LogicX

Max IOPS is still only 64,000 though?

Correct. We have agents for desktops (Windows, MacOS, Linux) as well as Mobile (Android, iOS) We basically run a service that listens for dns requests on port 53 loop back IP, and then we change system DNS to point to that loopback IP.

Now we can do a bunch of things with the traffic between your machine and us: like inject edns0 data to authenticate requests, shift traffic between our anycast networks, and encrypt you’re traffic using DNS over TLS!

Author and CTO of DNSFilter here; for any questions.

Agree - came here concerned Telia backbone routers had an issue...

Just to be clear, this would be more appropriately titled How we saved money moving from AWS to VPS providers.

It comes as little surprise to me that the AWS lightsail offering saved them money over traditional AWS services, just as they’d save even more using two dedicated servers with any reasonable provider and being able to have a hot-failover for everything.

At DNSFilter we’ve gone through the evolution of Heroku -> AWS -> VPSs -> Dedicated -> and now are setting up our first colo rack.

I did a price comparison recently between Dedicated, AWS, and Colo. Dedicated is 15% the cost of AWS for our needs, and colo will be 42% the cost of Dedicated for us.

Now keep in mind we have dedicated DevOps staff and are running at a very different scale from OP, and such a solution is not for everyone. But I personally have never understood the folks who love to brag about having spent much time and effort optimizing AWS to spin up and spin things down, when for the same cost I could just have a 10x more powerful server sitting there, on all the time to handle a spike in load, and I can utilize the extra resources or get things done faster with faster gear at 1/10th the price.

I respect and agree with your rant. CTO and Co-Founder of DNSFilter here.

When we get a complaint that our recursive servers are returning an 'old IP' as if we did something wrong... I start by explaining that they likely didn't properly lower their TTL prior to making a change.

Sadly we'll never win this battle; so at some point in the future we'll need to join the likes of google in providing a page to force cache expiration of domains at customers request :/

https://developers.google.com/speed/public-dns/cache

Agreed. There's a lot of 'magic' that goes into running a quality recursive resolver, least of which is eDNS0 and EDNS Client Subnet - which intentionally returns different answers based on the requester's source IP -- in most cases for the most-optimal CDN location to be returned.

Test with:

dig @ns1.google.com www.google.es +subnet=193.8.172.75/24

dig @ns1.google.com www.google.es +subnet=157.88.0.0/16

Note how you get different IPs returned.

Just to add to the discussion -- 'whats happening in the background' -- more specifically is your operating system's stub resolver.

So when you ask for www.amazon.com it ends up making multiple DNS lookups, as www.amazon.com is a CNAME record.

Nothing about this CNAME lookup gets passed back up the stack to your application; you just get that end-result: the IP address.

host www.amazon.com www.amazon.com is an alias for tp.47cf2c8c9-frontier.amazon.com. tp.47cf2c8c9-frontier.amazon.com is an alias for www.amazon.com.edgekey.net. www.amazon.com.edgekey.net is an alias for e15316.e22.akamaiedge.net. e15316.e22.akamaiedge.net has address 23.204.68.114

You should add your company and contact info to your HN profile.

I was recently looking into ytalk/talkd which is the old-school way to do such things...

Very cool, now I must decide between tmate and streamhut!

As said DNS operator (founder and CTO of DNSFilter.com) - I concur. We’ve been offering DoT for years, but are about to improve the offering with 0-RTT support.

We’re also working on POCs of DoH support, but it’s mostly moot compared to our DoT offerings which cover the whole OS, not just the browser.

Cicadas are what you’re looking for!

https://nypost.com/2020/04/16/seventeen-year-cicadas-are-abo...

SolarWinds was private 2015-2018 but went public again in 2018.

I always announce to the wait staff that I have a Gluten Allergy.

This typically leads down one of two paths: 1) Them apologizing and explaining about shared fryers, cross-contamination, etc. 2) Them asking if it’s Celiac, understanding, and listing how they’ll accommodate me so I don’t get sick.

If those don’t happen then it may be a sign to abort and leave if they don’t know what to say, have to get others, don’t offer to talk to the kitchen staff, etc.

I was diagnosed Celiac in 2008.

I recently moved to Boulder, CO and wow is life easier here: Everyone knows about and understands Celiac Disease. There are hundreds of restaurants with options in the greater Denver area, many of them 100% Gluten Free. I basically use this app many times a day: https://www.findmeglutenfree.com/

I just went to the 4 year celebration this weekend of my favorite Brewery: http://www.holidailybrewing.com/ - which was the nation’s first 100% Gluten Free Brewery. Had two different IPAs there today, and they had three gluten free food trucks in the parking lot today.

