Hacker News Reader

Comment by zamadatix | Hacker News Reader

I think, usually, in those cases it's that people believe the company did not really do anywhere near everything it could - it did the bare minimum it thought it could get away with then seemed shocked it wasn't enough to matter.

Here, if any pair of countries have conflicting rules then you simply can't expose your service to both because it's plain impossible for you to block all means of VPN/proxy regardless of how perfect your service tries to detect it. There's no payment, there's no account, there's no anything - you're just serving DNS to an IP that reports to be out of Germany according to German law. At some point it stops being a mistake/malintent of the company and one of the user. Where that transitions probably depends on the person though.

View on HN

> if any pair of countries have conflicting rules then you simply can't expose your service to both

Yes. This is also how physical products work. The internet makes it easy and the default to offer a service worldwide, hence also making it easy to get in conflict with the law worldwide. You have to pick and choose which laws to break, which laws to comply with by minimizing exposure, and which laws to comply with by making a tailor-made version for a specific market.

You say this confidently, but this is merely one theory about how things should work.

If I make a product in my country, where it’s legal, and a buyer purchases it from me and then brings it to you overseas where it’s illegal, and someone in your county tries to sue me for it, they are typically going to have a hard time. (Unless your country is powerful enough to violate the sovereignty of my nation.)

In most cases, you accessing my website is more like this scenario. Intermediaries (ISPs) brought you the product. I simply offered it to anyone who came to my “store” (server). I admit that this dynamic changes if you directly pay me for something.

Your framework implies that every social website needs to make a decision on whether or not users are allowed to insult the Thai monarch[0], and then must block access to Thais if they decide it’s allowed. In reality nobody does this, although they may choose not to put a server in Thailand if they are worried about it.

[0] https://en.wikipedia.org/wiki/L%C3%A8se-majest%C3%A9_in_Thai...

See also the UK's Online Safety Act and the UK's regulator Ofcom, which stated:

'Ofcom told the BBC: "We are aware of this lawsuit. Under the Online Safety Act, any service that has links with the UK now has duties to protect UK users, no matter where in the world it is based."

A service doesn't have to be based in the UK to be subject to the act, and therefore face action from Ofcom.'

The US-based lawyers for the services in question take a very different view....

> A service doesn't have to be based in the UK to be subject to the act, and therefore face action from Ofcom.'

Hm yeah but "action from Ofcom" doesn't really mean very much to a party half a world away.

For those not aware, note that Ofcom have effectively conceded defeat on this: https://news.ycombinator.com/item?id=50167028

> A service doesn't have to be based in the UK to be subject to the act, and therefore face action from Ofcom.

Manifestly, the British still think they are a world power.

> In most cases, you accessing my website is more like this scenario. Intermediaries (ISPs) brought you the product.

Offering a website to a certain country is not something ISP decided for you, but you actively did that yourself. I cant create a gambling website and host it in Monaco and then serve it to someone in CA and say that, it isnt on me, but on Comcast.

How do you "actively" offer a website to a country?

Websites aren't broadcasting, they are waiting there and responding to requests. Why should it be on every server in the world to have to figure out whether they're allowed to respond to a given request based on the client's country?

Why is it not the user's responsibility to not send requests? Why isn't it the ISP's responsibility to not route the requests? And every single router in between?

FWIW, this theory was attempted in court with a bittorrent case in Hong Kong. [1]

Defendant's lawyer argued that seeding a copyrighted movie was not (active) distribution but merely "making it available" (which was not associated with a criminal offense in HK law as opposed to "distributing infringing copies").

Didn't work out.

---

[1] HKSAR v Chan Nai Ming [2005] 4 HKLRD 142

This is someone in HK judged under HK jurisdiction. That's fine.

My point is it's weird to expect website operators to be aware of every jurisdiction on the planet and take steps to comply with each of them.

If that expectation becomes common, the obvious way to go isn't to block the countries you aren't allowed to serve. It's to only allow the ones you know you are allowed.

Imagine how the internet would be if you were default blocked from accessing any website hosted in a different country.

