Blocking is the wrong terminology here. Cloudflare is not an ISP which fetches whatever you ask for from third parties. It's a company contracted by the web site owners to distribute their websites. It's much more accurate to say that Cloudflare is no longer acting as a host for pirate sites in the UK.
The shocking part of this isn't that they aren't participating in that form of crime in the UK, it's that they're somehow able to participate in it in the rest of the world.
And I say this as someone who thinks that copyright laws are largely unjust, preventing people from engaging with their own culture, but that doesn't make them not the law.
Most of the world doesn't bother playing whack-a-mole with pirate sites because it usually doesn't work. The UK, however, is no stranger to enacting policies that are known to be ineffective.
Cloudflare offers Tor access for free. So to access these sites in the UK you just need to connect via Tor now. (Or of course you could pay for a VPN, but Tor is free).
Do you also refer to steam games that only sell in some regions as "geo-blocking"? I don't. Steam doesn't (they call them region restrictions). There's no blocking going on, merely declining to offer something in the first place. Cloudflare is the host here, they aren't blocking anything, they just aren't providing the pirate site in the first place.
> when they don't have legal obligation to.
While I know relatively little about UK law I'm extremely skeptical of the idea that cloudflare does not have a legal obligation to not knowingly host websites committing copyright infringement.
Yes? I agree "geo" and "region" are synonymous here, but as I understand the word "blocked" to be "blocked" a transaction has to be in action in the first place - and if one party to the transaction (steam) isn't interested then the transaction wasn't in action.
Similarly you can block a punch, but not if it was never thrown.
See https://cybersecurityadvisors.network/2025/04/15/la-liga-blo... : I'm slightly surprised that this hasn't caught up with them too. It used to be important to stay somewhat "below the radar" when pirating, not creating an account at one of the largest internet services. But then anti-piracy enforcement is about money and going after soft targets.
The implied parentheses were intended to be "(Cloudflare is no longer acting as a host for pirate sites) in the uk" not "Cloudflare is no longer acting as a host for (pirate sites in the uk)".
Copyright laws don't prevent people from engaging with their own culture. They just insist that users pay what the creator wants. Any person who is willing to pay can engage as much as they want.
It's like saying that laws against shoplifting prevent people from eating food at a supermarket.
Not so, there is no obligation on copyright owners to sell at a reasonable price. If you want to create a derivative work that the copyright holder ideologically disagrees with it is very likely that it is simply impossible to purchase the rights to do so. Nor is there any obligation for the copyright owner to make themselves known and available to negotiate with, there are numerous things that aren't available at any price because no one even knows who has the right to sell them (many old games for instance fall into this category).
Moreover it is simply unacceptable to say that poor people (which in many cases here means less than multi millionaires given the minimum deal size most copyright holders are interested in for derivative works - and less than centi-millionaires if we mean "affordably as a hobby") cannot legally engage with the work of the culture they grew up in.
Oh please. Don't dig yourself deeper. So what if the copyright owners set what you think of as an unreasonable price? In almost every case, those works are not part of the collective culture you celebrate. If the creator doesn't want to share, who cares? That's their perogative-- and there are plenty of other perfectly nice works that are made by people who are desperate to share. So please don't use this looney point as an excuse to steal.
And really, your point about poor people is true about everything. Why shouldn't they get free food for life just because they "grew up" eating? Or a free bicycle because they rode one when they were five?
I'm not digging at all, this is a position I feel very confident in defending. I could do without your condescension though.
I'm not excusing theft. Theft involves depriving someone of something that belongs to them, copyright infringement never does that. I'm also not advocating for copyright infringement, I'm advocating for doing away with the laws that establish copyright in the first place (I'd accept various other positions like "amend the time limit on copyright down to a year" - though I'd argue there's not much point to retaining copyright at all at that point).
The relevant question is "what are the odds a particular work is part of my cultural background", but "what are the odds that a particular work in my cultural background is copyrighted without a license to create derivative works available either freely or under fair reasonable and non-discriminatory terms". Those odds are approximately zero, everything is copyrighted these days, licenses to create derivative works are almost never available for notable cultural works (or really anything other than open source software, and wikipedia).
If you're a kid growing up Pokemon, and not part of the 0.001%, you can't afford a license to legally make up stories involving Pokemon. That's fundamentally unjust. Being able to tell stories about our experiences is fundamentally something that we should be entitled to do.
This isn't the case of a nominal, affordable, cost like food. We absolutely hold that food should be available to everyone at a price they can afford (and yes, if they can't afford it we should still feed them - see various UN resolutions and so on about food being a human right). This is the case of "you can only do this legally by making bespoke negotiated business-to-business style deals for huge sums of money" when it should be a right widely available.
The status quo is just that people break the law and make themselves criminals (intentional copyright infringment is a crime, and that's what you do when you write "fanfiction" without a license), and that's not right.
I don't see any discussion on the claim that cloudflare is acting as a host. Are they?
Usually we only describe the last link in the chain as the host. Everything else is usually not "the host" for a website. DNS providers, TLD registries, Domain registrars, IP address providers, VPNS, reverse proxies, web caching, CDN (which often, but not always, act as caches), DDOS protection, IT management layers, micro services, backups, IP management, (and many more) do not call themselves hosts for websites. The ones that call themselves as host are usually web hosting providers, web shops, "cloud", and vps. Hardware as a services seems like a bit more of a grey zone, similar to rented space in a data center.
The article specify that the pirate shops used cloudflares services of pass-through security and CDN. The more accurate description I would describe that is that cloudflare are selling services to pirate sites, and that this services has been blocked. How shocking that is depend on how much responsibility we as a society want to place on people who provide those kind of services. How much liability should a service provider have, say a security management services, when their customer is known to break local law?
Reminds me a bit of the specific case law in Sweden used in the pirate bay case. The law that the prosecutor used was a law directed toward biker gangs that targeted the bars that those gangs tended to use as a base. The law specified that even if the bar itself operated legally, the fact that the biker gang used it as a base made the owner legally liable if the bar provided services to those members.
> I don't see any discussion on the claim that cloudflare is acting as a host. Are they?
This is definitely how Cloudflare attempts to defend themselves! In essence, my above comment is rejecting Cloudflare's interpretation.
They aren't a preliminary step in the chain like DNS/domain stuff, they are the final step, they are the service the user asks for the actual content of the pirate site, and they return the actual content.
They aren't a tool being used by the user like an ISP or VPN that might have a privacy defence of being deliberately blind to the traffic they are forwarding, they are rather specifically contracted by the pirate site.
There's no expectation on the users behalf that when they query the pirate site hosted by cloudflare that query will go beyond cloudflare (like with a proxy). The user is perfectly happy if cloudflare serves that request entirely by returning data stored on their own servers. So is cloudflare, and as much as the time as feasible that's exactly what cloudflare does.
So I'm rejecting the notion that cloudflare is distinct in any relevant way from a typical webhost here.
--
> The more accurate description I would describe that is that cloudflare are selling services to pirate sites, and that this services has been blocked.
I'd be happy if the title read "court blocks Cloudflare from providing services to pirate sites" (though that's not the editorial slant the article was going for). Your phrasing leaves the blocking party ambiguous, which is sort of missing the point of my complaint.
If you mean "this services has been blocked [by Cloudflare]" like the original title, it runs into the same problem as the original title. You've changed the party Cloudflare is declining to transact with from the end-user to the pirate site. It's still the case that this is merely Cloudflare declining to provide services, not those services being blocked (which would only be possible if Cloudflare chose to provide them) by Cloudflare.
The distinction here matters because this isn't Cloudflare acting as an extension of law enforcement to step in and block a crime from occurring, this is merely Cloudflare itself choosing not to commit the crime. Maybe because a court ordered them not to, or maybe just because they decided not to (which the article seems to be trying to suggest).
Are they themselves denying DNS requests whose purpose was to assist in communicating with them? No. They are just choosing not to communicate with whomever sent the request.
I don't actually use Reddit or Twitter, but I sometimes come across NSFW posts from links. I've found that old.reddit.com seems to allow you to bypass the filter(s) without needing an account. For Twitter, I tend to use the xcancel.com Nitter instance, though there are other Nitter instances that work fine.
Bonus for using Nitter here, you can also see the latest posts from an account instead of the most popular posts, and see replies/interactions to individual tweets. Oh, and it gives you plain HTML.
Reddit pisses me off so much that despite the fact that I don't even use Reddit, just so that my experience sucks less when I'm linked to Reddit or have another reason to lurk it,
- I use the "Old Reddit Redirect" extension to force the browser to go to old reddit
- I use the "Load Reddit Images Directly" extension to bypass Reddit's hideous image viewer that tries to load if your browser makes the mistake of having text/html in the "Accept" headers when opening an image in a new tab. (Dear Firefox/Chrome/etc: maybe stop doing that? If I open an image in a new tab, there is a zero percent chance I want HTML.)
Reddit is also very aggressive at blocking VPNs. Mullvad is constantly blocked. Occasionally I'll turn it off, but Reddit is just a terrible place so I usually go elsewhere (I'm only going because of Google search results. I'd rather use an LLM than turn off my vpn for Reddit)
I just googled 'top nsfw Reddit' and aside from some disturbing implications of 'top' all opened fine with 'old.'. The IP is UK based, is coming up as UK on all geoip sites I tried and is in all of the last 30days of maxmind as UK based.
It might be some kind of phased rollout of course.
Oops, I should note that I'm a U.S. citizen in a state without any porn age gate laws. I have no idea what the status of using old.reddit.com to bypass the NSFW filter is in other jurisdictions, or honestly even my own (not sure how to test it.) All I know for sure is that it worked last time I tried it.
Is the reddit equivalent of xcancel/nitter (i.e., redlib https://github.com/redlib-org/redlib) also blocked? Presumably if the instance is hosted outside the UK it would work since I think it effectively proxies your requests.
I used to have one, but I don't anymore and personally I think if they ever force everyone onto new reddit I will probably just not follow reddit.com links anymore (or use a proxy that is less annoying, if those prove reliable enough.)
The tor network essentially relies on donated exit node bandwidth, and there's a finite capacity at any point in time. Torrenting is a bandwidth hog (and a lot of exit nodes will filter it out anyway)
Hey, we pay $100B/yr of tax money into the NSA/CIA/etc budgets every year so they can run exit nodes among other activities, I wouldn't exactly call it donated
Is it really just a matter of my bandwidth being hogged up, or more a risk of getting my IP address (range) banned, if not worse legal risks from activities being traced to me?
Yes, an exit node operator will appear as the source of the traffic, which can have legal repercussions. (Personal risk.)
But on a macro scale, the entire Tor network has fairly limited bandwidth and torrenting is a very easy way to saturate it. (Existential risk to the network / tragedy of the commons)
You can't get banned because no one knows who you are. You can bring down the entire Tor network. Probably not you by yourself, but if enough people do it they can.
Exit nodes have to deal with much more severe things than copyright infringement. They regularly get raided by law enforcement for accusations of child porn and hacking, and have to defend themselves by pointing out they didn't originate the traffic. There's a whole bunch of tips out there about how to not go to jail for running an exit node (which is legal).
That's why some "tor-torrent" protocol should be invented, where data is sent via torrent network. There's still some bandwidth amplification, but as long as someone is seeding from within tor, the whole transfer could be done there.
...would also help with privacy and nasty telco letters.
> Tor is great but the bandwidth/latency kinda sucks for casual browsing activity
It is reasonably decent these days. Generally there are periods where Tor network is slow.
> A VPN is a more realistic workaround to this kind of geofencing
Generally I tend to use a combination of Tor / VPN depending on what I am doing. Some gossip sites have onion urls and I will use Tor if visiting those. Other sites that are geo-fenced (sites like Odysee) are easier to get to via VPN.
> I almost said "solution" instead of workaround, but of course the only actual solution is to fix the legislation.
That isn't going to get fixed anytime soon. In fact I expect it to get worse over time.
I wrote a similar comment but then realised that if you're using tor per GP's recommendation, you'd be fine as long as your exit node isn't in the UK, or other regressive jurisdiction.
Which is why you will need to provide a cryptographically secure identity credential issued by the government, and you will need to re-verify at regular intervals, not just upload a JPEG.
Make no mistake, the plan is to require 'KYC' for Google, reddit, Facebook, X soon and all that and then later require it for all web sites, even this one.
Australia recently passed a law requiring Google to KYC Australian account holders to check ages to decide if the user will be allowed to control the "safe search" setting.
Well. Certainly for people in the room here. One imagines regulators know that too, and will draw the line accordingly… that they may grudgingly tolerate validation systems that allow some degree of individual fraud, but stomp on the first of us here to vibe-code our way to a fraud-as-a-service site that gets any traction.
I’m reminded of all-around-good-guy @patio11’s evergreen The Optimal Amount Of Fraud Is Non-Zero…
There is literally no point in signing those petitions. The only disagreement between the major political parties in the UK is how draconian it should be.
If it hits 100k then it needs to be debated in parliament. However the bill was already debated in parliament and got through and the petition doesn’t bring anything new to the table.
There would be more of an impact if, perhaps, everyone in the UK who has had to shut a web site because of this law wrote to their MP.
> If it hits 100k then it needs to be debated in parliament.
I don't think so. It says on the site "At 100,000 signatures, this petition will be considered for debate in Parliament".
I've seen people get excited about petitions before that got to 100,000 signatures and it all fizzled out, or it wasn't debated seriously in parliament. Often you will get a cookie cutter response with these petitions that is a paragraph long.
The reality is that most of the public are indifferent or supportive of the current legislation and most MPs know that.
> There would be more of an impact if, perhaps, everyone in the UK who has had to shut a web site because of this law wrote to their MP.
Each MP would get maybe a max of 10s of emails/letters each. Many of those MPs wouldn't even bother answering you. Those that do will often will probably give you the brush off.
I've written to my MP before (about encryption legislation), spent a lot of time presenting a clear and cogent argument and I got a "well I might have a chat with the home secretary" and they were still singing the same tune years later. What I was telling them was largely the same as other industry experts. They don't care and that is the unfortunate reality.
The fact is that the direction the UK government (doesn't matter whether it was Red Team or Blue Team) has been going in has been clear for well over a decade at this point. It would take a major political shake up for this to change IMHO.
True, but MPs receiving a few mails that say “this law has affected me in this way” is IMO far more likely to be effective than a petition with 100k signatures that says “I don’t like this law which you recently approved”.
MPs have been known to respond to letters. I have had responses to various issues. It obviously depends on the MP. Many MPs were very much opposed to this issue.
> True, but MPs receiving a few mails that say “this law has affected me in this way” is IMO far more likely to be effective than a petition with 100k signatures that says “I don’t like this law which you recently approved”.
I think they are both ineffective. So I don't believe that is true.
> MPs have been known to respond to letters. I have had responses to various issues.
Getting a response is one thing. Having something done is another.
> It obviously depends on the MP. Many MPs were very much opposed to this issue.
The legislation was going to happen at some point or another. The direction of travel was quite clear. There are always going to be some dissenters, but the awful legislation got passed anyway. So what did their dissent achieve? Nothing.
