Slashdot Mirror
Cloudflare Launches 1.1.1.1 Consumer DNS Service With a Focus On Privacy (betanews.com)
BrianFagioli writes: Today, Cloudflare announces a new consumer DNS service with a focus on privacy. Called '1.1.1.1.' it quite literally uses that easy-to-remeber IP address as the primary DNS server. Why announce on April Fool's Day? Because the IP is four ones and today's date is 4/1 -- clever. The secondary server is 1.0.0.1 -- also easy to remember.
The big question is why? With solid offerings from Google and Comodo, for instance, does the world need another DNS service? The answer is yes, because Cloudflare intends to focus on both speed, and more importantly, privacy.
The big question is why? With solid offerings from Google and Comodo, for instance, does the world need another DNS service? The answer is yes, because Cloudflare intends to focus on both speed, and more importantly, privacy.
Looks good so far. The Piratebay is not censored (but is usually in my country), for example.
Like their wireless lan controllers.
Who is Ian?
Cloudflare is an American company which was funded as and began its life as a "honey-pot", where the owners realized that the only way to extend its reach was to grow and style it as a genuine business.
As an American company they also have to respond to and carry out orders from the NSA and CIA if there is a court order present (which there always is -- they have their own "courts").
There is a lot of power in being able to tell who is looking at what website, and being able to possibly redirect them elsewhere when needed. If you think for a second that your browsing is private and that this service will not be used for shady purposes, then you are kidding yourself.
From the article:
"What many Internet users don't realize is that even if you're visiting a website that is encrypted -- has the little green lock in your browser -- that doesn't keep your DNS resolver from knowing the identity of all the sites you visit. That means, by default, your ISP, every wifi network you've connected to, and your mobile network provider have a list of every site you've visited while using them," says Cloudflare.
How does this stop ISPs from knowing which sites you visit? Once Cloudfare's DNS serves up the IP address (instead of your ISP's DNS), you still need to send/receive traffic from that IP address, which the ISP can easily monitor. The only way to prevent this is to use a VPN, while making sure to use your VPN's DNS as well.
The Pirate bay was not censored for me. Fast.
On the surface, yes. But, there are a number of options available for transport privacy that do not require using a VPN (provided you actually trust Cloudflare not to use your data and are savvy enough to setup one of the options) https://developers.cloudflare....
Mind the gap...
I think you're confusing it with 10.x.x.x. Although I've seen others type 1 or 100 due to typos, no self respecting network admin would do that though.
Custom electronics and digital signage for your business: www.evcircuits.com
Their priorities make the service an interesting alternative to Quad9: https://www.globalcyberallianc...
Are they also going to offer DNS over TLS?
How is this better than OpenNIC and DNSCrypt? Remember that Cloudfare is the company that has a CEO that "woke up in a bad mood" and decided to ban a domain from their service. Yeah, it was a bunch of Nazis, but it shows that they're not really committed to freedom ... just freedom for points of view that don't irritate them.
Works faster than level 3, hello Cloudflare.
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
Not casting aspersions, but I've yet to see a reason why I (or anyone) should trust CF. The "KPMG" 'audit' reason is absolutely not sufficient, too.
The service is free and lures folks in with "fast". When a service is free, you're the product (see recent FB kerfuffle).
And, no IPv6 endpoint seems like a big missing component when "competitors" have it.
Mind the gap...
Dell IPMI
So the old maxim that the Internet routes around the damage is true!
Ezekiel 23:20
I think you're confusing it with 10.x.x.x.
I don't think they are. For example: https://supportforums.cisco.co...
Cloudflare lost all credibility after what they did to the Daily Stormer. Look: I'm sure CF thinks they'll protect your privacy, but that goes out the door someone thinks you're a "Nazi". And you're a Nazi these days if you believe there are fewer than 52 genders.
So fuck Cloudflare.
