Comment by dimensi0nal
5 years ago
amazing how cloudflare has framed this anticompetitve move as a privacy thing.
it doesn't matter if your dns resolver leaks part of your ip address to archive.is's dns servers when you're about to connect to archive.is from your ip address anyway. the only thing dropping the edns client subnet does is prevent services you use from giving you a server that's closer to you when you do the dns lookup. this performance issue, of course, does not affect sites using cloudflare.
Just so we’re on the same page: Cloudflare decided globally not to include client IP in the EDNS data. Then archive.is decided to block Cloudflare’s resolvers from getting accurate records for their site.
To circumvent this, Cloudflare would have to reverse their global stance or make a special exception to satisfy archive.is.
It’s unclear how we could draw “anticompetitive” from this.
Understood, but why? Privacy is not an acceptable answer for the reasons OP stated. If Cloudflare gave a coherent, understandable reason, I'd probably be more on their side.
"Trust us, our network is big enough it will route right" is both not a good answer, nor true.
Privacy isn’t an absolute pass/fail. Giving authoritative nameservers my IP via EDNS leaks my IP. Sure, other things also leak my IP, but that doesn’t mean we should throw in the towel and accept any new way to leak user data.
In many cases, DNS logs aren’t going to the same place as web server logs, so this keeps my data in fewer log files owned by fewer people.
4 replies →
He didn't mean anticompetitive towards Archive.is, he meant with all content providers in general. By making them all less capable of delivering low-latency content, it makes Cloudfare appear better by comparison. Not sure how likely that would be but I'm pretty sure that was OP's meaning.
Cloudflare (Matthew Prince personally, here on Hacker News few months ago) said that they do reverse that their global stance for Netflix and some other megacorps.
So this is a super-premium feature unavailable to small players.
CloudFlare just changed how DNS behaved and charge corps to make it work as it worked before CloudFlare entered the stage.
Do you have a citation for that? Sourcing from https://news.ycombinator.com/item?id=19828702 , they don’t reverse their global stance for large providers. Their stance is ~”Including client IP via EDNS violates our goal of maximizing user data privacy”, and what they’re working on with other large-scale providers is a way to improve geo-resolution without weakening user privacy.
19 replies →
No I didn’t.
EDNS is an optional feature in general. Client subnet is even more optional.
There may not be a whole lot of private information in the client subnet, especially since it seems likely that after querying for an A/AAAA record, a client would then send a packet to (one of) the resulting IP(s) and reveal their address, but it's not required to pass it on, and it it seems better to reduce potentially private information passed on.
Can we not call literally everything "anticompetitive"? archive.is isn't a competitor of Cloudflare. Cloudflare doesn't treat them differently from any other site, they're not doing anything "to keep them down", their DNS product just has a focus that isn't compatible with archive.is' hunger for data.
That you might connect to archive.is directly isn't of any concern. You might also not do that, and they've decided that leaking data about the user isn't what they want to do.
It's not anticompetitive. It's not evil.
> Cloudflare doesn't treat them differently from any other site
Did we read the same article? Cloudflare is treating them, and anybody else that makes the same choices wrt EDNS, differently from the rest of the Internet.
Cloudflare treats everybody the same: they never include client subnet in the EDNS field.
Archive.is is manually having their nameservers respond w/ junk records when queried by Cloudflare’s resolvers.
I read the article, I'm pretty sure you are mistaken.
archive.is doesn't compete with cloudflare, but they (or other websites) might want to spend money on improving their performance. cloudflare's dns resolver being popular makes one non-cloudflare option for improving website performance less appealing.