DNS Performance compared: CloudFlare 22.214.171.124 x Google 22.214.171.124 x Quad9 x OpenDNS - <AUTHOR> https://firstname.lastname@example.com/dns-resolvers-performance-compared-cloudflare-x-google-x-quad9-x-opendns-149e803734e5 <comment><USER2> Pushed a shell script to compare all of them from your location:

[https://github.com/cleanbrowsing/dnsperftest](https://github.com/cleanbrowsing/dnsperftest)

      $ sh ./dnstest.sh |sort -k 22 -n
                   test1   test2   test3   test4   test5   test6   test7   test8   test9   test10  Average
      cloudflare     1 ms    1 ms    1 ms    4 ms    1 ms    1 ms    1 ms    1 ms    1 ms    1 ms      1.30
      norton         2 ms    2 ms    2 ms    2 ms    2 ms    2 ms    2 ms    2 ms    2 ms    2 ms      2.00
      neustar        2 ms    2 ms    2 ms    2 ms    1 ms    2 ms    2 ms    2 ms    2 ms    22 ms     3.90
      cleanbrowsing  11 ms   23 ms   11 ms   11 ms   11 ms   11 ms   11 ms   13 ms   12 ms   11 ms     12.50
      google         4 ms    4 ms    3 ms    21 ms   21 ms   61 ms   3 ms    21 ms   21 ms   22 ms     18.10
      opendns        2 ms    2 ms    2 ms    39 ms   2 ms    75 ms   2 ms    21 ms   39 ms   13 ms     19.70
      comodo         22 ms   23 ms   22 ms   22 ms   22 ms   22 ms   22 ms   22 ms   22 ms   23 ms     22.20
      quad9          10 ms   37 ms   10 ms   10 ms   10 ms   145 ms  10 ms   10 ms   10 ms   20 ms     27.20
      yandex         177 ms  216 ms  178 ms  182 ms  186 ms  177 ms  183 ms  174 ms  186 ms  222 ms    188.10
      adguard        199 ms  210 ms  200 ms  201 ms  202 ms  202 ms  199 ms  200 ms  198 ms  201 ms    201.20

<comment><USER3> From Perth, Western Australia:

                      test1   test2   test3   test4   test5   test6   test7   test8   test9   test10  Average
        cloudflare2nd  94 ms   81 ms   81 ms   79 ms   97 ms   90 ms   85 ms   89 ms   84 ms   78 ms     85.80
        cloudflare     74 ms   316 ms  69 ms   83 ms   77 ms   69 ms   85 ms   69 ms   82 ms   74 ms     99.80
        neustar        98 ms   100 ms  99 ms   102 ms  107 ms  113 ms  113 ms  112 ms  106 ms  100 ms    105.00
        adguard        154 ms  133 ms  133 ms  91 ms   94 ms   133 ms  96 ms   95 ms   98 ms   99 ms     112.60
        norton         132 ms  138 ms  117 ms  118 ms  131 ms  147 ms  133 ms  143 ms  141 ms  141 ms    134.10
        cleanbrowsing  154 ms  142 ms  140 ms  137 ms  155 ms  178 ms  158 ms  115 ms  77 ms   111 ms    136.70
        quad9          187 ms  170 ms  168 ms  154 ms  156 ms  156 ms  165 ms  164 ms  170 ms  174 ms    166.40
        opendns        258 ms  128 ms  121 ms  135 ms  125 ms  317 ms  124 ms  266 ms  131 ms  119 ms    172.40
        google         148 ms  264 ms  153 ms  137 ms  225 ms  274 ms  74 ms   258 ms  136 ms  279 ms    194.80
        google2nd      149 ms  284 ms  159 ms  223 ms  257 ms  412 ms  125 ms  254 ms  134 ms  268 ms    226.50
        comodo         273 ms  290 ms  303 ms  286 ms  308 ms  280 ms  314 ms  302 ms  263 ms  299 ms    291.80
        yandex         511 ms  567 ms  482 ms  442 ms  516 ms  443 ms  477 ms  471 ms  449 ms  454 ms    481.20

<comment><USER4> Are you using Telstra by chance? They have the worst routing I've ever seen. I've had huge problems getting good routes for their customers. I've had better luck with "IInet" customers.

I would be curious to see what the ping ms is for status.neocities.org, ideally it's coming from Sydney and not the states.

<comment><USER3> Not sure, actually! I'm just staying with someone at the moment. They're coincidentally changing broadband provider to this tomorrow - [https://node1.com.au/](https://node1.com.au/)

</comment></comment></comment></comment><comment><USER5> Which ISPs are so bad that you want to use external services, which are further in distance than your ISP, for speed? When I test with my ISP, they beat all of these services (both IPv4 and IPv6). They're simply closer to me in terms of hops.

My router is another story though. The Fritzbox (>200eur router) adds 6ms of latency, and that's what is advertised over DHCP. (Might still be fine, since cached queries are faster than the ping time to the ISP.) Note that my tests were all with uncached queries (random subdomains of a domain), so it always had to go out and ask an external server (though it could cache the NS record for the domain).

<comment><USER6> My isp got the brilliant idea of rolling their own YouTube cache servers. It's great in theory but in or active they're under powered and so at peak hours I can't even stream 240p on my 500mbits connection. I've had to block their cache servers in my firewall for YouTube to be butter smooth at 1080p consistently.

Another example is bell Canada who used to mine your DNS queries to profile you for ads, or ISPs that high jack the nxdomain result to send you sponsored results of vaguely similar sounding websites.

<comment><USER7> The YouTube cache is probably there not to increase performance for you, but to reduce ISP cost (ISP pays for all data received from outside of their network)

<comment><USER8> That's a strange way of looking at it. ISPs take all sorts of actions to both increase performance to customers, and to reduce their costs.

A competent ISP operating in good faith will execute and expand peering agreements when it makes economic sense to do so.

<comment><USER7> An ISPs #1 goal is to generate money.

When there's a competition this often equates with making customers happy so they will stick with the ISP and perhaps more will switch from competitors.

When there's no competition and customers have no choice who to use it's purely all about squeezing as much money as they can. This means raising prices for the service and reducing cost by paying less to others services even if it would reduce quality of service. The goal is to have service that's good enough to keep people still use them (I mean there is price point and/or quality that people would just not to have service at all).

If a specific action that ISP with monopoly does and it improves quality for customer that's just a coincidence.

</comment></comment></comment></comment></comment><comment><USER9> It would be more interesting to see how are they doing for some websites in the long tail, try the 900th, 9000th, and 90000th most popular sites instead of the top. And try some locations which are not actual datacenters?

<comment><USER10> And test consistency. Stddev, and get the worst results from 1000 runs.

<comment><USER11> Worst result can be an outlier, maybe better to use the 95th percentile or something.

</comment></comment></comment><comment><USER12> Mentally you need to add a big asterisk to tests of CDNs, and by extension "dns done like a cdn" from VPS provider networks (content networks). That's not where users come from (eyeball networks), and therefore not where they focus their efforts in peering and route-optimizing.

</comment><comment><USER13> I think we'll start seeing the standard configuration of 184.108.40.206,126.96.36.199 everywhere.

Google/Cloudflare tackled the UX of free DNS spectacularly with these gold IP addresses. It's the primary reason I use them instead of OpenDNS, which was an earlier player in this space.

<comment><USER14> Be careful with that, Google DNS (as an example) will start ignoring your DNS requests if you go over the rate-limit. Not an issue for home users, but an issue for any sizeable business.

<comment><USER15> How big a business do you have to be to use "free" DNS servers, but not big enough to run your own resolver?

<comment><USER16> Probably the same way they use Lets Encrypt instead of purchasing certificates. Lots of free things actually are free, despite the negative training otherwise we get from some companies.

</comment></comment></comment></comment><comment><USER17> 220.127.116.11 does not seem to be geographically-aware. Here are the resolutions for the same domain name (CNAME referring to the hopefully closest edge server), from France.

       % dig [domain] @18.104.22.168 +short
       [id].kxcdn.com.
       p-frpa00.kxcdn.com. # France

       % dig [domain] @188.8.131.52 +short
       [id].kxcdn.com.
       s-us-ca00.kvcdn.com. # America
       p-ussj00.kxcdn.com.

       % dig [domain] @188.8.131.52 +short
       [id].kxcdn.com.
       p-frpa00.kxcdn.com. # France

       % dig [domain] @ns0.fdn.fr +short # My ISP resolver
       [id].kxcdn.com.
       p-frpa00.kxcdn.com. # France

<comment><USER18> 126.96.36.199 does not pass along EDNS client subnet resulting in wrong geo-located responses. It is their "feature".

<comment><USER19> According to the FAQ[1], they also offer 18.104.22.168, which passes client subnet at the cost of other features.

[1] [https://www.quad9.net/faq](https://www.quad9.net/faq)

<comment><USER18> Fair enough, but most users won't care enough look it up and use 220.127.116.11 instead of 188.8.131.52 if they want better performance in exchange for allegedly lower privacy.

It appears 184.108.40.206 also does not pass client-subnet, atleast not by default. Queries to my authoritative from Google always includes client subnet, OpenDNS required request for whitelist. For Cloudflare its unclear.

<comment><USER20> >It appears 188.8.131.52 also does not pass client-subnet, atleast not by default.

Wow, this is actually a huge issue. Just as a simple test, I tried nslookup google.com for both 126.96.36.199 and 22.214.171.124, and Cloudflare's responses ping at about 200ms, whereas Google's responses ping at ~10ms.

<comment><USER21> That also explains the abnormally low response time of CloudFlare's solution compared to the 2nd and 3rd place solutions; the geo-location lookups require more time to reach and resolve a decision and thus represent an increase in response time from the resolver (in exchange for improved latency in all future communications to the target server).

</comment></comment></comment></comment></comment></comment><comment><USER22> Just run your own DNS resolver if you value your privacy. With prefetching and caching there will be little difference in performance.

<comment><USER23> But your DNS will have to query other DNS providers so if you're the only one using it, it won't be private.

<comment><USER24> There is 2 main different ways, one which does what you say - the other i'd say is pretty much OK.

If your local DNS server is merely querying an upstream resolver (like 18.104.22.168 / 126.96.36.199) on your behalf, then yes - it is no different.

If however, you query the root nameservers for the glue record for a domain and query the domain's own nameservers directly, then it is pretty good... As you are neither querying your ISP or TheMan.. which means that logically only the domain nameserver owner knows what queries you made (and you are probably hitting that domain in a moment anyway!). (The caveat is that some ISP's do transparent DNS proxying.. in which case, you have much larger trust issues with your ISP and need to take greater measures!)

That said.. I cba with that.

<comment><USER25> > only the domain nameserver owner knows what queries you made (and you are > probably hitting that domain in a moment anyway!)

But these are different people, with different incentives. The NS owner may be logging everything, without the domain owner's knowledge, and the NS owner won't even be in the wrong, because they likely made no promise to not log.

With a single resolver, I can verify that they're trustworthy enough [for me], just once, and direct all my traffic to it. Cloudflare's "We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours" is something, I imagine, they very much wouldn't want to be caught violating or changing their mind about later.