Just ran a benchmark of the service, here are my results:
Final benchmark results, sorted by nameserver performance:
(average cached name retrieval speed, fastest to slowest)
1. 0. 0. 1 | Min | Avg | Max |Std.Dev|Reliab%|
- Cached Name | 0.020 | 0.023 | 0.029 | 0.002 | 98.0 |
- Uncached Name | 0.022 | 0.090 | 0.287 | 0.075 | 100.0 |
- DotCom Lookup | 0.049 | 0.055 | 0.066 | 0.003 | 100.0 |
1dot1dot1dot1.cloudflare-dns.com
CLOUDFLARENET - Cloudflare, Inc., US
1. 1. 1. 1 | Min | Avg | Max |Std.Dev|Reliab%|
- Cached Name | 0.021 | 0.023 | 0.030 | 0.002 | 95.9 |
- Uncached Name | 0.022 | 0.096 | 0.325 | 0.082 | 100.0 |
- DotCom Lookup | 0.048 | 0.073 | 0.166 | 0.043 | 100.0 |
1dot1dot1dot1.cloudflare-dns.com
MEGAPATH2-US - MegaPath Networks Inc., US
8. 8. 4. 4 | Min | Avg | Max |Std.Dev|Reliab%|
+ Cached Name | 0.048 | 0.052 | 0.057 | 0.002 | 100.0 |
+ Uncached Name | 0.060 | 0.104 | 0.344 | 0.073 | 100.0 |
+ DotCom Lookup | 0.063 | 0.070 | 0.158 | 0.014 | 100.0 |
google-public-dns-b.google.com
GOOGLE - Google LLC, US
8. 8. 8. 8 | Min | Avg | Max |Std.Dev|Reliab%|
+ Cached Name | 0.049 | 0.053 | 0.060 | 0.002 | 98.0 |
+ Uncached Name | 0.057 | 0.106 | 0.367 | 0.077 | 100.0 |
+ DotCom Lookup | 0.063 | 0.073 | 0.156 | 0.020 | 100.0 |
google-public-dns-a.google.com
GOOGLE - Google LLC, US
But, there are a number of options available for transport privacy that do not require using a VPN (provided you actually trust Cloudflare not to use your data and are savvy enough to setup one of the options)
What alternate options does Cloudfare provide that don't require a VPN? I didn't see them mentioned in the link you provided. Is it an https tunnel through their servers?
Why? 1/4 of course!
I am Slashdot. Are you Slashdot as well?
I just run my own. Not that hard.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
To note that in most IP parsing libraries (or at least the ones I'm familiar with) 1.1.1.1 can be also expressed as 1.1 (if less than four numbers the last number is interpreted on as many bits are left till 32). So you can now be cool and ping 1.1 or dig google.com @1.1., making the old favourite, 8.8.8.8, quite a mouthful in comparison.
A zero host address in the local subnet in IPv4 means a reference to the local network. No matter your subnet length, 1.0.0.0 will always have a zero host address. 0/8 is reserved for "Local Identification". So 1.0.0.1 is the lowest valid IPv4 address.
So now we have DNS servers on 1.1.1.1, 4.4.4.4, and 8.8.8.8. Who has 2.2.2.2 and can they put a DNS server on it?
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
https://www.quad9.net
They ate our & 's that day.
So now we have DNS servers on 1.1.1.1, 4.4.4.4, and 8.8.8.8. Who has 2.2.2.2
OK, all these different numerical addresses are starting to get confusing. Someone ought to invent some kind of protocol to automatically map human-readable names onto these obscure numbers.
I looked it up. France telecom.
Whois has 2.2.0.0/16 assigned to France Telecom Orange and 2.2.2.2 isn't pingable at the moment.
Trying to become famous by taking photos. Visit my homepage please.
Nah. it's valid. If you have the IP routed to your device, there are ways to listen and respond on it.
Did you try the alternate 1.0.0.1?
How does this stop ISPs from knowing which sites you visit? Once Cloudfare's DNS serves up the IP address (instead of your ISP's DNS), you still need to send/receive traffic from that IP address, which the ISP can easily monitor. The only way to prevent this is to use a VPN, while making sure to use your VPN's DNS as well.
While their attempt at privacy is comendable, I'll stick with my current setup:
* GlobalCyberAlliance's 9.9.9.9 as primay for added protection against nasties (not for me specificaly, but for the less tech savvy users in the houses).
* Google's 8.8.4.4 as alternate.
* And OpenDNS' at 208.67.222.222 for modems that support a thrid option.
Some people may preffer some other order, and there is nothing wrong with that . Perhaps priviledging OpenDNS' for the family friendly filtering, or Google's for raw speed and non-censorship...
