Live data from Hacker News

Tell HN: Docker pull fails in Spain due to football Cloudflare block

news.ycombinator.com

281–290 of 444 posts

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#281
post #275
post #264

Earlier quoted context omitted.

LaLiga isn't Cloudflare's customer. They have no relationship. So why would Cloudflare rework their infrastructure just to instrument rapid blocking at their own expense as a favor to LaLiga? And if they don't, ISPs just break the Internet for each soccer match? This is a kind of coercion that makes no sense. Cloudflare has no obligation like this to LaLiga (and neither would a Spanish domestic CDN!).

The reason why entities comply with the wishes of courts is because there's consequences if they don't. Consequences like being filtered.

Cloudflare has not in fact refused to comply with any court orders! The very thing at issue is that LaLiga wants Cloudflare to do censorship on their behalf that Cloudflare, who has no contractual relationship with LaLiga, is not required to do by any legal framework in Spain or the US.

Cloudflare literally wasn't even a party to the ruling by which LaLiga has been compelling Spanish ISPs to do the IP-level blocking. They're just an affected third-party because the blocking scheme the courts have allowed LaLiga to impose on ISPs is on a per-IP basis.

Spain hasn't asked Cloudflare to do anything. Only LaLiga has acted like Cloudflare owes them a huge, expensive rework of their CDN's architecture for the purpose of censoring things for LaLiga purely as a favor to LaLiga. What LaLiga has over Cloudflare isn't a court order. It's a protection racket, or maybe a hostage situation, where court orders involving other parties are the gun held to the hostage's head.

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#282
post #114

Earlier quoted context omitted.

Looks like they already tried to appeal the block, and lost: https://x.com/jaumepons/status/1904906677335245294

They could potentially file the suit against Spain in European Court of Human Rights if they have exhausted national remedies. ECtHR has previously ruled some blocks to be illegal, but generally in the context where country sought the ban. Of course in both cases Court is the one that actually orders the ban. One relevant would be Yildirim v. Turkey where court ordered blocking access to all Google sites because ther…

[deleted]

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#283
Just use Nix.

1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler).

2. Nix has several ways to build OCI images, some even faster to assemble and slimmer output of official Docker tooling.

3. It is allowed several providers for same artefact to resolve pull.

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#284

Just use Nix. 1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler). 2. Nix has several ways to build OCI images, some even faster to assemble and slimmer output of official Docker tooling. 3. It is allowed several providers for same artefact to resolve pull.

> 1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler).

If nix fails to pull things from its binary cache, it will download the "sources" of the derivations, which are hosted in various places and so it's even more likely an overly broad block impacts one of them.

This football block very well could also cover GitHub, cdn.kernel.org, and so on, so nix building things could fail just as easily.

The solution isn't to use something else which can download source code from 100s of sites across the internet to compile as a fallback, it's to not use internet which sporadically blocks sites hosting developer assets.

The solution is not technical, it's political.

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#286

Just use Nix. 1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler). 2. Nix has several ways to build OCI images, some even faster to assemble and slimmer output of official Docker tooling. 3. It is allowed several providers for same artefact to resolve pull.

> 1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler). If nix fails to pull things from its binary cache, it will download the "sources" of the derivations, which are hosted in various places and so it's even more likely an overly broad block impacts one of them. This football block very well could also cover GitHub, cdn.kernel.org, and so on, so nix building things could fail…

1. We are more on OCI images? Assuming source available, run nix build and docker load of result.

2. Even if kernel.org or GitHub.com will be blocked, it likely than not it already was cached by nixos org cache or community cache or cachix or by your CI or by you workstation.

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#288
post #30

Heh, lucky you, at least you get a message. My ISP just drops traffic to the affected IPs. No ping, no traceroute, just a spinner in the browser until it says "page not found". Every response and comment from LaLiga, the football organization responsible for this, has been so far that this is a minor issue that only affects a few bunch of nerds who talk about "docker images" or "github repositories" or "whatever that…

> there are testimonies of smart home devices like anti-theft alarms or automatic doors, that stop working whenever [...] because their backends rely on Cloudflare. The fault here lies 100% with horribly designed IoT devices that turn into bricks when they lose internet connection.

Yeah the horribly designed alarm system that can't alert a central authority that something has gone wrong. Maybe we should just put huge air raid sirens on our homes instead?

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#289

Maybe it’s time to reflect upon the reliance on centralized services? Not long ago docker hub started rate limiting access and we all turned to blanket solutions like the GitLab registry cache. I wonder if the IPFS distributed docker registry thing still exists/works.

This isn't really about centralization. ISPs are blocking at the IP level, not Docker Hub specifically. You could self-host a registry behind Cloudflare and still run into the same thing.

"Behind Cloudflare" is the centralisation part
Post reply on HN