This place is like a celiac oasis! Love it here! Also plenty of grocery options, locally made breads and pastries. Though the ‘cake’ (literally) goes to http://www.mariposabaking.com in Oakland for best gluten free pastries - Been visiting them for over a decade. Was just there this week. Amazing!

I’m recently divorced, and sometimes it was a struggle eating at home with my ex-wife who was not gluten free.

I’ve traveled a lot to countries where they didn’t even understand what an allergy was (Ecuador was the worst).

These cards are a life-saver when traveling to countries where the language is not your native tongue: https://www.celiactravel.com/cards

CVS Pharmacy has “Gluten-Aid” pills which use a natural enzyme to break down gluten - I always carry these pills with me, and if I'm in a questionable food situation, maybe cross-contamination concern... I take the pill. Helps get through questionable days and allows for more travel.

Until you gain a comfort level of how to know whether to trust food/restaurants, you may wish to look into a gadget: https://blog.nimasensor.com/ which tests for gluten in food.

Anyone run any real-world performance comparisons on what this defer change did to the performance of their application?

... or you just deploy it on any VPS or bare metal with dokku installed: http://dokku.viewdocs.io/dokku/

This is the advice I give early stage startups... don’t waste cycles learning the AWS stack, and getting locked in. Just pay for a cheap VPS, and scale it vertically as you grow. By the time you outgrow vertical scaling you should have the revenue or funding to figure out your at scale architecture.

You’d be surprised how much you can handle with a single beefy VPS or dedicated.

You should look into DoT instead

My brother just had serious back surgery. We've been dropping him at the store entrance, and picking him up. He can sit fine, but walking is difficult. I can see this being a benefit for certain people with injuries or disabilities.

Yes, I think it's actually out of vogue now, but a few years ago it was trendy to describe things as bougey:

bougey

(pronounced: boo-G) a condensed version of the word bourgeoise, used to refer to capitalists, the upper class, gaudiness, and profit-oriented viewpoints

http://bougey.urbanup.com/4157958

Or positioned another way, this is Yak Shaving:

Any seemingly pointless activity which is actually necessary to solve a problem which solves a problem which, several levels of recursion later, solves the real problem you're working on.

http://yak-shaving.urbanup.com/1164318

We're a remote company, and due to issues we experienced with employees too far off from the core team timezone (US Eastern) - having no overlapping hours slowed down productivity and caused issues. We now have a guideline to be in a timezone 6 hours or less away. Obviously this can stretch if someone prefers to work other hours and does so consistently... however what we don't want to happen is we post 'these are our team hours' and someone is eager beaver to interview for the job, and claims they can work those hours, but never has before, and doesn't stick to it after being hired.

So per your example, I can't actually specify Europe-Remote, because I don't care if you're in Colombia, Brazil, US, UK.. just works two hours overlap with US Eastern 9-5.

I understand your frustration. I just wanted to share an employer perspective. I don't have a great solution besides that we're always upfront in our job postings about the 6 hour timezone from US Eastern guideline.

TECs are a pretty awesome tech - I plan to build a cooling pad for my dog in my camper van which water cools the hot side to a radiator mounted under the floor, outside. Modeled on this YouTube video where he makes a freezer: https://youtu.be/RkSR4rTl2GY

FWIW, there's a standard being developed to allow network admins to maintain control over DNS on their networks, even after this is enabled.

Disclaimer: I run a competing service.

India is difficult. I run our anycast network and we have coverage in India but I look forward to improved routing there in the future with additional transit providers.

It seems nextdns is announcing exclusively with Vultr: https://bgp.he.net/net/5.182.208.0/24

Which is not in India: https://www.vultr.com/locations/

There’s a large distinction between BGP announcing and running a properly balanced anycast network. Vultr is not designed for this, they have limited bgp community strings - so running an anycast network there will work either only with select locations, or with sinkholes pulling in traffic from far away.

I can confirm we run across transparent dns proxying with customers at DNSFilter all the time. Mobile carriers are the worst for doing this.

A few days ago it was a customers compromised router doing it.

For those curious about what is going on here...

Cloudflare has decided for privacy reasons they will not relay eDNS0 client subnet data - which yes, can reveal a portion of the IP of the requestor - but is used by CDN services in order to provide nearest servers or (in some cases) country specific content.

My guess here is archive.is feels they have some need to restrict what content is provided to where in the world, and as a result, without ECS in the request, takes you to a cname which essentially null routes you back to your local loop interface.

Source: Founder of DNSFilter.com - we support ECS, I coded it.

I'm not sure what you're expecting to accomplish now?

When you have a priced round, either their SAFE is valid and they convert, or it's not and they don't, and they sue you if they don't agree with your interpretation of the contract...

But until that day, what're you hoping to accomplish now?