[Kwpolska]

1.1.1.2 is their malware-blocking DNS, and 1.1.1.3 is their parental-controls DNS. If you want an unfiltered DNS, use 1.1.1.1 - which resolves archive.today just fine, although archive.today itself refuses to work on Cloudlfare DNS.

[sgbeal]

> 1.1.1.2 is their malware-blocking DNS, and 1.1.1.3 is their parental-controls DNS. ...

TIL, thank you. Time to go tweak my pi-hole server...

[arvid-lind]

I'm just curious, given all the other options that respect your privacy and don't put data collection at the center of their business model, why do you use Cloudflare on your pi-hole?

[sgbeal]

> why do you use Cloudflare on your pi-hole?

Because "if it ain't broke, don't fix it." i'm not one of those users who want to endlessly tweak their ad blocker. i want to set it up, clicking as few checkboxes as necessary to get it going, and then leave it. However, (now) knowing that Cloudflare filters different only each of their servers, i'm incentivized to go tweak a number in the config (as opposed to researching the pros and cons of every possible provider, a detail i truly have no interest in pursuing).

[OJFord]

If you mean you had 1.1.1.2 as a secondary, and don't want it to have a different configuration, you can use 1.0.0.1 along with 1.1.1.1 instead.

[sgbeal]

> If you mean you had 1.1.1.2 as a secondary, and don't want it to have a different configuration, you can use 1.0.0.1 along with 1.1.1.1 instead.

i had no clue which one was active. It was, for me, just a checkbox at the time. This thread prompted me to go check and tweak appropriately.

[daymanstep]

Which options respect your privacy?

[diarrhea]

I use unbound (recursive resolver), and AdGuard Home as well (just forwards to unbound). Unbound could do ad-blocking itself as well, but it's more cumbersome than in AGH. So I use two tools for the time being.

The upside is there's no single entity receiving all your queries. The downside is there's no encryption (IIRC root servers do not support it), so your ISP sees your queries (but they don't receive them).

[dannyfritz07]

I'll throw https://nextdns.io into the mix. Been very happy with it. Supports DOH, block lists, among a plethora of other features.

[ranger_danger]

The ones where you don't send a single company all of your queries

[travoc]

AdGuard DNS servers are excellent.

[nom]

quad9

[TZubiri]

what is the vector here? dns traffic is practically anonymous, there would have to be some very specific and purposeful trickery going on to link dns traffic to an identity. It sounds like something more hypothetical than a tangible threat model

[hirako2000]

It isn't anonymous. DNS server resolve, IP addresses by hostnames. It cannot then inspect further traffic but it certainly can log your IP address and all URL's a given IP ever hit.

Since ISP know your identity, and all it takes is to (request and get) the DNS logs and ISP servitude for all sort of questionable information, you as an identity are giving away all sites domains you visit.

[sgbeal]

> It cannot then inspect further traffic but it certainly can log your IP address and all URL's a given IP ever hit.

Correction: they can log host names/IPs, not URLs. The path of any given URL is part of the HTTP header, invisible to onlookers (assuming HTTP and assuming HTTPS is uncracked).

[hirako2000]

I can't edit. That is correct. URLs can't be known to a DNS server. Just the hostname and IP.

[TZubiri]

Considering that the DNS in question is third-party, that is, it's independent from the ISP. Then the DNS and the ISP will not share data with each other on a routine basis, which would make this concern negligible for every day traffic.

So to simplify, the DNS provider has a map of IPs to Domains visited, while the other hand an ISP has a map of IP addresses to identities.

To even cross-reference the data, the ISP and the DNS provider would need to partner, and violate their privacy guarantees.

At the very least it's obvious that using a separate DNS provider than your ISP's provides additional anonimity by decentralizing your traffic. Although this comes with a tradeoff, having 2 providers increases the odds of partial leaks.

This analysis is so overkill for your personal traffic that it borders tinfoil territory, if we are in a professional setting and are discussing the competitive data of a company or that of thousands of users, then this level of scrutiny is merited, but as-is, separating your DNS provider from your ISP is already very marginal and a bit paranoid. Evaluating the DNS providers to such an extent that a huge security company with good legal standing would somehow qualify as unsafe, for the traffic of one user, I stress, is paralyzingly over-engineering the security of an infrastructure that has already been secured such that users don't need to know what a DNS and how to configure it in order to have safe and private internet.

Imagine going to the bank and asking the teller for a withdrawal but not disclosing the amount and coming up with a mechanism to withdraw without anyone from the bank knowing what you withdrew. Sure, it increases your security, but also come on, what are we doing here?

