Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare misidentifies Hetzner IPs as being located in Iran

gitlab.com

Post reply on HN
Print view View original

131–140 of 245 posts

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#131

Post by LegionMammal978 »

anonzzzies wrote: post #126
LegionMammal978 wrote: post #113

Earlier quoted context omitted.

Given that most things are personal data under the GDPR (e.g., IP addresses have been considered personal data, and things like usernames are clearly personal data), I don't think most companies can get off quite that trivially, short of being completely stateless and never logging anything.

You can log with log if you have good reason; you just have to delete them after a reasonable time. Nothing about this is hard or costly if you think about from the start. Your 'forever data' basically should never contain PII as some users might have terminated their accounts etc so then their info cannot be in some cold store tape archive. Again, not complex; delete backups after a reasonable time and throw away th…

Sure, but regardless of your data-retention period, you still have to know where to find everything derived from anything user-generated, if you want to accurately respond to requests. You're free to argue that the GDPR is making companies do things that they already ought to have been doing, but my point is that "just don't be one of those evil user-tracking companies" is not a viable compliance policy in itself.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#132

Post by anonzzzies »

amatecha wrote: post #50
dathinab wrote: post #28

it's pretty absurd that cloudflare can just effectively cripple a cloud provider by tagging part of their IPv4 range as Iranian and not fixing their issues in over a year (and AFIK have no intention to fix them at all) like I wonder if Hetzner has any way to legally force them to stop misclassifying their IP

What's absurd to me is that Cloudflare gains more and more control over the internet, by people voluntarily submitting to its domination. My favorite is trying to go someone's random blog with like 5 posts (because they have a singular post about the technical topic I'm trying to figure something out about) and I can't access the site because Cloudflare has decided my locked-down Firefox ("resist fingerprinting" + st…

It is extremely hard to stop DDOS attacks without CF; my hoster has DDOS protection, but when there was a very large attack on our site, only CF could remedy it, and did so immediately when we panicked-moved dns and switched on bot fight. Entire attack that my hoster couldn't stop was gone. How do you do this without CF if you are a small company?

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#133

Post by anonzzzies »

LegionMammal978 wrote: post #131
anonzzzies wrote: post #126

Earlier quoted context omitted.

You can log with log if you have good reason; you just have to delete them after a reasonable time. Nothing about this is hard or costly if you think about from the start. Your 'forever data' basically should never contain PII as some users might have terminated their accounts etc so then their info cannot be in some cold store tape archive. Again, not complex; delete backups after a reasonable time and throw away th…

Sure, but regardless of your data-retention period, you still have to know where to find everything derived from anything user-generated, if you want to accurately respond to requests. You're free to argue that the GDPR is making companies do things that they already ought to have been doing, but my point is that "just don't be one of those evil user-tracking companies" is not a viable compliance policy in itself.

Yes, that's true, it is part of the intent though, that's why people say this I guess.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#134

Post by seszett »

lxgr wrote: post #122
miki123211 wrote: post #88

Earlier quoted context omitted.

Falsehoods programmers believe about law: the fact that an identification method isn't 100% accurate means that it has no value

Maybe this is more of a Europe vs. US observation than a programmer vs. lawyer observation, but I have indeed made the observation that US companies are often satisfied with "identity verification" that would absolutely not fly elsewhere. A PDF of a utility bill as "proof of residency", knowing somebody's SSN as "identity verification"... Yes, they might be definitionally best practice and accordingly enough from a l…

> A PDF of a utility bill as "proof of residency"

That's not really a EU Vs US thing though, but a "country with mandatory official declaration of residence" vs not.

France is the same as the US there, and I would assume the UK as well. Well I now realise the UK is not in the EU anymore... but France is probably not the only remaining country in the EU where you can move without some kind of administrative declaration?

Anyway the point for these countries is to not have a centralised record of where citizens live, for anti-surveillance reasons and resilience against potentially hostile authorities. So you can't ask the state to prove that you live somewhere because it doesn't have a record or if it has it cannot legally communicate it to anyone.

In contrast, Belgium for example has centralised records of residents and if your car is parked wrongly, the local police can look up the plate and call you on your registered phone number or knock to your door at your registered address, to tell you to move it. It's practical, but I find it creepy and dangerous. A hostile government would have so much power here.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#135

Post by lxgr »

seszett wrote: post #134
lxgr wrote: post #122

Earlier quoted context omitted.

Maybe this is more of a Europe vs. US observation than a programmer vs. lawyer observation, but I have indeed made the observation that US companies are often satisfied with "identity verification" that would absolutely not fly elsewhere. A PDF of a utility bill as "proof of residency", knowing somebody's SSN as "identity verification"... Yes, they might be definitionally best practice and accordingly enough from a l…

> A PDF of a utility bill as "proof of residency" That's not really a EU Vs US thing though, but a "country with mandatory official declaration of residence" vs not. France is the same as the US there, and I would assume the UK as well. Well I now realise the UK is not in the EU anymore... but France is probably not the only remaining country in the EU where you can move without some kind of administrative declaratio…

> the point for these countries is to not have a centralised record of where citizens live

In the US, state DMVs effectively still know everybody's address, don't they?

And even if they wouldn't – that information is only one data broker query away in the US.

I've recently experienced this by signing up for a financial company that, after entering only my phone number and SSN, presented me with my full address and asked me whether everything looks accurate. I understand that historically and value-wise, this is part of where the resistance to centralized government databases is coming from. But practically, they already exist.

