The response time depends on network peering from their anycast locations. I am seeing different response times based on test locations.

From US:

  # ./dnseval.py -f google-vs-quad9.txt -c 50 -C yahoo.com
  server      avg(ms)     min(ms)     max(ms)     stddev(ms)  lost(%)  ttl        flags
  ----------------------------------------------------------------------------------------------------
  8.8.8.8     31.857      31.278      33.416      0.434       %0       1332       QR -- -- RD RA -- --
  8.8.4.4     31.865      31.361      32.872      0.336       %0       1330       QR -- -- RD RA -- --
  9.9.9.9     93.703      92.797      95.362      0.586       %0       1391       QR -- -- RD RA -- --

From Iran:

  # ./dnseval.py -f google-vs-quad9.txt -c 50 -C yahoo.com
  server      avg(ms)     min(ms)     max(ms)     stddev(ms)  lost(%)  ttl        flags
  ----------------------------------------------------------------------------------------------------
  8.8.8.8     105.093     90.046      130.871     9.749       %0       3590       QR -- -- RD RA -- --
  8.8.4.4     99.458      84.472      133.375     11.308      %0       3585       QR -- -- RD RA -- --
  9.9.9.9     96.231      83.957      134.709     9.503       %0       3595       QR -- -- RD RA -- --

Tests are performed using dnsdiag tools: https://github.com/farrokhi/dnsdiag

Perhaps they accidentally lifted the blocking rules. Or it will drop as soon as they upgrade their censorship software.

Which part of https://www.eriklundblad.com/log/post/lets-encrypt-on-freebs... is hard?

Actually, setting up LE on FBSD was even easier than that. We've had LE working on two of our FBSD servers for 4 months. Running the py27-letsencrypt client with --certonly and -d domainname -d ..., installed the certs in /usr/local/etc/letsencrypt/live/<domain>/...

Then pointing nginx to the "live" cert location and setting a cron job to renew every 4 weeks or so pretty much takes care of the whole process. I notice the FBSD LE client was just upgraded, not sure what new features it offers, but certainly should work at least as well as before.

Yes, but that is not the official client.

In aeronautics, component lifecycle tracking is dead serious business - hence even some trivial parts are individually identified, much more than in any other industry.

You need to watch some air crash investigation episodes on youtube.

wasn't this obvious from the beginning? And the same would happen to RockMelt as well.