Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP blocking the UK is not enough to comply with the Online Safety Act

prestonbyrne.com

Post reply on HN
Print view View original

261–270 of 418 posts

Re: IP blocking the UK is not enough to comply with the Online Safety Act

#261

Post by inkyoto »

mzajc wrote: post #18

> The primary one is that the notion of a “UK based IP” is nonsense. Geolocation databases work by figuring out where people log in from and only after doing a lot of pattern recognition do those addresses get associated with that location. I support the cause, but I don't think that's true. RIPE, the RIR responsible for UK, makes available a list of allocations per country. For UK: https://stat.ripe.net/data/country…

Regrettably, the list in question offers limited operational value, as it omits the so-called «exit» CIDR's utilised by major cloud service providers – a glaring omission that renders the dataset largely superficial.

Let's, for analytical clarity, set aside the UK and examine Germany as an isolated datapoint.

AWS, for instance, possesses and operates the entirety of the 3.0.0.0/9 address space – a range distributed across numerous jurisdictions and continents. Notably, significant CIDR allocations from 3.0.0.0/9 reside within German territory, yet remain absent from the RIPE registry. Such inadvertent obfuscation undermines efforts at precise geolocation.

One may, through inference and correlation – specifically via https://ip-ranges.amazonaws.com/ip-ranges.json – arrive at a reasonably accurate estimation of the German CIDR's by aggregating address ranges tied to a designate AWS region they are associated with. Such inference is only feasible due to the vendor’s decision to publish such data. I would reasonably conjecture that other cloud providers engage in a comparable practice.

Thus, whilst it is not altogether impossible to ascertain the geolocation of a given IP address, the exercise remains contingent upon the discretionary transparency of global infrastructure operators and multiple indirect information sources – a rather fragile foundation upon which to build certainty.

Re: IP blocking the UK is not enough to comply with the Online Safety Act

#262

Post by Springtime »

ubercow13 wrote: post #210
crtasm wrote: post #34

>This is demonstrably false. By testing from.. a single VPN IP? And as noted in other comments here he doesn't seem to understand how geo ip databases are maintained. I sure won't be asking this guy to represent me anytime soon.

He is not claiming being blocked from one IP proves the geoblock is complete, he is claiming it shows that the geoblock in place is also active for the mirror site. >What appears to have happened is that SaSu had a site mirror and that someone figured out a way to hit the mirror – which was also subject to the geoblock, something which took me under a minute to personally confirm – without using a VPN.

And also:

> If I had to guess, it’s that some NGO found some UK-based IP addresses which weren’t captured by the block because they weren’t properly geolocated.

Ofcom's clarified contention is that the geoblock is unreliable, while the lawyer seems to be rebutting the original statements that they interpreted Ofcom as claiming no geoblocking was active ('remains accessible to UK users', 'was directly available to people with UK IP addresses (with and without a VPN)').

Re: IP blocking the UK is not enough to comply with the Online Safety Act

#263

Post by kelnos »

HPsquared wrote: post #125
landl0rd wrote: post #86

Earlier quoted context omitted.

No, one has chosen to make something available for contact within one country. One is not actively himself reaching across borders to do so. One cannot reasonably be required to take any affirmative action to fulfill the whims of a foreign government. Also, Britain isn't important enough to make this stick against e.g. an American. If someone writes me a letter asking a question about material that is prohibited in h…

The client requests content from a server. The server may be abroad. It's the same as ordering goods from abroad, only much faster. I wonder what the law is for importing goods that are illegal in the destination country.

It's really the same principle. For physical goods that are crossing borders, but are illegal in the destination country, their customs officials can seize the goods. For data packets on the internet, the destination country is free to block them if they find them objectionable.

Re: IP blocking the UK is not enough to comply with the Online Safety Act

#264

Post by sleepybrett »

aDyslecticCrow wrote: post #133
iamnothere wrote: post #119

Earlier quoted context omitted.

If country B doesn’t like it, block the site in question. You’re not going to extradite US site operators, period. Find another approach.

Then no country should have legal authority over companies operating in the country but based internationally. You could earn a lot of money by selling unregistered firearms, pipe bombs or drugs over the internet and sending it over the border. "If country B doesn’t like it, block the mail in question". Saying only the country of origin can regulate activity done in another country creates a legal worm-bucket with va…

We have treaties with other contries to cover most of these cases and customs to cover many others.