In the US, resistance against government ID for private contracts seems to come more from an intention of not wanting the government to be able to interfere with the right of people to legally transact with each other without government mandate or intervention. But even that resistance is largely over – I had to show my driver's license to every bank I ever opened an account with.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#136

Post by throwaway48476 »

aguaviva wrote: post #115
grishka wrote: post #109

Earlier quoted context omitted.

I live in Russia and I've never experienced most of the things you're describing. And it's become so much worse after 24/02/2022. We even had Spotify for a year! It was starting to genuinely feel like a first-world country. Now you have to open a bank account in a different country for foreign companies to consider taking your money at all. The internet is utterly broken. The government blocks quite a lot, AND some f…

Do you think the sanctions are having a significant effect in terms of slowing down the war effort?

Sanctions have an effect, the government complains about them a lot.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#137

Post by grishka »

aguaviva wrote: post #115
grishka wrote: post #109

Earlier quoted context omitted.

I live in Russia and I've never experienced most of the things you're describing. And it's become so much worse after 24/02/2022. We even had Spotify for a year! It was starting to genuinely feel like a first-world country. Now you have to open a bank account in a different country for foreign companies to consider taking your money at all. The internet is utterly broken. The government blocks quite a lot, AND some f…

Do you think the sanctions are having a significant effect in terms of slowing down the war effort?

Few of them do have an effect on the military, but hardly a significant one. Some of them forced the government officials to eat their own dog food. Most of them, however, feel like mocking petty revenge. If anything, those sanctions that disproportionately affect regular powerless people only reinforce the official propaganda's view that "we're encircled by enemies".

Vladimir Kara-Murza expressed the same ideas much more eloquently on the press conference that followed the prisoner swap in August: https://newsukraine.rbc.ua/news/russian-opposition-figure-ka...

In my own opinion, a good step in the right direction would be if we could travel to European countries as easily as we used to be able to. Then more people could see with their own eyes that they're being lied to.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#138

Post by nozzlegear »

JumpCrisscross wrote: post #79
nozzlegear wrote: post #70

Earlier quoted context omitted.

From that same link, financial sanctions against a country can be one of any of the following: * authority to prohibit U.S. citizens from engaging in financial transactions with the individuals, entities, or governments on the list, except by license from the U.S. government * requiring the United States to oppose loans by the World Bank and other international financial institutions, * diplomatic immunity waived, to…

> the US has so many sanctions because the USD is so powerful That's appealing to sanctions' effectiveness. It's unclear they are. Instead, they're a potent signalling mechanism that's more palatable than shipping arms or worse, soldiers.

I'm not sure I understand. That's exactly the point of sanctions, to use the power of the US economy and the USD to exert American influence. You're right, they're not always effective at achieving their immediate goals, but they signal US disapproval and help pursue long-term goals without shipping those arms or soldiers anywhere.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#139

Post by seszett »

lxgr wrote: post #135
seszett wrote: post #134

Earlier quoted context omitted.

> A PDF of a utility bill as "proof of residency" That's not really a EU Vs US thing though, but a "country with mandatory official declaration of residence" vs not. France is the same as the US there, and I would assume the UK as well. Well I now realise the UK is not in the EU anymore... but France is probably not the only remaining country in the EU where you can move without some kind of administrative declaratio…

> the point for these countries is to not have a centralised record of where citizens live In the US, state DMVs effectively still know everybody's address, don't they? And even if they wouldn't – that information is only one data broker query away in the US. I've recently experienced this by signing up for a financial company that, after entering only my phone number and SSN, presented me with my full address and as…

That's what happens when government is regulated but companies aren't. The kind of process you describe is totally illegal and unheard of in the EU.

In France banks also take utilities bills as proof of residence (but they also ask for id or passport to check your identity). ID cards do have an address as well as passports and driving licences, but even the government doesn't accept them as proof of residence because they're often out of date.

In my case they all have different addresses and none of them has my current address. My Belgian ID though has to be reissued every time I move to a different municipality.

Oh and regarding DMV having addresses yes, but (in France) they are indexed by a DMV-specific key that cannot easily be matched to another database, say social security or taxes (which also independently have addresses on most citizens). Driving license number, fiscal number, SSN, cannot legally be used anywhere else than with their respective services. There is of course the names that can be used, but no system is perfect I guess.

Anyway these are just implementation details, but my point is that the EU has many different administrative systems and in at least some of them, utilities are the only legal proof of residence.

Re: Cloudflare misidentifies Hetzner IPs as being located in Iran

#140

Post by viraptor »

snowwrestler wrote: post #119
viraptor wrote: post #105

Earlier quoted context omitted.

All of that is about complying with gdpr, assuming you're sharing customer data. If you don't, there's nothing to do. It's like "international shipping of live animals is a massive undertaking and takes lots of time" - cool, it's true - I'm not doing that so I'm done. Sure, you have to comply with data requests, but if you don't store/share it... that's also trivial.

GDPR does not regulate “sharing,” it regulates any use of personal data. IP address is considered personal data, so you can’t avoid GDPR compliance if you are running a website at all (since you must process IP addresses in order to serve a website).

I'm using simplified language here, not writing a legal document. The first use was also supposed to be "storing/sharing", but it's processing in practice. But here you go:

> GDPR does not regulate “sharing,”

13.1.e requires at least the notification of the recipients of the data. With the requirement about the purpose of use, it effectively regulates sharing.

> since you must process IP addresses in order to serve a website

That's right and that places the IP in the 4.1.f "processing is necessary for the purposes of the legitimate interests pursued by the controller" area which doesn't require consent.

Post reply on HN