In the meanwhile, with the root NS method, I can only hope that my queries will get lost in the "noise". And I'm putting noise in quotation marks because there isn't much diversity in the name server ownership: 75% of Alexa top 1M domains are hosted at Cloudflare, GoDaddy and Amazon. [0]

[0] [https://www.datanyze.com/market- share/dns/Alexa%20top%201M/](https://www.datanyze.com/market- share/dns/Alexa%20top%201M/)

<comment><USER26> With QNAME minimalisation, RFC7129 (Authenticated denial of existence) and RFC8020 (NXDOMAIN: There really is nothing underneath), you should be sending almost nothing to the root servers of use.

QNAME minimalisation will only send <randomstring>.com to the root for them to give you the referral.

and RFC7129/RFC8020 mean that when you get a NXDOMAIN back from the root, you'll cache it and never try again for a large swath of possible names.

<comment><USER27> QNAME minimization just minimizes the name to one label under a delegation, there's no randomization. So root zone would only get 'com.' (and type NS). It's unfortunately easy for authoritative servers (below TLD level) to bypass it by returning NXDOMAIN. Resolver has to fall back on using a full name. The main reason is that a lot of authoritative DNS servers (notably Akamai) return NXDOMAIN when there's nothing under the minimized name, but there is something below it (aka empty non-terminal). So without workarounds the resolver would return NXDOMAIN early instead of retrying with the full name.

</comment></comment></comment></comment></comment></comment><comment><USER28> You can run a benchmark of your own using namebench. I recommend you uncheck the options for the included nameservers or it will take a very long time to run and enter only the DNS servers you want to test manually. It can use your Firefox browsing history as a source for domains to resolve.

Ignore the "incorrect" and "hijacked" warnings, I think the program has hardcoded, outdated IP ranges for popular services which causes those.

[https://code.google.com/archive/p/namebench/](https://code.google.com/archive/p/namebench/)

<comment><USER29> for the curious arch user, it's on AUR

ps: namebench is quite extensive. thousands of queries and a nice and long report. enjoy it

</comment></comment><comment><USER30> If you want to see the performance from even more locations here is a more detailed benchmark [https://www.cdnperf.com/tools/cdn-latency- benchmark/0d8b484e...](https://www.cdnperf.com/tools/cdn-latency- benchmark/0d8b484e2b77537487e5170c4c38647e)

Or you can even use a CLI [https://perfops.net/cli](https://perfops.net/cli) to run custom tests from any location

</comment><comment><USER31> Unfortunately no tests for IPv6 connections. Disappointing considering that all DNS traffic I generate will be over IPv6.

</comment><comment><USER19> Besides response time, the next level of comparison is how well geo-DNS-based services (global load balancing, etc.) support these resolvers. AFAIK 184.108.40.206 gives decent results in most places, though I've seen suboptimal US-centric results from Quad9 in Asia. Support for RFC 7871 (Client Subnet in DNS Queries) comes into play here too.

<comment><USER32> I always used 126.96.36.199, since I couldn't remember OpenDNS's IPs.

But just found out today that, from Sydney, OpenDNS and Cloudflare are kicking Google's ass for speed. 184.108.40.206 is on par with my ISP-default DNS.

<comment><USER33> Ever since The Great Comcast DNS Outage of 2010, I've had the OpenDNS IPs burned into my memory from telling so many people.

I like the fact that you can sign up for OpenDNS and customize some of the filtering (ads, spam/malware, etc.) They used to have crappy handling of nxdomains (by default) redirecting you to a website with ads, but I believe that's no longer the case?

<comment><USER6> As250 is running a free DNS server with adblocking enabled FWIW: [https://twitter.com/as250/status/790593201832857601?s=20](https://twitter.com/as250/status/790593201832857601?s=20)

Pihole is also a great alternative if you have a spare raspi lying around.

<comment><USER34> > if you have a spare raspi lying around.

Really, if you have a spare computer of any type. I run it on a VM and it works just fine. It was made for Raspberry Pis but it'll work on any system.

</comment></comment></comment></comment></comment><comment><USER35> The OpenNIC project has a database of community/private DNS servers with certain standards.

[https://www.opennic.org/](https://www.opennic.org/)

</comment><comment><USER36> Is there a tutorial on setting up your own? I've got a huge hosts file and would like it to affect all the devices at my home but setting up a DNS server always seemed high-level black magic to me.

<comment><USER37> [https://pi-hole.net](https://pi-hole.net)

</comment></comment><comment><USER38>
      Moscow, Russia
                     test1   test2   test3   test4   test5   test6   test7   test8   test9   test10  Average
      adguard        6 ms    8 ms    4 ms    8 ms    11 ms   5 ms    7 ms    4 ms    4 ms    22 ms     7.90
      google2nd      4 ms    4 ms    5 ms    22 ms   30 ms   18 ms   3 ms    27 ms   3 ms    3 ms      11.90
      yandex         5 ms    9 ms    5 ms    9 ms    87 ms   50 ms   9 ms    9 ms    5 ms    60 ms     24.80
      google         3 ms    18 ms   3 ms    20 ms   29 ms   165 ms  3 ms    18 ms   3 ms    19 ms     28.10
      cloudflare2nd  45 ms   44 ms   46 ms   44 ms   46 ms   44 ms   44 ms   45 ms   65 ms   48 ms     47.10
      quad9          47 ms   48 ms   47 ms   48 ms   46 ms   57 ms   46 ms   44 ms   46 ms   45 ms     47.40
      opendns        45 ms   47 ms   46 ms   59 ms   47 ms   45 ms   47 ms   49 ms   51 ms   44 ms     48.00
      norton         52 ms   49 ms   53 ms   52 ms   58 ms   56 ms   51 ms   48 ms   54 ms   52 ms     52.50
      cleanbrowsing  96 ms   48 ms   60 ms   46 ms   49 ms   46 ms   45 ms   49 ms   44 ms   46 ms     52.90
      neustar        54 ms   56 ms   52 ms   59 ms   50 ms   57 ms   55 ms   57 ms   59 ms   54 ms     55.30
      comodo         80 ms   88 ms   73 ms   113 ms  79 ms   75 ms   75 ms   74 ms   74 ms   90 ms     82.10
      cloudflare     1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms   1000.00

</comment><comment><USER39> From Waimanalo, Hawaii cloudflare times out:

                      test1   test2   test3   test4   test5   test6   test7   test8   test9   test10  Average
      192.168.50.1      154 ms  157 ms  154 ms  154 ms  154 ms  154 ms  156 ms  158 ms  155 ms  184 ms    158.00
      cloudflare        1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms   1000.00
      google            106 ms  82 ms   80 ms   158 ms  113 ms  148 ms  82 ms   107 ms  106 ms  81 ms     106.30
      quad9             91 ms   99 ms   111 ms  106 ms  90 ms   97 ms   89 ms   91 ms   89 ms   88 ms     95.10
      opendns           105 ms  81 ms   96 ms   120 ms  82 ms   110 ms  81 ms   115 ms  105 ms  83 ms     97.80
      norton            82 ms   80 ms   82 ms   94 ms   84 ms   91 ms   82 ms   80 ms   82 ms   83 ms     84.00
      cleanbrowsing     135 ms  158 ms  245 ms  136 ms  132 ms  132 ms  133 ms  138 ms  133 ms  145 ms    148.70
      yandex            287 ms  389 ms  256 ms  256 ms  258 ms  256 ms  258 ms  257 ms  258 ms  255 ms    273.00
      adguard           290 ms  270 ms  319 ms  295 ms  433 ms  340 ms  261 ms  351 ms  290 ms  264 ms    311.30
      neustar           86 ms   82 ms   83 ms   84 ms   80 ms   90 ms   80 ms   81 ms   84 ms   83 ms     83.30
      comodo            149 ms  148 ms  152 ms  152 ms  153 ms  148 ms  150 ms  147 ms  148 ms  151 ms    149.80

</comment><comment><USER40> Quad9 has several IPs and different services, see ([https://www.heise.de/imgs/18/2/3/1/7/9/4/7/quad9-feature- mat...](https://www.heise.de/imgs/18/2/3/1/7/9/4/7/quad9-feature- matrix-72311e6ae96e13b1.png)). For some reason this is hidden on the quad9 website.

<comment><USER34> It's in their FAQ: [https://www.quad9.net/faq/#Is_there_a_service_that_Quad9_off...](https://www.quad9.net/faq/#Is_there_a_service_that_Quad9_offers_that_does_not_have_the_blocklist_or_other_security)

Seems they've sunset .11 and .12, but .10 is still up.

</comment></comment><comment><USER41> This tests the performance / distance between vps data centers and the dns server's data centers. imho it's better to have a test web page that consumers visit and establishes a tcp connection to those dns services and estimate the rtt of a single packet from the time it took to establish the connection, or test via the https interface for services that support it.

<comment><USER42> While I whole-heartedly agree with your objection, I question the solution. How do you get high accuracy timing of DNS resolution in JavaScript inside the browser?

<comment><USER43> Not a JavaScript developer, but if they can do timings fine enough to run Meltdown attacks in JS, I think they can safely and accurately measure network timings.

<comment><USER42> Timing in general isn't the issue here, there isn't a way to my knowledge to get just the DNS portion (specifically across an arbitrary set of DNS providers) of the network timing in JS. Just like there isn't a way to test the timing of a single packet really either.

<comment><USER43> You can get the DNS-over-HTTP(s) though. Not as ideal as a perfect DNS request/response over UDP, of course.

<comment><USER42> See original context, it is clearly about evaluating DNS providers with real end users via a web app. Considering a majority of providers don't support it, seems it'll be a very limited evaluation if it followed your proposal.

</comment></comment></comment></comment></comment></comment><comment><USER44> Anecdotally, I know a guy who runs a local Cloud provider in the greater- Beijing area (part of Hebei proveince). He told me Cloudflare has struck a deal with the government to have integration with them, presumably with higher standard than normal tech providers.

That might explain why CloudFlare has good performance across the globe, which in a large part related to China.

</comment><comment><USER18> [https://pulse.turbobytes.com/results/5ac1f967ecbe4078c200ee4...](https://pulse.turbobytes.com/results/5ac1f967ecbe4078c200ee4a/)

Cloudflare consistently times out from these networks.

Netherlands - AS13127 Philippines - AS135132 Thailand - AS17552 (One of the largest consumer internet providers) US - AS7018 (AT&T)

<comment><USER45> I'm sure this is because 126.96.36.199 does not work everywhere well. Maybe with 184.108.40.206 it will work more reliable.

<comment><USER18> Yep you are right right.

