tl;dr: No. Quite the opposite, actually — Archive.is’s owner is intentionally blocking 1.1.1.1 users.

CloudFlare’s CEO had this to say on HackerNews:

We don’t block archive.is or any other domain via 1.1.1.1. […] Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. […] The archive.is owner has explained that he returns bad results to us because we don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users.

I am mainly making this post so that admins/moderators at BeeHaw will consider using archive.org or ghostarchive.org links instead of archive.today links.

Because anyone using CloudFlare’s DNS for privacy is being denied access to archive.today links.

https://ghostarchive.org/archive/PmSkp

  • Pleonasm@programming.dev
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    It might be terrible for you but it’s very handy for the rest of us.

    If it’s so bad, maybe just pay to bypass all the paywalls that the site removes from your way. Having your local ISPs details sent through is a small price to pay for the convenience.

    • jarfil@beehaw.org
      link
      fedilink
      arrow-up
      2
      ·
      edit-2
      1 year ago

      it’s very handy for the rest of us.

      How is it more handy than Archive.org? You can submit URLs for archival just the same, and it doesn’t require user tracking.

      I’ve used Archive.is before, but seeing this I won’t anymore.

      EDIT: after some digging (see comment thread) and further consideration… I’m not sure anymore.

      • Pleonasm@programming.dev
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        It’s way faster for one. It actively scrapes articles from behind paywalls, using a bank of credentials it has. Archive.org respects robots.txt and will take down copyrighted material on request. Archive.is doesn’t do any of that.

        I would view it as complementary to archive.org. it’s more like sci-hub to me. A useful tool, run by one person who likes the idea of providing such a service.

        What exactly do you think is being tracked by your ECS being sent along with DNS requests? All it means is that archive.is can’t load balance properly because they don’t know what their nearest server to your location is. If you’re so privacy conscious that leaking a portion of your IP to a DNS provider, then hardcode archive.is IPs into your hosts file or use a VPN. Not that your problem can really be with archive.is, because you’re visiting the site anyway, giving them your full IP.

        It just seems like such a non issue to me.

        • jarfil@beehaw.org
          link
          fedilink
          arrow-up
          0
          ·
          edit-2
          1 year ago

          actively scrapes articles from behind paywalls, using a bank of credentials it has […] more like sci-hub

          I see… not sure I approve, but I see.

          use a VPN

          That’s precisely one of the issues with EDNS, already described 10 years ago:

          • DNS leaks when using a VPN
          • DNS Cache timing attacks
          • Network scanning
          • DDoS amplification
          • Cache pollution

          (https://00f.net/2013/08/07/edns-client-subnet/)

          From the CEO’s reply on YC:

          We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1.

          (https://news.ycombinator.com/item?id=19828702)

          Seems like dropping the originating address is a reasonable action on their part.

          Only thing they could possibly do, would be to replace the originating address with the address of the particular DNS resolver in their network, which they said they had 180 of… but that would still reveal your geographic area in case of a VPN leak.

          On the other hand, if you don’t care about any of that, why not use Google’s 4.4.4.4?

          • Pleonasm@programming.dev
            link
            fedilink
            arrow-up
            0
            ·
            1 year ago

            The reason I’m saying use a VPN is because you’re presumably visiting the site anyway, so leaking your full IP to them anyway. You can route your DNS lookups through what server you like, obviously. (Again, the privacy issue would be not that you’re leaking part of your IP to archive.is, but to everyone in the chain of recursive DNS resolvers). You could use TOR too, I think even in this thread someone posted a TOR url for it.

            Cloudflare do make the DNS queries from 1 of their 180 locations, so there is some information being passed through about where the request is coming from in terms of load balancing.

            I’m not arguing that Cloudflare are doing the wrong thing by omitting ECS data in general. Just that site owners have a right to do as they like WRT people using their website and if that includes blocking Cloudflare, so be it. What he is doing is not legal (or at least grey area) in many countries so anything that makes his life easier is understandable IMO.

            Also, ECS leaking does not seem like a real concern for the vast majority of people surfing the net.

            Lastly I don’t think Google own 4.4.4.4, did you mean 8.8.4.4?

            • jarfil@beehaw.org
              link
              fedilink
              arrow-up
              0
              ·
              1 year ago

              I know what you meant with the VPN. Just saying that CloudFlare is using the VPN leakage case to justify not supporting ECS. As for the rest of the problems, DNS servers that suport ECS, hopefully have already implemented countermeasures.

              Indeed Archive.is is free to block whoever he wants… he’s just using a weird argument, particularly when there is an onion address for it, which is kind of the opposite of a CDN… or I don’t understand his side completely. It feels to me like both sides are sticking to their stances, when either or both could fix the issue without much of a problem.

              I don’t think Google own 4.4.4.4, did you mean 8.8.4.4?

              Damn. Yeah, I meant 8.8.8.8 and 8.8.4.4. Brain fart.