I came to the realisation a number of years ago that for the majority of people, the only care about being able to use their Netflix, shopping on amazon, check their email and post photos on Facebook. Concerns outside of that are simply too abstract/distant to care about.
> I think they are both ineffective. So I don't believe that is true.
I disagree that writing to MPs is always ineffective. Some campaigns have been successful. Whether it will be effective in this case is another matter. Maybe when people start to experience the block it will gain traction.
Of course if you don’t even make low-effort attempts to make your voice heard and exercise your democratic rights, you can be certain that you’ll lose them.
> I disagree that writing to MPs is always ineffective. Some campaigns have been successful. Whether it will be effective in this case is another matter.
It won't be effective in this case. It been going in the same direction of travel and none of the parties (including outsider parties such as the Greens, Reform etc) proclaim to believe in in reversing this direction of travel. They are much more interested in other issues that are much more hot button. Those issues are easy for the public to understand because they are likely to have encountered them often.
> Maybe when people start to experience the block it will gain traction.
No it won't. People will either find a way to circumvent via VPN/Tor or some other mechanism (which is what they already do) or they will simply shrug their shoulders and won't bother.
There has already been a large number of forums/sites that have been shutdown or site been blocked in the UK and there hasn't been any significant traction on this issue.
> Of course if you don’t even make low-effort attempts to make your voice heard and exercise your democratic rights, you can be certain that you’ll lose them.
I don't really know how to respond to something like this because I believe it is naive on a number of levels. I consider myself a realist. I believe "making your voice heard and exercising your democratic rights" is about as effective as talking to a brick wall (at least on a national level).
I have personally made attempts. I wrote to my MP often. I cited links, news articles etc to back up my argument. It was an utter waste of time. At best you may get a short response. I realised I was ultimately wasting my time, I stopped and will never do it again. I actually feel stupid for believing that I could make any difference at all. I suspect this is the experience for other people and is often not spoken about.
Moreover much more notable people have tried to make themselves heard around a number of related concerns about freedom of speech, threats to privacy, iffy counter-terrorism laws etc. More often than not has always been either ignored entirely, responses that completely ignored the crux of the issue, or straight up lies from successive governments for almost two decades now.
Realistically our options will be to learn to live with the poor legislation, circumvent it, or leave the country.
Do you wait for the end of football matches before deciding which team to support, because only the one that won matters?
I advocate against laws I don't like, and try to give people practical advise about how to protest against them, as well as how to circumvent them, and minimize their effects, and encourage them to pass this knowledge on. I consider it a good use of my time, even if not everyone cares to retain that info or pass it on.
Politics is never a foregone conclusion (unless you completely give up and go silent, in which case your opposition has carte blanche to do what it likes)... but like "viral content", it's not something you can always whip in your your favour. People are irrational creatures, and you never quite know what will make them all sit up and take notice. You can never be sure what will set the nation's agenda, and what stories "have legs", until they happen. For example: the Post Office scandal was a dull boring thing that nobody cared about, and then... an ITV drama made people care? But there have been ITV dramas about political scandals before, and they didn't all have that effect. But that one did. And the writers of the drama didn't just make stuff up, they followed the details of campaigners and journalists who had been covering this for years, even if at times they felt they were shouting into the void.
You just keep trying and see what sticks and what doesn't. The standard UKGov petitions site has at least some quantum of usefulness in that it encourages people to think about the issue, and if they sign it, they know there are others that agree with them. Change is possible.
I believe it to be a statement of reality. I am simply spelling out how it is. It is not an endorsement.
Moralising about my assessment does not make it untrue.
> Do you wait for the end of football matches before deciding which team to support, because only the one that won matters?
I also read spoilers for movies before I watch them in the cinema. I am truly awful ;-)
> I advocate against laws I don't like, and try to give people practical advise about how to protest against them, as well as how to circumvent them, and minimize their effects, and encourage them to pass this knowledge on. I consider it a good use of my time, even if not everyone cares to retain that info or pass it on.
I would only bother talking about how to circumvent them. The other activities are a waste of time. It took me quite a while to come to this conclusions (about 20 years) but that is the conclusion I came to. Those who are interested in circumventing it will come and find you typically, those who aren't won't bother.
> Politics is never a foregone conclusion (unless you completely give up and go silent, in which case your opposition has carte blanche to do what it likes)... but like "viral content", it's not something you can always whip in your your favour. People are irrational creatures, and you never quite know what will make them all sit up and take notice. You can never be sure what will set the nation's agenda, and what stories "have legs", until they happen.
I don't believe it is a forgone conclusion. I believe that one has to obtain power to enact change.
I don't believe that anything is "bottom up" i.e. there is a ground swell of public opinion and this peculates up to those in power. I think it is "top down".
> People are irrational creatures, and you never quite know what will make them all sit up and take notice. You can never be sure what will set the nation's agenda, and what stories "have legs", until they happen.
It is actually well understood what makes them sit up and notice. It has been extensively documented.
> For example: the Post Office scandal was a dull boring thing that nobody cared about, and then... an ITV drama made people care? But there have been ITV dramas about political scandals before, and they didn't all have that effect. But that one did. And the writers of the drama didn't just make stuff up, they followed the details of campaigners and journalists who had been covering this for years, even if at times they felt they were shouting into the void.
This only proves my point. Until a major broadcaster in the United Kingdom e.g. run by people with power, money and connections, popularised something only then did people take notice.
> The standard UKGov petitions site has at least some quantum of usefulness in that it encourages people to think about the issue, and if they sign it, they know there are others that agree with them.
I don't think it does. The people that sign these petitions have often already decided that the law needs to be repealed. Ask someone working down the local shop if they even know if this petition exists? Probably not.
> Change is possible.
Not by us. This is a lie told to you to keep believing. It was a bitter pill to swallow that ultimately your voice will go unheard. However it is ultimately liberating as you can direct your energy elsewhere.
> I don't really know how to respond to something like this because I believe it is naive on a number of levels. I consider myself a realist. I believe "making your voice heard and exercising your democratic rights" is about as effective as talking to a brick wall (at least on a national level)
This is partly a perception issue. You need to adjust your expectations.
Individually you are unlikely to make a difference. You write a letter and are knocked back, you see no immediate impact and all your human senses are telling you “this didn’t work”. That is how the human mind works. It’s very demoralising (arguably by design).
You feel like you are the only one acting, because you do not see anyone else acting, and therefore you feel alone on this issue, and knowing you do not have the individual pressure to move the needle, you feel it is shouting into the void.
This is a human feeling but it is not necessarily reality. You don’t know who else has acted on this, who has written letters, what the various MP Signal chats are saying. You have no way to gauge support.
Therefore you should make the efforts even if there is no positive feedback, because there are unseen forces.
You might also need less political pressure than you think. MPs are human. Put yourself in the shoes of a MP receiving letters from the public. If one person sends a letter on this issue, it’s lost in the noise, one of many crazies talking about irrelevant topics, dismissed. If only 10 people send letters on the same topic, that starts to put the issue on your radar, no? 10 letters, then you hear about a 100k petition on the same topic that’s going to get noticed, do some research, maybe even discuss it between MPs. You’ve given a reason for them to make a self-important speech in parliament.
Continual pressure on all fronts. Keep pushing, help efforts that gain more support and build more pressure. It’s all you can do but also the least you can do.
This reply you have given me is why I don't like having these conversations. You fundamentally still believe that the democratic process can work. I don't even believe it really exists. I believe what you see happening publicly is nothing more than political theatre.
> Put yourself in the shoes of a MP receiving letters from the public. If one person sends a letter on this issue, it’s lost in the noise, one of many crazies talking about irrelevant topics, dismissed. If only 10 people send letters on the same topic, that starts to put the issue on your radar, no? 10 letters, then you hear about a 100k petition on the same topic that’s going to get noticed, do some research, maybe even discuss it between MPs. You’ve given a reason for them to make a self-important speech in parliament.
Lets pretend this did happen.
What happens next is when some tragedy occurs (there are plenty that happen unfortunately) e.g. a teenage girl committing suicide because she was bullied on Instagram.
Then every major news website, news paper and news broadcast runs with "Dangerous Internet Trolls caused the suicide of lovely teenage girl".
Then there is a series of "discussions" about the issues on Question Time or LBC. The solutions presented will be various draconian measures which means more censorship, monitoring and surveillance. They will have a token person (that is often unlike-able) arguing against more draconian measures for "balance" which will be derided by the rest of the panel (and often the audience). After that you are back to square one, because it is now politically toxic.
This is known as "manufacturing consent".
I've seen this play out literally hundreds of times now.
> Then every major news website, news paper and news broadcast runs with "Dangerous Internet Trolls caused the suicide of lovely teenage girl".
Sure, that can happen.
What if tomorrow's headline is "porn habits of everyone in Britain revealed", or "6 in 10 people's bank accounts stolen after ID leak". Would there be room for change then?
We can then have the trustworthy, familiar face of Martin Lewis on the news telling people how to protect their identity, and he can highlight how this terrible problem was caused by mandatory rules set by Ofcom, and they can have some squirmy little git from Ofcom promising to "look into the problem", and by day 4 of the ongoing national identity theft disaster, the government will yield.
It has happened! Quite a number of times in fact. That why I used that particular example.
> What if tomorrow's headline is "porn habits of everyone in Britain revealed", or "6 in 10 people's bank accounts stolen after ID leak". Would there be room for change then?
No. It will be spun in a way where they can justify more draconian measures or something else will be into the news cycle and it will be forgotten about after a few weeks.
> We can then have the trustworthy, familiar face of Martin Lewis on the news telling people how to protect their identity, and he can highlight how this terrible problem was caused by mandatory rules set by Ofcom, and they can have some squirmy little git from Ofcom promising to "look into the problem", and by day 4 of the ongoing national identity theft disaster, the government will yield.
I think it would be the ICO not Ofcom. Nevertheless, they will have some politician or spokes person blaming it on not enough funds and/or powers going to the appropriate regulator.
> We can be cynical, but can hope too.
It isn't cynicism. I am literally describing what happens more often than not.
The choice will be between going out of business and going to jail. They'll choose to go out of business. I've noticed that HN users often think businesses have some obligation to be infinitely sustainable - they do not. They just need to be sustainable long enough to recoup their setup costs.
Cloudflare doesn't do things that send them to jail, like ignoring court orders. They'll log whatever the court tells them to log.
Cloudflare does plenty of sketchy stuff, like deliberately hosting DDoS-for-hire sites because it increases the demand for anti-DDoS products. But they will take them down if they are ordered to - and reveal their origin IP. They are not going to jail for you.
Funny in a US state I'm finding more and more places are popping up with an age verification. Doesn't really bother me so much content out there but yeah.
It's weird too how I don't want to prove my age, guess it's the taboo aspect of it vs. say showing your id at a bar.
Bars usually don't write down your data or associate every movement you make while there with your id, so it's definitely more risky than the traditional meatspace verification process.
Part of the issue is that for my entire life, age was either not enforced or a promise. It feels wrong having gates up where they previously didn't exist.
I get it; I wandered into gay porn sites and irc chats when I was in the 4th grade back in the 90s, and my friends and I loved chatting up those interested in our pre-teenage selves at the time. But I still will never provide a legit id for any age restricted services. Though I do have fakes for non us based companies to deal with financial kyc but haven't used them in some time (years), so no idea if they would work in the days of oligarchic identity management saas.
Even if it does, nothing will change. They've been trying to push through this legislation for 10 years. They don't care what the citizens want - their need to spy takes priority.
Not really been much advance notice of that to account holders. I wonder how the normally sane and well balanced people left using Twitter will react to that. Or even how they determine "UK account" anyway, given all the usual geographical qualifiers.
I came to the realisation recently that the free Internet only happened (in the West) because:
- The Silent Generation, in charge at the time, had no idea what was this Internet thing about.
- The US Intelligence community understood it was a powerful tool to operate abroad.
- Nobody dared derailing the only engine of growth and progress in many economies
It obviously got out of control and is very abnormal in fact if you consider how power really works.
As of today, as a user of a reputable VPN, I am blocked from a lot essential websites or have to prove I am an human every 5 minutes, it sucks.
Anyway we are one major cyber disaster away for our the state to switch from a blacklist to whitelist paradigm. A safer and better Internet for everyone.
We will probably still have ways to access the "Free" Internet. It is gonna be fun, slower and might get you in serious troubles.
The thing is, the Internet was supposed to be P2P initially (in Spanish it had the motto "La red de redes" (the network of networks, meaning that it was supposed to connect several LANs together).
But as soon as you had ISPs started, centralization came. Now, most countries will have at most 5 major ISPs, and in reality geographical availability within countries make 1 or 2 available.
Then, originally people had their own websites (I was there!) in their own servers. But Geocities started the centralization trend. And then CDNs, and then MySpace/Facebook and all that.
The only way we are going to get the "freedom" network as it was before is through mesh-networks or similar technologies. Which maybe so far are very slow and cumbersome, but they will have to evolve. I know it is not very fashionable here in HN, but the only see that capable of happening is implementing some kind of "incentive mechanism" that incenvitives people to let data pass through their node in the mesh network; aaaand cryptocurrencies offer an possible solution for that.
> The thing is, the Internet was supposed to be P2P initially (in Spanish it had the motto "La red de redes" (the network of networks, meaning that it was supposed to connect several LANs together).T
The Internet is just a commercialised ARPANet. ARPANet was designed to survive bombs taking out a fair percentage of it's nodes. The Internet still has that robust resistance to damage. You can see it in action when anchors cut ocean cables - barely anyone notices. And as the old saying goes, the internet treats censorship as damage and routes around it.
However, the commercial enterprises built on top of the internet love centralisation. CloudFlare is an interesting case in point. They have been champions of an uncensored internet for as long as I can remember, which is one of the reasons they grew to their current size. That growth was always going to compromise that core principle, because once a significant amount of traffic passed through them they would become an attractive target for groups wanting to inflict their views of what's proper viewing for the rest of the world.
But while CloudFlare can't exist without the internet, the internet will continue on without CloudFlare. So while the self appointed gatekeepers have indeed blocked the large hole in the sponge that is CloudFlare, underneath the sponge is still a sponge. Information people find interesting will just take other routes.
Or to put it another way, if they think they have stopped or even appreciably slowed down teenage boys from accessing porn, they are kidding themselves.
I find this hard to believe. In New Zealand, the tiny country I live in, I can name off the top of my head at least 10 ISPs. You're telling me most countries, which on average are far bigger than mine, have fewer? I don't believe it. Another made-up statistic.
Something I have always been wondering is: how much was WiMAX a threat to this centralisation and the 3 - 5 ISP per country model?
I remember around 2010 there were cities with several small new ISPs providing fast home and mobile Internet for cheap and with very good coverage.
Infrastructure costs were probably very low. Order of magnitude I guess compared to 4G, cable or fiber.
You could find phones supporting it (HTC was one of the maker) and it seemed to be the perfect solution for most users.
I am not sure if those small ISPs already had a roaming system in place but it would have made a lot of sense.
Anyway, when Intel finally gave up I thought there are probably strong forces wanting to keep access to the Internet in a few hands, expensive and centralised.