        ~# mtr --report --address 192.168.2.2 220.127.116.11
        Start: Mon Apr  2 16:53:31 2018
        HOST: apu                         Loss%   Snt   Last   Avg  Best  Wrst StDev
          1.|-- 192.168.2.1                0.0%    10    0.9   1.1   0.9   1.2   0.0
          2.|-- 10.137.128.1               0.0%    10   11.3  12.8  10.7  17.1   1.8
          3.|-- 10.246.253.133             0.0%    10    7.7   8.2   7.5   9.1   0.0
          4.|-- 10.185.94.203              0.0%    10    9.1   8.4   6.9   9.4   0.6
          5.|-- 10.185.94.25               0.0%    10    9.5   8.7   7.7  10.0   0.5
          6.|-- 61-91-220-101.static.asia  0.0%    10   11.7  11.7   8.6  25.7   5.2
          7.|-- 58-97-82-116.static.asian  0.0%    10   10.7  10.2   8.6  15.4   1.9
          8.|-- ppp-171-102-254-81.revip1  0.0%    10    9.2   9.2   7.1  10.8   0.9
          9.|-- ppp-171-102-250-134.revip  0.0%    10    8.4  10.0   8.4  11.3   0.7
         10.|-- ppp-171-102-250-149.revip  0.0%    10    9.0   9.7   9.0  10.9   0.3
         11.|-- ???                       100.0    10    0.0   0.0   0.0   0.0   0.0
        ~# mtr --report --address 192.168.2.2 184.108.40.206
        Start: Mon Apr  2 16:54:05 2018
        HOST: apu                         Loss%   Snt   Last   Avg  Best  Wrst StDev
          1.|-- 192.168.2.1                0.0%    10    1.2   1.1   0.8   1.3   0.0
          2.|-- 10.137.128.1               0.0%    10   12.1  12.8   9.2  18.2   2.4
          3.|-- 10.246.253.133             0.0%    10    9.8   9.0   7.5  14.7   2.0
          4.|-- 10.185.94.203              0.0%    10    4.4   7.9   4.4   8.8   1.2
          5.|-- 10.185.94.17               0.0%    10    9.2   9.1   7.2  10.3   0.9
          6.|-- 61-91-220-55.static.asian  0.0%    10    9.7  10.6   8.0  17.2   2.6
          7.|-- 58-97-82-120.static.asian  0.0%    10   10.5   9.7   8.2  11.2   0.7
          8.|-- ppp-171-102-254-65.revip1  0.0%    10   10.5   9.7   8.8  10.7   0.0
          9.|-- ppp-171-102-254-227.revip  0.0%    10    8.9  13.1   8.8  44.0  10.8
         10.|-- 61-91-213-130.static.asia  0.0%    10   10.9   9.8   8.3  10.9   0.6
         11.|-- TIG-Net242-40.trueinterga  0.0%    10   15.0  14.1  10.9  16.1   1.8
         12.|-- TIG-Net245-243.trueinterg  0.0%    10   38.1  38.0  36.4  40.6   0.9
         13.|-- 13335.sgw.equinix.com      0.0%    10   37.4  38.6  36.4  48.5   3.5
         14.|-- 1dot1dot1dot1.cloudflare-  0.0%    10   36.9  36.3  35.0  36.9   0.5

Edit: Formating

</comment></comment></comment><comment><USER46> What about services which use anycast/geolocation to decide where to serve you data from? They will get bad location data as they will get the location of the resolver. This can have a direct impact on services.

An example of my own is from about 10 years ago when Netflix started streaming. We got a Roku and signed up but the service terrible due to the stream stopping to buffer every few minutes. After researching and trying several things I eventually came across the fact that the stream was coming from servers in over a thousand miles away with pretty bad latency between. Long story short, I eventually figured out it was due to my using the level3 resolvers for DNS. As soon as I changed to our ISP's DNS servers it worked great and the data was streaming from very close.

<comment><USER47> I wonder if location data would/could/should be an optional flag in DNS requests, instead of relying on physical location of the resolver.

</comment></comment><comment><USER48> What is the benefit to Google/CloudFlare of providing free DNS resolution? Why do they offer it?

<comment><USER49> Long back when this started, OpenDNS was the largest public DNS provider. And I know at one point they started "hijacking" google requests - you can read this here : [http://www.dslreports.com/forum/r21284386-Google-Com- Hijacke...](http://www.dslreports.com/forum/r21284386-Google-Com-Hijacked-by- OpenDNS). This was in 2008. They used to also hijack DNS requests to show their own ads. And i am pretty sure many ISPs always played around with DNS in this way.

In 2009, Google launched its own Public DNS - the reasons given were to make the web faster and safer, and i think there is some sense in which they have delivered. But I think another reason was defensive - provide an alternative to OpenDNS and to crappy ISP DNSs.

In 2014 - OpenDNS stopped using DNS to show ads : [https://umbrella.cisco.com/blog/2014/05/29/no-more- ads/](https://umbrella.cisco.com/blog/2014/05/29/no-more-ads/).

</comment></comment><comment><USER50> Why is google DNS listed as "private"? They permanently log all of your DNS queries.

[https://developers.google.com/speed/public- dns/privacy](https://developers.google.com/speed/public-dns/privacy)

<comment><USER8> That page specifically says that they don't:

> Google Public DNS stores two sets of logs: temporary and permanent. The > temporary logs store the full IP address of the machine you're using. [...] > We delete these temporary logs within 24 to 48 hours.

> In the permanent logs, we don't keep personally identifiable information or > IP information. We do keep some location information (at the city/metro > level) so that we can conduct debugging, analyze abuse phenomena. After > keeping this data for two weeks, we randomly sample a small subset for > permanent storage.

<comment><USER50> Read the page.

>Finally, if you're interested in knowing what else we log when you use Google Public DNS, here is the full list of items that are included in our permanent logs:

>Request domain name, e.g. www.google.com

>Client's AS (autonomous system or ISP), e.g. AS15169

>User's geolocation information: i.e. geocode, region ID, city ID, and metro code

>Absolute arrival time in seconds

Not tracking individual IPs doesn't mean shit.

</comment></comment></comment><comment><USER51> What I don't understand is how these services are offered at apparently no cost.

Sure, I expect Google is slurping all of my connections to help build an ad profile on me. But what about the other companies? They've got to keep the lights on somehow.

<comment><USER52> > I expect Google is slurping all of my connections to help build an ad > profile on me.

Google says they don't - from [https://developers.google.com/speed/public- dns/privacy](https://developers.google.com/speed/public-dns/privacy):

> We don't correlate or combine information from our temporary or permanent > logs with any personal information that you have provided Google for other > services.

Honestly, Google DNS policy seems largely similar to Cloudflare, with the exception of 3rd party audit.

Cloudfare apparently doesn't do GeoIP mapping, so, till they implement that, it's not going to be useful for me.

</comment></comment><comment><USER53> GRC's DNS Benchmark[0]

For anyone who wants to test their DNS servers. It is Windows binary, but works fine on Wine.

[0] [https://www.grc.com/dns/benchmark.htm](https://www.grc.com/dns/benchmark.htm)

<comment><USER54> This is the only proper way to test nameservers as a consumer. Everything else using any virtual servers in data centers will be skewed.

</comment></comment><comment><USER26> Things to look for in comparing recursive DNS servers performance:

The 95%ile DNS response time for cached/uncached names. The 95%ile DNS response when one/some of the authoritative nameservers is "lame" or not responding. (better yet, 99%ile, but that requires even more queries...)

The average packet loss to the nameserver. (As many resolvers use the default of a 5s timeout, better resolvers use a 1s timeout, the best stub resolvers would use a dynamic timeout, but afaik, none do...).

Do they implement DNSSEC validation? What is their story for domains that break DNSSEC (eg: [https://www.internetsociety.org/resources/deploy360/2014/cas...](https://www.internetsociety.org/resources/deploy360/2014/case- study-comcasts-dnssec-implementation/))?

Do they implement RFC7129 (authenticated denial of existence)? This can be used to prevent your service being used to attack an authoritative nameserver, prevents leaks of useless domains (eg machines looking up untitled.pdf as a domain), and allows you to return NXDOMAIN with much lower latency, making DNS search paths faster. RFC8020 (NXDOMAIN: There is really nothing underneath) would be another example where you can prevent leaking names, and return faster responses from a smaller cache (although I admit I've never seen anyone implement RFC8020 yet).

Will they accept (signed) responses into their cache in the additional section? Again, this can significantly reduce the time for uncached responses.

[hint: These are good reasons you should sign your domain, it can make things faster and reduce load on your authoritative nameserver!]

What is their story for domains that need a cache flush?

Do they (correctly) implement IPv6 from the recursive to the authoritative nameservers? Do they (correctly) implement IPv6 from the stub to the recursive nameserver?

How big is their cache? How long do things stay in their cache? There's no point being close to a nameserver with an empty cache. Querying www.google.com isn't really going to tell you much about their cache depth, nor is the Alexa 1M. You need a very very wide variety of names.

Do they provide good GeoIP responses? There's no point in getting an answer for the middle of the US in <1ms if you happen to be 300ms away in Asia somewhere. The DNS response was fast, but the webserver it sent you to is going to give you abysmal performance. This is often done with EDNS0-Client- Subnet, but it can also be fudged by making the outbound IPs for the iterative requests being diverse enough for different localities.

Do they "lie" about names? In what circumstances do they lie? Do they NXDOMAIN malicious domains? adult websites? ad domains? random websites? Do they redirect ad websites to their own ad farm? How do their lies handle DNSSEC?

Do they perform QNAME minimalisation to help protect your queries from servers that don't need it?

What other features do they implement to make sure their cache is never poisoned?

What is their abuse plan? If I send them a vast number of queries what happens? Do they send back TrunCated responses and force me over TCP? Will they respond with SERVFAIL? Or will they drop the queries? Or will they pass them all through to the authoritative nameservers? Do I need to do anything (other than stop sending abusive amounts of load) to be unblocked? What if the reason I'm sending a large number of queries is because I'm a carrier grade NAT IP pool and I have one broken/bad user?

What is their reliability story? Is it expected that they will go down for 10 minutes every now and again?

What do they do about general Internet Hygiene? Do they have protects against being used for reflection attacks?

Do they do preemptive lookups to keep their cache warm or is someone always guaranteed to have to wait for the full resolution? How do they make sure they don't accidentally DoS authoritative nameservers with preemptive resolutions?

Things not to look for:

ICMP/mtr times are essentially meaningless, except as providing general information about routing decisions.

The mean response time, as it tends to be washed out by cached response times, and what you don't care about is if it takes 15ms or 17ms on average, as you can't perceive the difference. What you _do_ care about is if one nameserver has 1/5000 queries which take >1s as that will become a frequent noticeable problem when your surfing.

Just looking at a few common names that are likely to be in the cache. Yes, those are important, but as with anything at scale, it's the long tail that's actually interesting and will dominate your perception of performance. You can set up your own domain, and search for random strings and force the full end- to-end query flow. (Beware about wildcard domains for this, if your domain is signed, in theory the nameserver could synthesize responses without going back to your nameserver).

Where are your vantage points for measurements? Many people appear to measure from places like AWS zones, and then report spectacular performance for DNS servers also hosted in the same AWS zones – despite most of their users not being hosted there.

Hmm, I'm sure there's more, but that's off the top of my head.