My way gives me a nice balance of protection and speed, while avoiding the censorship of the State run ISP (CANTV Venezuela). But YMMV
*** Suerte a todos y Feliz dia!
He's the chap who works behind the counter at Walmart
OK, all these different numerical addresses are starting to get confusing. Someone ought to invent some kind of protocol to automatically map human-readable names onto these obscure numbers.
One one one one
Four four four four
Eight eight eight eight
#DeleteChrome
many sites per ip...
That's only usually true for small shared-hosting sites or multiple services from a single entity.
what happened to this place?
The Dunning-Kruger is still strong though!
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Other easy to remember public DNS Servers
That is intentional. Cloudflare has their own commercial DNS service and do not want businesses to piggyback of their services
Hopefully it's bettern than NortonDNS which I stopped using for performance reasons.
http://saveie6.com/
With this and all other attempts to provide privacy or security, what chain of trust allows me to believe that this is actually private or secure.
Surely there are many organizations with the resources to flood Slashdot with posts assuring me that this, or any other service, is secure.
Is TOR secure, or a NSA honeypot? How could I possibly know? Without personally having deep technical expertise, how can I trust anything.
An comments about tinfoil hats could be legit, or yet more planted posts.
We need a root source of trust or everything else falls apart.
Maybe Cisco should stop doing things to break the way IP works. There are reserved IP ranges just for that purpose.
Too bad Cisco uses this for a virtual IP in some o
Like their wireless lan controllers.
It is a shame so many "networking companies" can so badly fuckup basics of networking like that.
Remember when Linksys hard coded a bunch of public MIT server addresses as "internal" because they didn't know the most commonly used private-reserved IP block was 192.168.*.* and thought all IPs under 192.* were?
Or when Juniper hard coded 128.* as a blackhole range?
Back on the current topic, 1.0.0.0/8 was reserved for packet radio networks from 1981 until only 2010.
I can only imagine Cisco isn't alone in incorrectly utilizing it for their own purposes.
A prior company I worked for used the 14.* block internally as well, although partially in their defense the company and its internal networks predated RFC1918 by a couple of years, and the 14/8 was similarly reserved as 1/8 for unroutable traffic before any blocks of addresses were specifically allocated as such.
1.1.1.1 valid cloudflare
2.2.2.2 invalid owned by Orange S.A. according to RIPE
3.3.3.3 invalid owned by Amazon
4.4.4.4 invalid owned by Level 3 Communications, Inc
5.5.5.5 invaild owned by TelefÃnica Germany
6.6.6.6 invalid owned by Headquarters, USAISC
7.7.7.7 invalid owned by DoD Network Information Center
8.8.8.8 valid google
9.9.9.9 valid quad9
Minimum threshold fixed. Thanks!
This is the lowest IP number on the internet.
And yet it doesn't seem any more favorable than my own IP address. It doesn't have ocean views, doesn't get discounts at the local restaurant, and the chicks don't really give a damn. Also thanks to the service run on it you never need to give a damn what your IP address is.
So what makes it so valuable in you eyes?
You're forgetting 9.9.9.9 which is https://www.quad9.net/ and also a DNS server.
6.6.6. the network of the Beast
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
I worked at a company whose core network was 192.0.0.0/24. It took me two years to get everything moved to a real private IP space.
Cheap storage VM.
also 1.0.0.1, that's cloudflare's backup DNS.
Cheap storage VM.
Cloudflareâ(TM)s DNS will offer support for both DNS-over-TLS and DNS-over-HTTPS, and the company is hoping that its HTTPS support will see more browsers and operating systems support the protocol.
First time noticed DNS over HTTPS come across IETF announce I immediately assumed they want browsers to bypass our DNS filters and shared caches while creating brand new tracking opportunities.
Ever since then every time this has come up it's been the same BS justifications.
When RFC7873 is widely deployed then and only then will I mildly give a fuck about anything having to do with DNSSEC. Even then only in the context of TLSA. The concept of secure name lookup is rather pointless and redundant given underlying routing infrastructure is itself insecure.
insult me in Latin, et tu brute?
