Cloudflare announces 1.1.1.1 'privacy-first' consumer DNS

[HEXUS]

Service usage could improve responsiveness when you are using the internet.

Read more.

[Saracen]

Looks interesting. Worth checking out.

[kingpotnoodle]

As usual the stated numbers for response time are clearly a best case, I checked resolution of bbc.co.uk from 1.1.1.1, 8.8.8.8 (Google DNS) and 208.67.222.222 (OpenDNS) and all were 12-14ms consistently.

I checked our company website, Dig indicated that none of the 3 had it cached, OpenDNS was the fastest at 14ms, 1.1.1.1 20ms and Google 38ms.

This was done at work, on 100Mb Virgin fibre. I don't think I'll bother changing from Google DNS just for marginal benefits.

[Glyce]

No human will ever notice the change in speed.

[konfliqt]

I ping 2ms to 1.1.1.1 and 8-9ms to 8.8.8.8 - woo Hyperoptic

[3dcandy]

My Virgin DNS goes down fairly regularly. Changed to 1.1.1.1 and not a single glitch today so far...
Hardly a scientific conclusion but normally DNS would give up about 5 times on a normal working day

[spacein_vader]

My Virgin DNS goes down fairly regularly. Changed to 1.1.1.1 and not a single glitch today so far...
Hardly a scientific conclusion but normally DNS would give up about 5 times on a normal working day

While that's positive news I think it says more about Virgins DNS than Cloudflares.

[jimborae]

Been using it for the last 3 days, seems no better or worse to OpenDNS that I was previously using.

[3dcandy]

While that's positive news I think it says more about Virgins DNS than Cloudflares.

Oh I know... worst DNS servers known to man. Work pc which is connected via homeplugs gets a 35ms ping. Was 85 with Virgin

[Sixiepoo]

1.1.1.1 is just full of crap tho, too many users regardless and the moment it gets ddos'd its dead.

id rather stay on 9.9.9.9 atleast it has a blacklist/whitelist function

[DanceswithUnix]

No human will ever notice the change in speed.

Perhaps not one DNS response, but a single modern web page can generate dozens. Get a chain of 10 DNS queries in a row and 30ms becomes 0.3s which you can just about feel. Personally I run a house DNS cache to speed this stuff up as much as possible.

1.1.1.1 is just full of crap tho, too many users regardless and the moment it gets ddos'd its dead.

id rather stay on 9.9.9.9 atleast it has a blacklist/whitelist function

You know that CloudFlare are the CDN people you run to if you are getting slashdotted/DDOS'ed right?

[Corky34]

....the moment it gets ddos'd its dead.

I thought one of the big selling points of Cloudflare was that it uses DDoS mitigation techniques. (EDIT: beaten to it by DanceswithUnix )

Getting back to the articles premises that it's a 'privacy-first' consumer DNS, aren't things like DNS servers that don't keep a record of what sites someone visits potentially illegal in the UK now? I thought the Investigatory Powers Act required communication service providers to retain UK internet users' "Internet connection records".

[scaryjim]

... Getting back to the articles premises that it's a 'privacy-first' consumer DNS, aren't things like DNS servers that don't keep a record of what sites someone visits potentially illegal in the UK now? I thought the Investigatory Powers Act required communication service providers to retain UK internet users' "Internet connection records".

It probably depends on the exact definitions in the act, but logging DNS queries at the DNS service isn't going to provide any additional information compared to logging that query as it leaves your ISPs endpoints anyway. The request and response are still going to be recorded somewhere, as is your visit to whatever site you were looking up....

[Telekloud]

As usual the stated numbers for response time are clearly a best case

Perhaps it would be best to check dnsperf yourself.

[DanceswithUnix]

It probably depends on the exact definitions in the act, but logging DNS queries at the DNS service isn't going to provide any additional information compared to logging that query as it leaves your ISPs endpoints anyway. The request and response are still going to be recorded somewhere, as is your visit to whatever site you were looking up....

The Cloudflare announcement says they suggest using dns-over-https as an option, in which case snoopers will only be able to see that you performed a lookup not the contents or results. Hopefully support for that protocol will improve with the extra visibility.

[Corky34]

...in which case snoopers will only be able to see that you performed a lookup not the contents or results....

I'm fairly sure CSPs are only meant to keep records of the websites people are visiting and not the contents, such as visiting https://hexus.net but not knowing what articles you looked at while there, i had assumed that would be done via keeping DNS lookup records as that, i assumed, would have been the easiest way to implement it.