(Disclaimer: Once upon a time, I was one of the engineers oncall for Google Public DNS, so I have Opinions)

<comment><USER27> This is a great comment. The ping time is so much less meaningful for recursive service than for authoritative. The latency difference between cached answer and uncached answer is in several orders of magnitude. The cache hit ratio also plummets without some sort of cache sharing, which many recursive services don't implement. So you may end up with great ping time, but something like:

``` ;; Query time: 12 msec ;; Query time: 149 msec ;; Query time: 14 msec ;; Query time: 238 msec ;; Query time: 112 msec ;; Query time: 27 msec ```

For less popular names.

</comment></comment><comment><USER55> Hi, could someone explain to me what this DNS stuff is about like I'm 5? How is it related to private browsing?

<comment><USER56> DNS is a service that converts easy to remember names like google.com or youtube.com to hard to remember ip addresses so you don't have to. We find it easier to remember names than strings of numbers. So usually your isp assigns their own dns server for you to use automatically and most people don't think about it. Sometimes a DNS server can go bad or become slow and people use services like google's dns services to speed up access to the sites they use. Google could use dns look up information from your computer to know what sites you visit even when you don't search google.com for it. I don't know if they do or not but I was thinking, if I was google I would probably do that. Its not that google needs your browsing habits to find web sites but it can use the querys it recieves to measure the popularity of web sites or web pages. As to why the current interest in DNS I'm not sure.

A lot of trust is in DNS and a lot of people don't realize that an evil dns server can make your browser think you are going to good sites but could actually be an imposter.

Other annoyances are NXDOMAIN (non existant domain) querys that are hyjacked to serve you ads.

Controling DNS servers is a great way for a nation state to censor communication. They could take any site they wish and forward your browser to an automatic service that logs you with other "wrong thinkers". Or just resolve the domain name to null reference.

Speed, security, privacy are things to consider for DNS. But like a lot of things on the internet, it all about trust...

</comment></comment><comment><USER57> Hmmm. Off the bat, CloudFlare ICMP for me is worse than Google:

[http://www.jaruzel.com/files/ICMP-CloudFlareDNS-vs-Google- te...](http://www.jaruzel.com/files/ICMP-CloudFlareDNS-vs-Google-tetx.png)

I'll stick with Google I think. UK/London btw.

</comment><comment><USER58> Safari barfs on visiting [https://184.108.40.206](https://22.214.171.124) as linked in the article. Certificate invalid (though it looks fine). Rather unfortunate regarding perception; it's an interesting service!

<comment><USER59> Works for me; Safari 11.0.3 on High Sierra.

(I'm surprised it works at all though... I wouldn't have thought you could have an HTTPS certificate for an IP address? You learn something new every day.)

<comment><USER60> The actual domain name is [https://cloudflare-dns.com/](https://cloudflare- dns.com/) (found by inspecting the cert)

Before SNI, every cert had to go to a static public IP address. Everything between you and the TLS terminator had to handle this. As a side-effect, you didn't actually need to know the domain name to get the tunnel, because everything handling the packets was running on the destination IP.

tl;dr: Trickery based on dated TLS quirks.

<comment><USER58> That works fine (the URL directly). The certificate is valid. Entering [https://188.8.131.52](https://188.8.131.52) doesn't, but shows the same certificate.

Don't really understand what's happening here. Anyway thanks for the info there.

<comment><USER60> How odd. What browser are you using? It appears to be deviating from spec.

<comment><USER58> Safari 11.1 (13605.33.1.2). Mac OSX 10.13.4.

<comment><USER60> You are using a slightly more recent version than me, but not significantly. There's no obvious reason there, unless Apple decided to kill support for ip addresses entirely. Is it possible that your machine has been configured in an unconventional fashion?

</comment></comment></comment></comment></comment></comment></comment><comment><USER61> I let it (the story) sit a day after 4/1 just to make sure it wasn't really an April Fools' joke. But today I made it my primary DNS server and it's performing very well. Glad there's another player in the private DNS space.

</comment><comment><USER62> I wonder how well 4.2.2.x compares...

Then again, a few ms of difference is unlikely to make any noticeable effect in real-world use cases where clients already have local DNS caching and the bulk of the time is data transfer, not DNS lookups.

<comment><USER42> > the bulk of the time is data transfer, not DNS lookups

You'd be surprised.

</comment></comment><comment><USER63> No tests for Africa?

</comment><comment><USER64> I've been using Quad9, if anything just because I feel Google already knows too much about me anyway. So far no complaints about it.

</comment><comment><USER65> Why is Montreal reporting abnormally high response times across the board?

For example:

# Cloudflare Toronto 3.42ms vs. Montreal 17ms;

# Google Toronto 9.42ms vs. Montreal 16.71ms.

<comment><USER66> I live in Montréal, and I saw the same tendency. Cloudflare has a datacenter here. Waiting for a tangible explanation…

<comment><USER67> Are you using BIG ISP or small? Big guys don't peer at QIX and drag your traffic to US. On other side, smaller players peer at QIX [https://qix.ca/members](https://qix.ca/members)

</comment></comment></comment><comment><USER68> How do other services compare? Like [https://blog.uncensoreddns.org/dns- servers/](https://blog.uncensoreddns.org/dns-servers/) [https://dns.watch/](https://dns.watch/) [https://ipredator.se/page/services#service_dns](https://ipredator.se/page/services#service_dns)

</comment><comment><USER69> I wasn't aware of Quad9, it seems like a pretty great option for those that are easy targets of scams/phishing.

<comment><USER70> Quad9 is supported/funded by City Of London Police, the same police that cooperates with ad companies to track people online. [https://www.theguardian.com/media-network/media-network- blog...](https://www.theguardian.com/media-network/media-network- blog/2014/apr/17/police-advertising-industry-copyright-infringement)

Keep away from this.

<comment><USER71> Interesting question: would I rather protect my elderly Mum from known malicious domains potentially trying to scam/phish, or from potential tracking and ad targeting?

(Actually, it's not really a difficult choice at all, is it?)

<comment><USER72> Why not both? You're smart enough I guess to find a good solution.

</comment></comment></comment></comment><comment><USER73> I switched all my devices to CloudFlare 'cause it 2x faster than Google DNS in my location - Europe.

<comment><USER74> I'm in Europe too which is in Paris and Google DNS is way faster at 4ms vs 15ms for cloudflare.

</comment></comment><comment><USER75> Will website name in certificate shared by server during handshake kill the DNS over https purpose?

</comment><comment><USER76> Out of curiosity, are there any negatives for everyone to funnel their DNS traffic through a single provider? Might be paranoia, and it may in this case just be putting all of your traffic through company_a vs all of your traffic through company_b scenario, but I've been curious since this was announced.

</comment><comment><USER65> Why is Montreal abnormally high for all services?

<comment><USER77> It goes to NYC ...

</comment></comment><comment><USER78> google is faster for me in the bay area from comcast network. Using both ping and dig for testing

</comment><comment><USER79> It is blocked in Turkey.

</comment><comment><USER80> Cloudflare it is then!

</comment><comment><USER81> Thanks, great response times from my NYC droplet.

    				   test1   test2   test3   test4   test5   test6   test7   test8   test9   test10  Average
    	quad9          1 ms    2 ms    1 ms    1 ms    1 ms    1 ms    1 ms    1 ms    1 ms    1 ms      1.10
    	cloudflare     2 ms    1 ms    1 ms    2 ms    1 ms    1 ms    1 ms    2 ms    1 ms    1 ms      1.30
    	comodo         1 ms    2 ms    2 ms    3 ms    2 ms    1 ms    2 ms    1 ms    1 ms    2 ms      1.70
    	adguard        2 ms    2 ms    3 ms    2 ms    2 ms    2 ms    2 ms    2 ms    2 ms    2 ms      2.10
    	cleanbrowsing  2 ms    4 ms    2 ms    2 ms    2 ms    2 ms    14 ms   16 ms   2 ms    2 ms      4.80
    	norton         6 ms    7 ms    7 ms    7 ms    8 ms    7 ms    6 ms    7 ms    7 ms    7 ms      6.90
    	namecheap      7 ms    7 ms    7 ms    7 ms    7 ms    7 ms    7 ms    7 ms    7 ms    7 ms      7.00
    	neustar        8 ms    7 ms    7 ms    8 ms    9 ms    6 ms    7 ms    7 ms    7 ms    7 ms      7.30
    	namecheap2nd   8 ms    8 ms    7 ms    9 ms    9 ms    8 ms    10 ms   8 ms    8 ms    8 ms      8.30
    	opendns        20 ms   1 ms    1 ms    30 ms   2 ms    8 ms    1 ms    16 ms   15 ms   3 ms      9.70
    	google2nd      16 ms   1 ms    1 ms    17 ms   1 ms    24 ms   1 ms    16 ms   17 ms   14 ms     10.80
    	google         17 ms   1 ms    1 ms    17 ms   1 ms    41 ms   1 ms    17 ms   18 ms   15 ms     12.90
    	cloudflare2nd  1 ms    2 ms    1 ms    1 ms    1000 ms 2 ms    2 ms    1 ms    2 ms    2 ms      101.40
    	yandex         101 ms  102 ms  104 ms  101 ms  115 ms  103 ms  107 ms  100 ms  105 ms  136 ms    107.40

Not so much from my home ISP:

    				   test1   test2   test3   test4   test5   test6   test7   test8   test9   test10  Average
    	namecheap2nd   45 ms   45 ms   44 ms   45 ms   48 ms   45 ms   45 ms   46 ms   48 ms   45 ms     45.60
    	cloudflare2nd  45 ms   49 ms   48 ms   47 ms   45 ms   44 ms   45 ms   45 ms   46 ms   46 ms     46.00
    	namecheap      46 ms   48 ms   48 ms   44 ms   45 ms   45 ms   46 ms   45 ms   45 ms   48 ms     46.00
    	cleanbrowsing  46 ms   46 ms   44 ms   56 ms   45 ms   44 ms   48 ms   46 ms   44 ms   46 ms     46.50
    	google2nd      49 ms   47 ms   47 ms   45 ms   51 ms   47 ms   46 ms   44 ms   43 ms   46 ms     46.50
    	comodo         46 ms   47 ms   48 ms   49 ms   46 ms   47 ms   44 ms   45 ms   47 ms   50 ms     46.90
    	adguard        49 ms   48 ms   45 ms   46 ms   46 ms   48 ms   49 ms   48 ms   48 ms   48 ms     47.50
    	google         46 ms   49 ms   47 ms   47 ms   45 ms   47 ms   47 ms   49 ms   44 ms   67 ms     48.80
    	opendns        47 ms   46 ms   47 ms   64 ms   48 ms   49 ms   46 ms   64 ms   64 ms   48 ms     52.30
    	cloudflare     44 ms   48 ms   45 ms   50 ms   48 ms   110 ms  45 ms   48 ms   45 ms   47 ms     53.00
    	quad9          46 ms   49 ms   45 ms   47 ms   49 ms   153 ms  46 ms   45 ms   48 ms   46 ms     57.40
    	neustar        66 ms   66 ms   66 ms   67 ms   66 ms   66 ms   66 ms   67 ms   66 ms   67 ms     66.30
    	norton         91 ms   67 ms   67 ms   67 ms   66 ms   66 ms   67 ms   66 ms   67 ms   67 ms     69.10
    	yandex         176 ms  279 ms  176 ms  174 ms  188 ms  178 ms  179 ms  176 ms  174 ms  179 ms    187.90

</comment><comment><USER82> Does anyone actually believe that google isn't hoovering up personal data with its DNS service?

<comment><USER83> All this tasty data:

Request domain name, e.g. www.google.com

Request type, e.g. A (which stands for IPv4 record), AAAA (IPv6 record), NS, MX, TXT, etc.

Transport protocol on which the request arrived, i.e. TCP, UDP, or HTTPS

Client's AS (autonomous system or ISP), e.g. AS15169 User's geolocation information: i.e. geocode, region ID, city ID, and metro code

Response code sent, e.g. SUCCESS, SERVFAIL, NXDOMAIN, etc.

Whether the request hit our frontend cache

Whether the request hit a cache elsewhere in the system (but not in the frontend)

Absolute arrival time in seconds

Total time taken to process the request end-to-end, in seconds

Name of the Google machine that processed this request, e.g. machine101

Google target IP to which this request was addressed, e.g. one of our anycast IP addresses (no relation to the user's IP)

<comment><USER82> And my IP address, linking my browsing to my google account and my identity.

</comment></comment></comment><comment><USER84> I feel like people forgot about how CloudFlare, Google, et. al. can new effectively censor content they don't agree with:

[https://fightthefuture.org/article/the-new-era-of- corporate-...](https://fightthefuture.org/article/the-new-era-of-corporate- censorship/)

..and even though CloudFlare back pedaled on that particular decision somewhat, it still happened.