WiMAX was just Intel alternative to LTE. It might have been threat to Qualcomm, and cellular telecom in-groups, but not a threat to centralization trend at all. Range was shorter than existing cellular, so it needed more towers, not less.
The centralized search engine's AI summary says that LTE became more popular, and the people who would buy WiMax hardware ended up buying LTE hardware instead.
From what I remember (and I might be wrong) WiMAX was first competing on the "home" Internet market. Mostly against cable & DSL I guess at the time.
It was a USB dongle you would put in your laptop.
Having a one WiMAX enabled smartphones was the cherry on top and probably more of a long term goal.
The only one I remember was the HTC Evo 4G [0] (the first 4G enabled smartphone released in the US, and by 4G they meant WiMAX, not LTE).
My guess is there was for sure a big battle between Intel, major phone manufacturers, telcos, infra providers and various patents holders.
There was probably a chicken and egg dilemma for mobile phone manufacturer since they had to wait for the network to grow before risking launching their WiMAX phone but having a WiMAX enabled phone would make WiMAX at home really attractive.
My guess is also that since people usually get their phone from their telco, phone manufacturer had to be careful not to go against their interests. And since most telco wanted LTE, WiMAX couldn't take off.
But there might be more to this story, including the fact Intel was also trying to get in the phone SOC market at this time.
> As of today, as a user of a reputable VPN, I am blocked from a lot essential websites or have to prove I am an human every 5 minutes, it sucks.
I have to do that using corporate and residential US networks, simply because I use Firefox.
As great as Cloudflares services might be to each individual user, the centralization of infrastructure, and by extension the centralization of power, doesn’t seem to be worth it at a macro level. The tragedy of the commons strikes again.
You're forgetting that that the Internet was intertwined with the phone system at a time when the latter was the only reliable form of communication at both local and long-distance levels. Interference with the Internet would be interference with the international telephone system.
I don't see how the fact that dial-up was the norm for the internet "last mile" changes anything wrt the ability to block it. It would be done in exact same way it is done today - by forcing ISPs to do the blocking on internet protocol level.
Every computer is a general purpose computer. What would you do to force me to participate exclusively in your nanny-net? I suspect any answer to that question requires an incredible amount of coordination and participation.
The real problem with the internet, as I see it, is centralization. This is a product of monopoly, which is the core feature of copyright. A truly better internet would replace the authoritative structure of copyright with a truly decentralized model.
As far as I can tell, the only hard problem left in decentralized networking is moderation. No one wants to browse an unmoderated internet. The problem is that moderation is structured as an authoritative hierarchy, so it's not compatible with true decentralization.
I propose we replace moderation with curation. Every user can intentionally choose the subset of internet they want to interact with, defined by attestations from other users, all backed with a web of trust. This way everyone is the highest authority, and users can help each other avoid content they are disinterested in.
The decline of internet began way before trump, I'd say with the rise of facebook and everything moving on there (your local restaurant used to have a website, then switched to facebook only).
Centralized power, centralized censorship.
At approximately the same time, social networks became less social and more propaganda feeds.... so it went from a feed of content made by your friends for other friends (from complaints in status messages to photos of their plates) and moved to whatever crap they try to serve you now,...
The internet was a very good tool in subverting dictatorships and influencing elections.
Now that adversaries of the West have mastered it and the shoe is on the other foot ,internet bad
Previously, a convenient and low-latency way to bypass UK internet censorship was to proxy via a local datacentre - it's only the residential ISPs that are under pressure to censor traffic, commercial ones less so.
But if the blocking is happening somewhere other than the ISP, this is less effective. A hypothetical TPB user might want to proxy via Luxembourg now (seems like the shortest hop to somewhere with sane legislation)
My ISP (Virgin Media) does DNS filtering and IP-based blocking and TLS SNI inspection. So you have to use ESNI or domain fronting, which last time I checked my browser could not be easily configured to do.
At this point, what's the difference between the UK and China other than the specific content they block?
Some ISPs have even started blocking wireguard here & I've had to resort back to xray/v2ray
I currently live in student accommodation so not sure what they're using upstream. The university network also drops wireguard connections but only to known providers like Mullvad (assuming obfuscation is off)
Is that common for all ISPs or just Virgin? When I lived in the UK (already a number of years ago) it was all just DNS-based. Running my own DNS resolver unblocked everything. I don't recall which ISP.
I think it's just Virgin doing the SNI stuff, but I wouldn't be surprised if others are doing IP filtering. I'm not sure if anyone's done a good survey of what the different ISPs are doing (it'd be an interesting project).
Cloudflare has said pirate sites as clients - they are not (and cannot) block any pirate sites that are not their clients. The remedy is for those sites to no longer be patrons of Cloudflare.
If an analogy helps anyone understand better - imagine you have a lemonade stand. You use your neighbor's yard to set up the stand for some reason (maybe since its closer to a main road, the why doesn't really matter). The city tells your neighbor that they will be fined if they continue to have a lemonade stand in their yard, so your neighbor parks their truck in front of the stand, hiding it from the street.
In that analogy, cloudflare is the neighbor and your lemonade stand is the pirate site. You aren't prevented from selling your lemonade, but you can no longer freely use your neighbor's yard unless you want to direct people around the truck ahead of time.
About a decade ago, there were proposals for a "driver's license for the internet."
Nowadays... I actually think it might be a lesser evil. Picture such an ID, if there were a standard for it, enrolled into your computer.
If it were properly built, your computer could provide proof of age, identity, or other verified attributes on approval. The ID could also have micro-transaction support, for allowing convenient pay-as-you-go 10 cents per article instead of paywalls, advertising, and subscriptions everywhere. Websites could just block all non-human traffic; awfully convenient in this era of growing spam, malware, AI slop, revenge porn, etc. Website operators, such as those of small forums, would have far less moderation and abuse prevention overhead.
Theoretically, it would also massively improve cybersecurity, if websites didn't actually need your credit card number and unique identity anymore. Theoretically, if it was tied to your ID, it's like Privacy.com but for every website; much lower transaction friction but much higher security.
I think that's the future at this rate. The only question is who decides how it is implemented.
This is so naive. Big tech would be the first to get various exceptions to train their greedy AIs. They would lobby so hard to lock down personal computers, just to make sure you are not tampering with your digital passport. Google would finally have their wet dream of locked down PCs that have no adblock.
Politicians would be salivating at the idea of getting the real identities of dissenters, and religious fucks would finally have their way of banning porn and contraceptives.
You're assuming this isn't already in the works; I simply see it as we can make the standard now, or let the standard be dictated.
We're already seeing it piecemeal, with Cloudflare supporting skipping CAPTCHAs on verified iOS and macOS devices; mobile driver's license enrollment options on iOS; age verification rollouts for websites with no-doubt people thinking how to streamline things; etc.
I personally think we are one big cyberattack from the whole concept returning fast. One big cyberattack from governments (and people in general) saying they've had enough of the free-for-all status quo. This isn't a good place to be.
> You're assuming this isn't already in the works; I simply see it as we can make the standard now, or let the standard be dictated.
The difference is we've grandfathered in a lot of older technology - x86, old desktop operating systems like Windows and Linux, old browsers, BIOS, etc. So the existing tools we have for censorship have to work around these existing platforms.
These platforms were created in a time where user control was paramount and security was an afterthought. They often do not have the mechanisms required to lock down the boot loader 100% of the time, or give a verified boot chain, or make sure the display signal isn't being intercepted. Our DRM and censorship, then, is very limited. I mean, even with secure boot - I can just turn that off. I can just turn on legacy MBR BIOS mode too. What now?
On other, newer, platforms, like your smartphone or smart TV, you'll notice the DRM is much stronger. Try changing out your OS on an iPhone. These platforms are ripe for the picking when it comes to censorship you can't circumvent.
So long as these older platforms exist, the usecases must be supported. Sure, we can "streamline" things on DRM heavy platforms like iOS - but we need to keep a trapdoor. Who is going to alienate Windows? Or x86 as a whole?
I'm aware that this might very well be "in the works", what's your point with that? Who is this "we" you are talking about? Are you going to publish a repository on github about what you believe is the ethical way to do this, and you expect Google to follow, or ???
What is this "one big cyberattack away" that you are talking about? Large sites get hacked all the time, and _nobody_ in power gives a single flying fuck. There are zero people held responsible for storing passwords in plaintext, or the admin password set to "123456" or passwords left as the default.
German national ID has this built-in; you can cryptographically prove that you are currently in possession of an ID (and its PIN) over a certain age, for example, without revealing your date of birth. It's just not in widespread use.
Thank you for sharing this. I have been frustrated about the lack of chip and pin for IDs for years. We have had digital IDs in the form of debit/credit card since the 90s, and yet the governments have been agonizingly slow to adopt this (at least to me) painfully obvious idea. So good job Germany!
The problem is national security consequences of it. Handing out nation-backed ID card tied to secure identity undermines sovereignty of the nation, because it means Walmart and likes can (illegally) exert political influence by silently or openly classing and discriminating you.
It is important that personal ID is only transparent and spoof-proof to legitimate government the individual identifies with, and that soft ID databases that private entities may build have limitations in its completeness.
That's not trivial to do right, especially through bureaucratic government processes.
Chip and PIN is almost how electronic passports already work - it's just that the 'PIN' is printed in the passport itself, so in order for anybody to communicate with the chip, it has to see the page which has it printed in order to scan for it first.
CA DMV app lets me add my driver's license to my mobile wallet (which works with NFC).
Of course, it doesn't eliminate my legal responsibility to carry my driver's license while driving, and while the printed piece of plastic lasts five years and my passport booklet is legal I.D. for 10 years at a time, the mobile driver's license needs to be updated every 30 days.
the number of people who work for (or defend those who work for) firms like raytheon, northrop grumman, palantir, meta, amazon, microsoft, alphabet, flock et al leads me to believe there are not enough people left to care about building this technology. we're cooked. too many developers lack the moral position necessary to turn the tide in a meaningfully widespread way - at best, it's "if not me, someone else will do this work anyways, so i might as well be the one collecting the paycheck/stock options." at worst, it's "i think it's a good thing to create tools to surveil/manipulate/kill people."
mourn the loss of the internet we knew and be ready to sacrifice ease of use to return to lower-tech/still-underground options.
You can create an ID card system that reliably verifies some sort of personal attribute (such as age) without revealing other personal information or a validation request being sent to the government which shares what sites you may or may not have been browsing
First, while there's research on the math for things like ZNP, there is a shocking lack of research on security vulnerabilities for the actual implementations of such age verification systems which should make anyone using them extremely nervous.
Second, if a porn website, social media, video game or whatever other thing regulators want to discourage people visiting kicks you off into an age verification takes requires you to some system/site, even an independent one, that requires you upload your ID, a fair number of people will simply refuse simply due to lack of understanding in how it works and trust that it actually is anonymous.
Third, every implementation I've seen doesn't work for some/all non-citizens/tourists.
And finally and more importantly, the ease at bypassing those systems means it's unlikely to stop anyone underage and ultimately is no better than existing parental control software, so all one is doing is restricting speech for adults.
To the surprise of many, Google recently announced it is already integrating ZK-proof-of-age into Google Wallet with those kinds of properties, open sourcing the underlying libraries, and working with governments to encourage their ZKP system's adoption for exactly this sort of problem.
Cynicism wins the day because negative outcomes are easier to plan for than positive outcomes. Humans defaulting to optimistic outcomes of the future often end up littering the ground with externalities that they failed to consider. And we also only have a single model for infinite growth (cancer) that always leads to destruction, so relentless optimism as a biological organism means a need for infinite growth, which we only know to be a path to destruction.
The answer, therefore, is not bitching on the internet about all the wet blankets who only see negative outcomes, but acknowledging that everything we know needs to end eventually including ourselves, and balancing optimism for the short term with cynicism for the long term. And thus discovering that a healthy cynicism for the future predictions is probably appropriate, unless you truly want to live forever and have infinite energy for everything. But that's a god.
Easier to plan for is an interesting lens to look through, can't immediately discard it for sure.
From my perspective, negative expectations do have a higher chance of turning out real, but because negative expectations most often are just code for human misalignment. We have some philosophical, instinctual, or aesthetic (etc.) preferences, but then reality is always going to be broader than that. So you're bound to hit things that are in misalignment. It takes active effort to cultivate the world to be whatever particular way. But this is also why I find simple pleas to cynicism particularly hollow. It comes off as resignation, exactly where the opposite is what would be most required.
That's a fair counter argument, and I do genuinely believe (not know) that everyone needs a balance of cynicism and optimism to function optimally as a human. I also believe the resignation you feel from cynicism is rampant exactly because as humans we've become very good at basic survival and beyond that it's not totally clear what our targets for living should be. Certainly we can all agree that trying to harness ever more energy and growing forever can't be the target. But that's all we've done for two millennia now. How to we avoid becoming a cancer to our planet (or any other environment we find ourselves in)?
Making things secure and private is hard. There's a lot of hoops to jump through.
Naive implementations are easy and cheap. And, if these tools and their entire software tree is not open-source, we cannot verify it's security.
We just have to trust that the developers are good at what they're doing. When every company under the sun has had multiple data breeches, I'm not too keen to do that.
Open-source the entire stack, show me a few white papers proving it's cryptographically sound, then I'll consider it. Until then, we should do with these tools what they deserve: being shoved up the government's ass.
The rich and powerful have always worked very hard to keep their position. They have vastly more resources than the rest of us to throw at the problem. It's not cynicism to predict that every tool will be used to make our lives worse unless it helps them get richer and more powerful.
it absolutely will mean surveillance, unless you were born yesterday. governments will implement what you're describing in a way that is not privacy preserving
this is supposed to be HACKER news, not fucking bootlicker news
Someone steals your id creds and uses them as you is the simplest. The methods will range from stealing ids to breaking into auth servers to mitm attacks or fake ids and rogue auth servers. Everything works so well with video game protection methods now.. no one will be able to crack anything?
The recipes and tools for bypassing these kinds of blocks (and far worse ones as well - compared to what Russia and China are doing, this is child play) are one search away. The only thing necessary is the desire to actually do it.
Yes, and we're losing. Why do you think the internet is covered in ads, 25% Cloudflare, infested with CAPTCHAs and IP blocking, and the problem gets worse every year?
There are real problems that haven't been fixed; the driver's license concept correctly implemented might be better than continuing down this path. I view it as we can make a good standard; or let a bad standard be dictated.
At least in the current system, there are some websites where you don't have to prove your real identity. Hacker News, for example.
In an internet driver's license system, remember that your computer would have to be locked down, and only able to access government-approved websites using government-approved clients - something like they have in China, or like using an iPhone but worse.
Once the ability for any site to verify your identity was set up, all sites would have to verify your identity, or lose their own verification, under one of many standard excuses like protecting the children.
Most ads that I see these days are from Big Tech megacorps. Do you seriously think that having a "driver license for the Internet" would mean that the likes of Google and Meta would stop?
The drivers license id doesn't solve anything but adds a layer of nonsense on top.
That doesn't stop cloudflares marketshare takeover. It doesn't stop CAPTCHA which will filter out bots using these ids. It provides an easy method for hackers to use. It filters out the curious kids.