“Common sense is not so common.” — Voltaire
Are you serious? I mean, we're on /. - the home for geeks and nerds - and you ask who the FUCK is Sir Ian McKellen? Only the greatest wizard of all time, Gandalf! And if you thought - for one second - about Harry Potter when I said wizard, we're going to banish you to theverge.com or some other godforesaken corner of the Internet!
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
CloudFlare
C:\Users\Norman>ping 2606:4700:4700::1111
Pinging 2606:4700:4700::1111 with 32 bytes of data:
Reply from 2606:4700:4700::1111: time=16ms
Reply from 2606:4700:4700::1111: time=16ms
Reply from 2606:4700:4700::1111: time=16ms
Reply from 2606:4700:4700::1111: time=16ms
Ping statistics for 2606:4700:4700::1111:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 16ms, Maximum = 16ms, Average = 16ms
Google
C:\Users\Norman>ping 2001:4860:4860::8888
Pinging 2001:4860:4860::8888 with 32 bytes of data:
Reply from 2001:4860:4860::8888: time=16ms
Reply from 2001:4860:4860::8888: time=16ms
Reply from 2001:4860:4860::8888: time=16ms
Reply from 2001:4860:4860::8888: time=16ms
Ping statistics for 2001:4860:4860::8888:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 16ms, Maximum = 16ms, Average = 16ms
2.2.2.2 is Orange (France Telecom) according to whois data.
Just found out that I own 10.10.10.10, so I'm putting my DNS there to mark my territory.
On a worldwide corporate network that I maintain, we set up 10.10.10.0/24 as an Anycast space so that we can have 10.10.10.10 answer as the DNS server for every location.
Tired of FB/Google censorship? Visit UNCENSORED!
It's funny how people are concerned about their ISP snooping on them ... and then they go and visit Facebook.
Tired of FB/Google censorship? Visit UNCENSORED!
Then open a support case with Dell and tell them they're violating RFC 3927: https://tools.ietf.org/html/rfc3927
by using a public IP they don't own.
They should be using 169.254.0.0/16 as all compliant devices do when no DHCP server responds.
How is this better than DNS Watch? They are a free, not ad-sponsered, privacy-focused DNS provider with goals of neutrality and anti-censorship.
Cloudflare is basically the Big Brother gatekeeper of the Internet at this point, with strong ties to the US. Them claiming "privacy" as something they care about is pretty absurd.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
> Dell IPMI defaults the network address to this ip when it doesn't get a response from the dhcp server.
Already addressed in RFC3927 for quite some time. Have Dell update their firmware.
"169.254.0.0/16 - This is the "link local" block. As described in [RFC3927], it is allocated for communication between hosts on a single link. Hosts obtain these addresses by auto-configuration, such as when a DHCP server cannot be found."
Google name-based virtual hosting.
Your ISP knows which IP addresses you connected to, but a single IP address may host multiple sites.
The real "Libtards" are the Libertarians!
I wish we could trust the government. I'd hope that in a democracy we could and they would provide that - but sadly we can't.
So we now have
1.1.1.1
9.9.9.9
8.8.8.8
4.4.4.4
I'm sure it's just a coincidence
Maybe Cloudflare avoids him, too. Fuck, a lot of people know fuck all about VPN'S and think they do.
And they can tell what site you accessed based on the HOST header or the SNI parameter when negotiating SSL...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
That sounds like added hassle for no good reason.
And by which damned host name you just looked up with DNS, even if you didn't use their names servers, because DNS is not encrypted.
Cisco does not use anything other than RFC1918 reserved blocks. They are actually incredibly diligent about that.
On their website, Cloudflare makes a big deal out of the privacy their DNS service provides--even citing the probability that ISPs collect and store data from those who use their (ISPs) DNS. Yet, as others have pointed out in this thread, the ISP can still log all of the IP addresses their customers connect to. What could really be gained, in terms of privacy, by using 1.1.1.1 or any other DNS service?
NR
I run my own recursor that points to the roots. pdns-recursor on linux. even in a vm is superior to any other solution I've tried.
in soviet russia cloudflare avoids you?
I could add 10.2.3.0 alias to my linux box but Windows 10 said no. That's incorrect on Linux, no?
Yes - the Red Wizard!
Browsing at +1 - no ACs, I ignore their posts. So refreshing!