zlacker

This is actually addressed in the original HN comment the post links to (>>19828702 ):

> EDNS IP subsets can be used to better geolocate responses for services that use DNS-based load balancing. However, 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results.

>>philwe+(OP)
And today it’s over 250. And the only site I’m aware of that objects to us protecting user privacy by making EDNS more private is this one. ¯\_(ツ)_/¯

>>philwe+(OP)
Yeah but if the site standardized on EDNS to get this information, it's rather difficult to do something different just for Cloudflare.

>>wkat42+W3
edns-client-subnet only provides an IP address; the receiving CDN still needs to geolocate it.

So the main difference is that Cloudflare's servers need to be present in the IP geolocation database. Given their prevalence, they're probably in most of them already.

>>eastda+m2
"Protecting user privacy", from the largest MITM attackers on the internet, is laughable.

>>mikeco+wd
> from the largest MITM attackers

If that were true, there's a lot of really stupid people throwing away their money by paying CF to hack them.

>>eastda+m2
Right, the site full of nerds who think archive.is and co. is a cool toy. Dilemma! ;)