In the end it solves nothing and creates more problems.
I'm in favour of A) a restricted internet with an encryption scheme based on state controlled hardware devices, like Estonia has, that's accessible by default from browsers, and B) an unrestricted internet that's available to anyone who clicks through a few scary browser warnings, but is generally regarded as weird, dangerous, and not commercially viable except for weird or dangerous stuff.
Realistically, the moment the two are decoupled, B) is going to be banned and blocked outright - and the more they are decoupled, the easier it would be to ban. By and large, the only reason why it's still possible to access "dark" content online is because it's so intermeshed with the more mundane stuff on infrastructure level that the most efficient blocking methods have unacceptably high levels of collateral damage.
I don't see how you'd decouple one from the other, given that it's essentially just giving the user their own encryption certificate. Have the EU pass legislation saying that you can't request that the user sign anything unless they're in the process of making an account.
This is a big deal. We knew since the beginning that replacing the World-Wide Web with a centralized system would make it vulnerable to government censorship, however well intentioned Cloudflare's founders were. This is only the beginning.
Classic mafia racket economics would claim that Cloudflare themselves created the botnet ddos problem so that they themselves could solve it, and now they have the power to do this, especially when governments ask them very sternly to do so.
They existed before, but websites selling DDoS as a service were easier to track down and competitors would DDoS eachother. Cloudflare provided a strong layer of protection for everyone, including these DDoS websites, and took no action to take them down when reported
Though certain mafia economics would suggest exactly that, I personally am not suggesting it. It's just an extremely interesting possibility that could only be proven with evidence.
i thought people in the west used these things called seedboxes? basically computers in low risk countries like romania etc, download the torrent there, then copy the file over or something like that.
I have one of these. However it is connected to a VPN 24/7 in my own home. It can't access the net without the VPN being connected and I've checked for IP leaks.
You <----> residential ISP <----> VPN endpoint <----> CloudFlare CDN <----> actual site
The older blocks were being done by residential ISPs, so using a VPN (even simply with an endpoint inside the U.K.) bypassed them. One could obtain the same effect by having a business ISP instead.
Now CloudFlare is also doing the blocks in its CDN, which means that it does not matter whether the ISP is business or residential, or whether a U.K. endpoint VPN is being used. All three end up talking to CloudFlare's CDN from inside the U.K., and that CDN is now blocking the content.
The tinfoil hat brigade can rest easy. (-: They aren't detecting VPNs. They're just blocking things at a point that is closer to the content origin than all of the U.K. VPNs and ISPs, rather than at a point that that is further away than the U.K. VPNs are.
This is how I block VPNs for game servers: https://zolk3ri.name/cgit/schachtmeister2/about/. It could work for any servers. It is very easy to do so. It gives you a "score" of the IP address (README.md explains it) that connected to your server, and you can decide what to do based on that, for example in my game servers there are certain thresholds. It has been working great.
realistically blocking low cost personal VPNs / proxies is pretty easy. Any new servers they stand up are gonna get picked up by commercial threat intel services with an hour and then just blocked. Especially if the CDNs are working with the government.
You could roll your own but wireguard/openvpn going to random hosting provider is gonna achieve the same thing if they are playing hardball.
They're not playing hardball, it's all on a "will this do" basis, like the US state-level bans. They're certainly not going to start blocking random IPs in hosting providers, that's reserved for email spammers.
While I don't think it's reasonable to blame corporations for complying with legal orders in the end, I don't see any evidence that they tried to fight it. I really wish they did.
Pirate Sites are stupid. And the need for a Site is a stupid limitation of Bittorrent. People should use real distributed protocols like SoulSeek, Kademila or other similar file sharing protocols that do not require a website for discovery.
Cloudflare used to have really open ToS and would host anybody. This included all sorts of far-right sites, and eventually they accepted that they were going to be held responsible for what their customers were doing.
UK is speed-running the Orwellian police state. They're already arresting people for Tweets, and logging "non-crime hate incidents" on your record, available to prospective employers.
They have been speed-running for decades. Remember "anti-social behaviour orders"? Those were introduced in 1998.
I think a better Orwell reference for this isn't 1984 though but rather https://www.orwellfoundation.com/the-orwell-foundation/orwel.... This is the essay that was originally meant as a preface to Animal Farm - and, ironically, was itself censored (by publishers).
>A man has been accused of sending a "grossly offensive" tweet in which he claimed "the only good Brit soldier is a deed one" the day after fundraising hero Captain Sir Tom Moore died.
there are so many approaches already tho. yggdrasil, ipfs, tor, freifunk, meshtastic, i2p (mixing a lot of things here, but there is tech out there). so much cool stuff, we just gotta use it.
They could've defined it as multiple filter lists for different kinds of content like uBlock does, but they chose not to. Therefore, anyone who (understandably and rightfully) want to block CSAM etc are now inadvertently blocking everything else that Protocol Labs disagrees with (e.g. copyright violation).
No, that was Usenet. John actually said "the Net", but he was talking about Usenet. Usenet routing does work that way, although it's vulnerable to spoofing. Internet routing basically doesn't work that way at all and never has.
In response to a legal order, Cloudflare has taken steps to limit access to this website through Cloudflare's pass-through security and CDN services within the United Kingdom. Find more information about the order, the party that requested it, and the authority that issued it here.'
In my opinion, this article does a terrible job of explaining the technical mechanisms by which these blocks have been implemented, and the relationships between the entities involved.
Trying to piece together the details, here's my undewrstanding:
- Until recently, major British residential ISPs were blocking access to torrent/pirate/porn sites for their customers ("BT, Virgin Media, Sky, TalkTalk, EE, and Plusnet account for the majority of the UK’s residential internet market")
- Cloudflare has recently been ordered by courts in the UK to block access to these torrent/pirate/porn sites
- The reason that Cloudflare is involved is because many of these sites use Cloudflare as a content delivery network. A CDN is <waves hands> basically an application-layer distributed cache that sits between end users' web browsers and the origin HTTP servers that they're trying to access.
- Cloudflare geolocates clients connecting to its CDN. It undoubtedly has many reasons to do this, besides just court-ordered geoblocking: these would include routing queries efficiently within its globally distributed datacenters, DDoS prevention, bot blocking, etc.
- Cloudflare's geolocation techniques are, unsurprisingly, more sophisticated than just determining a country based on a client's IP address.
If I've got all that right (do I???)… then the tl;dr is:
It used to be possible for UK users to circumvent the blocks of these sites simply by using any VPN to acquire a non-UK IP address. Now the order to block these sites has been imposed on Cloudflare, which plays a critical role as an intermediary in distributing their content in a scalable way. For a variety of reasons, some of which end-users probably approve of and others not, Cloudflare uses more sophisticated techniques to geolocate clients. So "just use a VPN" is not enough to circumvent the blocks anymore.
How is this a footgun? Big Tech will protect Big Tech, it's only an advantage to have a service that will bend to their will. The centralization is the point.
It sits between millions of users and the websites they desire to visit, and if they're on the right network using the right browser, they won't even know it.
This isn't part of that slippery slope, since that was Cloudflare's voluntary choice, but this is legally required of them. (I do think both kinds are bad, though.)
Cloudflare also blocked a popular Internet celebrity gossip site and actionably -defamed them in the process, and a popular blog, yet still has customers who run animal crushing sites (which is literally illegal content in many countries).
Don't defend them. Their decisions are arbitrary and it's really sad so much of the web has chosen to use their garbage services.
Honestly I really don't care if countries want to ban sites that obviously exist to facilitate breaking the law. Yeah yeah but muh linux isos. If they call themselves PIRATE BAY, EZTV, SPORTSCULT or whatever, and everyone who uses it talks only about pirating movies and stuff with a wink wink "linux ISOs" it's pretty clear why it exists.
Visit others like ext.to and literally the entire front page is stuff like the new Superman movie, etc. You sound like a fool if you try to argue it's mainly for legitimate purposes. (Contrast with freenet and stuff, where if you've ever used it, you'll find most of the stuff there is people's boring ass personal webpages and stuff
Blocking is the wrong terminology here. Cloudflare is not an ISP which fetches whatever you ask for from third parties. It's a company contracted by the web site owners to distribute their websites. It's much more accurate to say that Cloudflare is no longer acting as a host for pirate sites in the UK.
The shocking part of this isn't that they aren't participating in that form of crime in the UK, it's that they're somehow able to participate in it in the rest of the world.
And I say this as someone who thinks that copyright laws are largely unjust, preventing people from engaging with their own culture, but that doesn't make them not the law.
Most of the world doesn't bother playing whack-a-mole with pirate sites because it usually doesn't work. The UK, however, is no stranger to enacting policies that are known to be ineffective.
well, it certainly seems to be effective in this case
Cloudflare offers Tor access for free. So to access these sites in the UK you just need to connect via Tor now. (Or of course you could pay for a VPN, but Tor is free).
https://developers.cloudflare.com/network/onion-routing/
for a whole two weeks probably
> Blocking is the wrong terminology here. This is geo-blocking, by definition.
Personally, it's always sad when a company agrees to censor on their own merit when they don't have legal obligation to.
> > Blocking is the wrong terminology here.
> This is geo-blocking, by definition.
Do you also refer to steam games that only sell in some regions as "geo-blocking"? I don't. Steam doesn't (they call them region restrictions). There's no blocking going on, merely declining to offer something in the first place. Cloudflare is the host here, they aren't blocking anything, they just aren't providing the pirate site in the first place.
> when they don't have legal obligation to.
While I know relatively little about UK law I'm extremely skeptical of the idea that cloudflare does not have a legal obligation to not knowingly host websites committing copyright infringement.
> Do you also refer to steam games that only sell in some regions as "geo-blocking"? I don't. Steam doesn't (they call them region restrictions).
So I am not blocked from buying a game based on my geographic location, I am merely restricted from it based on my region...
Yes? I agree "geo" and "region" are synonymous here, but as I understand the word "blocked" to be "blocked" a transaction has to be in action in the first place - and if one party to the transaction (steam) isn't interested then the transaction wasn't in action.
Similarly you can block a punch, but not if it was never thrown.
sad how your take is one of the only sensible ones in this thread
There are court orders here; it doesn't look voluntary to me.
See https://cybersecurityadvisors.network/2025/04/15/la-liga-blo... : I'm slightly surprised that this hasn't caught up with them too. It used to be important to stay somewhat "below the radar" when pirating, not creating an account at one of the largest internet services. But then anti-piracy enforcement is about money and going after soft targets.
> It's much more accurate to say that Cloudflare is no longer acting as a host for pirate sites in the UK.
I understood from the article that it was for users in the UK, not for hosts in the UK.
The implied parentheses were intended to be "(Cloudflare is no longer acting as a host for pirate sites) in the uk" not "Cloudflare is no longer acting as a host for (pirate sites in the uk)".
Copyright laws don't prevent people from engaging with their own culture. They just insist that users pay what the creator wants. Any person who is willing to pay can engage as much as they want.
It's like saying that laws against shoplifting prevent people from eating food at a supermarket.
Not so, there is no obligation on copyright owners to sell at a reasonable price. If you want to create a derivative work that the copyright holder ideologically disagrees with it is very likely that it is simply impossible to purchase the rights to do so. Nor is there any obligation for the copyright owner to make themselves known and available to negotiate with, there are numerous things that aren't available at any price because no one even knows who has the right to sell them (many old games for instance fall into this category).
Moreover it is simply unacceptable to say that poor people (which in many cases here means less than multi millionaires given the minimum deal size most copyright holders are interested in for derivative works - and less than centi-millionaires if we mean "affordably as a hobby") cannot legally engage with the work of the culture they grew up in.
Oh please. Don't dig yourself deeper. So what if the copyright owners set what you think of as an unreasonable price? In almost every case, those works are not part of the collective culture you celebrate. If the creator doesn't want to share, who cares? That's their perogative-- and there are plenty of other perfectly nice works that are made by people who are desperate to share. So please don't use this looney point as an excuse to steal.
And really, your point about poor people is true about everything. Why shouldn't they get free food for life just because they "grew up" eating? Or a free bicycle because they rode one when they were five?
I'm not digging at all, this is a position I feel very confident in defending. I could do without your condescension though.
I'm not excusing theft. Theft involves depriving someone of something that belongs to them, copyright infringement never does that. I'm also not advocating for copyright infringement, I'm advocating for doing away with the laws that establish copyright in the first place (I'd accept various other positions like "amend the time limit on copyright down to a year" - though I'd argue there's not much point to retaining copyright at all at that point).
The relevant question is "what are the odds a particular work is part of my cultural background", but "what are the odds that a particular work in my cultural background is copyrighted without a license to create derivative works available either freely or under fair reasonable and non-discriminatory terms". Those odds are approximately zero, everything is copyrighted these days, licenses to create derivative works are almost never available for notable cultural works (or really anything other than open source software, and wikipedia).
If you're a kid growing up Pokemon, and not part of the 0.001%, you can't afford a license to legally make up stories involving Pokemon. That's fundamentally unjust. Being able to tell stories about our experiences is fundamentally something that we should be entitled to do.
This isn't the case of a nominal, affordable, cost like food. We absolutely hold that food should be available to everyone at a price they can afford (and yes, if they can't afford it we should still feed them - see various UN resolutions and so on about food being a human right). This is the case of "you can only do this legally by making bespoke negotiated business-to-business style deals for huge sums of money" when it should be a right widely available.
The status quo is just that people break the law and make themselves criminals (intentional copyright infringment is a crime, and that's what you do when you write "fanfiction" without a license), and that's not right.
I don't see any discussion on the claim that cloudflare is acting as a host. Are they?
Usually we only describe the last link in the chain as the host. Everything else is usually not "the host" for a website. DNS providers, TLD registries, Domain registrars, IP address providers, VPNS, reverse proxies, web caching, CDN (which often, but not always, act as caches), DDOS protection, IT management layers, micro services, backups, IP management, (and many more) do not call themselves hosts for websites. The ones that call themselves as host are usually web hosting providers, web shops, "cloud", and vps. Hardware as a services seems like a bit more of a grey zone, similar to rented space in a data center.
The article specify that the pirate shops used cloudflares services of pass-through security and CDN. The more accurate description I would describe that is that cloudflare are selling services to pirate sites, and that this services has been blocked. How shocking that is depend on how much responsibility we as a society want to place on people who provide those kind of services. How much liability should a service provider have, say a security management services, when their customer is known to break local law?
Reminds me a bit of the specific case law in Sweden used in the pirate bay case. The law that the prosecutor used was a law directed toward biker gangs that targeted the bars that those gangs tended to use as a base. The law specified that even if the bar itself operated legally, the fact that the biker gang used it as a base made the owner legally liable if the bar provided services to those members.
> I don't see any discussion on the claim that cloudflare is acting as a host. Are they?
This is definitely how Cloudflare attempts to defend themselves! In essence, my above comment is rejecting Cloudflare's interpretation.
They aren't a preliminary step in the chain like DNS/domain stuff, they are the final step, they are the service the user asks for the actual content of the pirate site, and they return the actual content.
