zlacker

[parent] [thread] 14 comments
1. jchw+(OP)[view] [source] 2019-10-04 06:29:19
I am no expert by any means. However, I strongly suspect EDNS is not actually needed to run a CDN. There’s a lot of approaches to balancing load and distributing traffic. An example of another approach would be using anycast IPs.

I’m also surprised that traffic from Cloudflare DNS users caused any significant problem. Was it really that much traffic?

replies(3): >>profmo+z >>jlokie+Eo >>tomp+Pu
2. profmo+z[view] [source] 2019-10-04 06:36:27
>>jchw+(OP)
> However, I strongly suspect EDNS is not actually needed to run a CDN.

It's not. The proof is that CDNs existed long before edns-client-subnet was introduced. All it does is allow the CDN's DNS servers to return the most optimal A/AAAA records for the client. But the worst that should happen without it is you get sent to a more distant CDN server, and the content loads more slowly.

The fact that archive.is somehow suffers without this feature (which, btw, wasn't standardized until 2016) suggests they're doing something really, really odd. If I were them, I'd focus on making my system more robust, rather than demanding the rest of the Internet adopt a relatively young, optional DNS extension.

replies(2): >>cnst+j2 >>vberna+73
◧◩
3. cnst+j2[view] [source] [discussion] 2019-10-04 07:02:11
>>profmo+z
Per https://serverfault.com/a/560059/110020, Google's 8.8.8.8 has had support for `edns0-client-subnet` since at least 2013, so, even if it's only been standardised in 2016, it's been a de-factor standard for quite a while, especially in the internet-technology-years.

Here's an interesting thought — if it's so bad for privacy and isn't necessary for a CDN, does Cloudflare the CDN simply disregard ECS when receiving requests from DNS.Google, or do they take it into account?

replies(4): >>DarkWi+X2 >>profmo+23 >>darkla+U3 >>dwild+QJ
◧◩◪
4. DarkWi+X2[view] [source] [discussion] 2019-10-04 07:11:11
>>cnst+j2
> de-factor standard

Google isn't the internet, you know?

◧◩◪
5. profmo+23[view] [source] [discussion] 2019-10-04 07:11:52
>>cnst+j2
> even if it's only been standardised in 2016, it's been a de-factor standard for quite a while, especially in the internet-technology-years.

If archive.is thinks that Internet standards should be adopted so quickly, it's weird that they don't support IPv6 considering it's been a standard since 1998!

Obviously I'm kidding, but only kind of. When it comes to insisting on adopting new standards, edns-client-subnet is a weird hill to die on, especially considering it was always meant to be optional.

> does Cloudflare the CDN simply disregard ECS when receiving requests from DNS.Google, or do they take it into account?

I don't think they have a reason to use it because they use TCP anycast. Looking at https://cachecheck.opendns.com/ they seem to return the same IPs regardless of geography.

replies(1): >>cnst+55
◧◩
6. vberna+73[view] [source] [discussion] 2019-10-04 07:13:28
>>profmo+z
EDNS client subnet exists since there are large public DNS servers. Google did implement it very early on 8.8.8.8 (DNS operators had to request them to enable it when querying their authoritative servers) because it is needed to correctly operate a CDN.
replies(1): >>profmo+v4
◧◩◪
7. darkla+U3[view] [source] [discussion] 2019-10-04 07:26:12
>>cnst+j2
> if it's so bad for privacy and isn't necessary for a CDN, does Cloudflare the CDN simply disregard ECS when receiving requests from DNS.Google, or do they take it into account?

I don't understand that for various reasons.

1) Privacy is already lost here. If I shout my mobile number on a train with you that's full of people, everyone knows my phone number. If you choose to keep it / use it to call me tomorrow doesn't matter.

2) If Cloudflare can make _better_ decisions based on the information shared by Google, why shouldn't they? As long as it is optional and they don't take their ball and go home^W^W^W^W^W^Wreply with 127.0.0.3 in cases where you don't provide it..

replies(1): >>pixl97+0a1
◧◩◪
8. profmo+v4[view] [source] [discussion] 2019-10-04 07:33:49
>>vberna+73
I know why it exists, and it's nice to have, but what I'm saying is there's no reason a site should completely fail to load without it. The worst case should be you just get routed to a more distant cache, and the site is slower. The same as what used to happen before edns-client-subnet existed.
◧◩◪◨
9. cnst+55[view] [source] [discussion] 2019-10-04 07:42:33
>>profmo+23
When you talk about ECS being optional, you also have to keep the context in mind.

* Yes, if you're running a local resolver for your LAN, or have a website on a single server, of course ECS should be optional.

* If you're running a CDN (and archive.today does), or if you're running a public resolver at 100+ POPs, then, no, ECS is not meant to be optional.

replies(1): >>wopian+gk
◧◩◪◨⬒
10. wopian+gk[view] [source] [discussion] 2019-10-04 11:25:57
>>cnst+55
"not meant to be optional" is surely a suggestion and not a requirement?

i.e it's not "(...CDN...) then ECS should not be optional"

11. jlokie+Eo[view] [source] 2019-10-04 12:18:58
>>jchw+(OP)
> An example of another approach would be using anycast IPs.

Anycast IP is very expensive, unfortunately. Just getting a /22 has been expensive for years, and is now also getting difficult as well. It is beyond the reach of smaller companies.

GeoDNS is extremely cheap in comparison. You can run distributed services using GeoDNS for low latency on multiple continents on a hobby budget these days.

Anycast is technically better in many ways (the combination of anycast and geoDNS is better again), but anycast is so expensive that smaller operators just can't use it.

These days, smaller operators can use Cloudflare for their CDN, and the suspicious mind might think that suits Cloudfare just fine. But that doesn't really help for low-latency interactive services, or non-HTTP services.

> I’m also surprised that traffic from Cloudflare DNS users caused any significant problem.

Maybe the problem isn't amount of traffic, but rather that the site doesn't want to gain a reputation as slow (and therefore incompetently administered, and offputting to use) when everyone running Firefox switches over to 1.1.1.1 DoH automatically.

replies(1): >>jchw+PV
12. tomp+Pu[view] [source] 2019-10-04 13:06:45
>>jchw+(OP)
You could also in theory use the originating IP of the DNS requests themselves. But Cloudfare messes up that as well:

https://twitter.com/archiveis/status/1018691421182791680

> Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as invalid.

◧◩◪
13. dwild+QJ[view] [source] [discussion] 2019-10-04 14:39:03
>>cnst+j2
> If it's so bad for privacy and isn't necessary for a CDN, does Cloudflare the CDN simply disregard ECS when receiving requests from DNS.Google, or do they take it into account?

It's not because it can be bad for privacy that you can't use it for good. The feature exist for a good reason, it's valid, it doesn't change anything to the fact though that it can be use for bad reasons too, which is why you want to remove it. In the means time, there's no reasons not to use it for good reason while it's still there.

◧◩
14. jchw+PV[view] [source] [discussion] 2019-10-04 15:56:36
>>jlokie+Eo
FWIW, archive.is being unreachable under Cloudflare DNS predates Firefox’s plans IIRC.
◧◩◪◨
15. pixl97+0a1[view] [source] [discussion] 2019-10-04 17:17:33
>>darkla+U3
1) probabilities. No one is likely to keep that information on the train. Unless of course AT&T runs the train in which they tell you they will record everything you say and use it for marketing or what ever other purposes.
[go to top]