Hacker News Reader

Comment by saurik | Hacker News Reader

But when the user goes to use the IP address they got back, even more detailed information is going to be given to the endpoint; I can see this maybe being a benefit for TXT records or something?

Hiding ECS from DNS queries seems to mostly just further create imbalances between companies that can afford routing at the IP level over companies that want to do cheaper routing at the DNS level.

(And like, if you attempt to directly mitigate the final IP problem by using a VPN or CG-NAT or something, that same solution will work for the DNS resolver, so I really am seeing no benefit.)

View on HN

You can still do routing at DNS-level as long as you have a less dense infrastructure than Cloudflare.

>1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results.

>> 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results.

Cloudflare makes an exception to this rule for Archive.{today,is,...} domains. All queries for this domains come from Amazon EC2 in the U.S., not the 180 edges of Cloudflare. This was on blog.archive.today. Why? Who knows. But the decision to break up is made by both parties, not just the archive.

Source?

https://blog.archive.today/post/623568857709395968/i-from-th...

There was another answer I could not find quickly where that is named here "another free dns service" was named Amazon.

Amazon doesn't make any sense as the "another free DNS service" since they're described as free and "much smaller than Cloudflare", and Amazon is neither of those things.

And in any case, if I assume that Cloudflare is indeed proxying all DNS queries for Archive.today through some shitty EC2 instance that causes Archive.today to not have any geo information, it's a completely self-inflicted wound. They could've gotten geographical data from 1.1.1.1 to the accuracy of the edge nodes but decided to just outright block 1.1.1.1.

To add, I can't find any other evidence of this. This community post was posted on the same day as that blog entry, and archive.is still isn't loading: https://community.cloudflare.com/t/getting-servfail-for-some...

Amazon is indeed not a "another free DNS service", that should have to be in different points of time. Overloaded a "free DNS service" they launched an EC2 instance, or vice versa.

> They could've gotten geographical data from 1.1.1.1 to the accuracy of the edge nodes but decided to just outright block 1.1.1.1.

Yes.

But they cannot get back in time to getting information from the edges simple by unblocking.

Since CloudFlare sends queries not from the edges.

So there is a deadlock atm.

Reply on news.ycombinator.com