Slashdot Mirror
Cloudflare Launches 1.1.1.1 Consumer DNS Service With a Focus On Privacy (betanews.com)
BrianFagioli writes: Today, Cloudflare announces a new consumer DNS service with a focus on privacy. Called '1.1.1.1.' it quite literally uses that easy-to-remeber IP address as the primary DNS server. Why announce on April Fool's Day? Because the IP is four ones and today's date is 4/1 -- clever. The secondary server is 1.0.0.1 -- also easy to remember.
The big question is why? With solid offerings from Google and Comodo, for instance, does the world need another DNS service? The answer is yes, because Cloudflare intends to focus on both speed, and more importantly, privacy.
The big question is why? With solid offerings from Google and Comodo, for instance, does the world need another DNS service? The answer is yes, because Cloudflare intends to focus on both speed, and more importantly, privacy.
Looks good so far. The Piratebay is not censored (but is usually in my country), for example.
Like their wireless lan controllers.
Who is Ian?
Cloudflare is an American company which was funded as and began its life as a "honey-pot", where the owners realized that the only way to extend its reach was to grow and style it as a genuine business.
As an American company they also have to respond to and carry out orders from the NSA and CIA if there is a court order present (which there always is -- they have their own "courts").
There is a lot of power in being able to tell who is looking at what website, and being able to possibly redirect them elsewhere when needed. If you think for a second that your browsing is private and that this service will not be used for shady purposes, then you are kidding yourself.
This is the lowest IP number on the internet. Why isn't it worth more money, With a shortage of IPv4 addresses you would think getting the number 1 ip address would be worth millions.
From the article:
"What many Internet users don't realize is that even if you're visiting a website that is encrypted -- has the little green lock in your browser -- that doesn't keep your DNS resolver from knowing the identity of all the sites you visit. That means, by default, your ISP, every wifi network you've connected to, and your mobile network provider have a list of every site you've visited while using them," says Cloudflare.
How does this stop ISPs from knowing which sites you visit? Once Cloudfare's DNS serves up the IP address (instead of your ISP's DNS), you still need to send/receive traffic from that IP address, which the ISP can easily monitor. The only way to prevent this is to use a VPN, while making sure to use your VPN's DNS as well.
The Pirate bay was not censored for me. Fast.
On the surface, yes. But, there are a number of options available for transport privacy that do not require using a VPN (provided you actually trust Cloudflare not to use your data and are savvy enough to setup one of the options) https://developers.cloudflare....
Mind the gap...
I think you're confusing it with 10.x.x.x. Although I've seen others type 1 or 100 due to typos, no self respecting network admin would do that though.
Custom electronics and digital signage for your business: www.evcircuits.com
Their priorities make the service an interesting alternative to Quad9: https://www.globalcyberallianc...
Are they also going to offer DNS over TLS?
How is this better than OpenNIC and DNSCrypt? Remember that Cloudfare is the company that has a CEO that "woke up in a bad mood" and decided to ban a domain from their service. Yeah, it was a bunch of Nazis, but it shows that they're not really committed to freedom ... just freedom for points of view that don't irritate them.
Works faster than level 3, hello Cloudflare.
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
Not casting aspersions, but I've yet to see a reason why I (or anyone) should trust CF. The "KPMG" 'audit' reason is absolutely not sufficient, too.
The service is free and lures folks in with "fast". When a service is free, you're the product (see recent FB kerfuffle).
And, no IPv6 endpoint seems like a big missing component when "competitors" have it.
Mind the gap...
Dell IPMI defaults the network address to this ip when it doesn't get a response from the dhcp server. This makes this great feature incompatible with my network!
Could I suggest 10.1.1.1?
many sites per ip...
what happened to this place?
Dell IPMI
So the old maxim that the Internet routes around the damage is true!
Ezekiel 23:20
I think you're confusing it with 10.x.x.x.
I don't think they are. For example: https://supportforums.cisco.co...
Cloudflare lost all credibility after what they did to the Daily Stormer. Look: I'm sure CF thinks they'll protect your privacy, but that goes out the door someone thinks you're a "Nazi". And you're a Nazi these days if you believe there are fewer than 52 genders.
So fuck Cloudflare.
