Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare misidentifies Hetzner IPs as being located in Iran

gitlab.com

Post reply on HN
Print view View original

31–40 of 245 posts

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#31

Post by Animats »

greyface- wrote: post #10
38 wrote: post #3

I mean, so? Why should it matter where they are located?

It's the interpretation of some cloud providers that exchanging datagrams with entities in OFAC-sanctioned countries constitutes a prohibited transaction.

The actual sanctions are complicated.[1]

There's a big list of allowed Internet activity between the US and Iran.[2] It is explicitly US policy to not cut off Iran from the Internet. The State Department wants people in Iran to get info from the outside world. However, the US does not allow US domain registrations or web hosting "for or on behalf of the Government of Iran".

The Office of Foreign Assets Control can be queried for case by case info. That's appropriate here.

[1] https://www.ecfr.gov/current/title-31/subtitle-B/chapter-V/p...

[2] https://www.ecfr.gov/current/title-31/subtitle-B/chapter-V/p...

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#32

Post by golergka »

londons_explore wrote: post #27
golergka wrote: post #19

Earlier quoted context omitted.

Isn't intent of sanctions to weaken the adversary? Providing services, even free-tier (or, may be, especially so), to sanctioned countries is exactly the opposite of that.

It makes US service providers, like Google and Amazon, very unattractive for businesses that require worldwide coverage - for example wikipedia. I would argue that for unpaid services (for example serving up web content), we should not be applying sanctions. Those specific sanctions are so easy for the iranians to work around (VPN), and so damaging to our businesses (no worldwide service).

> It makes US service providers, like Google and Amazon, very unattractive for businesses that require worldwide coverage

You know what is much more unattractive to these businesses? Getting on the wrong side of the US government. And honestly, I don't see any business (except for ones in Russia, China and Iran) changing provider because they don't provide service to Iran.

> damaging to our businesses (no worldwide service)

I'm confused, are you arguing here for allowing free-tier services under the sanction regime, or for getting rid of sanctions against Iran altogether? If it's the latter, then the argument is self-consistent. But if it's the former, then you're effectively saying that an american business which currently doesn't provide any services to iranian customers would instead prefer to provide free-tier services for them without any way to get them to paid tier, and that doesn't make any sense. If you know that users from a certain region would always be at 0% conversion, you would get nothing by providing them with a free tier.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#33

Post by TheTr1ckt3r »

This whole issue of blocking Iranian IPs and not allowing them to download Docker containers for ‘legal’ reasons is ridiculous. Additionally, trying to detect and ban VPNs used by Iranians, which will affect the next user of that IP, is equally absurd

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#34

Post by Fokamul »

VWWHFSfQ wrote: post #8
38 wrote: post #3

I mean, so? Why should it matter where they are located?

My servers ban huge swaths of IPs from certain places that originates enormous amounts of spam, scanners, and other nefarious traffic. It's very effective

So you ban US and China, aka two places where most spam, ddos and malware is coming from. Right?

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#35

Post by VWWHFSfQ »

Fokamul wrote: post #34
VWWHFSfQ wrote: post #8

Earlier quoted context omitted.

My servers ban huge swaths of IPs from certain places that originates enormous amounts of spam, scanners, and other nefarious traffic. It's very effective

So you ban US and China, aka two places where most spam, ddos and malware is coming from. Right?

China yes

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#36

Post by themoonisachees »

tyree731 wrote: post #4
38 wrote: post #3

I mean, so? Why should it matter where they are located?

You may be surprised to discover that services will filter traffic by location.

In my previous jobs we didn't have any business in china and banning all IP ranges was a cheap an easy strategy to remove 50% of unsuccessful login attempts.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#37

Post by RadiozRadioz »

I'm frequently reminded how thankful I am to live in a country with a strong, positive international reputation. Even ignoring actual quality-of-life stuff associated with where I live - simply not being from a country with a "dodgy" reputation makes many things so much easier.

I don't have to think about blocked websites. Companies accept my payments. Couriers ship to me. With my passport, I walk straight to the front of the fast lane, past the large queue of people who didn't happen to be born somewhere rich, western and politically stable.

I don't take it for granted, and it makes me sad that this distinction exists.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#38

Post by londons_explore »

golergka wrote: post #32
londons_explore wrote: post #27

Earlier quoted context omitted.

It makes US service providers, like Google and Amazon, very unattractive for businesses that require worldwide coverage - for example wikipedia. I would argue that for unpaid services (for example serving up web content), we should not be applying sanctions. Those specific sanctions are so easy for the iranians to work around (VPN), and so damaging to our businesses (no worldwide service).

> It makes US service providers, like Google and Amazon, very unattractive for businesses that require worldwide coverage You know what is much more unattractive to these businesses? Getting on the wrong side of the US government. And honestly, I don't see any business (except for ones in Russia, China and Iran) changing provider because they don't provide service to Iran. > damaging to our businesses (no worldwide s…

Imagine wikipedia was looking for new hosting.

They consider Google cloud, but then reject it because GCP cannot serve users in Iran, and Wikipedia's policy is to be globally available.

Google loses worldwide revenue from all of wikipedia.

(I have met multiple companies who have dismissed GCP for this reason. Even companies with no current business in Iran might one day want to expand there, so don't want to make infrastructure choices which lock them out).

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#39

Post by Onavo »

RadiozRadioz wrote: post #37

I'm frequently reminded how thankful I am to live in a country with a strong, positive international reputation. Even ignoring actual quality-of-life stuff associated with where I live - simply not being from a country with a "dodgy" reputation makes many things so much easier. I don't have to think about blocked websites. Companies accept my payments. Couriers ship to me. With my passport, I walk straight to the fro…

It's more that you are on the right side in a unipolar world. When the world shifts to multipolarity in the next few years, the problem will solve itself.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#40

Post by kiba »

Onavo wrote: post #39
RadiozRadioz wrote: post #37

I'm frequently reminded how thankful I am to live in a country with a strong, positive international reputation. Even ignoring actual quality-of-life stuff associated with where I live - simply not being from a country with a "dodgy" reputation makes many things so much easier. I don't have to think about blocked websites. Companies accept my payments. Couriers ship to me. With my passport, I walk straight to the fro…

It's more that you are on the right side in a unipolar world. When the world shifts to multipolarity in the next few years, the problem will solve itself.

Multipolarity is a more dangerous world, as we have seen Russia asserts itself at the expense of Ukraine.
Post reply on HN