Another reason why Cloudflare sucks.
this post was submitted on 21 Jan 2025
102 points (98.1% liked)
Technology
60659 readers
5035 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
i think this would be true of basically any large service that had multiple data centers. whichever one catches your data is the one closest to you.
the difficulty is accessing that data even if you can't read it you still have the closest location.
sounds to me like the Internet working as intended. if you want true privacy you need to take extra steps
Not even guaranteed to be the closest data center. It’s not completely out of the ordinary for there to be a faster route available to a data center farther away.
true, true
Agreed. Privacy is always a balance between your threat model and useability. If your general location is enough to put you in danger, hopefully you're already aware of how your data is being sent over the various networks and have measures in place to stay safe.
For most people, knowing very generally where they are isn't especially useful information to anyone with an interest in surveillance.
On the one hand, deanonimization attacks are never entirely avoidable on unhardened targets and this one isn't particularly sophisticated and leaks relatively little information.
On the other hand deanonimization attacks are always bad and it's a good reminder to people of the risks they are taking. This is also slightly non-obvious behavior, even if it makes sense to the technically competent, as something like an IP grabber normally requires user interaction such as clicking a link. It's also a vector that CF might be able to mitigate by patching the ability to query a given cache directly.
they should be able to patch that as long as nothing relies on it working as is
I don't want to be a contrairian, but your cellphone carrier does this non stop. Cloudflare is not a good company, but this is the least of your problems.
You have entirely misunderstood this exploit.
How so? Asking out of curiosity.
I'm not trying to wear a tinfoil hat, but Snowden clearly revealed that the government is easily able to purchase cellphone location data based on GPS and tower data more easily than they can go through the FISA courts.
Ah, thought you meant though metadata. Like a end user snooping through some obscure meta data method (even after cleaning) let's you triangulate something.
Your cellphone provider very likely already sells this data.
I know mine does, because I attended a webinar of a buying company where they explicitly mentioned this.
oh no, now they nkow I'm in the US North East, assuming I'm not using a VPN...
stop using cloudflare.
Fully agreed, sorry to see people down voting you. But the Internet was not meant to be run by a single company called Cloudflare, it's a dangerous prospective. Since the more people depend on Cloudflare the more powerful it become and the more depend people will become. We need alternative solutions to protect against DoS and more.
I support this because most all cloudflare websites require browser fingerprinting otherwise they will not serve you the page. The moment I enable the jShelter addon, I am cut off from a significant portion of the internet
CF is DNS you could be using it a lot and never know
I have a pihole serving DNS for my local network that is configured to use unfiltered Quad9 for upstream.
ok, you are certainly not a common user.
Unbound is better IMO :)
Well, I'm now using pihole for blocking + unbound for recursive resolving
What are the advantages over pihole?
EDIT: https://docs.pi-hole.net/guides/dns/unbound/ this page has a good explanation
So Unbound is actually a very powerful validating, recursive and caching DNS resolver. So without relaying on Google DNS or ISP DNS, you can host your own Unbound recursive DNS server, which can do request to other DNS servers and even root-dns servers. You can even setup your own stub zones and forward zones (sorry this is too much details I know). And like I said it also has caching feature. I will soon create a blog post about Unbound as well on my https://blog.melroy.org site be sure to subscribe.
Here is a snipped of part of my config, feel free to use it however you want:
# Serve stale data
serve-expired: yes
serve-expired-ttl: 86400 # one day, in seconds
serve-expired-client-timeout: 500 # 500ms
# Increase caches for better performance
msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
rrset-cache-size: 300m
msg-cache-size: 150m
outgoing-range: 200
num-queries-per-thread: 100
You can use both. Unbound is a validating, recursive, caching DNS resolver.
You can setup Unbound to be a self hosted DNS solution, and point PiHole to use your Unbound.
Source: Unbound
Okay but what are the advantages of doing this?
Do you know what DNS does?
If you don't, essentially is what translates IP addresses to hostnames.
So what having unbound would do is allow you to do DNS lookup locally.
Um.... yes I understand what DNS does. Really?
I'm not trying to challenge you in any way. My disconnect in understanding is what unbound does and why I would want to use it over the built-in pihole FTLDNS. What are its advantages?
EDIT: I've answered my own question, unbound queries root name servers directly instead of using DNS providers. This is interesting. New question, what is the advantage of being my own DNS provider? Privacy from my ISP (who can just see the IPs that I am connecting to, anyway)?
I wasn't trying to be short or condescending either. Just relaying what I know.
It is another layer of privacy in some cases. Could protect against poisoning of I'm not mistaken, but don't quote me.
I know for me, I prefer to self host things where I can so I can own as much of my own data as possible.
Another reason to not use Cloudflare. Not that long ago they also "lost the log records" (this incident happened on November 14, 2024). I strongly believe the internet can become better without Cloudflare, especially now basically the whole world is depending on it.
It is impossible to use most of corpo internet if you block cloudflare. Shit is wild.
Not sure who is down voting you lol
I wish people would respond with a rebuttal so we can move convo forward.
You don't need a VPN mate...
It ain't a solution but surely would help here