Cloudflare has a list of all data they collect from firefox DoH here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

Before CF was CF, they were a group of blackhats running honeypots. I was part of that community. It turned out, building a distributed CDN had potential to make money. And here we are. They built a great CDN. I would use them over Akamai any day. They have very talented hackers. That said, consolidating all DNS lookups to one central company guarantees they will have non stop pressure (if not already) to give warrant-less access to the data. This is very valuable data.

I never take privacy statements on a website seriously. A company can say one thing and do another. HN crowd knows this better than anyone.

source?

For what, the honeypots? I have no idea of such an article exists. I was one of their members and ran several honeypots and made use of several of my domains. It was started on freenode's IRC network, or at least that is how I learned about it and joined in. There are probably IRC logs on archive servers out there somewhere.

Interesting story, thanks for sharing it!

Why do people trust cloudflare more then FB and Google? Isnt the ultimate goal of all this big tech co the same: to known everything?

My ISP knows my real-world identity: name, address, phone number and credit card information. Cloudflare knows none of these things about me, so there's much less they can do with my browsing information.

Cloudflare has access to many of the sites you browse. They have the SSL keys, they host the services. They (potentially) know a lot more about you than your ISP. If you ever bought something from a web shop hosted on Cloudflare they have access to your billing address, credit card info and what you are buying. They may not collect it but they do have access.

Who said he was using cloudflare as his upstream DNS? There are far more choices than cloudflare, google, or your ISP.

They delete it after 24 hours and aggregate it via sampling for tuning afterwards.

Even I keep logs for 7 days before selecting for permanent storage, they are saints.

Doesn't matter if they are saints or not. My point was that we need a solution that we don't have to trust the other party being saint.

Does such a thing exist? You ask for a key lookup from address A, that can be stored no matter what. You can obfuscate it through proxies I guess

Pi-Hole doesn't require Cloudflare DNS. You can use your ISPs DNS service as they know who you're connecting to anyways.

Or you take 15 minutes and set up unbound.

You can operate a full resolver without Cloudflare or any other resolver DNS server. Every time you do a complete recursive resolution on the DNS names yourself locally and then only the DNS servers of the service you are using are going to know that you visited their service (and the adversary eavesdropping on the network between you and the service).

Set up your own server then?

What DNS provider is actually trustworthy and how can you prove it?

Run DoH over a Tor socket then...