Just ran a benchmark of the service, here are my results:
Final benchmark results, sorted by nameserver performance:
(average cached name retrieval speed, fastest to slowest)
1. 0. 0. 1 | Min | Avg | Max |Std.Dev|Reliab%|
- Cached Name | 0.020 | 0.023 | 0.029 | 0.002 | 98.0 |
- Uncached Name | 0.022 | 0.090 | 0.287 | 0.075 | 100.0 |
- DotCom Lookup | 0.049 | 0.055 | 0.066 | 0.003 | 100.0 |
1dot1dot1dot1.cloudflare-dns.com
CLOUDFLARENET - Cloudflare, Inc., US
1. 1. 1. 1 | Min | Avg | Max |Std.Dev|Reliab%|
- Cached Name | 0.021 | 0.023 | 0.030 | 0.002 | 95.9 |
- Uncached Name | 0.022 | 0.096 | 0.325 | 0.082 | 100.0 |
- DotCom Lookup | 0.048 | 0.073 | 0.166 | 0.043 | 100.0 |
1dot1dot1dot1.cloudflare-dns.com
MEGAPATH2-US - MegaPath Networks Inc., US
8. 8. 4. 4 | Min | Avg | Max |Std.Dev|Reliab%|
+ Cached Name | 0.048 | 0.052 | 0.057 | 0.002 | 100.0 |
+ Uncached Name | 0.060 | 0.104 | 0.344 | 0.073 | 100.0 |
+ DotCom Lookup | 0.063 | 0.070 | 0.158 | 0.014 | 100.0 |
google-public-dns-b.google.com
GOOGLE - Google LLC, US
8. 8. 8. 8 | Min | Avg | Max |Std.Dev|Reliab%|
+ Cached Name | 0.049 | 0.053 | 0.060 | 0.002 | 98.0 |
+ Uncached Name | 0.057 | 0.106 | 0.367 | 0.077 | 100.0 |
+ DotCom Lookup | 0.063 | 0.073 | 0.156 | 0.020 | 100.0 |
google-public-dns-a.google.com
GOOGLE - Google LLC, US
But, there are a number of options available for transport privacy that do not require using a VPN (provided you actually trust Cloudflare not to use your data and are savvy enough to setup one of the options)
What alternate options does Cloudfare provide that don't require a VPN? I didn't see them mentioned in the link you provided. Is it an https tunnel through their servers?
Russian bots running on iPhone confirmed.
could we suggest getting a new network?
Why? 1/4 of course!
I am Slashdot. Are you Slashdot as well?
I just run my own. Not that hard.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
To note that in most IP parsing libraries (or at least the ones I'm familiar with) 1.1.1.1 can be also expressed as 1.1 (if less than four numbers the last number is interpreted on as many bits are left till 32). So you can now be cool and ping 1.1 or dig google.com @1.1., making the old favourite, 8.8.8.8, quite a mouthful in comparison.
some stupid vendors use the IP for Portal Authentication, for example: Cisco
https://www.quad9.net
They ate our & 's that day.
My ISP, and others I expect, log and retain DNS queries. And any (wifi) network you use can intercept and change a DNS response.
How is this new DNS server useful?
Cloudflare’s DNS will offer support for both DNS-over-TLS and DNS-over-HTTPS, and the company is hoping that its HTTPS support will see more browsers and operating systems support the protocol.
Did you try the alternate 1.0.0.1?
How does this stop ISPs from knowing which sites you visit? Once Cloudfare's DNS serves up the IP address (instead of your ISP's DNS), you still need to send/receive traffic from that IP address, which the ISP can easily monitor. The only way to prevent this is to use a VPN, while making sure to use your VPN's DNS as well.
While their attempt at privacy is comendable, I'll stick with my current setup:
* GlobalCyberAlliance's 9.9.9.9 as primay for added protection against nasties (not for me specificaly, but for the less tech savvy users in the houses).
* Google's 8.8.4.4 as alternate.
* And OpenDNS' at 208.67.222.222 for modems that support a thrid option.
Some people may preffer some other order, and there is nothing wrong with that . Perhaps priviledging OpenDNS' for the family friendly filtering, or Google's for raw speed and non-censorship...
My way gives me a nice balance of protection and speed, while avoiding the censorship of the State run ISP (CANTV Venezuela). But YMMV
*** Suerte a todos y Feliz dia!
He's the chap who works behind the counter at Walmart
many sites per ip...
That's only usually true for small shared-hosting sites or multiple services from a single entity.
what happened to this place?
The Dunning-Kruger is still strong though!
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Other easy to remember public DNS Servers
The original free, canonical, secure, privacy assured DNS by Verisign:
How fucking dumb can people be to not realize that?
That is intentional. Cloudflare has their own commercial DNS service and do not want businesses to piggyback of their services
Hopefully it's bettern than NortonDNS which I stopped using for performance reasons.
http://saveie6.com/
dns.globalcyberalliance.org uses an invalid security certificate.
The certificate is only valid for the following names: *.quad9.net, quad9.net
Error code: SSL_ERROR_BAD_CERT_DOMAIN
GlobalCyberAlliance
Their webpage looks and reads like a joke, like some evil Watch Dogs 3 corporation.They're looking for government contracts?