They aren't a tool being used by the user like an ISP or VPN that might have a privacy defence of being deliberately blind to the traffic they are forwarding, they are rather specifically contracted by the pirate site.
There's no expectation on the users behalf that when they query the pirate site hosted by cloudflare that query will go beyond cloudflare (like with a proxy). The user is perfectly happy if cloudflare serves that request entirely by returning data stored on their own servers. So is cloudflare, and as much as the time as feasible that's exactly what cloudflare does.
So I'm rejecting the notion that cloudflare is distinct in any relevant way from a typical webhost here.
--
> The more accurate description I would describe that is that cloudflare are selling services to pirate sites, and that this services has been blocked.
I'd be happy if the title read "court blocks Cloudflare from providing services to pirate sites" (though that's not the editorial slant the article was going for). Your phrasing leaves the blocking party ambiguous, which is sort of missing the point of my complaint.
If you mean "this services has been blocked [by Cloudflare]" like the original title, it runs into the same problem as the original title. You've changed the party Cloudflare is declining to transact with from the end-user to the pirate site. It's still the case that this is merely Cloudflare declining to provide services, not those services being blocked (which would only be possible if Cloudflare chose to provide them) by Cloudflare.
The distinction here matters because this isn't Cloudflare acting as an extension of law enforcement to step in and block a crime from occurring, this is merely Cloudflare itself choosing not to commit the crime. Maybe because a court ordered them not to, or maybe just because they decided not to (which the article seems to be trying to suggest).
If requests to their DNS servers were being denied, would you call that blocking?
Are they themselves denying DNS requests whose purpose was to assist in communicating with them? No. They are just choosing not to communicate with whomever sent the request.
Otherwise, probably yes.
PSA: UK users can visit all their favourite websites in Tor Browser. Just don't run your torrent client using the tor network. Thank you.
You can also access 4chan, Tattle Life, and other nasty gossip websites that the UK nanny state wants to ban.
And you can access the porn on Reddit and Twitter (though in some cases you'll have to make an account). And of course the "tube" sites work fine.
After you've done that, as a UK citizen, please go to https://petition.parliament.uk/petitions/722903 and ask the government to repeal their awful law.
I don't actually use Reddit or Twitter, but I sometimes come across NSFW posts from links. I've found that old.reddit.com seems to allow you to bypass the filter(s) without needing an account. For Twitter, I tend to use the xcancel.com Nitter instance, though there are other Nitter instances that work fine.
Bonus for using Nitter here, you can also see the latest posts from an account instead of the most popular posts, and see replies/interactions to individual tweets. Oh, and it gives you plain HTML.
Reddit pisses me off so much that despite the fact that I don't even use Reddit, just so that my experience sucks less when I'm linked to Reddit or have another reason to lurk it,
- I use the "Old Reddit Redirect" extension to force the browser to go to old reddit
- I use the "Load Reddit Images Directly" extension to bypass Reddit's hideous image viewer that tries to load if your browser makes the mistake of having text/html in the "Accept" headers when opening an image in a new tab. (Dear Firefox/Chrome/etc: maybe stop doing that? If I open an image in a new tab, there is a zero percent chance I want HTML.)
Reddit is also very aggressive at blocking VPNs. Mullvad is constantly blocked. Occasionally I'll turn it off, but Reddit is just a terrible place so I usually go elsewhere (I'm only going because of Google search results. I'd rather use an LLM than turn off my vpn for Reddit)
Interesting, are you using any particular exit country for Mullvad? I’ve used Canada and never ran into Reddit blocking it.
Mostly US and Sweden. I'll give Canada a go. Thanks for the suggestion
The bypass via old.reddit.com stopped working today as well.
I just googled 'top nsfw Reddit' and aside from some disturbing implications of 'top' all opened fine with 'old.'. The IP is UK based, is coming up as UK on all geoip sites I tried and is in all of the last 30days of maxmind as UK based.
It might be some kind of phased rollout of course.
Oops, I should note that I'm a U.S. citizen in a state without any porn age gate laws. I have no idea what the status of using old.reddit.com to bypass the NSFW filter is in other jurisdictions, or honestly even my own (not sure how to test it.) All I know for sure is that it worked last time I tried it.
Is the reddit equivalent of xcancel/nitter (i.e., redlib https://github.com/redlib-org/redlib) also blocked? Presumably if the instance is hosted outside the UK it would work since I think it effectively proxies your requests.
> - I use the "Old Reddit Redirect" extension to force the browser to go to old reddit
if you make a Reddit account, you can flip an obscure setting so that www.reddit.com serves the same site as old.reddit.com
I used to have one, but I don't anymore and personally I think if they ever force everyone onto new reddit I will probably just not follow reddit.com links anymore (or use a proxy that is less annoying, if those prove reliable enough.)
> Just don't run your torrent client using the tor network. I have never used tor so novice question: why not?
> please go to https://petition.parliament.uk/petitions/722903 Signed!
The tor network essentially relies on donated exit node bandwidth, and there's a finite capacity at any point in time. Torrenting is a bandwidth hog (and a lot of exit nodes will filter it out anyway)
> donated exit node bandwidth
Hey, we pay $100B/yr of tax money into the NSA/CIA/etc budgets every year so they can run exit nodes among other activities, I wouldn't exactly call it donated
Is it really just a matter of my bandwidth being hogged up, or more a risk of getting my IP address (range) banned, if not worse legal risks from activities being traced to me?
You can use the I2P network for torrenting if that's what you want, as that kind of traffic is not frowned upon.
Probably going to be slower than over the Tor network without any manual tweaking.
Yes, an exit node operator will appear as the source of the traffic, which can have legal repercussions. (Personal risk.)
But on a macro scale, the entire Tor network has fairly limited bandwidth and torrenting is a very easy way to saturate it. (Existential risk to the network / tragedy of the commons)
You can't get banned because no one knows who you are. You can bring down the entire Tor network. Probably not you by yourself, but if enough people do it they can.
I believe OP was responding from the perspective of an exit node operator.
Exit nodes have to deal with much more severe things than copyright infringement. They regularly get raided by law enforcement for accusations of child porn and hacking, and have to defend themselves by pointing out they didn't originate the traffic. There's a whole bunch of tips out there about how to not go to jail for running an exit node (which is legal).
That's why some "tor-torrent" protocol should be invented, where data is sent via torrent network. There's still some bandwidth amplification, but as long as someone is seeding from within tor, the whole transfer could be done there.
...would also help with privacy and nasty telco letters.
https://en.wikipedia.org/wiki/ActivityPub
Thanks!
Some clients by default leak your IP when using Tor, the last I checked. When announcing to other peers, the IP of the host machine is provided.
So, you anonymously make the requests through an exit node, but the request contains your IP, which defeats the entire purpose of Tor.
Interesting, thanks
> I have never used tor so novice question: why not?
bandwidth is a scarce resource on tor.
No it isn't. https://metrics.torproject.org/bandwidth.html
Thats relay bandwidth, I assume exit node bandwidth is some fraction of that
The very next tab: https://metrics.torproject.org/bandwidth-flags.html
> PSA: UK users can visit all their favourite websites in Tor Browser.
And get to solve a dozen whack-a-mole intentionally-slow-loading reCAPTCHAs just to see the page, or worse, end up in a Cloudflare redirect loop.
I get enough of that between Brave Browser and using Linux as my desktop OS.
They don't show up significantly more often for me than in Brave browser.
Though at that point might as well use Tor in Brave, because the additional ad&trackers blockers improves drastically the load times.
Now, if only Brave would go the extra mile of having the Tor browser window better mimick the Tor Browser.
I've got PiHole and a couple extensions installed that block more than Brave itself does. Not really into Tor, but I did try it a couple times.
I use tor semi-regularly to get around stupid UK geo-fencing of content and honestly it hasn't been like that in a while.
Tor is great but the bandwidth/latency kinda sucks for casual browsing activity. A VPN is a more realistic workaround to this kind of geofencing.
I almost said "solution" instead of workaround, but of course the only actual solution is to fix the legislation.
> Tor is great but the bandwidth/latency kinda sucks for casual browsing activity
It is reasonably decent these days. Generally there are periods where Tor network is slow.
> A VPN is a more realistic workaround to this kind of geofencing
Generally I tend to use a combination of Tor / VPN depending on what I am doing. Some gossip sites have onion urls and I will use Tor if visiting those. Other sites that are geo-fenced (sites like Odysee) are easier to get to via VPN.
> I almost said "solution" instead of workaround, but of course the only actual solution is to fix the legislation.
That isn't going to get fixed anytime soon. In fact I expect it to get worse over time.
It's actually pretty ok for casual browsing these days. Have you tried it recently?
You'll need more than just an account to access "certain mature content" on sites like Reddit - you'll soon need to upload some photographic ID.
https://www.bbc.co.uk/news/articles/cj4ep1znk4zo
I wrote a similar comment but then realised that if you're using tor per GP's recommendation, you'd be fine as long as your exit node isn't in the UK, or other regressive jurisdiction.
It is trivial to create a digital picture of a false ID.
Which is why you will need to provide a cryptographically secure identity credential issued by the government, and you will need to re-verify at regular intervals, not just upload a JPEG.
Make no mistake, the plan is to require 'KYC' for Google, reddit, Facebook, X soon and all that and then later require it for all web sites, even this one.
Australia recently passed a law requiring Google to KYC Australian account holders to check ages to decide if the user will be allowed to control the "safe search" setting.
Why don't users just share passwords? Assuming no credit cards attached to the account, serms no reason not to.
Have you tried that with Google accounts now? They'll logout all your sessions and force extra authentication to get back in.
There will always be something you could maybe do as a workaround, but they are going to make it extremely hard.
Well. Certainly for people in the room here. One imagines regulators know that too, and will draw the line accordingly… that they may grudgingly tolerate validation systems that allow some degree of individual fraud, but stomp on the first of us here to vibe-code our way to a fraud-as-a-service site that gets any traction.
I’m reminded of all-around-good-guy @patio11’s evergreen The Optimal Amount Of Fraud Is Non-Zero…
https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...
> After you've done that, as a UK citizen, please go to https://petition.parliament.uk/petitions/722903 and ask the government to repeal their awful law.
There is literally no point in signing those petitions. The only disagreement between the major political parties in the UK is how draconian it should be.
If it hits 100k then it needs to be debated in parliament. However the bill was already debated in parliament and got through and the petition doesn’t bring anything new to the table.
There would be more of an impact if, perhaps, everyone in the UK who has had to shut a web site because of this law wrote to their MP.
> If it hits 100k then it needs to be debated in parliament.
I don't think so. It says on the site "At 100,000 signatures, this petition will be considered for debate in Parliament".
I've seen people get excited about petitions before that got to 100,000 signatures and it all fizzled out, or it wasn't debated seriously in parliament. Often you will get a cookie cutter response with these petitions that is a paragraph long.
The reality is that most of the public are indifferent or supportive of the current legislation and most MPs know that.
> There would be more of an impact if, perhaps, everyone in the UK who has had to shut a web site because of this law wrote to their MP.
Each MP would get maybe a max of 10s of emails/letters each. Many of those MPs wouldn't even bother answering you. Those that do will often will probably give you the brush off.
I've written to my MP before (about encryption legislation), spent a lot of time presenting a clear and cogent argument and I got a "well I might have a chat with the home secretary" and they were still singing the same tune years later. What I was telling them was largely the same as other industry experts. They don't care and that is the unfortunate reality.
The fact is that the direction the UK government (doesn't matter whether it was Red Team or Blue Team) has been going in has been clear for well over a decade at this point. It would take a major political shake up for this to change IMHO.
True, but MPs receiving a few mails that say “this law has affected me in this way” is IMO far more likely to be effective than a petition with 100k signatures that says “I don’t like this law which you recently approved”.
MPs have been known to respond to letters. I have had responses to various issues. It obviously depends on the MP. Many MPs were very much opposed to this issue.
> True, but MPs receiving a few mails that say “this law has affected me in this way” is IMO far more likely to be effective than a petition with 100k signatures that says “I don’t like this law which you recently approved”.
I think they are both ineffective. So I don't believe that is true.
> MPs have been known to respond to letters. I have had responses to various issues.
Getting a response is one thing. Having something done is another.
> It obviously depends on the MP. Many MPs were very much opposed to this issue.
The legislation was going to happen at some point or another. The direction of travel was quite clear. There are always going to be some dissenters, but the awful legislation got passed anyway. So what did their dissent achieve? Nothing.
I came to the realisation a number of years ago that for the majority of people, the only care about being able to use their Netflix, shopping on amazon, check their email and post photos on Facebook. Concerns outside of that are simply too abstract/distant to care about.
> I think they are both ineffective. So I don't believe that is true.
Well, I know doing nothing is ineffective. Might as well do something.
On this particular issue, that something can't be political. Assuming anything can be done at all.
There is no support from the public and I don't be believe there ever will be, and there is no/very little support from any of the political parties.
Even in places where you would think they would be against such legislation, the disagreement is often how it is worded.
I would rather this not be the case. But I have to accept reality and exist within the confines of it.
> I think they are both ineffective. So I don't believe that is true.
I disagree that writing to MPs is always ineffective. Some campaigns have been successful. Whether it will be effective in this case is another matter. Maybe when people start to experience the block it will gain traction.
Of course if you don’t even make low-effort attempts to make your voice heard and exercise your democratic rights, you can be certain that you’ll lose them.
> I disagree that writing to MPs is always ineffective. Some campaigns have been successful. Whether it will be effective in this case is another matter.
It won't be effective in this case. It been going in the same direction of travel and none of the parties (including outsider parties such as the Greens, Reform etc) proclaim to believe in in reversing this direction of travel. They are much more interested in other issues that are much more hot button. Those issues are easy for the public to understand because they are likely to have encountered them often.
> Maybe when people start to experience the block it will gain traction.
No it won't. People will either find a way to circumvent via VPN/Tor or some other mechanism (which is what they already do) or they will simply shrug their shoulders and won't bother.
There has already been a large number of forums/sites that have been shutdown or site been blocked in the UK and there hasn't been any significant traction on this issue.
> Of course if you don’t even make low-effort attempts to make your voice heard and exercise your democratic rights, you can be certain that you’ll lose them.
I don't really know how to respond to something like this because I believe it is naive on a number of levels. I consider myself a realist. I believe "making your voice heard and exercising your democratic rights" is about as effective as talking to a brick wall (at least on a national level).
I have personally made attempts. I wrote to my MP often. I cited links, news articles etc to back up my argument. It was an utter waste of time. At best you may get a short response. I realised I was ultimately wasting my time, I stopped and will never do it again. I actually feel stupid for believing that I could make any difference at all. I suspect this is the experience for other people and is often not spoken about.
Moreover much more notable people have tried to make themselves heard around a number of related concerns about freedom of speech, threats to privacy, iffy counter-terrorism laws etc. More often than not has always been either ignored entirely, responses that completely ignored the crux of the issue, or straight up lies from successive governments for almost two decades now.
Realistically our options will be to learn to live with the poor legislation, circumvent it, or leave the country.
How nihilistic and dismissive.