[arvid-lind]

> A Cloudflare Ray ID is an identifier given to every request that goes through Cloudflare.

https://developers.cloudflare.com/fundamentals/reference/clo...

if you think a little creatively about how this information could be used by an organization that was created at the insistence of the United States Department of Homeland Security, then you're on the right track.

[acdha]

This is a silly conspiracy theory: the ray ID references the specific CDN edge server which processed your request.

Even the request ID is not what you’re implying: that’s unique for a single request, but it’s not public and anyone who has your HTTPS payload has equivalent tracking capabilities.

[mat_b]

I did some experimenting recently and I'm quite convinced that when I use Comcasts DNS they are selling it to advertisers. I've switched to 1.1.1.1 simply because it annoys me that Comcast is doing this.

[edoceo]

How could that experiment work?

[fn-mote]

Resolve the hostnames but don’t visit the sites. RefrigeratorFixit.com, StoveBrand.com, ConsumerReports.org.

See that you start getting ads for kitchen appliances.

[TZubiri]

Today we are one of the lucky 10k

[surgical_fire]

I have no idea why anyone would use Cloudflare DNS, much less trust their more filtered versions.

[saaaaaam]

I use cloudflare DNS because it’s faster. But should I worry, having read your comment? What is the downside to using it? What would you recommend instead?

[surgical_fire]

Quad9.

Many years ago I used Cloudflare, and more than once I had issues with them blocking websites I wanted to access.

I absolutely despise that. I want my DNS to resolve domain names, nothing else.

For blocking things I have Pi-Hole, which is under my control for that reason. I can blacklist or whitelist addresses to my needs, not to the whims of a corporation that wants to play gatekeeper to what I can browse.

[akerl_]

So… why not use 1.1.1.1, cloudflare’s resolver that does not block resolution?

1.1.1.2 and .3 are explicitly offered with filtered responses.

[surgical_fire]

I used to use 1.1.1.1. I still had issues.

Quad9 behaves exactly as I expect a DNS to work, in the sense that I only remember I use it when the topic of DNS pops up.

[akerl_]

Your claim was that 1.1.1.1 was blocking sites.

Are you saying now you just had issues with the quality of service? Or do you want to provide more details to substantiate the claim that they were blocking sites?

[hirako2000]

Because that would be subject to the whim of the provider, who subject to court orders would have to oblige to continue operating as US entity.

[akerl_]

How does that differ from Quad9? You’re subject to Swiss laws, so there’s still a government involved? And you’re now hosted in an area where the US government has far fewer limitations on what they can attempt.

[ranger_danger]

Why give all your queries to a single company with an interest in tracking you and selling your data?

[saaaaaam]

But don’t most ISPs do this? And if you use google’s DNS, for example, are they not doing this? Does cloudflare sell the data?

[ranger_danger]

IMO all the more reason to run your own resolver and not just forward every query to a single entity.

[8cvor6j844qw_d6]

Same thoughts. Cloudflare DNS is noticeably slow to resolve on some of my devices.

Switching to literally any other DNS and the same domains resolve instantly.

Could be a issue specific to my location or devices, but its been consistent enough that I stopped bothering.

[Bender]

I don't use the public resolvers but here [1] is a script that will show which of those public resolvers is fastest from your location. Add or remove resolvers as you desire. Be sure to scroll down to see a few of the sorting examples. Not my script or repo.

Just as a side note: Something I have done with this in the past as a fun experiment was to set up an Unbound DoT server on assorted VPS nodes in assorted locations around the country, run this script and configure each Unbound to use the 5 to 10 fastest servers on each node and cache results longer. Then I used Tinc (open source VPN) to connect to these VPS nodes from my home's Unbound and distribute the requests among all of them. I save query logs from all of them and use cron to look up all my queries hourly to keep the cache fresh and mess up any analytic patterns for my queries. Just a fun experiment. 99.99% of the time I just query the root DNS servers for what NS servers are authoritative for a given domain or what I call bare-backing the internet.

[1] - https://github.com/cleanbrowsing/dnsperftest

[ranger_danger]

I have no idea why anyone would drink water from a faucet, much less trust their more filtered versions.

[Hamuko]

The "censored" part of archive.today seems unrelated to the filtering itself. 1.1.1.3 flags Pornhub.com as "EDE(17): Filtered" but archive.today is "EDE(16): Censored".

Supposedly it should be an external party that's requiring Cloudflare not to publish the DNS record. https://www.rfc-editor.org/rfc/rfc8914.html#name-extended-dn...