If you really want something fast and secure, run your own caching DNS that uses root DNS servers.

<comment><USER85> > If you really want something fast and secure, run your own caching DNS that > uses root DNS servers.

is there a good tutorial for this somewhere?

<comment><USER86> If you want to do it on your local linux system, it's pretty easy: you just need to install bind9 and use `nameserver 127.0.0.1` in your /etc/resolv.conf

Bind9 has a poor reputation because of how difficult it is to use it to define zones (manage a domain name), but if you want to use it as a resolver, it's basically plug'n'play.

Huge bonus included : if you want to flush the cache, you just need to run `sudo rndc flush`, so you don't have to wait for TTL timeout to test your newly configured domain name when you setup a website (you still have to restart your browser, because most of them do their own dns caching).

<comment> vertex-four Honestly, isn't Unbound a better shout if you're not going to be fiddling with it? Just install, run, and edit /etc/resolv.conf to point at 127.0.0.1.

<comment><USER86> Well, you're describing exactly how to do it with bind9 :) What make you say Unbound is better?

<comment><USER28> Unbound is more lightweight. All it does is recursive lookups, it has no option for being authoritative. If that's all you need then that's better.

There are other options too, I don't know what makes Unbound better than PowerDNS Recursor or Knot Resolver.

</comment></comment></comment></comment></comment></comment><comment><USER87> Is DNS _configuration_ ever considered as a factor in "DNS performance"? IME as an end user, it makes a significant difference.

For example if it takes seven queries to resolve a name "A" versus two queries to look up a name "B", then in almost all cases, irrespective of the distance to a cache, looking up A is going to be noticeably slower than looking up B. Indirection is only one example. Even worse are configuations that knowingly trigger retries and wait for client timeouts in order to present a client with a particular nameserver.

Indirection and other "DNS tricks" come at a cost. IME, these are not compensated for via the proximity of a cache.

</comment><comment><USER88> There's a lot more to consider than just performance when deciding whom to share your browsing habits with. Why would you choose Cloudflare or Google?

This isn't an endorsement of Quad9 or OpenDNS; I just don't know enough about them. However, the fact that Cloudflare and Google are privacy-and-security nightmares is well documented.

</comment><comment><USER89> OpenNIC offers DNSCrypt.

[https://www.opennic.org/](https://www.opennic.org/)

</comment><comment><USER90> Google and Privacy=Yes ... sure.

</comment><comment><USER91> I presume that Google uses this as part of it's surveillance operation.

<comment><USER26> Google has a separate, stricter, privacy policy for Google Public DNS: [https://developers.google.com/speed/public- dns/privacy](https://developers.google.com/speed/public-dns/privacy)

Basically there are two log files kept:

\- One for up to 48 hours which contains IP addresses, which is used for handling abuse.

\- One is permanent which doesn't contain any personal identifying information (eg IP addresses), which is used for things like internal performance monitoring, load testing, and tracking frequency of longer term abuse etc.

Google provides Google public DNS because if you see the internet as being slow because of poor DNS performance, then you don't use websearch as much. Google doesn't need to use Google Public DNS to track users, and would rather not have the information (as it makes it available for government requests etc which are a major pain to deal with). But running a large scale recursive DNS server tends to attract a _lot_ of abuse, both intentional, and unintentional as I'm sure 184.108.40.206 and 22.214.171.124 are discovering.

Google provides Google Public DNS because a lot of ISPs provide extremely poor default recursive nameservers (having tiny caches, dropping queries due to overload, not implementing IPv6, DNSSEC validation, EDNS0 payload size, or other important modern DNS features. Some ISPs also hijack domains for their own purposes, or "stretching" DNS TTLs etc) so providing a better alternative to improve overall Internet use is clearly in Google's best interest.

Having other public resolvers, with different trade offs is clearly better for everyone, including Google as long as they are reliable, trustworthy, and provide low latency responses.

Good luck to everyone who's joining in the fun of running a planet scale recursive DNS server.

(Disclaimer: I have previously worked on Google Public DNS, but no longer do)

<comment><USER92> Do you know if Chrome uses Google Public DNS by default? I've heard it does for performance and avoiding problems with ISPs' crappy DNS. I imagine it would still need to fall back to local DNS to resolve names on enterprise intranets.

<comment><USER26> This is outside my area of expertise.

My uninformed assumption is that chrome generally uses whatever is configured in the system resolver, otherwise things like captive portals, and split horizon DNS wouldn't work properly, but I don't specifically know.

</comment></comment></comment></comment><comment><USER32> dig +noall +stats @220.127.116.11 news.ycombinator.com; dig +noall +stats @126.96.36.199 news.ycombinator.com; dig +noall +stats @188.8.131.52 news.ycombinator.com; dig +noall +stats @18.104.22.168 news.ycombinator.com; dig +noall +stats @22.214.171.124 news.ycombinator.com; dig +noall +stats @22.214.171.124 news.ycombinator.com

Fixed? =P

I removed some of the records form the article after reading some of the comments here. Cloudflare, Google, and OpenDNS only.

Kind of cool, I switched it up and ran it against 10 sites I frequent... was pretty impressed to see how well OpenDNS was doing.

<comment><USER70> You should be doing `dig @220.127.116.11 news.ycombinator.com`

<comment><USER28> That resolves "news.ycombinator.com" and "220.127.116.11" with your system resolver.

You're looking for "dig @188.8.131.52 news.ycombinator.com" which will resolve "news.ycombinator.com" using "18.104.22.168".

<comment><USER70> Thanks, I wrote that from memory. I'll update my comment.</comment></comment></comment></comment>


Ask HN: What are your maxvisit and minaway settings? - <AUTHOR> Context: https://news.ycombinator.com/item?id=814695 <comment><USER2> I disabled the feature. I got tired of being locked out of conversations. Before that I think I was using the default: 20, 180.</comment>


Uber's playbook for sabotaging Lyft (2014) - <AUTHOR> http://www.theverge.com/2014/8/26/6067663/this-is-ubers-playbook-for-sabotaging-lyft <comment><USER2> We don't have Uber here in my country.

But I find it interesting that almost everything I read about Uber's customer experience is positive. People seem to like Uber rides. Meanwhile, every other news about the company itself implies that it's a tasteless company with shitty tactics. I wonder if it's the ultimate capitalist success path.

Just a complete outsiders observation. I don't personally have a single experience with them.

<comment><USER3> I think some of the genius of Uber was identifying an industry where the quality was so incredibly low, and yet customers tolerated it anyway.

I used to catch taxis every week, and one taxi driver spent the trip explaining to me why he believed Hitler had the right idea. Another taxi driver lectured me on the religious immorality of nightclubs & drinking alcohol before letting me out of his car. Another driver spent the trip talking to his girlfriend on the phone, forbidding her to take a job she had been offered because he believed a woman's place was in the home.

Uber is soooo much better, but the quality bar is so low that it isn't difficult to be better. It's just that no-one had dared to compete before (because government regulations prohibited anyone from doing so).

<comment><USER4> There's something to be said about an industry where the bar for "good" is the service employee just not talking to you at all for an extended period of time.

<comment><USER5> I like to talk to my taxi drivers. They've mostly been immigrants and I ask them about their home country, their family, what they think about America.

It's been great every time.

<comment><USER6> In addition to the nice things you said, I've found out about lots of incredible ethnic food I never would have heard about otherwise. A ride with a Tajik driver led to an incredible Afghan restaurant (which is apparently as close as the Bay Area gets to Tajikistan's cousine).

Drivers in general are in one of those very interesting roles that interacts with a broad swatch of the population. Even aside from their own background, they are one of the stirring sticks that mixes a place's cultures together.

</comment></comment></comment></comment></comment><comment><USER7> I've used Uber much more than Lyft, but I've had almost entirely positive experiences with both. Only one time did a Lyft driver cancel a trip on me after I waited 15mins and almost missed a flight. I reported the incident through the app and a $10 USD credit showed up instantly in my account with a friendly note from the rep.

At an airport, an Uber driver picked up my fare and then immediately canceled it which caused a $5 USD charge on my account. A quick report through the app rectified the situation in < 24hrs.

The Uber experience is so seamless across time-zones, countries, etc and directly integrates with Expensify. If Lyft expands more into Europe, I will definitely use them as well. I tend to use Lyft more in big US cities. Hailo is also quite popular in Europe. When traveling, I never take a regular taxi if I can help it. The one exception to this is Dublin, Ireland. Taxis are so ubiquitous and cheap that you can get one 24/7 from almost anywhere in city by just walking outside and putting your hand out.

For the ultimate in customer service and luxury, Blacklane is better than both. You pay a huge surcharge for it, but sometimes you need a pre-scheduled ride that is 100% reliable.

<comment><USER8> Hailo is immensely popular in Dublin, absolutely fantastic service. Sometimes I take it for granted, then threads about Uber and Lyft come up and I realise how amazing it is.

<comment><USER9> Dublin sure, but lot less decent down the country. Not nearly enough available rides, if any at times.

<comment><USER8> Yeah but I guess that's a drawback of relying on existing taxi's. It's shocking trying to get a taxi down the country even without Hailo

</comment></comment></comment></comment><comment><USER10> Lyft user here. I always ask the question "What do you like about Lyft compared to driving for Uber"? The answer is that Lyft takes better care of them with better pay incentives and less rigorous scheduling demands. If you want more of your money to go to the driver instead of a central command, use Lyft. I've never noticed a lack of drivers in most medium-to-large sized cities that I'm.

<comment><USER11> Could you clarify what you mean by "scheduling demands"? As I understand it, Uber is strictly work-when-you-want.

<comment><USER12> Not OP, but both Uber and Lyft tie bonuses to weekly/monthly acceptance rate and rides completed. I can't recall numbers, and they have been tricky to find on my phone. But I too can anecdotally confirm that Lyft drivers seem to enjoy it more in the Bay Area, and one of the reasons I've heard is that the bonus structure is a bit more liberal.

<comment><USER13> A Lyft driver told me the other day that it was something like a 30% bonus on whatever you had earned that week when you hit 80 rides in a calendar week.

</comment></comment></comment></comment><comment><USER14> To me, the need to resort to such tactics indicates that Uber doesn't have a very big advantage over its competitors.

The usual reason passengers seem to prefer Uber is their easier availability and greater reliability. Others will catch on to this soon enough.

It is also notable that in places with a better reputation for taxi services, such as in London, Uber's inroads have not been as great as they have been in SF or NY.

<comment><USER15> >better reputation for taxi services, such as in London, Uber's inroads have not been as great as they have been in SF or NY.

Odd, my personal experience has been the exact opposite. I can't remember any of my friends (aged in their 20s) ever getting a taxi in London but catching Uber's is a weekly occurrence.