Do you wait for the end of football matches before deciding which team to support, because only the one that won matters?
I advocate against laws I don't like, and try to give people practical advise about how to protest against them, as well as how to circumvent them, and minimize their effects, and encourage them to pass this knowledge on. I consider it a good use of my time, even if not everyone cares to retain that info or pass it on.
Politics is never a foregone conclusion (unless you completely give up and go silent, in which case your opposition has carte blanche to do what it likes)... but like "viral content", it's not something you can always whip in your your favour. People are irrational creatures, and you never quite know what will make them all sit up and take notice. You can never be sure what will set the nation's agenda, and what stories "have legs", until they happen. For example: the Post Office scandal was a dull boring thing that nobody cared about, and then... an ITV drama made people care? But there have been ITV dramas about political scandals before, and they didn't all have that effect. But that one did. And the writers of the drama didn't just make stuff up, they followed the details of campaigners and journalists who had been covering this for years, even if at times they felt they were shouting into the void.
You just keep trying and see what sticks and what doesn't. The standard UKGov petitions site has at least some quantum of usefulness in that it encourages people to think about the issue, and if they sign it, they know there are others that agree with them. Change is possible.
> How nihilistic and dismissive.
I believe it to be a statement of reality. I am simply spelling out how it is. It is not an endorsement.
Moralising about my assessment does not make it untrue.
> Do you wait for the end of football matches before deciding which team to support, because only the one that won matters?
I also read spoilers for movies before I watch them in the cinema. I am truly awful ;-)
> I advocate against laws I don't like, and try to give people practical advise about how to protest against them, as well as how to circumvent them, and minimize their effects, and encourage them to pass this knowledge on. I consider it a good use of my time, even if not everyone cares to retain that info or pass it on.
I would only bother talking about how to circumvent them. The other activities are a waste of time. It took me quite a while to come to this conclusions (about 20 years) but that is the conclusion I came to. Those who are interested in circumventing it will come and find you typically, those who aren't won't bother.
> Politics is never a foregone conclusion (unless you completely give up and go silent, in which case your opposition has carte blanche to do what it likes)... but like "viral content", it's not something you can always whip in your your favour. People are irrational creatures, and you never quite know what will make them all sit up and take notice. You can never be sure what will set the nation's agenda, and what stories "have legs", until they happen.
I don't believe it is a forgone conclusion. I believe that one has to obtain power to enact change.
I don't believe that anything is "bottom up" i.e. there is a ground swell of public opinion and this peculates up to those in power. I think it is "top down".
> People are irrational creatures, and you never quite know what will make them all sit up and take notice. You can never be sure what will set the nation's agenda, and what stories "have legs", until they happen.
It is actually well understood what makes them sit up and notice. It has been extensively documented.
> For example: the Post Office scandal was a dull boring thing that nobody cared about, and then... an ITV drama made people care? But there have been ITV dramas about political scandals before, and they didn't all have that effect. But that one did. And the writers of the drama didn't just make stuff up, they followed the details of campaigners and journalists who had been covering this for years, even if at times they felt they were shouting into the void.
This only proves my point. Until a major broadcaster in the United Kingdom e.g. run by people with power, money and connections, popularised something only then did people take notice.
> The standard UKGov petitions site has at least some quantum of usefulness in that it encourages people to think about the issue, and if they sign it, they know there are others that agree with them.
I don't think it does. The people that sign these petitions have often already decided that the law needs to be repealed. Ask someone working down the local shop if they even know if this petition exists? Probably not.
> Change is possible.
Not by us. This is a lie told to you to keep believing. It was a bitter pill to swallow that ultimately your voice will go unheard. However it is ultimately liberating as you can direct your energy elsewhere.
> I don't really know how to respond to something like this because I believe it is naive on a number of levels. I consider myself a realist. I believe "making your voice heard and exercising your democratic rights" is about as effective as talking to a brick wall (at least on a national level)
This is partly a perception issue. You need to adjust your expectations.
Individually you are unlikely to make a difference. You write a letter and are knocked back, you see no immediate impact and all your human senses are telling you “this didn’t work”. That is how the human mind works. It’s very demoralising (arguably by design).
You feel like you are the only one acting, because you do not see anyone else acting, and therefore you feel alone on this issue, and knowing you do not have the individual pressure to move the needle, you feel it is shouting into the void.
This is a human feeling but it is not necessarily reality. You don’t know who else has acted on this, who has written letters, what the various MP Signal chats are saying. You have no way to gauge support.
Therefore you should make the efforts even if there is no positive feedback, because there are unseen forces.
You might also need less political pressure than you think. MPs are human. Put yourself in the shoes of a MP receiving letters from the public. If one person sends a letter on this issue, it’s lost in the noise, one of many crazies talking about irrelevant topics, dismissed. If only 10 people send letters on the same topic, that starts to put the issue on your radar, no? 10 letters, then you hear about a 100k petition on the same topic that’s going to get noticed, do some research, maybe even discuss it between MPs. You’ve given a reason for them to make a self-important speech in parliament.
Continual pressure on all fronts. Keep pushing, help efforts that gain more support and build more pressure. It’s all you can do but also the least you can do.
This reply you have given me is why I don't like having these conversations. You fundamentally still believe that the democratic process can work. I don't even believe it really exists. I believe what you see happening publicly is nothing more than political theatre.
> Put yourself in the shoes of a MP receiving letters from the public. If one person sends a letter on this issue, it’s lost in the noise, one of many crazies talking about irrelevant topics, dismissed. If only 10 people send letters on the same topic, that starts to put the issue on your radar, no? 10 letters, then you hear about a 100k petition on the same topic that’s going to get noticed, do some research, maybe even discuss it between MPs. You’ve given a reason for them to make a self-important speech in parliament.
Lets pretend this did happen.
What happens next is when some tragedy occurs (there are plenty that happen unfortunately) e.g. a teenage girl committing suicide because she was bullied on Instagram.
Then every major news website, news paper and news broadcast runs with "Dangerous Internet Trolls caused the suicide of lovely teenage girl".
Then there is a series of "discussions" about the issues on Question Time or LBC. The solutions presented will be various draconian measures which means more censorship, monitoring and surveillance. They will have a token person (that is often unlike-able) arguing against more draconian measures for "balance" which will be derided by the rest of the panel (and often the audience). After that you are back to square one, because it is now politically toxic.
This is known as "manufacturing consent".
I've seen this play out literally hundreds of times now.
> Then every major news website, news paper and news broadcast runs with "Dangerous Internet Trolls caused the suicide of lovely teenage girl".
Sure, that can happen.
What if tomorrow's headline is "porn habits of everyone in Britain revealed", or "6 in 10 people's bank accounts stolen after ID leak". Would there be room for change then?
We can then have the trustworthy, familiar face of Martin Lewis on the news telling people how to protect their identity, and he can highlight how this terrible problem was caused by mandatory rules set by Ofcom, and they can have some squirmy little git from Ofcom promising to "look into the problem", and by day 4 of the ongoing national identity theft disaster, the government will yield.
We can be cynical, but can hope too.
> Sure, that can happen.
It has happened! Quite a number of times in fact. That why I used that particular example.
> What if tomorrow's headline is "porn habits of everyone in Britain revealed", or "6 in 10 people's bank accounts stolen after ID leak". Would there be room for change then?
No. It will be spun in a way where they can justify more draconian measures or something else will be into the news cycle and it will be forgotten about after a few weeks.
> We can then have the trustworthy, familiar face of Martin Lewis on the news telling people how to protect their identity, and he can highlight how this terrible problem was caused by mandatory rules set by Ofcom, and they can have some squirmy little git from Ofcom promising to "look into the problem", and by day 4 of the ongoing national identity theft disaster, the government will yield.
I think it would be the ICO not Ofcom. Nevertheless, they will have some politician or spokes person blaming it on not enough funds and/or powers going to the appropriate regulator.
> We can be cynical, but can hope too.
It isn't cynicism. I am literally describing what happens more often than not.
Ssshhh
They may work out that UK has a 2 party system where each one just takes turns and none of it makes much difference.
I don't think many of the so called alternatives are going to be any better. Wait til they figure that one out!
Tor is great but wouldn't an easier and higher bandwidth (for the yarr harr) solution to just buy any VPN service that exits outside of the UK?
Yes
VPNs are yet another Cloudflare and are next in line to implement censorship.
They very well could be, but I doubt they remain in business for very long were they compelled to block the raison d'etre people use them.
The choice will be between going out of business and going to jail. They'll choose to go out of business. I've noticed that HN users often think businesses have some obligation to be infinitely sustainable - they do not. They just need to be sustainable long enough to recoup their setup costs.
Cloudflare doesn't go out of business, neither will vpns.
Cloudflare doesn't do things that send them to jail, like ignoring court orders. They'll log whatever the court tells them to log.
Cloudflare does plenty of sketchy stuff, like deliberately hosting DDoS-for-hire sites because it increases the demand for anti-DDoS products. But they will take them down if they are ordered to - and reveal their origin IP. They are not going to jail for you.
Funny in a US state I'm finding more and more places are popping up with an age verification. Doesn't really bother me so much content out there but yeah.
It's weird too how I don't want to prove my age, guess it's the taboo aspect of it vs. say showing your id at a bar.
Bars usually don't write down your data or associate every movement you make while there with your id, so it's definitely more risky than the traditional meatspace verification process.
Part of the issue is that for my entire life, age was either not enforced or a promise. It feels wrong having gates up where they previously didn't exist.
I get it; I wandered into gay porn sites and irc chats when I was in the 4th grade back in the 90s, and my friends and I loved chatting up those interested in our pre-teenage selves at the time. But I still will never provide a legit id for any age restricted services. Though I do have fakes for non us based companies to deal with financial kyc but haven't used them in some time (years), so no idea if they would work in the days of oligarchic identity management saas.
It might be necessary to ensure that your exit node is not in the UK or another locality that is otherwise blocked.
That procedure depends upon your platform and client.
http://www.b3rn3d.com/blog/2014/03/05/tor-country-codes/
Edit: Use this link instead (thanks mzajc!):
https://web.archive.org/web/20180429212133/http://www.b3rn3d...
I get a "badware" risk on that link from uBlock Origin (Firefox).
"uBlock filters – Badware risks"
The domain has been squatted and displays typical spam advertisements. The last good archive is on https://web.archive.org/web/20180429212133/http://www.b3rn3d...
I hope many UK citizens are going to sign it.
Even if it does, nothing will change. They've been trying to push through this legislation for 10 years. They don't care what the citizens want - their need to spy takes priority.
> They don't care what the citizens want
Polling has shown that the Online Safety Act had 70+ % of the population supporting it.
Something like 60% don't think it goes far enough.
I know, what it might do is make people realize that they are not in control, which is what I would like people to know, as a bare minimum.
On tor, reddit blocks you from logging in with 90-95% of the exit nodes
Reddit runs an onion service. Can you not use that?
Logins almost always give some 4xx error from both their onion address and regular address on Tor
You can browse though
You are very unlucky
I have no idea what Tattle Life is but two clicks in, first to “Offtopic” and then “The Lucy Letby case”, and Apple Pay pops up.
Not a fake one, but the real deal trying to charge me £0.00.
I don’t have the patience to investigate that further but I am all behind banning scummy sites like that.
Tor is a bit slow for streaming video.
Not really been much advance notice of that to account holders. I wonder how the normally sane and well balanced people left using Twitter will react to that. Or even how they determine "UK account" anyway, given all the usual geographical qualifiers.
Crazy stuff
[flagged]
Stop disseminating misinformation by a YouTuber who has no business making judgement calls on a topic they obviously don't understand.
Strange that they would allow such petitions in North Korea.. ehh I mean in the uk.
I came to the realisation recently that the free Internet only happened (in the West) because:
- The Silent Generation, in charge at the time, had no idea what was this Internet thing about.
- The US Intelligence community understood it was a powerful tool to operate abroad.
- Nobody dared derailing the only engine of growth and progress in many economies
It obviously got out of control and is very abnormal in fact if you consider how power really works.
As of today, as a user of a reputable VPN, I am blocked from a lot essential websites or have to prove I am an human every 5 minutes, it sucks.
Anyway we are one major cyber disaster away for our the state to switch from a blacklist to whitelist paradigm. A safer and better Internet for everyone.
We will probably still have ways to access the "Free" Internet. It is gonna be fun, slower and might get you in serious troubles.
The thing is, the Internet was supposed to be P2P initially (in Spanish it had the motto "La red de redes" (the network of networks, meaning that it was supposed to connect several LANs together).
But as soon as you had ISPs started, centralization came. Now, most countries will have at most 5 major ISPs, and in reality geographical availability within countries make 1 or 2 available.
Then, originally people had their own websites (I was there!) in their own servers. But Geocities started the centralization trend. And then CDNs, and then MySpace/Facebook and all that.
The only way we are going to get the "freedom" network as it was before is through mesh-networks or similar technologies. Which maybe so far are very slow and cumbersome, but they will have to evolve. I know it is not very fashionable here in HN, but the only see that capable of happening is implementing some kind of "incentive mechanism" that incenvitives people to let data pass through their node in the mesh network; aaaand cryptocurrencies offer an possible solution for that.
> The thing is, the Internet was supposed to be P2P initially (in Spanish it had the motto "La red de redes" (the network of networks, meaning that it was supposed to connect several LANs together).T
The Internet is just a commercialised ARPANet. ARPANet was designed to survive bombs taking out a fair percentage of it's nodes. The Internet still has that robust resistance to damage. You can see it in action when anchors cut ocean cables - barely anyone notices. And as the old saying goes, the internet treats censorship as damage and routes around it.
However, the commercial enterprises built on top of the internet love centralisation. CloudFlare is an interesting case in point. They have been champions of an uncensored internet for as long as I can remember, which is one of the reasons they grew to their current size. That growth was always going to compromise that core principle, because once a significant amount of traffic passed through them they would become an attractive target for groups wanting to inflict their views of what's proper viewing for the rest of the world.
But while CloudFlare can't exist without the internet, the internet will continue on without CloudFlare. So while the self appointed gatekeepers have indeed blocked the large hole in the sponge that is CloudFlare, underneath the sponge is still a sponge. Information people find interesting will just take other routes.
Or to put it another way, if they think they have stopped or even appreciably slowed down teenage boys from accessing porn, they are kidding themselves.
> most countries will have at most 5 major ISPs
I find this hard to believe. In New Zealand, the tiny country I live in, I can name off the top of my head at least 10 ISPs. You're telling me most countries, which on average are far bigger than mine, have fewer? I don't believe it. Another made-up statistic.
Something I have always been wondering is: how much was WiMAX a threat to this centralisation and the 3 - 5 ISP per country model?
I remember around 2010 there were cities with several small new ISPs providing fast home and mobile Internet for cheap and with very good coverage. Infrastructure costs were probably very low. Order of magnitude I guess compared to 4G, cable or fiber.
You could find phones supporting it (HTC was one of the maker) and it seemed to be the perfect solution for most users. I am not sure if those small ISPs already had a roaming system in place but it would have made a lot of sense.
Anyway, when Intel finally gave up I thought there are probably strong forces wanting to keep access to the Internet in a few hands, expensive and centralised.