                • jarfil@beehaw.org
                  link
                  fedilink
                  arrow-up
                  1
                  ·
                  edit-2
                  1 year ago

                  DNS server returns not the closest IP to the request origin but the closest IP abroad, so any takedown procedure would require bureaucratic procedures so I am getting notified notified and have time to react.

                  Oh, so he’s not using a CDN, but a sort of “anti”-CDN.

                  attacks where people upload illegal content

                  I offered them to proxy those CloudFlare DNS’s users via their CDN but they rejected.

                  Wonder why 😆

                  Yes, that holds up to scrutiny pretty well.

                  After “I’ve proposed we just fix it on our end …” all requests for 7 archive.* domains are sent from Symantec USA IP

                  …and that’s a dick move on part of CloudFlare.

    • Saik0@lemmy.saik0.com
      link
      fedilink
      English
      arrow-up
      0
      ·
      1 year ago

      If it’s so bad, maybe just pay to bypass all the paywalls that the site removes from your way

      Or I can just use Firefox reader mode… which works for like 90% of the sites that are paywalled that I’ve ever visited.

      But honestly I don’t care what you say with an attitude like that. People who give up security for some fake semblance of “convenience” make the internet worse for everyone. I’m not sure how a company/website violating your rights is “handy” for you… but you do you.

      • 1984@lemmy.today
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        What, stop using Chrome?? Unthinkable… Google says it’s the best and we can trust them. They want what’s best for us. /s

      • Pleonasm@programming.dev
        link
        fedilink
        arrow-up
        0
        ·
        1 year ago

        Not really a paywall then, is it? I don’t know why you think it’s fake, it’s a very real convenience.

        Violating my rights ? Is geolocating your users violating their rights now?

        • Saik0@lemmy.saik0.com
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Not really a paywall then, is it?

          Well no shit… It wasn’t a real paywall if archive.org or archive.is can bypass either no? What’s your point with this statement?

          I don’t know why you think it’s fake, it’s a very real convenience.

          What/when did I say anything was fake? See above question… I said they’re a terrible service. Not that they’re fake. I’m telling you that it’s not any more convenient than the reader view button and that doesn’t give your data to some shady third party that doesn’t NEED your data… even though they’ll apparently go to war with one of the biggest transits on the internet over it to get it.

          s geolocating your users violating their rights now?

          Yes… attempting to punish users who don’t want to be geolocated… or FORCING users to geolocate would be collecting personal data. That is a literal violation of rights in many countries, specifically the EU… and California. So yes.

          Are we done?

          • Pleonasm@programming.dev
            link
            fedilink
            arrow-up
            0
            ·
            1 year ago

            Archive.is can and does bypass real paywalls. That’s why it’s useful.

            You literally called it a fake convenience in your previous comment. Do you have the memory of a goldfish?

            Geolocation of users of course does not violate GDPR, don’t be ridiculous.

            You have no idea what you’re talking about and clearly don’t understand the issue at hand, so yep, we’re done.

            • Saik0@lemmy.saik0.com
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              Archive.is can and does bypass real paywalls. That’s why it’s useful.

              Firefox reader mode does as well…

              You literally called it a fake convenience in your previous comment.

              Yes… so less button presses and faffing with bullshit just using the built in feature on firefox… See how archive.is isn’t that convenient at all?

              Do you have the memory of a goldfish?

              You seem to have the intelligence of one. You just said “fake”, assuming that someone would understand what the hell you’re talking about… When you communicate poorly, don’t be mad when people don’t understand you.

              Geolocation of users of course does not violate GDPR, don’t be ridiculous.

              They’re not just using geolocation and throwing the data away after they’re done. otherwise they wouldn’t be fighting cloudflare. Storing that data for whatever other purpose they could have with it would absolutely be a violation of GDPR and similar laws. You’re the one being ridiculous here.

              You have no idea what you’re talking about and clearly don’t understand the issue at hand, so yep, we’re done.

              I’m literally a CISO… It’s my job to make these kinds of decisions. So jokes on you. My company would fail compliance audits if we did dumb shit like this.

              • Pleonasm@programming.dev
                link
                fedilink
                arrow-up
                1
                ·
                1 year ago

                JavaScript paywalls are not real paywalls. So no, Firefox can’t bypass real paywalls.

                Unlucky for your company to have a CISO with such poor reading comprehension.

                • Saik0@lemmy.saik0.com
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  1 year ago

                  JavaScript paywalls are not real paywalls. So no, Firefox can’t bypass real paywalls.

                  Alright… Find me a page where archive.is can bypass the paywall… that Firefox cannot.

                  Unlucky for your company to have a CISO with such poor reading comprehension.

                  I’m going to refer you to my previous statement

                  You just said “real paywalls”, assuming that someone would understand what the hell you’re talking about… When you communicate poorly, don’t be mad when people don’t understand you.

                  You didn’t mention “Only Javascript” until just now… And for some reason you believe that those are fake? You’ve got some weird definitions here.