tl;dr: No. Quite the opposite, actually — Archive.is’s owner is intentionally blocking 1.1.1.1 users.

CloudFlare's CEO had this to say on HackerNews:

We don’t block archive.is or any other domain via 1.1.1.1. [...] Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. [...] The archive.is owner has explained that he returns bad results to us because we don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users.

I am mainly making this post so that admins/moderators at BeeHaw will consider using archive.org or ghostarchive.org links instead of archive.today links.

Because anyone using CloudFlare's DNS for privacy is being denied access to archive.today links.

https://ghostarchive.org/archive/PmSkp

top 50 comments

sorted by: hot top controversial new old
[–] 84 points 3 years ago

Archive.is used to block people with Finnish IPs too, allegedly because of personal immigration issues.

I don't get the impression it's something anyone should ever rely on.

  • source
  • [–] 56 points 3 years ago (17 children)

    Because anyone using CloudFlare’s DNS for privacy is being denied access to archive.today links.

    Yes, which makes Archive.is a terrible service... Because they don't get super fine details of where your connection is originating from they poison the DNS response they give cloudflare. Any site that weaponizes DNS then blames me for choosing to not allow them to do so... Fuck them.

  • source
  • hideshow 17 child comments
  • load more comments (17 replies)
    [–] 49 points 3 years ago (26 children)

    Time to add 1.1.1.1 to my list of DNS servers to use

  • source
  • hideshow 26 child comments
  • [–] 38 points 3 years ago (12 children)

    In case you don't know, Cloudflare already controls a massive amount of websites, have access to their unencrypted traffic and are making the web inaccessible for people who use tor or noscript. They are a threat to the open web.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 13 points 3 years ago (8 children)

    Do you have an alternative that isn't google? Because google's DNS privacy policy is much worse.

    I don't like cloudflare, but their DNS terms are relatively good, and they have my info anyway because as you say, they're everywhere. I don't think my not using their DNS will make any appreciable mark on their business, either.

  • source
  • parent
  • hideshow 8 child comments
  • load more comments (2 replies)
  • [–] 4 points 3 years ago (11 children)
  • [–] 6 points 3 years ago (3 children)

    I do CloudFlare first and Google as backup.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 5 points 3 years ago

    LOL that's not a bad way of explaining it. My reasoning is that I like CloudFlare, so I'll default to them, but if CF goes down I want DNS to continue working. I figure Google is one of the servers that's LEAST likely to go down.

  • source
  • parent
  • load more comments (2 replies)
  • [–] 15 points 3 years ago

    This was driving me crazy.... at least I know why now.

  • source
  • [–] 13 points 3 years ago (11 children)

    That's really weird explanation on part of CF CEO, as just after DNS request you usually connect to the site which address you requested and site gets a lot more details including full IP address anyway.

  • source
  • hideshow 11 child comments
  • [–] [S] 57 points 3 years ago* (last edited 3 years ago) (4 children)

    https://news.ycombinator.com/item?id=19828702

    Here's the full comment on HackerNews, the article quoting him only had the snippet. The larger comment makes more sense. Emphasis mine.

    We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service.

    Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service.

    The archive.is owner has explained that he returns bad results to us because we don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users. This is especially problematic as we work to encrypt more DNS traffic since the request from Resolver to Authoritative DNS is typically unencrypted. We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1.

    EDNS IP subsets can be used to better geolocate responses for services that use DNS-based load balancing. However, 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets.

    We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security. Those conversations have been productive and are ongoing. If archive.is has suggestions along these lines, we’d be happy to consider them.

    So it's really more about metadata related to the IP, like geolocation.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 3 years ago

    That . . . really looks like a game of DNS chicken. In Cloudflare's place, I'd just shrug, provide garbage EDNS data that meets the technical requirements (probably pointing at archive.is's own location), and move on, but they're apparently too wrapped up in their principles to blink first.

  • source
  • parent
  • [–] 4 points 3 years ago

    We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results.

    Couldn't they just put that as the EDNS?

  • source
  • parent
  • load more comments (1 reply)
  • [–] 12 points 3 years ago (1 child)

    And? My DNS provider shouldn't be leaking my information even if I immediately use the info they gave me to connect to the site.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 3 years ago

    To be fair, they use a dns-based load balancer / cdn, so they want to know your ip address so their dns server can geolocate you and reply with the nearest server's IP address. I guess this is probably easier to setup or less costly than using anycast like most cdn services.

  • source
  • parent
  • load more comments (1 reply)
    [+] 11 points 3 years ago* (last edited 2 years ago) (7 children)
  • [–] 13 points 3 years ago (2 children)

    My solution is more complicated but doesn't require switching browsers

    1. I run a tor client on my home server in docker, the same place I keep my vpn access, torrenting, etc
    2. I run a socks proxy on my home server, that sends all requests through the tor network (and a different socks proxy for when I want to use the VPN)
    3. On my desktop and laptop, I use the FoxyProxy firefox extension (SwitchyOmega on Chrome). I setup the socks proxy (proxies) on it, using URL patterns.
    4. When I go to a .onion link, FoxyProxy uses the pattern, and sends the traffic over my tor socks proxy
  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 3 years ago*

    Beware that most of the fingerprinting happens through JavaScript in the browser, so accessing websites over Tor using the same browser, still allows to match the access to your browser's fingerprint. That's why the Tor Browser bundle tries to minimize the ability of websites to fingerprint it.

    Additionally, running JavaScript from .onion sites, is kind of like playing the Russian roulette.

  • source
  • parent
  • [–] 10 points 3 years ago (2 children)

    Test your DNS with some benchmark. I have learned this the hardway, when I swapped to for more private quad9 my internet became sometimes borderline unusable. If you are for some reason on windows you can use this one. For me openDNS was consistently the fastest to respond.

  • source
  • hideshow 2 child comments
  • load more comments (1 reply)
    [–] 4 points 3 years ago (1 child)

    Honestly I am sick and tired of people being shit, nearly every week we find out that someone that used to be respected and appreciated is actually a shit person, and it's exhausting,

  • source
  • hideshow 1 child comment
  • load more comments (1 reply)
    load more comments
    view more: next ›