With this and all other attempts to provide privacy or security, what chain of trust allows me to believe that this is actually private or secure.
Surely there are many organizations with the resources to flood Slashdot with posts assuring me that this, or any other service, is secure.
Is TOR secure, or a NSA honeypot? How could I possibly know? Without personally having deep technical expertise, how can I trust anything.
An comments about tinfoil hats could be legit, or yet more planted posts.
We need a root source of trust or everything else falls apart.
Might as well let Facebook run a public DNS too then.
Both Facebook and Google are bilking us if we use their services, so any new public DNS on that scale is more than welcome.
Why help F'n'G make more money by using their "graciously" provided "free" services.
Fuck them, not CF.
Then they need to knock it the fuck off.
If you're going to squat on someone else's IP space, bad things start to happen.
Maybe Cisco should stop doing things to break the way IP works. There are reserved IP ranges just for that purpose.
Too bad Cisco uses this for a virtual IP in some o
Like their wireless lan controllers.
It is a shame so many "networking companies" can so badly fuckup basics of networking like that.
Remember when Linksys hard coded a bunch of public MIT server addresses as "internal" because they didn't know the most commonly used private-reserved IP block was 192.168.*.* and thought all IPs under 192.* were?
Or when Juniper hard coded 128.* as a blackhole range?
Back on the current topic, 1.0.0.0/8 was reserved for packet radio networks from 1981 until only 2010.
I can only imagine Cisco isn't alone in incorrectly utilizing it for their own purposes.
A prior company I worked for used the 14.* block internally as well, although partially in their defense the company and its internal networks predated RFC1918 by a couple of years, and the 14/8 was similarly reserved as 1/8 for unroutable traffic before any blocks of addresses were specifically allocated as such.
Cloudflare still constantly interferes with VPN connections and hasn't figured out how to distinguish between not traffic and real VPN traffic. It would be nice if they could focus on that. Normally I just AVOID sites with Cloudflare for that very reason.
What, you can't trust your government?
Well, then who CAN you trust? :)
Seriously the only chance you have at established trust anymore is a chain of trust bootstrapped from people you know, and utilizing the 6 degrees of separation (or whatever depth of networked trust you need) who in turn sign off on other certificates/people they have vetted and work from there. A blockchain like Bitcoin, only hashing chains of crypto identities would allow this, although the specifics of implementation and 'permission levels' of trust to range from 'unverified but believed trustworthy, up to 'verified as a trusted server/friend of many years' would be needed to successfully utilize this system, along with a reduction in trust for identities signing off on sites that have been proven untrustworthy.
I worked at a company whose core network was 192.0.0.0/24. It took me two years to get everything moved to a real private IP space.
Cheap storage VM.
for user data. move along, nothing interesting to see here
Do you find anything wrong with opendns?
Cloudflareâ(TM)s DNS will offer support for both DNS-over-TLS and DNS-over-HTTPS, and the company is hoping that its HTTPS support will see more browsers and operating systems support the protocol.
First time noticed DNS over HTTPS come across IETF announce I immediately assumed they want browsers to bypass our DNS filters and shared caches while creating brand new tracking opportunities.
Ever since then every time this has come up it's been the same BS justifications.
When RFC7873 is widely deployed then and only then will I mildly give a fuck about anything having to do with DNSSEC. Even then only in the context of TLSA. The concept of secure name lookup is rather pointless and redundant given underlying routing infrastructure is itself insecure.
Do they log?
Facebook, Google, Cloudfare, etc... all these companies are in the business of data collection. Your data.
Why don't you ask yourself why these services are free? Why would any company offer a free service?
Because you are submitting your personal data to them, and they are selling it.
So do you really think Cloudfare or anybody else gives a flying fuck about your privacy?
Who's the lesser evil? Google, Cloudfare, or your ISP? They all will sell you out.
insult me in Latin, et tu brute?
“Common sense is not so common.” — Voltaire
that's rich. that's fucking hilarious.
this is a company that not only sees where you go, but also what you do when you're there..... they track you across all their hosted or "protected" sites..... and they discriminate harshly against tor traffic.
cloudfare can fuck the hell right off.
(Parent poster again)
Yes I've both worked for and see many a company using public IP blocks internally.
Although in my case, all but one were not even technology companies so far as "computers" go.
I'm not saying doing that isn't wrong, but I'm willing to cut them much more slack for making the mistake as such things were far out of their field.
Also to be fair, at least the ones I am still in contact with have fixed their numbering long ago.
..saying
'Dead
U out U `FWD . CONTD in CONTD . CONCORD `GYPPED .
KL in U . U . U out U `U out U `U we bes U out U `
U U . U . U . U we bes U we bes U we bes U out U `
U `U `U . U . U `PELL `U `PELL `CONTD in GYPPED .