> Imagine how the internet would be if you were default blocked from accessing any website hosted in a different country.

It's a difficult issue for sure. It's almost a geopolitical problem -- the larger economic blocs (eg. EU, China, USA) can basically dictate terms and expect general compliance (eg. GDPR) because most companies can't avoid operating in those areas, while smaller countries can't really do much unless they're part of a bigger economic bloc.

False. Making a website accessible from the internet is not “offering” it to anyone. You might have a claim if I were paying to advertise in that country, maybe.

And actually you can just make a gambling website overseas, people have done that since forever. You might have trouble with accepting payments, though.

> If I make a product in my country, where it’s legal, and a buyer purchases it from me and then brings it to you overseas where it’s illegal, and someone in your county tries to sue me for it, they are typically going to have a hard time.

Except the analogue to your ISP for your example is UPS and they are far less (if at all?) responsible for the content of packages they deliver.

UPS is partially liable for incorrect declarations of international packages and for attempting to deliver packages they should have known were illegal...

It’s just a metaphor and it breaks down if you dig into the specifics too deeply, as with all metaphors. But if you insist, I as the seller am not responsible either. If I’m a bookseller and I send a banned book to you via UPS, after you paid me in person in cash, and your customs seizes it, you don’t get your package and nothing happens to me. YOU might get in trouble though.

Now if I keep sending banned materials to your country, it might be a bad idea for me to travel there. But nothing else is going to happen, unless you’re a global power and you drone me or compel my government to extradite me. (Or if my own country was foolish enough to make mutual extradition agreements for such things.)

(Note, I specified in person in cash above because as I mentioned before, electronic payments make things messy. But most websites are “free”.)

> I think, usually, in those cases it's that people believe the company did not really do anywhere near everything it could - it did the bare minimum it thought it could get away with then seemed shocked it wasn't enough to matter.

Yes, and Quad9 could have done better in the German court case. At a minimum they could have asked users to register and provide proof of residency, and then could have ensured that their DNS service is offered only to registered users.

> At a minimum they could have asked users to register and provide proof of residency

This would have been a massive burden to them, and (as we have seen from the ongoing data leaks) a gigantic privacy risk to its users. It would have also been a big overreach, as the German ruling would have mostly impacted non-German users.

Let's take this level of user tracking for DNS would be accepted & fine by Germany as well as what folks were thinking was feasible for the company to do as a given, how does it prove the user+ip who registered is the user+ip who submitted the request instead of the place it got proxied? Or malware enabling the same?

If you can solve this for me it would actually help a lot at work :D

Just shift the legal burden of ensuring that no unauthorized users use an IP to the legitimate user of the IP /s

Germany did this, it made free wifi illegal.

It is my understanding that getting infected by a botnet is not illegal yet, so there is room for improvement.

It could be in Germany until the law was reformed. You were civilly responsible for whatever the botnet did.

How would you imagine this could work?

A recursive DNS resolver is identified just by an IP address for your system level DNS resolver to use (eg. in /etc/resolv.conf). Even if you assigned a random, secret IPv6 address for every individual user, they could simply share that with anyone else too. In IPv4, pretty much impossible.

This is an insane take. Where does it stop? Are we going to be tracked and surveilled from every service?

I’m not defending it and hate it too, but it’s worth remembering that from the perspective of many governments and regulators, the internet is a legally broken Wild West that the law needs to catch up with. Viewed through the lens of legal precedent that balanced privacy/safety/liberty before telecommunications networks, that is true: surveillance was permitted within a very broad set of parameters (by default, even: that’s why we talk about e.g. private residences being protected exceptions to no-privacy-by-default).

Again, I don’t endorse that framing. But that’s where a lot of lawmakers are at. They’re not corrupt or fascists or hysterical about porn or whatever (well, plenty are, but not most). They’re trying to correct what they identify as a dangerously uncontrolled area.

User authentication is not a function of DNS. You are requiring an entirely new protocol to be designed. And the nobody will use it.

Reply on news.ycombinator.com