<comment><USER16> Same. London black cabs are fairly expensive, and at busy times (like just after pubs and bars close at night) you can have a really hard time trying to find one. I don't know what the deal is with the non-black cabs in London ... but they seem more shady, it's much harder to tell if the driver is registered or just some dude with a car, so I just avoid them. Uber solves both these problems. I and my friends are in our 30s, and we nearly all have been using Uber exclusively since it arrived.

<comment><USER17> If you're flagging down anything but a black taxi in central London then it's just some dude with a car: Official minicabs have to be booked by phone or from their offices.

</comment></comment></comment></comment><comment><USER18> Tons of people here on HN use Uber - yet most of them know about those shady tactics used by Uber against Lyft.

Genuine question: Why would you want to support such a company by being a customer?

<comment><USER3> I've put my answer a bit higher in the thread: because the competition and customer experience are currently so much worse. (Lyft hasn't arrived in my city yet.) Some of the competitors here have used shady tactics against Uber as well, I've had taxi drivers pull up pretending to be my Uber driver.

If a competitor can match or exceed Uber's service, I'd consider switching. The convenience of travelling interstate / overseas & using the same service I use at home is quite compelling though.

<comment><USER19> Taxi drivers pretend to be your Uber driver? How on earth do they expect to get paid?

<comment><USER3> I did wonder that. Perhaps he would have threatened to call it in to police as a customer refusing to pay. Maybe he just wanted to torch the ratings of Uber customers, by having them no-show for the Uber they actually ordered.

The whole thing just felt very unsafe. This happened in the early hours of the morning as well. I was very glad when he finally drove off.

</comment></comment></comment></comment><comment><USER20> Uber just came to my town. I won't be using it.

We have had a thriving taxi ecosystem here forever, and the money stays locally. I don't want the new worldwide taxi monopoly moving, thanks.

<comment><USER21> I felt the same way until I realized you can literally hit a couple buttons on your phone and have a car pick you up almost instantaneously and I don't have to deal with thinking about payment at all...

<comment><USER20> Can do that with the local cab apps too...

</comment></comment></comment><comment><USER22> I try to use Lyft as often as I can, they seem to genuinely care for their employees(drivers). Uber is quite ruthless when it comes to pricing. Simple features such as tipping is not present.

It is my part-time hobby of sorts to interview drivers who drive for both and inevitably (27 - 1) they prefer driving for Lyft. The one case where the driver said she prefers Uber was that the #rides were more (Bay area).

I think voting with your wallet is a powerful concept and in some cases, it is the only thing we can do.

</comment><comment><USER23> Original discussion: [https://news.ycombinator.com/item?id=8229081](https://news.ycombinator.com/item?id=8229081)

</comment><comment><USER24> Looks like Nenshi was right. (Recently in Boston the Mayor of Calgary said Uber were "Dicks")

</comment><comment><USER25> Capitalism. I laughed hard when Uber left Germany because they were clashing with regalatians.

<comment><USER26> Uber are still in Berlin and Munich.

<comment><USER27> It's not the same service as elsewhere. They either arrange a regular taxi (Berlin) or use licensed limousine companies (Munich).</comment></comment></comment>


Couchbase 2.0 Released - <AUTHOR> http://www.couchbase.com/couchbase-server/overview

<comment><USER2> It's an interesting release.. I had been tinkering with the beta. Oddly enough (considering the name) to me it seems really more tempting as a replacement for memcached than for couchdb.

Can someone from Couchbase or someone familiar with their plans please confirm the points here:

[http://www.couchbase.com/docs/couchbase- manual-2.0/couchbase...](http://www.couchbase.com/docs/couchbase- manual-2.0/couchbase-introduction-migration-couchdb.html)

Specifically these points:

* Basic data storage operations must use the memcached API.

* However, the HTTP REST API for basic CRUD operations must be updated to use the memcached protocol.

It seems that the couchdb REST API is no longer supported. Was that due to resource constraints in getting 2.0 shipped or is it an intentional design decision to not support this?

<comment><USER3> It's not so much that you need to use the memcached API. We've built a set of client libraries that give you a consistent API (check out couchbase.com/develop) though parts are done through memcached binary protocol (for speed) and parts are done through a RESTful interface inspired by CouchDB.

It wasn't about resource constraints; it that we felt going after distributed deployments and having the speed to keep up with application demands (mostly driven by CRUD) was important. That's what devs and ops people kept telling us they'd need.

</comment></comment><comment><USER4> Can someone explain to me in a few words what the difference is now between CouchDB, Membase, Couchbase?

I was looking into CouchDB a while back and loved its concepts but then it became an apache project and there was couchone and membase and coucbase and i lost track of that is happening in the community.

In short: Is Couchbase somewhat like the next CouchDB? Does it still use HTTP/JS everywhere? I loved the fact that i could stay in JS/HTTP/HTML in CouchDB, query CouchDB directly from the browser and even build a whole website in that system. Now it looks like there are a lot of client libraries again, Is this not HTTP anymore?

<comment><USER4> Thanks for the responses. In the end it's what i feared, there is some open source fork with relatively uncertain future and the new database by the original creator is a totally different beast. Not saying CouchDB is dead but at the point in time i wouldn't feel comfortable recommending it :(

<comment><USER5> I wouldnt worry, Damien hadnt been particularly active with CouchDB dev for quite a while before CouchBase happened.

CouchDB has a new release pending, a bunch of new features and work in development.

The CouchBase situtation certainly caused a lul in CouchDB activity, mostly due to the confusion over the branding, but it has most definitely gotten through the other side of that.

</comment></comment></comment><comment><USER6> We've been looking at Couchbase for our startup, and have found it a great fit for our needs. Unfortunately, we needed the functionality of 2.0, which wasn't available at the time. Since then we've been building on Postgre. Seems we'll have to take it into consideration again...

Do you know if a client for the Go language will be released?

edit: Sorry, I see there's a Go client as a community SDK.

</comment><comment><USER7> Looks interesting, too bad they don't provide an official node.js client, as the unofficial one doesn't seem to be widely used so it's a bit risky (I guess there's a reason it's called 'experimental')

<comment><USER8> I worked on the node client. The core API is mostly stable, so it should be fine to work with. We are still adding some of the less-used functionality, but for basic operations, I've been using it and its fine. Github link <https://github.com/couchbase/couchnode>

</comment></comment><comment><USER9> It's a pity their ruby client does not support jruby since it directly depends on a c lib. I guess you can go and use the java client and wrap it, but it would be nice to have a drop-in replacement.

<comment><USER8> Here is a wrapped version of th java client <https://github.com/jeremy- brenner/jcouchbase>

And here is some example code that uses it

<https://github.com/scalabl3/JRuby-Rails-Torquebox-Couchbase></comment></comment>


Personal Tech Lip-reading smart speakers: Just what no one always wanted - <AUTHOR> https://www.theregister.co.uk/2019/03/29/lipreading_smart_speakers_just_what_noone_always_wanted/ <comment><USER2> _Dave, although you took very thorough precautions in the pod against my hearing you, I could see your lips move._</comment>


C++17 Is Here: Interview with Herb Sutter - <AUTHOR> https://www.infoq.com/news/2017/10/cpp-17-herb-sutter-interview <comment><USER3> Being new to C++, on of my biggest gripes is that I often feel unsure whether I'm using the right way to do things, or if I'm using an old method that was replaced by a new one. Especially given that I never took the time to properly learn the language, but mostly piece together SO answers ... .

Is there a C++17-exclusive compiler-flag? Or linters that inform you about outdated concepts? Some way to get rid of the backwards compatible cruft when writing new things.

<comment> GuB-42 My opinion is that there is no "right way" of doing C++, unlike, say, python.

You can write a kernel in C++, or you can do high level UI, or a game engine, and these will be very different, you can almost say you are using a different language.

For example, to allocate an array, you can use a vector, array, new, or malloc. Most people will tell you to use a vector, but a vector uses a bit more memory than an array, so you might want to use this instead, but you may not want to link with the STL at all, so you go with new, but if you don't want to deal with exceptions or just want a block of raw memory, you may want to go with malloc instead.

Just use the new features if it makes life easier for you, that's the idea. As for linters, I know that cppcheck can warn you of C-isms (ex : C-style casts) but I don't know any of them that target modern C++ variants.

<comment><USER4> > My opinion is that there is no "right way" of doing C++, unlike, say, > python.

There are, however, definitely wrong ways of doing things in C++. There's quite a few things in the STL that should have long since been deprecated if not outright removed.

Simple example is std::map. Absolutely horrible data structure. std::unordered_map is what you actually want, but to a beginner nothing really tells you that. You just think "I need a map, oh hey there's a std::map, perfect!" and go about your day completely unaware of how awful a data structure you just chose.

Another example that's a mistake made in C++ hello worlds of all things is std::endl. std::endl does not mean "end line", it means "\n + flush" (specifically '\n' \- it does not do '\n\r' or '\r\n' conversions at all, the underlying file system does that). And flushing on every new line only makes sense for line-buffered things like std::out, but std::out already flushes on '\n' character. So std::endl in practice just leads to a ton of unnecessary & unexpected flushes.

> so you go with new, but if you don't want to deal with exceptions or just > want a block of raw memory, you may want to go with malloc instead.

There's actually very little reason to ever use malloc. If you globally don't want exceptions just use -fno-exceptions. If you don't want exceptions in the small scope you're working in then use std::nothrow, eg: "new (std::nothrow) int[1024 * 1024]".

As for why you do this over malloc the reason is simple - it avoids overflow bugs. new int[size_t] never overflows. malloc(size_t * sizeof(int)) - <USER2> that overflows trivially, and that overflow results in security bugs.

Raw malloc would arguably be another case of "this is just wrong C++" rather than "this is a perfectly valid alternative". Raw free would belong in this case except for calloc, which is still very useful (and avoids the common overflow bug that malloc has). malloc's only saving grace is realloc, but now you're pretty deep into a specific edge case.

<comment><USER5> actually, you should see the pain that you get when having unordered dictionaries by default.

which is the default in python, you get awesome effects, where the order of the unordered dictionary is dependent on the random seed.

where library implementor are serializing a dict into a serial structure (and are not sorting by key). running the same code and same data twice, will get you potentially different results.

now here comes the best. most of the time in python you don't see the difference. the output is exactly the same but never the less the order is not guaranteed.

so I believe having an ordered by default data-store will help the ecosystem.

Calling it unordered explicitly helps, to make sure that anybody serializing the structure will need to make a choice how to sort it.

<comment><USER6> In Python 3.6, dicts are now ordered.

<comment><USER5> it's an implementation detail. not guaranteed. :( which makes this even worse.

</comment></comment></comment></comment></comment></comment><comment><USER7> Not directly related, but a question that popped up while reading this:

