Hacker News Reader

Comment by onion2k | Hacker News Reader

It's understandable to ban the site given it does break Vercel's terms, but the allegation that Vercel hasn't let the owner transfer the domain away is a serious concern. Removing a customer is always hard but you have to do it in a way that ends in a clean break between your business and the customer. Keeping a domain fails to achieve that in a big way.

View on HN

This is why you shouldn't combine your registrar with whatever services you have your domains pointed at. Domains should be delegated to services using a simple OAuth2 protocol. DomainConnect is technically close but very corporate and not good for self-hosted services.

> Domains should be delegated to services using a simple OAuth2 protocol

Maybe i'm missing something, but why not do this using simple DNS? Nameservers at the registrar, or nameservers at some simple dns-only thing, and point hostnames to whatever you want at the moment.

The barrier to entry to using a domain name is way too high. Even just to use a domain with email you have to manually enter a bunch of DNS records. That should be a quick OAuth2 flow from your email provider that gives them a token they can use to set the records for you.

And they shutdown all his other projects.

This part doesn’t seem unreasonable to me, however the domains being held does seem unreasonable.

They presumably shut down his account, and that indirectly resulted in shutting down everything. I'd put that on the customer - if you run a risky project that could get your account banned you should partition things better.

I absolute believe that Vercel does not like to host it and they have the freedom to restrict the service. But I _am_ curious which term of the TOS it violated.

Vercel's terms are at https://vercel.com/legal/terms. A handful of possible violations from section 6, Acceptable Use:

- The Services may only be used for lawful purposes.

- You shall not attempt to undermine the security or integrity of computing systems or networks of Vercel, its partners, or any other person, and must not attempt to gain unauthorized access.

- You may not use the services or Vercel's infrastructure for proxying, scraping, to create virtual private networks, or to create virtual private servers.

Reasonable people might disagree whether 12ft.io is being unlawful, undermining the integrity of a computing system, gaining unauthorized access, or proxying/scraping. So the TOS also says:

- The final decision of whether an account is in violation of any of these acceptable use terms is at the sole discretion of Vercel.

> You may not use the services or Vercel's infrastructure for proxying, scraping

I think that's pretty clear cut then.

Looking at archive.org, I think this was only added in their most recent May 1, 2023 TOS update.

He might be the reason it now exists in the TOS. :)

I just realized that archive.org might also in violation of Vercel's ToS given its ability to bypass paywall.

Why would they care? They are not hosted on Vercel.

Since the service alters the data before delivery, a strong argument can be made that it’s not a proxy per se. Say I did something similar with the goal of assisting vision-impaired users. That’s not just a proxy.

It’s the weekend. He’ll talk to them on Monday.

> a strong argument can be made that it’s not a proxy per se.

I suppose, although lots of proxies make changes.

Either way, he should probably change the URL that it uses if he intends to argue it's not a proxy of any kind. ;) I still have a tab open with an article, and the URL is:

  https://12ft.io/proxy?q=https%3A%2F%2Fwww...

> - The final decision of whether an account is in violation of any of these acceptable use terms is at the sole discretion of Vercel.

Seems like it's not safe to host on Vercel, then. They're giving themselves absolute control with zero recourse.

Looks like you're opted into arbitration too. Classic hostile, anti-consumer behavior.

Don't they know who they exist to serve?

Every mainstream cloud platform has substantially the same term in their user agreement, including the big hyperscalers. Abuse is a constant challenge for cloud providers; it would be an untenable problem if abusers had legal recourse to account closure.

I'd be OK with them taking up to 30 days to do this, but I too expect that they let the owner transfer their domain away. I am not currently concerned, because I think they will let the owner transfer it away probably in less than a week if the owner has a constructive dialogue with them.

so they seized the domain kinda like you do with malware?

it's unfortunate that the only button for Vercel admins is "seize everything in this account", as that's a bit imprecise if one domain is hacked

but if it's a person willfully violating TOS, then it's not really a hacked box, it's an intentionally created thing - and maybe that means that person shouldn't be a customer of Vercel anymore.

Reply on news.ycombinator.com