WiMAX was just Intel alternative to LTE. It might have been threat to Qualcomm, and cellular telecom in-groups, but not a threat to centralization trend at all. Range was shorter than existing cellular, so it needed more towers, not less.
how much was WiMAX a threat to this centralisation and the 3 - 5 ISP per country model?
Not at all. Today there are hundreds of WISPs based on Wi-Fi(ish) or proprietary FWA technology in the US alone.
The centralized search engine's AI summary says that LTE became more popular, and the people who would buy WiMax hardware ended up buying LTE hardware instead.
From what I remember (and I might be wrong) WiMAX was first competing on the "home" Internet market. Mostly against cable & DSL I guess at the time. It was a USB dongle you would put in your laptop.
Having a one WiMAX enabled smartphones was the cherry on top and probably more of a long term goal. The only one I remember was the HTC Evo 4G [0] (the first 4G enabled smartphone released in the US, and by 4G they meant WiMAX, not LTE).
My guess is there was for sure a big battle between Intel, major phone manufacturers, telcos, infra providers and various patents holders.
There was probably a chicken and egg dilemma for mobile phone manufacturer since they had to wait for the network to grow before risking launching their WiMAX phone but having a WiMAX enabled phone would make WiMAX at home really attractive.
My guess is also that since people usually get their phone from their telco, phone manufacturer had to be careful not to go against their interests. And since most telco wanted LTE, WiMAX couldn't take off.
But there might be more to this story, including the fact Intel was also trying to get in the phone SOC market at this time.
- [0] https://en.wikipedia.org/wiki/HTC_Evo_4G
> As of today, as a user of a reputable VPN, I am blocked from a lot essential websites or have to prove I am an human every 5 minutes, it sucks.
I have to do that using corporate and residential US networks, simply because I use Firefox.
As great as Cloudflares services might be to each individual user, the centralization of infrastructure, and by extension the centralization of power, doesn’t seem to be worth it at a macro level. The tragedy of the commons strikes again.
Try disabling third party cookies, and on some sites, you'll be clicking cloudflare captchas every time you open them :)
Ah, I guess that's why I get tons of them, thank you!
Can't they at least set a first-party cookie to avoid repeated captchas per site, given that they're terminating HTTP?
You're forgetting that that the Internet was intertwined with the phone system at a time when the latter was the only reliable form of communication at both local and long-distance levels. Interference with the Internet would be interference with the international telephone system.
I don't see how the fact that dial-up was the norm for the internet "last mile" changes anything wrt the ability to block it. It would be done in exact same way it is done today - by forcing ISPs to do the blocking on internet protocol level.
Thats a good idea, we could moderate the phone system.
Every computer is a general purpose computer. What would you do to force me to participate exclusively in your nanny-net? I suspect any answer to that question requires an incredible amount of coordination and participation.
The real problem with the internet, as I see it, is centralization. This is a product of monopoly, which is the core feature of copyright. A truly better internet would replace the authoritative structure of copyright with a truly decentralized model.
As far as I can tell, the only hard problem left in decentralized networking is moderation. No one wants to browse an unmoderated internet. The problem is that moderation is structured as an authoritative hierarchy, so it's not compatible with true decentralization.
I propose we replace moderation with curation. Every user can intentionally choose the subset of internet they want to interact with, defined by attestations from other users, all backed with a web of trust. This way everyone is the highest authority, and users can help each other avoid content they are disinterested in.
Yeah, a lot of stuff only worked because it was a "subculture". That could no longer be sustained once the first Twitter President arrived.
The decline of internet began way before trump, I'd say with the rise of facebook and everything moving on there (your local restaurant used to have a website, then switched to facebook only).
Centralized power, centralized censorship.
At approximately the same time, social networks became less social and more propaganda feeds.... so it went from a feed of content made by your friends for other friends (from complaints in status messages to photos of their plates) and moved to whatever crap they try to serve you now,...
The internet was a very good tool in subverting dictatorships and influencing elections. Now that adversaries of the West have mastered it and the shoe is on the other foot ,internet bad
Previously, a convenient and low-latency way to bypass UK internet censorship was to proxy via a local datacentre - it's only the residential ISPs that are under pressure to censor traffic, commercial ones less so.
But if the blocking is happening somewhere other than the ISP, this is less effective. A hypothetical TPB user might want to proxy via Luxembourg now (seems like the shortest hop to somewhere with sane legislation)
You didn’t even need to do that. Just needed an /etc/hosts entry for the domain.
My ISP (Virgin Media) does DNS filtering and IP-based blocking and TLS SNI inspection. So you have to use ESNI or domain fronting, which last time I checked my browser could not be easily configured to do.
At this point, what's the difference between the UK and China other than the specific content they block? Some ISPs have even started blocking wireguard here & I've had to resort back to xray/v2ray
Very little difference. But blocking wireguard is huge change, which ISPs are doing that?
I currently live in student accommodation so not sure what they're using upstream. The university network also drops wireguard connections but only to known providers like Mullvad (assuming obfuscation is off)
You may have some success with DPI bypass tools we've been using in Russia for years now, like GoodbyeDPI and Zapret.
Is that common for all ISPs or just Virgin? When I lived in the UK (already a number of years ago) it was all just DNS-based. Running my own DNS resolver unblocked everything. I don't recall which ISP.
I think it's just Virgin doing the SNI stuff, but I wouldn't be surprised if others are doing IP filtering. I'm not sure if anyone's done a good survey of what the different ISPs are doing (it'd be an interesting project).
TalkTalk, Sky, BT & pretty much all domestic mainstream ISPs do DPI down to SNI.
They also exercise an IWF proxy so your already MiTM'd.
https://www.iwf.org.uk/
I think "block" is a misnomer here.
Cloudflare has said pirate sites as clients - they are not (and cannot) block any pirate sites that are not their clients. The remedy is for those sites to no longer be patrons of Cloudflare.
If an analogy helps anyone understand better - imagine you have a lemonade stand. You use your neighbor's yard to set up the stand for some reason (maybe since its closer to a main road, the why doesn't really matter). The city tells your neighbor that they will be fined if they continue to have a lemonade stand in their yard, so your neighbor parks their truck in front of the stand, hiding it from the street.
In that analogy, cloudflare is the neighbor and your lemonade stand is the pirate site. You aren't prevented from selling your lemonade, but you can no longer freely use your neighbor's yard unless you want to direct people around the truck ahead of time.
Shouldn't surprise absolutely nobody, once you become the gatekeeper of the Internet, you're going to gatekeep.
Now it's torrent sites and next it's going to be other things the party in charge doesn't like.
Right, it's only natural; they MitM 20% of the internet.
Similarly, I struggle to believe they're not providing much of the data they collect to the CIA.
CIA front like snapchat with all on camera access. Nothing surprising
About a decade ago, there were proposals for a "driver's license for the internet."
Nowadays... I actually think it might be a lesser evil. Picture such an ID, if there were a standard for it, enrolled into your computer.
If it were properly built, your computer could provide proof of age, identity, or other verified attributes on approval. The ID could also have micro-transaction support, for allowing convenient pay-as-you-go 10 cents per article instead of paywalls, advertising, and subscriptions everywhere. Websites could just block all non-human traffic; awfully convenient in this era of growing spam, malware, AI slop, revenge porn, etc. Website operators, such as those of small forums, would have far less moderation and abuse prevention overhead.
Theoretically, it would also massively improve cybersecurity, if websites didn't actually need your credit card number and unique identity anymore. Theoretically, if it was tied to your ID, it's like Privacy.com but for every website; much lower transaction friction but much higher security.
I think that's the future at this rate. The only question is who decides how it is implemented.
This is so naive. Big tech would be the first to get various exceptions to train their greedy AIs. They would lobby so hard to lock down personal computers, just to make sure you are not tampering with your digital passport. Google would finally have their wet dream of locked down PCs that have no adblock.
Politicians would be salivating at the idea of getting the real identities of dissenters, and religious fucks would finally have their way of banning porn and contraceptives.
You're assuming this isn't already in the works; I simply see it as we can make the standard now, or let the standard be dictated.
We're already seeing it piecemeal, with Cloudflare supporting skipping CAPTCHAs on verified iOS and macOS devices; mobile driver's license enrollment options on iOS; age verification rollouts for websites with no-doubt people thinking how to streamline things; etc.
I personally think we are one big cyberattack from the whole concept returning fast. One big cyberattack from governments (and people in general) saying they've had enough of the free-for-all status quo. This isn't a good place to be.
> You're assuming this isn't already in the works; I simply see it as we can make the standard now, or let the standard be dictated.
The difference is we've grandfathered in a lot of older technology - x86, old desktop operating systems like Windows and Linux, old browsers, BIOS, etc. So the existing tools we have for censorship have to work around these existing platforms.
These platforms were created in a time where user control was paramount and security was an afterthought. They often do not have the mechanisms required to lock down the boot loader 100% of the time, or give a verified boot chain, or make sure the display signal isn't being intercepted. Our DRM and censorship, then, is very limited. I mean, even with secure boot - I can just turn that off. I can just turn on legacy MBR BIOS mode too. What now?
On other, newer, platforms, like your smartphone or smart TV, you'll notice the DRM is much stronger. Try changing out your OS on an iPhone. These platforms are ripe for the picking when it comes to censorship you can't circumvent.
So long as these older platforms exist, the usecases must be supported. Sure, we can "streamline" things on DRM heavy platforms like iOS - but we need to keep a trapdoor. Who is going to alienate Windows? Or x86 as a whole?
I'm aware that this might very well be "in the works", what's your point with that? Who is this "we" you are talking about? Are you going to publish a repository on github about what you believe is the ethical way to do this, and you expect Google to follow, or ???
What is this "one big cyberattack away" that you are talking about? Large sites get hacked all the time, and _nobody_ in power gives a single flying fuck. There are zero people held responsible for storing passwords in plaintext, or the admin password set to "123456" or passwords left as the default.
Seriously, what are you talking about?
German national ID has this built-in; you can cryptographically prove that you are currently in possession of an ID (and its PIN) over a certain age, for example, without revealing your date of birth. It's just not in widespread use.
Thank you for sharing this. I have been frustrated about the lack of chip and pin for IDs for years. We have had digital IDs in the form of debit/credit card since the 90s, and yet the governments have been agonizingly slow to adopt this (at least to me) painfully obvious idea. So good job Germany!
The problem is national security consequences of it. Handing out nation-backed ID card tied to secure identity undermines sovereignty of the nation, because it means Walmart and likes can (illegally) exert political influence by silently or openly classing and discriminating you.
It is important that personal ID is only transparent and spoof-proof to legitimate government the individual identifies with, and that soft ID databases that private entities may build have limitations in its completeness.
That's not trivial to do right, especially through bureaucratic government processes.
Chip and PIN is almost how electronic passports already work - it's just that the 'PIN' is printed in the passport itself, so in order for anybody to communicate with the chip, it has to see the page which has it printed in order to scan for it first.
CA DMV app lets me add my driver's license to my mobile wallet (which works with NFC).
Of course, it doesn't eliminate my legal responsibility to carry my driver's license while driving, and while the printed piece of plastic lasts five years and my passport booklet is legal I.D. for 10 years at a time, the mobile driver's license needs to be updated every 30 days.
Why have the digital version of you need the plastic copy still?
oh good, and your authoritarian government can know you're in the closet and trying to figure out how to leave the country, too!
no, fuck this idea so hard. if this is inevitable, our duty is to build technology that defeats it
the number of people who work for (or defend those who work for) firms like raytheon, northrop grumman, palantir, meta, amazon, microsoft, alphabet, flock et al leads me to believe there are not enough people left to care about building this technology. we're cooked. too many developers lack the moral position necessary to turn the tide in a meaningfully widespread way - at best, it's "if not me, someone else will do this work anyways, so i might as well be the one collecting the paycheck/stock options." at worst, it's "i think it's a good thing to create tools to surveil/manipulate/kill people."
mourn the loss of the internet we knew and be ready to sacrifice ease of use to return to lower-tech/still-underground options.
You can create an ID card system that reliably verifies some sort of personal attribute (such as age) without revealing other personal information or a validation request being sent to the government which shares what sites you may or may not have been browsing
First, while there's research on the math for things like ZNP, there is a shocking lack of research on security vulnerabilities for the actual implementations of such age verification systems which should make anyone using them extremely nervous.
Second, if a porn website, social media, video game or whatever other thing regulators want to discourage people visiting kicks you off into an age verification takes requires you to some system/site, even an independent one, that requires you upload your ID, a fair number of people will simply refuse simply due to lack of understanding in how it works and trust that it actually is anonymous.
Third, every implementation I've seen doesn't work for some/all non-citizens/tourists.
And finally and more importantly, the ease at bypassing those systems means it's unlikely to stop anyone underage and ultimately is no better than existing parental control software, so all one is doing is restricting speech for adults.
I, for one, would publically publish my credentials so that others could use them.
To the surprise of many, Google recently announced it is already integrating ZK-proof-of-age into Google Wallet with those kinds of properties, open sourcing the underlying libraries, and working with governments to encourage their ZKP system's adoption for exactly this sort of problem.
- [2025-04-29] https://blog.google/products/google-pay/google-wallet-age-id...
- [2025-07-03] https://blog.google/technology/safety-security/opening-up-ze...
- [2025-06-11] https://zeroknowledge.fm/podcast/363/
I think the point is that "can" is not the same as "will".
Because only people who are engaging in cynicism can predict the future.
Cynicism wins the day because negative outcomes are easier to plan for than positive outcomes. Humans defaulting to optimistic outcomes of the future often end up littering the ground with externalities that they failed to consider. And we also only have a single model for infinite growth (cancer) that always leads to destruction, so relentless optimism as a biological organism means a need for infinite growth, which we only know to be a path to destruction.
The answer, therefore, is not bitching on the internet about all the wet blankets who only see negative outcomes, but acknowledging that everything we know needs to end eventually including ourselves, and balancing optimism for the short term with cynicism for the long term. And thus discovering that a healthy cynicism for the future predictions is probably appropriate, unless you truly want to live forever and have infinite energy for everything. But that's a god.
Easier to plan for is an interesting lens to look through, can't immediately discard it for sure.
From my perspective, negative expectations do have a higher chance of turning out real, but because negative expectations most often are just code for human misalignment. We have some philosophical, instinctual, or aesthetic (etc.) preferences, but then reality is always going to be broader than that. So you're bound to hit things that are in misalignment. It takes active effort to cultivate the world to be whatever particular way. But this is also why I find simple pleas to cynicism particularly hollow. It comes off as resignation, exactly where the opposite is what would be most required.
That's a fair counter argument, and I do genuinely believe (not know) that everyone needs a balance of cynicism and optimism to function optimally as a human. I also believe the resignation you feel from cynicism is rampant exactly because as humans we've become very good at basic survival and beyond that it's not totally clear what our targets for living should be. Certainly we can all agree that trying to harness ever more energy and growing forever can't be the target. But that's all we've done for two millennia now. How to we avoid becoming a cancer to our planet (or any other environment we find ourselves in)?
