TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Content Filtering & Categorization

1 post · Apr 2020

What this trail covers

Cloudflare launched 1.1.1.1 for Families, a filtered DNS service with default settings for Malware and Malware + Adult Content. The service uses licensed site categorization data. An error in selecting the 'Adult Content' feed led to the inadvertent blocking of LGBTQIA+ sites. The issue was resolved by correcting the feed and pushing an updated data structure. Future protections include pre-release checks against known sites to prevent similar mistakes.

All Cloudflare trails
  1. The Mistake that Caused 1.1.1.3 to Block LGBTQIA+ Sites TodayThis post details a specific incident where an incorrect data feed was used for the 'Adult Content' category in the new 1.1.1.1 for Families DNS service, leading to the unintended blocking of LGBTQIA+ sites. The technical details include the licensing of categorization data, the existence of multiple 'Adult Content' categories from providers, and the slow process of updating and distributing the data structure across data centers. The immediate fix involved pushing an allow list and then regenerating and distributing the correct data structure. Future protections involve build system checks against known sites before default updates.
  2. Introducing 1.1.1.1 for FamiliesIntroduced two new DNS resolver IP addresses (1.1.1.2/1.0.0.2 and 1.1.1.3/1.0.0.3) for 1.1.1.1 for Families, offering malware blocking and malware + adult content filtering. The service leverages Cloudflare's existing site categorization and filtering technology, previously used in Gateway. The post details the setup process and mentions future plans for custom allowlists, blocklists, and time-based category blocking.