNIC designated 1.0.0.0/24 and 1.1.1.0/24 out of the whole /8 to APNIC Labs for "research" because they were getting so much bogus traffic. That just happened a few years ago.

I know.

I’m one of the first 100 users Cloudflare had sign up when it launched. I know because you sent me a t-shirt with my domain (and the 99 others) on it.

I switched over to your new DNS service the day it launched. I’m also an AT&T customer both residential and for corporate useage. It’s been fun giving them trouble to get them to route this correctly.

Hopefully this is behind us now and the ip becomes properly routable by even larger parts of the Internet as you grow this.

One question though, is there a plan to add typo correction? It’s the only thing I miss from using OpenDNS.

Thanks for being an early adopter! I've misplaced my version of that tshirt, which is a serious bummer. Remember working with our designer to hide all the "naughty" domains in the rays of the Cloudflare sun. :-)

I doubt we'll do typo correction. We're DNS purists. DNS should answer what you ask. Doing otherwise opens many cans of worms.

Bummer on the shirt! It is a great design. Although, I'm biased since your team gave my domain a prominent placement.

That position on typo correction is a bummer. I fat finger typing domains on occasion and found it handy to have my DNS service take care of that for me. Hopefully in time you guys reconsider. I am sure common errors could be corrected and it would lead to a better browsing experience for folks using your service.

Thanks though for making such an excellent service free and fast! Love the work you do!

How would that even work? You'd get certificate errors on any TLS site with typo-correcting-dns right?

I think they reply with their own HTTP server IP, which then redirects you to the "correct" address.

I assume it breaks if you type a wrong https:// address, but I guess few people do that, they just type the domain and let the site redirect to https:// if needed.

I love how this service is actually improving the 1/8 situation. It’s a very cool solution to a challenging problem. Well executed!

This is one of the things I love about HN - someone can post an inane and inaccurate slam of a free service, and the CEO of the company providing said service responds in a clear and friendly manner.

It's not inane and inaccurate, I also think running a DNS on 1.1.1.1 is fucking stupid

Why, exactly? Be specific.

It's a weird address that was going to cause problems like this

It's a nice, short, memorable address that Cloudflare has every right to use. What's wrong here?

But exactly like the commenter stated. Part of the goal is to fix IPs like this being inaccesible. This DNS is both easy to access and using what should be, a perfectly accessible IP

What's weird about it? It's a valid IP address, the fact that they are all 1's isn't noteworthy except it's easy to remember.

It seems a somewhat popular pattern for DNS:

1.1.1.1 1dot1dot1dot1.cloudflare-dns.com

2.2.2.2 not found

3.3.3.3 not found

4.4.4.4 not found

5.5.5.5 not found

6.6.6.6 not found

7.7.7.7 not found

8.8.8.8 google-public-dns-a.google.com

9.9.9.9 dns.quad9.net

Because some ATT and Cisco devices use that address already. There is no reason to need to remember it.

Cloudflare does offer a backup IP: 1.0.0.1. And 2 IPv6 addresses as well.

But it's a fairly low risk for both cloudflare and users.

Just about all systems I've worked on allow multiple DNS IP addresses, so just set an alternate.

Cloudflare doesn't make any money from this (aside from the advertising it's giving them), so it doesn't really harm them that it's broken due to 3rd party abuse/issues.

I think that would be counter-productive. One of the main goals is to do research on how the 1.1.1.1-like addresses work in the real world. Offering a nice and free DNS service on those addresses is almost just a side-effect, which obviously triggers real-world reactions and uproar when ISPs fail to route properly. If they had offered backup addresses, maybe ISP customers wouldn't complain as loudly, and the media / attention levels would have been lower.

They did. They are publicising 1.1.1.1 since it's easy to remember. But they said you can also use 1.0.0.1

Which is really handy. When testing if you're online, running "ping 1.1" is far quicker than "ping 8.8.8.8" or "ping 1.1.1.1"

Why am I today just learning that `ping` will stuff 0's into octets you omit from an address? All of the keystrokes I could have saved and minutes on the phone I could have saved doing `ping 192.168.1` instead!

It's not omitting and it's not just zeros: try `ping 127.256` and `ping 127.65536`.

It's not ping. It's a common C library routine used by quite a number of programs that does this. And this is old behaviour of that library function, that has been around for decades. Here's FreeBSD's library function from 1994, and it was fairly old then:

* https://github.com/dspinellis/unix-history-repo/blob/FreeBSD...

I am even MORE surprised that Windows PING also supports this!

Remember the windows IP stack originated from the BSD stack

Ah yeah, forgot that. :)

Today I also learned. Thanks!

AT&T using 1.1.1.1 as part of its internal network is even more foolish then.

That bigger idiots exist in the universe doesn't diminish your own stupidity.

Reply on news.ycombinator.com