Making things secure and private is hard. There's a lot of hoops to jump through.
Naive implementations are easy and cheap. And, if these tools and their entire software tree is not open-source, we cannot verify it's security.
We just have to trust that the developers are good at what they're doing. When every company under the sun has had multiple data breeches, I'm not too keen to do that.
Open-source the entire stack, show me a few white papers proving it's cryptographically sound, then I'll consider it. Until then, we should do with these tools what they deserve: being shoved up the government's ass.
The rich and powerful have always worked very hard to keep their position. They have vastly more resources than the rest of us to throw at the problem. It's not cynicism to predict that every tool will be used to make our lives worse unless it helps them get richer and more powerful.
Some of us learn from experience and make predictions based on past actions by the governments.
Trauma sufferers also just learned from experience.
These are possible, there are zero-knowledge proof (ZKP) algorithms and whatnot, but it is not going to happen.
Local ID Proofs =/= Surveillance
it absolutely will mean surveillance, unless you were born yesterday. governments will implement what you're describing in a way that is not privacy preserving
this is supposed to be HACKER news, not fucking bootlicker news
[flagged]
The level of discourse has drop here.
Someone steals your id creds and uses them as you is the simplest. The methods will range from stealing ids to breaking into auth servers to mitm attacks or fake ids and rogue auth servers. Everything works so well with video game protection methods now.. no one will be able to crack anything?
The recipes and tools for bypassing these kinds of blocks (and far worse ones as well - compared to what Russia and China are doing, this is child play) are one search away. The only thing necessary is the desire to actually do it.
Yes, and we're losing. Why do you think the internet is covered in ads, 25% Cloudflare, infested with CAPTCHAs and IP blocking, and the problem gets worse every year?
There are real problems that haven't been fixed; the driver's license concept correctly implemented might be better than continuing down this path. I view it as we can make a good standard; or let a bad standard be dictated.
Those are trivial problems compared to an internet linked to your identity.
Clicking through some captchas and installing an adblocker just isn't the hard life you're trying to claim it is.
At least in the current system, there are some websites where you don't have to prove your real identity. Hacker News, for example.
In an internet driver's license system, remember that your computer would have to be locked down, and only able to access government-approved websites using government-approved clients - something like they have in China, or like using an iPhone but worse.
Once the ability for any site to verify your identity was set up, all sites would have to verify your identity, or lose their own verification, under one of many standard excuses like protecting the children.
Most ads that I see these days are from Big Tech megacorps. Do you seriously think that having a "driver license for the Internet" would mean that the likes of Google and Meta would stop?
The drivers license id doesn't solve anything but adds a layer of nonsense on top.
That doesn't stop cloudflares marketshare takeover. It doesn't stop CAPTCHA which will filter out bots using these ids. It provides an easy method for hackers to use. It filters out the curious kids.
In the end it solves nothing and creates more problems.
> Yes, and we're losing. Why do you think
Obviously. Why do YOU think I'm angry-posting about it on the orange shithole site with the username "dingnuts" ?
I'm in favour of A) a restricted internet with an encryption scheme based on state controlled hardware devices, like Estonia has, that's accessible by default from browsers, and B) an unrestricted internet that's available to anyone who clicks through a few scary browser warnings, but is generally regarded as weird, dangerous, and not commercially viable except for weird or dangerous stuff.
Realistically, the moment the two are decoupled, B) is going to be banned and blocked outright - and the more they are decoupled, the easier it would be to ban. By and large, the only reason why it's still possible to access "dark" content online is because it's so intermeshed with the more mundane stuff on infrastructure level that the most efficient blocking methods have unacceptably high levels of collateral damage.
I don't see how you'd decouple one from the other, given that it's essentially just giving the user their own encryption certificate. Have the EU pass legislation saying that you can't request that the user sign anything unless they're in the process of making an account.
And then wait for when the well-funded and publicly supported A decides that B is evil and needs to be taken down.
> Shouldn't surprise absolutely nobody...
...because this is far from the first time this has happened with Cloudflare.
Is it? When did it happen before?
This is a big deal. We knew since the beginning that replacing the World-Wide Web with a centralized system would make it vulnerable to government censorship, however well intentioned Cloudflare's founders were. This is only the beginning.
Classic mafia racket economics would claim that Cloudflare themselves created the botnet ddos problem so that they themselves could solve it, and now they have the power to do this, especially when governments ask them very sternly to do so.
Being that botnet DDOS existed before CF that's a pretty strong statement.
They existed before, but websites selling DDoS as a service were easier to track down and competitors would DDoS eachother. Cloudflare provided a strong layer of protection for everyone, including these DDoS websites, and took no action to take them down when reported
Classic NSA tactics would be to setup a giant American Man-In-The-Middle company that most of the traffic of the world passes through.
And classic Washington Consensus tactics would be to manufacture a fake enemy to demonize in the media, such as Non-Western botnet makers
botnets are usually coming from residential networks due to infected hosts/IoT devices.
if cloudflare were to host malware on their own IPs, it would have been trivial to see CF's steps.
Unless you want to suggest that CF is developing and distributing sophisticated malware and making botnets across the world
Though certain mafia economics would suggest exactly that, I personally am not suggesting it. It's just an extremely interesting possibility that could only be proven with evidence.
i thought people in the west used these things called seedboxes? basically computers in low risk countries like romania etc, download the torrent there, then copy the file over or something like that.
I have one of these. However it is connected to a VPN 24/7 in my own home. It can't access the net without the VPN being connected and I've checked for IP leaks.
https://github.com/qdm12/gluetun
However at some point I will have a machine setup in a foreign country as a jump box.
As per the URLs listed in the article, many people don't download movies nowadays.
They stream them on streaming websites.
Is this because the torrent sites are using cloudfare on their end? If so, seems like a simple solution
Torrent sites use Cloudflare to hide their origin IPs, among other things, so just not using it isn't an easy option.
Easier for torrent sites to tell people to use VPNs.
[flagged]
That seems less plausible than other pirate sites, random asshole teenagers, or even streaming companies DDosing them.
The site suggests that VPNs may be effected. What's the mechanism here? Is this likely to cause trouble for all VPNs?
DNS blocking via 1.1.1.1 is suggested. So, change to another dns.
https://www.cloudflare.com/trust-hub/abuse-approach/
Now CloudFlare is also doing the blocks in its CDN, which means that it does not matter whether the ISP is business or residential, or whether a U.K. endpoint VPN is being used. All three end up talking to CloudFlare's CDN from inside the U.K., and that CDN is now blocking the content.
The tinfoil hat brigade can rest easy. (-: They aren't detecting VPNs. They're just blocking things at a point that is closer to the content origin than all of the U.K. VPNs and ISPs, rather than at a point that that is further away than the U.K. VPNs are.
This is how I block VPNs for game servers: https://zolk3ri.name/cgit/schachtmeister2/about/. It could work for any servers. It is very easy to do so. It gives you a "score" of the IP address (README.md explains it) that connected to your server, and you can decide what to do based on that, for example in my game servers there are certain thresholds. It has been working great.
realistically blocking low cost personal VPNs / proxies is pretty easy. Any new servers they stand up are gonna get picked up by commercial threat intel services with an hour and then just blocked. Especially if the CDNs are working with the government.
You could roll your own but wireguard/openvpn going to random hosting provider is gonna achieve the same thing if they are playing hardball.
They're not playing hardball, it's all on a "will this do" basis, like the US state-level bans. They're certainly not going to start blocking random IPs in hosting providers, that's reserved for email spammers.
While I don't think it's reasonable to blame corporations for complying with legal orders in the end, I don't see any evidence that they tried to fight it. I really wish they did.
Why would they fight it? It plays right into their MO as gatekeepers of the Internet.
They have no legal grounds to fight it. So there would be no point in trying to.
Why is Cloudflare providing its services to known pirate sites?
Is the site illegal? If yes, where? And is CF required to follow the laws of that jurisdiction?
To prevent a competitor popping up with a USP.
I guess renting a vps and setup wireguard should still work?
Yes.
And you can buy VPS using crypto.
So pirate sites cannot use CloudFlare. But isn’t that against their ToS?
Im just confused - can somebody explain me this?
Pirate Sites are stupid. And the need for a Site is a stupid limitation of Bittorrent. People should use real distributed protocols like SoulSeek, Kademila or other similar file sharing protocols that do not require a website for discovery.
SoulSeek still relies on central servers for some things. Every time they go down, people go to the sub reddit to ask what's happening.
> Pirate Sites are stupid. And the need for a Site is a stupid limitation of Bittorrent.
See https://bitmagnet.io/
Cloudflare used to have really open ToS and would host anybody. This included all sorts of far-right sites, and eventually they accepted that they were going to be held responsible for what their customers were doing.
UK is speed-running the Orwellian police state. They're already arresting people for Tweets, and logging "non-crime hate incidents" on your record, available to prospective employers.
They have been speed-running for decades. Remember "anti-social behaviour orders"? Those were introduced in 1998.
I think a better Orwell reference for this isn't 1984 though but rather https://www.orwellfoundation.com/the-orwell-foundation/orwel.... This is the essay that was originally meant as a preface to Animal Farm - and, ironically, was itself censored (by publishers).
Can you quote one of the Tweets that resulted in someone being arrested?
https://downforeveryoneorjustme.com/google
Anyway, few examples of many:
>A teenager who posted rap lyrics which included racist language on Instagram has been found guilty of sending a grossly offensive message.
https://www.bbc.com/news/uk-england-merseyside-43816921
>A man has been accused of sending a "grossly offensive" tweet in which he claimed "the only good Brit soldier is a deed one" the day after fundraising hero Captain Sir Tom Moore died.
https://news.sky.com/story/man-accused-of-sending-grossly-of...
>UK police arrest veteran because anti-LGBTQ post 'caused anxiety'
https://www.foxnews.com/world/uk-police-british-army-veteran...
>Officers from 37 police forces made 12,183 arrests in 2023 [over offensive posts on social media], the equivalent of about 33 per day.
https://archive.ph/Yk6Bo
Wow, that last statistic on arrests for offensive posts is staggering.
Just when streaming site are turning extra crappy and user hostile
Time to make our own internet…
there are so many approaches already tho. yggdrasil, ipfs, tor, freifunk, meshtastic, i2p (mixing a lot of things here, but there is tech out there). so much cool stuff, we just gotta use it.
> ipfs
IPFS have content blocking already: https://badbits.dwebops.pub/
well it's a slippery slope. you exist in existing jurisdictions and I'd rather not host CSAM tbh
They could've defined it as multiple filter lists for different kinds of content like uBlock does, but they chose not to. Therefore, anyone who (understandably and rightfully) want to block CSAM etc are now inadvertently blocking everything else that Protocol Labs disagrees with (e.g. copyright violation).
fair criticism then
Do I get this right that Cloudflare now decides for me which countries are allowed to see my content?
The Internet sees censoring as damage and routes around it accordingly.
No, that was Usenet. John actually said "the Net", but he was talking about Usenet. Usenet routing does work that way, although it's vulnerable to spoofing. Internet routing basically doesn't work that way at all and never has.
'The Internet' is not a thing and won't route anything around. Censured sites stay censured.
This is not cloudflare’s job.
Also, don’t they have bigger problems than this as country?
I wonder how long it will take their most loyal client state, Ireland, to implement mirror legislation. I give it a year.
Setting my VPN to the UK or Ireland is blocking the sites for me. Mainland Europe is fine.
Well that didn't take long! Truly, we are the least independent non-member member of the United Kingdom.
It's truly United.
Are you getting a 451 error though? Think that's something else.
Yeah its the 451 error. It says:
'Unavailable For Legal Reasons What happened?
In response to a legal order, Cloudflare has taken steps to limit access to this website through Cloudflare's pass-through security and CDN services within the United Kingdom. Find more information about the order, the party that requested it, and the authority that issued it here.'
It's a Dublin VPN though.
That's interesting suspect some multinational ISP's must be routing through their UK operations.
In my opinion, this article does a terrible job of explaining the technical mechanisms by which these blocks have been implemented, and the relationships between the entities involved.
Trying to piece together the details, here's my undewrstanding:
- Until recently, major British residential ISPs were blocking access to torrent/pirate/porn sites for their customers ("BT, Virgin Media, Sky, TalkTalk, EE, and Plusnet account for the majority of the UK’s residential internet market")
- Cloudflare has recently been ordered by courts in the UK to block access to these torrent/pirate/porn sites
- The reason that Cloudflare is involved is because many of these sites use Cloudflare as a content delivery network. A CDN is <waves hands> basically an application-layer distributed cache that sits between end users' web browsers and the origin HTTP servers that they're trying to access.
- Cloudflare geolocates clients connecting to its CDN. It undoubtedly has many reasons to do this, besides just court-ordered geoblocking: these would include routing queries efficiently within its globally distributed datacenters, DDoS prevention, bot blocking, etc.
- Cloudflare's geolocation techniques are, unsurprisingly, more sophisticated than just determining a country based on a client's IP address.
If I've got all that right (do I???)… then the tl;dr is:
It used to be possible for UK users to circumvent the blocks of these sites simply by using any VPN to acquire a non-UK IP address. Now the order to block these sites has been imposed on Cloudflare, which plays a critical role as an intermediary in distributing their content in a scalable way. For a variety of reasons, some of which end-users probably approve of and others not, Cloudflare uses more sophisticated techniques to geolocate clients. So "just use a VPN" is not enough to circumvent the blocks anymore.
Is this affecting anyone else in Canada
Yes centralising power was such a good idea. Well done big tech. Another footgun.
How is this a footgun? Big Tech will protect Big Tech, it's only an advantage to have a service that will bend to their will. The centralization is the point.
Everyone opted to use Cloudflare, not just big tech. They now control much of the internet in a way that any nation state could only dream of.
The bit where we hand everything over and then take the consequences for doing so.
Anything centralized is easier to capture.
cloudflare is big tech now?
It sits between millions of users and the websites they desire to visit, and if they're on the right network using the right browser, they won't even know it.
It's #24 on this list https://companiesmarketcap.com/software/largest-software-com... so I'd say it's big tech.
[dead]
First, they came for 8chan...
This isn't part of that slippery slope, since that was Cloudflare's voluntary choice, but this is legally required of them. (I do think both kinds are bad, though.)
Cloudflare also blocked a popular Internet celebrity gossip site and actionably -defamed them in the process, and a popular blog, yet still has customers who run animal crushing sites (which is literally illegal content in many countries).
Don't defend them. Their decisions are arbitrary and it's really sad so much of the web has chosen to use their garbage services.
Honestly I really don't care if countries want to ban sites that obviously exist to facilitate breaking the law. Yeah yeah but muh linux isos. If they call themselves PIRATE BAY, EZTV, SPORTSCULT or whatever, and everyone who uses it talks only about pirating movies and stuff with a wink wink "linux ISOs" it's pretty clear why it exists.
Visit others like ext.to and literally the entire front page is stuff like the new Superman movie, etc. You sound like a fool if you try to argue it's mainly for legitimate purposes. (Contrast with freenet and stuff, where if you've ever used it, you'll find most of the stuff there is people's boring ass personal webpages and stuff