As a C++ programmer I'm quite happy to see the language keep improving in quite a good pace, but I'm wondering if anyone can shine some light on how this evolution compares with other widely used languages.

Of course newer languages can change drastically quite fast (Swift comes to mind), but I don't follow more accomplished languages (PHP, Java, JavaScript, Python, Even C, ..., sorry if I didn't name your language) close enough to get an idea.

<comment><USER8> That's quite a list of languages. Here's my opinion on a few that I know:

My impression of C++ is that is evolves fairly quickly, but also includes everything, the kitchen sink and the highway, making for an expansive and complex language. Scala gets some of the same flak.

Java evolves glacially, and outside of very rare large improvements (e.g. lambda's in 8) it's still the same (verbose) language and will remain for a long time.

PHP evolves fairly quikly, but the API's aren't consistent leading to a bit of the "flavor of the week" feeling for new additions. I don't know how this has been since PHP 7+

Javascript is evolving at a rapid pace, but despite that they seem to move toward a clear goal with nice functional API's and constructs being added to the language.

<comment><USER9> PHP 7+ hasn't added that much in terms of new APIs — (e.g. libsodium in 7.2, and it's typical function(target, arguments) stuff). It added strict typing and a very significant bunch of ergonomic/performance changes.

I'd say half the reason to call it a quick evolution is how fast it's being adopted compared with the glacial progress from 5.2 to 5.6, or Python 2 to 3.

Also a third half of the freshness has been adoption of packaging and coding standards.

</comment></comment></comment><comment><USER10> Sorry but I am going to complain again about modules. I mean I'm inches from making a petition so that compiler vendors can agree on something and move on. This would make the language much more attractive for new users, reduce compile time, etc.

Please!

<comment><USER11> What good does a petition do for this. If you want them so badly, why not use them, and give feedback to the vendors about what approach they should standardise on?

<comment><USER10> What must one do to test them?

Are there beta version of compilers, would it be GCC, clang, MSVC?

</comment></comment></comment><comment><USER12> I do really love how C++ is evolving. The language is fighting and adapting and I think in a very smart way. This old dog can learn new tricks. I also love how often it makes me feel stupid at the incredible knowledge of it's maintainers and implementers.

</comment><comment><USER13> Wow, just thinking about C++ while slacking, was enough to inspire a solution to a race condition in my Clojurescript project.

Earlier, I made some notes and walked away from the problem, because it was getting frustrating. Then, while I was checking this out, I started thinking "Imagine how complex this would have been if I had done it in C++" Then the immediately following thought was "Well, in C++, I would instead build it like so, because it needs to be thread safe." Problem solved, obvious-in-hindsight solution.

Even though my problem wasn't caused by a low level threading mistake, thinking about the problem in the context of a more primitive tool helped me to better understand how my own tools are working.

</comment><comment><USER14> Stroustrup said he was disappointed with C++17 as it didn't introduce anything massive. You can see him mentioning this widely and openly at cppcon last year.

It'll be interesting to see what gets in next.

<comment><USER15> Well concepts and modules, arguably the most important features C++ desperately needs, are still missing from this release.

<comment><USER16> eh, check that modules is what you think it is/should be:

[https://izzys.casa/posts/millennials-are-killing-the- modules...](https://izzys.casa/posts/millennials-are-killing-the-modules- ts.html)

Modules without buy-in from build tools (or a fresh build tool) will probably be DoA as Isabella says.

<comment><USER17> There is a fresh build tool that supports modules in the big three (GCC, Clang, and VC):

[https://build2.org](https://build2.org)

</comment></comment></comment></comment><comment><USER18> Does anyone know the state of modules (so as to support something like npm) in C++?

<comment><USER19> Modules (in the C++ terminology) and a package manager like npm are two different beasts. Modules are not part of C++17, although Clang and MSVC both bake their own bread with implementation of the current modules draft.</comment></comment>


Dual Cameras for Image Fusion (2017) - <AUTHOR> https://www.eetimes.com/author.asp?section_id=36&doc_id=1331849 <comment><AUTHOR> Flagship smartphones have moved onto three sensors without much talk of image fusion. If image fusion was implemented I think it would be discussed by the manufacturers. It's possible for third party apps to do some of their own image fusion work, but I'm not aware of any. Is this the killer app of multi- camera smartphones that no one wants?</comment>


How Gojee Threw Away Its Entire Codebase and Got to a Better Product, Faster - <AUTHOR> http://startscratching.com/2011/05/27/writing-tests-when-does-it-make-sense-for-quick-prototyping/

<comment><USER2> Good, thoughtful discussion of a situation that happens all the time at startups.

</comment><comment><USER3> one lesson from this, have as much emotional attachment to your code as you do your product = NONE</comment>


Wikipedia: Making of Doom - <AUTHOR> http://en.wikipedia.org/wiki/Making_of_Doom#Programming

<comment><USER3> One really nifty piece of code that I associate id-software with is the 0x5f3759df hack. Though it was probably known before, Hakmem would be the first place to look.

I am sure there are many more such bit twiddling and magic number hacks, but nothing quite as useful to me than this magic to compute the reciprocal of a square root. The only other floating point operations that comes up this frequently in what I do are log and exp.

In my day to day coding (not that I code every day, far from it) I have nothing to do with game engines, yet inverse square root shows up in almost every corner (pun intended) in the vector manipulation code, for example in finding the cosine similarity between two documents.

Does not work for double precision, 64 bit, and nothing I write is so performance critical that it demands the use of this trick, but its still fun

        float Q_rsqrt( float number )
        {
            long i;
            float x2, y;
            const float threehalfs = 1.5F;
            x2 = number * 0.5F;
            y  = number;
            i  = * ( long * ) &y;
            i  = 0x5f3759df - ( i >> 1 );
            y  = * ( float * ) &i;
            y  = y * ( threehalfs - ( x2 * y * y ) );
            return y;
        }

Taken from the wikipedia article <http://en.wikipedia.org/wiki/Fast_inverse_square_root> has the fuller story.

<comment><USER4> Yeah, this is really cool :) A favorite of mine is the xor-swap: While not useful in pratice for me, you can get quite stunned faces if you tell your friends, that a swap is possible without a third variable.

      x = x xor y
      y = x xor y
      x = x xor y

It's also possible to use addition and subtraction instead of xor.

<comment><USER5> FWIW, pretty much every 3rd (penultimate) year engineering student in India knows the xor-swap, I should think (only they might not call it that, because they've just memorised the procedure, and have very little idea _why_ it works... /cynical)

This is one of the most common questions in 'technical interviews' when big IT companies are recruiting fresh grads.

(See <http://www.allinterview.com/showanswers/17145.html>)

<comment><USER3> I am not sure where your cynicism or contempt is coming from. There is not much to a deeper understanding of xor-swap. If one knows the xor truth table one knows why it works, and knowing the truth table is essentially an act of memorization. I hope they are exposed to digital logic way before 3rd year. On the other hand cases where this will not work in the current form, perhaps needs a somewhat deeper understanding of bit lay out. Say if one were to swap two unicode characters from void * pointers to them.

<comment><USER5> My cynicism (not contempt - I know that the students are under various sorts of pressures) stems from personal experience.

It's not much good explaining how simple it is to understand the xor-swap - <USER2> doesn't change the fact that the majority of engineering students go to the link like the one I posted, compile a list of questions and answers, and rattle off answers before the question is even completed in the interviews.

It's like knowing [any interesting method] can be used to accomplish a task, without knowing why said method works.

 _edit: I realise all this is OT, but I was downvoted for my earlier post and felt the need to defend it._

</comment></comment></comment></comment></comment><comment><USER6> Worth reading: <http://en.wikipedia.org/wiki/Masters_of_Doom>

<comment><USER7> \+ one for this book. Excellent startup narrative.

<comment><USER8> \+ one here too. Very good book, very nice narrative.

</comment></comment></comment><comment><USER9> More fun Doom trivia on the origin of the (id)spispopd cheat code:

<http://www.urbandictionary.com/define.php?term=idspispopd>

The Smashing Pumpkins for their part continued to the joke by adding a sample from Doom to 'Where Boys Fear to Tread' on 'Mellon Collie and the Infinite Sadness'. The booklet contains the following credit: "Explosion from Doom courtesy of id Software, Inc and bobby prince Music""

</comment><comment><USER10> This is a really great wiki entry. I was searching around after reading it and came across this pic from '92 which is really amazing: <http://bit.ly/qxaxrC>

Both Carmacks, Romero, Tom Hall, Kevin Cloud, etc in startup mode :D

I used to read their .plan's.... :o

<comment><USER11> Unshortened link: <http://www.3drealms.com/bio/images/legacy_romero2.jpg>

<comment><USER12> Why do people post bit.ly links in places where there is no char limit? Are people that conditioned by twitter?

<comment><USER10> I'm a data nerd and I like to see when people click on my links :) For example barely anyone clicked when I posted this on twitter vs. tons of exposure on HN: <https://bitly.com/qxaxrC+>

Dunno, I just enjoy keeping track of what I post and seeing what's popular, etc!

<comment><USER12> Fair enough, I guess I forgot about that. It's still a leap of faith to press a bit.ly link by paranoids like me. I should probably use an addon and forget about these.

</comment></comment></comment></comment></comment><comment><USER13> Here's a video tour of their offices circa 1993, for those who haven't seen it. I think this is a cool look into the beginnings of the company and the (early) excitement surrounding Doom at the time.

<http://www.youtube.com/watch?v=Q65xJfVkiaI>

<comment><USER14> Haha great video! They're playing not completely finished Doom and sometimes it kicks them back to DOS with an error message like

File not found

Don't worry about "File not found"

</comment></comment><comment><USER15> Here is a 60min DOOM post-mortem by John Romero from the Game Developers' Conference.

[http://www.gdcvault.com/play/1014627/Classic_Game_Postmortem...](http://www.gdcvault.com/play/1014627/Classic_Game_Postmortem___DOOM)

If you look around the free section of the GDC site there are a lot videos about other classic games too

<comment><USER16> John Romero and Tom Hall, in fact.

It's quite an interesting talk - lots of people have interviewed John Carmack about the history of Doom, and he was certainly a core figure, but I enjoyed hearing a telling from outside the usual "id Software has been continuously successful for decades" frame of reference.

</comment></comment><comment><USER17> Gotta love the cool stop animated models they used for the sprites in the games, but here's the best bit that I didn't know:

(about the sources for some of the textures)"Among the more unusual sources, one texture was based on Adrian's snakeskin boots, and a bloody texture for the hell levels was created from a photograph of a wound on Cloud's knee"

Awesome. I thought the skin-wall textures in ep.3 were pretty gross. Eww! nerdscabs!

</comment><comment><USER18> John Romero's blog has a lot of good content on the making of Doom and other classic id software games too: <http://planetromero.com/>

</comment><comment><USER19> So, software invented on the NeXT includes Doom and the World Wide Web? Not bad for a failed platform.

<comment><USER8> If I remember well, the _biggest_ problem with NeXT was that it was quite expensive! According to the "Master of Doom" book, Carmack pay around U$ 10,000 for _one_ workstation in 1991.