U . U U . U . U out U `U out U `U we bes U . U in
U in KL . U . U out U `U out U `U we bes U in U .
U out U `FWD . CONTD in CONTD . CONCORD `U out U `
Storage?'
Are you serious? I mean, we're on /. - the home for geeks and nerds - and you ask who the FUCK is Sir Ian McKellen? Only the greatest wizard of all time, Gandalf! And if you thought - for one second - about Harry Potter when I said wizard, we're going to banish you to theverge.com or some other godforesaken corner of the Internet!
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
CloudFlare
C:\Users\Norman>ping 2606:4700:4700::1111
Pinging 2606:4700:4700::1111 with 32 bytes of data:
Reply from 2606:4700:4700::1111: time=16ms
Reply from 2606:4700:4700::1111: time=16ms
Reply from 2606:4700:4700::1111: time=16ms
Reply from 2606:4700:4700::1111: time=16ms
Ping statistics for 2606:4700:4700::1111:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 16ms, Maximum = 16ms, Average = 16ms
Google
C:\Users\Norman>ping 2001:4860:4860::8888
Pinging 2001:4860:4860::8888 with 32 bytes of data:
Reply from 2001:4860:4860::8888: time=16ms
Reply from 2001:4860:4860::8888: time=16ms
Reply from 2001:4860:4860::8888: time=16ms
Reply from 2001:4860:4860::8888: time=16ms
Ping statistics for 2001:4860:4860::8888:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 16ms, Maximum = 16ms, Average = 16ms
uhm, that doesn't solve the problem though. Yes, they may not know what you're sending and receiving, but your ISP will still know who you're sending and receiving from.
It's funny how people are concerned about their ISP snooping on them ... and then they go and visit Facebook.
Tired of FB/Google censorship? Visit UNCENSORED!
Wonder how long before Cloudflare is offering a paid Passive DNS feed
Then open a support case with Dell and tell them they're violating RFC 3927: https://tools.ietf.org/html/rfc3927
by using a public IP they don't own.
They should be using 169.254.0.0/16 as all compliant devices do when no DHCP server responds.
How is this better than DNS Watch? They are a free, not ad-sponsered, privacy-focused DNS provider with goals of neutrality and anti-censorship.
Cloudflare is basically the Big Brother gatekeeper of the Internet at this point, with strong ties to the US. Them claiming "privacy" as something they care about is pretty absurd.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
Not in any WLC I have ever used
> Dell IPMI defaults the network address to this ip when it doesn't get a response from the dhcp server.
Already addressed in RFC3927 for quite some time. Have Dell update their firmware.
"169.254.0.0/16 - This is the "link local" block. As described in [RFC3927], it is allocated for communication between hosts on a single link. Hosts obtain these addresses by auto-configuration, such as when a DHCP server cannot be found."
Google name-based virtual hosting.
Your ISP knows which IP addresses you connected to, but a single IP address may host multiple sites.
The real "Libtards" are the Libertarians!
Guess you dont serve a guest TOS agreement page?
And they can tell what site you accessed based on the HOST header or the SNI parameter when negotiating SSL...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Ian is an intern there. Theyâ(TM)re developing hardware theyâ(TM)re going to implant in him to make him fetch coffee via remote control
Those idiots couldn't vend a working update to their own modifications of intels bmc sdk. I think mentioning rfc would break their minds.
Otherwise you would be pro-Unicode (and contra emoji crap [including literally] in Unicode).
And by which damned host name you just looked up with DNS, even if you didn't use their names servers, because DNS is not encrypted.
Cisco does not use anything other than RFC1918 reserved blocks. They are actually incredibly diligent about that.
On their website, Cloudflare makes a big deal out of the privacy their DNS service provides--even citing the probability that ISPs collect and store data from those who use their (ISPs) DNS. Yet, as others have pointed out in this thread, the ISP can still log all of the IP addresses their customers connect to. What could really be gained, in terms of privacy, by using 1.1.1.1 or any other DNS service?
NR
I run my own recursor that points to the roots. pdns-recursor on linux. even in a vm is superior to any other solution I've tried.
First time noticed DNS over HTTPS come across IETF announce I immediately assumed they want browsers to bypass our DNS filters and shared caches while creating brand new tracking opportunities.
Of course they want the browser to control it. How else are they going to scrape the info before it's encrypted? If the user is using something like dnscrypt, Google won't have access to that data stream anymore. That makes Google has a sad.
If you use third-party DNS then two people know.
Cisco 2504 Wireless Controller uses 1.1.1.1 as a login page for certain types of wifi authentication, usually set up for guests.
so Gandalf became Magneto?
Yes - the Red Wizard!
Browsing at +1 - no ACs, I ignore their posts. So refreshing!