<comment><USER20> And total non-sequitor (if you missed it the first time around):

How to burn a NeXTCube

<http://simson.net/photos/hacks/cubefire.html>

</comment></comment></comment><comment><USER21> >and the editing tools were written in Objective-C.

I find this really interesting, Carmack's been using Objective-C long before he started his iPhone work.

<comment><USER22> Does that makes him a hipster?

</comment></comment><comment><USER23> I would pay decent money to see the movie remake, kickstarter anyone?</comment>


A direct tissue-grafting approach to increasing endogenous brown fat - <AUTHOR> https://www.nature.com/articles/s41598-018-25866-y <comment><USER2> It would be amazing if some % of the transplanted brown fat remains indefinitely. If so, it could be a lifelong calorie burning machine.

Plastic surgeons achieve 50-60% survival of grafted fat with modern techniques. I couldn't tell from the study if brown fat would be any different, or if the quantity required would make the procedure a hassle.

Let's solve for the equilibrium. Kim Kardashian will graft a bunch of brown fat into sexually dimorphic areas. This will have the dual benefit of increased (conventional) attractiveness and fat burning, which will make her yet more normatively attractive, in a virtuous cycle.

<comment><USER3> If brown fat burns calories, it must produce heat. I wonder if this would make you feel hot all the time.

<comment><USER4> That would be nice to get some feedback that I've eaten too much.

</comment></comment></comment><comment><USER5> Is this a possibly undetectable way to cheat at endurance sports?

<comment><USER2> Elite athletes are as lean as possible, so they wouldn't get any BMI benefits. Beyond that, I don't think brown fat is metabolized for exercise any better than regular fat. You can already somewhat increase brown fat with regular exposure to cold temperatures.

</comment></comment><comment><USER6> Sign me up.</comment>


Show HN: VersionHistory.io – Manage and communicate your product updates - <AUTHOR> http://www.versionhistory.io

<comment><USER2> In theory, I'm right in your target market. I've been considering a good way to keep my handful of users up to date with small changes that aren't big enough to be immediately visible.

But I'm just not feeling it.

In the FAQ, you try to distance yourself from the way that blog posts are used. But, and this is big, blog posts can be used exactly like it seems VisionHistory is designed to be used. I could post nothing but a bullet list on a blog. Just because most people don't doesn't remove that possibility.

I was intrigued enough, given my current desire to have/make a solution to this, to check out the pricing page. So it's not that I was completely uninterested. But I wasn't interested enough to pay the prices listed and I don't know what you could add that would change that. It just seems to solve too small of a problem.

<comment><AUTHOR> Definitely fair points. I appreciate the feedback!

We are hoping some of the features that a blog can't (or at least not easily) provide would make people want to covert. For example, your customers can subscribe to be notified of updates automatically, easily search through the version updates, submit feature requests to you, download a printer friendly version, etc. all from one nice interface.

Of course if some feature does come to mind that you think would make you want to transition if we added it, do let me know. I'm always open to ideas!

You're right -- it is a small problem that needs solving but one that we've seen time and again from building our own Web applications. So we're happy to solve it and see if there's a larger market of SaaS apps (and others) that could benefit from it.

</comment></comment><comment><AUTHOR> Scott here from VersionHistory.io. Happy to answer any questions! Or if you have any feedback (good or bad), I'd love to hear it. Thanks!</comment>


Experts Warn Internet Is Running Out of Bandwidth - <AUTHOR> http://www.foxnews.com/story/0,2933,518405,00.html

<comment><USER2> I don't mean to be rude here, but could we give the "teh internets is runnin' out!!!" stories a rest on HN. I don't think there's anyone on this list who doesn't grok how absurd this is. We've been hearing this same tired alarmism since '99, but in the past few days, its shown up four times on HN.

Again, don't want to step on any toes but sheesh!

</comment><comment><USER3> So, whose PR is behind this? Time Warner and Comcast?

</comment><comment><USER4> If only there were only some way to add more routers to the internet!

Oh the humanity!</comment>


Can I get some feedback on a new site from HONEST users? - <AUTHOR>

<comment><USER2> What exactly is the site supposed to be about?

I'm not going to sign up to any beta on a site that tells me nothing about itself.

No, "Ask, Decide, Repeat" doesn't tell me much. Also, the logo being an image, I couldn't even copy & paste the slogan from there.

<comment><AUTHOR> Well it is in closed beta but it is a decision making site. I agree the splash lacks. Its more of a gateway. Video and all that jazz coming very soon. Good point about the slogan. I'll have to change that.

<comment><USER2> Even a short "about" would've been nice, even if it's closed. Knowing that it's a decision making site already tells a lot more than one could figure out just by visiting it.

<comment><AUTHOR> Cool. Working on a video that is going to go on the front. That will hopefully alleviate any confusion.

</comment></comment></comment></comment><comment><AUTHOR> Sorry, I am trying to get feedback on a site I started www.choicr.com from beta users. I just heard this was the best place to get techie type reviewers.</comment>


Ask HN: What's your favorite startup logo? - <AUTHOR>

<comment><USER2> Hipmunk has an awesome logo/mascot.

The Github Octocat is also awesome :)

[https://octodex.github.com/](https://octodex.github.com/)

</comment><comment><USER3> I think the best ones manage to have a simple, clean aesthetic but are representative of their brand and offering.

A couple of my favourites: Birchbox (birchbox.com), Treehouse(teamtreehouse.com), Intercom (intercom.io)

</comment><comment><USER4> I think Shutl's little rocket ship is kind of cute.</comment>


Does it scare anyone that Zuckerberg named his daughter Maxima? - <AUTHOR> Anyone with a passing understanding of AI can see that for someone like Zuck, this is the equivalent of naming your child something like "Apex" or "The Solution". <comment><USER2> Does anyone here have passing understanding of music?

I want to know what Moon Unit, Dweezil, Ahmet and Diva is equivalent to.

</comment><comment><USER3> A cursory glance at the responses indicates that the short answer is: no.

</comment><comment><USER4> Would you ask the same question if it was a boy called Max?

<comment><AUTHOR> No I wouldn't because "Maxima" is directly taken from AI terminology and "Maximus" is not.

<comment><USER4> Maxima is the Latin word for the plural of 'maximum'. It's essentially the feminine version of Maximus. It's been used as a name for a couple of thousand years. It's used as a term in AI, but as a name it has nothing to do with that.

</comment></comment></comment><comment><USER5> Maybe he just has a thing for Nissans.</comment>


Anyone interested in weekly interview problems and detailed solutions newsletter - <AUTHOR> Hi friends,
I am running a newsletter that sends out 5-10 coding interview problems with detailed solutions in Go. My goal is to build a database of top 100, most frequently appeared problems that I think are the most valuable and effective to spend time on. For each one, I am including my thoughts of process on how to approach and solve it, adding well-documented solutions with test cases, time and space complexity analysis.
Let me know if you're interested in the idea. Here is the link to:
- its blog post: https://medium.com/@hoanhan101/i-am-making-ultimate-study-guides-for-mastering-coding-interview-challenges-3f88a228441a?source=friends_link&sk=999d12c966d910736764fefbc9b8a0d3
- the newsletter itself: https://www.getrevue.co/profile/hoanhan101
Best, Hoanh <comment><USER2> In case you plan to monetise it, this may be of interest: [https://www.indiehackers.com/interview/a2b57cca87](https://www.indiehackers.com/interview/a2b57cca87)

Is the newsletter good for beginners to Go too? I'm planning on learning it soon.

<comment><AUTHOR> Thanks for the pointer. I'd like to keep mine free and open-source for now.

I hope the newsletter is friendly enough for beginners too. I also have [https://github.com/hoanhan101/ultimate- go](https://github.com/hoanhan101/ultimate-go) for learning Go better and faster.

<comment><USER2> Thanks, I'll check it out

</comment></comment></comment><comment><AUTHOR> Reposted clickable links:

\- its blog post: [https://medium.com/@hoanhan101/i-am-making-ultimate-study- gu...](https://medium.com/@hoanhan101/i-am-making-ultimate-study-guides-for- mastering-coding-interview- challenges-3f88a228441a?source=friends_link&sk=999d12c966d910736764fefbc9b8a0d3)

\- the newsletter itself: [https://www.getrevue.co/profile/hoanhan101](https://www.getrevue.co/profile/hoanhan101)

</comment><comment><USER3> Nice idea. I'm not a GO developer but if I was I'd be interested.

</comment><comment><USER4> This sounds really cool, I'd be interested.

</comment><comment><USER5> I would be!</comment>


Someone's registered my personal name as a domain name - <AUTHOR> http://securityskeptic.typepad.com/the-security-skeptic/2012/06/someones-registered-my-personal-name-as-a-domain-name.html

<comment><USER2> I already own a domain based on my name. I have a low grade fear of someone taking the domain, either through underhanded means, or by bullying through legal means. I've had my domain more than a decade. There is at least one online business that has since cropped up recently, that uses all the words of my domain as the words in their apparent business name.

Losing my domain would be a nightmare. It's my identity (and after 10+ years it feels as much like my identity as my given name), and it's a key to passwords for almost all my business relationships.

<comment><AUTHOR> You might want to read another article at this site - [http://securityskeptic.typepad.com/the-security- skeptic/2009...](http://securityskeptic.typepad.com/the-security- skeptic/2009/10/evacuation-kit-for-domain-name-holders.html) \- it describes the documentation you should keep to prove the domain is yours in case it's hijacked. I imagine some of the same information would be useful.

Also, I hope you don't really mena "key to passwords" in the literal sense:-)

<comment><USER2> Thanks for the article, I've queued it.

As for the key to passwords:

1\. I lose my domain.

2\. Email continues to trickle in to the domain thief, addressed to me.

3\. Thief gleans various web sites and businesses that I have a relationship with.

4\. Thief begins to ask for password resets all over town.

4a. My bank sends email that a bill has been paid. Thief gets to work guessing my security question, or just calls the bank and talks his way into my account. I am sometimes amazed just how easy it is to get my bank to talk to me about my account over the phone, no doubt because they don't want to piss me off.</comment></comment></comment>


US filing against Russian hackers highlights role of cryptocurrencies in crime - <AUTHOR> https://meanderful.blogspot.com/2018/07/crypto-crime-recycled-vignette.html <comment><USER2> What was interesting to me when I read through the indictment was how cryptocurrencies allowed the investigators to connect so many activities. Imagine them trying to figure things out if it had all been paid by cash.

<comment><AUTHOR> Cash might have been better thanks to the wonderful world of CCTV that protects us all like a helpful Big Brother</comment></comment>


Taking on Freelance Work While Bootstrapping: Can It Work? - <AUTHOR> http://www.bootstrappist.com/archives/taking-on-freelance-work-while-bootstrapping-can-it-work/

<comment><USER2> I seriously undercharged when I started out meaning I had to work as many hours as possible to make ends meet. When I got confident enough to raise my rate, I was able to scale back my hours and work 3 days on freelance projects and 2 days on bootstrapping. The problem I found was transitioning away from the freelance projects (my bread and butter) and dedicating more time to my app which was putting more of a demand on my time as it grew.

</comment><comment><USER3> In my extensive experience, it can work, but only if you are very disciplined about both the bootstrapping and the freelancing. Decide in advance how long you'll do both, what type of projects you'll take, and the terms you'll freelance under.</comment>