What the UK is doing is claiming, without having dealt with this via treaty that I am somehow responsible for keeping their citizens off my website. This is not something they can actually do. Now if they made a deal with my country that said that I had to in some way we'd be in a different universe. But currently they do not.

As I, and probably many others, see it. If they don't want UK citizens visiting 4chan or whereever they should control the flow of data through their borders better and punish their citizens for data smuggling if they vpn their way around it. It's no different than prohibited goods like automatic weapons. If I send someone in the UK a fully automatic ak-47 (which is legal in my juristiction) then I suspect UK customs will catch it at the border and possibly jail, or at least have a stern talking to the recipient.

Re: IP blocking the UK is not enough to comply with the Online Safety Act

#265

Post by mike_hearn »

youngNed wrote: post #49
spacebanana7 wrote: post #14

Earlier quoted context omitted.

Even in Reform, I get the sense that Zia Yusuf was the only person campaigning seriously against it. Going on a one man crusade to force Farage to criticise it and put fully repealing the act on their manifesto.

It was a Reform politician who championed it in: https://publications.parliament.uk/pa/bills/cbill/58-03/0004... WITH A RAP https://www.youtube.com/watch?v=9ql6tGu9aWg https://www.youtube.com/watch?app=desktop&v=r4mRo2M5VMA

Yes, but she is now allied with a party that has committed to repealing it. This seems to be the result of pure political calculation by all involved. Dorries is unfortunately quite popular with certain demographics that aren't natural Reform supporters (i.e. the sort who love the OSA), so bringing her in probably does help them. But they know they can't absorb too many former Tories without undermining the justification for their own existence.

Re: IP blocking the UK is not enough to comply with the Online Safety Act

#266

Post by brookst »

beejiu wrote: post #126
brookst wrote: post #106

Earlier quoted context omitted.

Even if it was legal in your own country? That seems odd.

Yes, and this already happens, every day.

So like a German going 160kph on an appropriate section of the autobahn should avoid travel to the US?

Re: IP blocking the UK is not enough to comply with the Online Safety Act

#267

Post by kelnos »

mzajc wrote: post #18

> The primary one is that the notion of a “UK based IP” is nonsense. Geolocation databases work by figuring out where people log in from and only after doing a lot of pattern recognition do those addresses get associated with that location. I support the cause, but I don't think that's true. RIPE, the RIR responsible for UK, makes available a list of allocations per country. For UK: https://stat.ripe.net/data/country…

The author addresses this: these IP allocation lists are rife with errors and are sometimes outdated.

This is likely why someone living in the UK was able to access one of the sites in question despite the geoIP-based ban.

Re: IP blocking the UK is not enough to comply with the Online Safety Act

#268

Post by kelnos »

hilbert42 wrote: post #241
Hizonner wrote: post #55

You shouldn't even be expected to geoblock. If I'm operating a Web site in country A, I should not have to care about country B's laws unless I am taking specific action intended to attract users in country B in particular . That's doesn't mean just to target the whole world, either. If you don't want your citizens to access something in another country, take it up with your citizens. It was obvious from the minute t…

"You shouldn't even be expected to geoblock." I read the article and I remain confused. I've just come to this story after seeing it on HN so I might have misunderstandings from being unaware of the background. Also, I neither reside in the US nor UK so I'd have not seen local media reports. In short, I gather UK's Ofcom is threatening a US web site for online content that is lawful within the US's jurisdiction and u…

The UK -- and many other countries -- assert that their laws do bind people outside their borders, regardless of the absurdity (in most cases) of attempting to enforce that law elsewhere.

I think it's important to fight these sort of things even in cases where they can't actually enforce it. For one thing, say one of the site operators in question have a need or desire to visit the UK at some point in the future, but can't, because there's some sort of legal judgment against them because of this. That would be a shitty situation.

On top of that, ignoring these sorts of things also ignores possible efforts by the UK to convince other governments (like the US) to adopt similar laws, or at least agree to some level of extra-territorial enforcement. Fighting these cases sends a signal to everyone involved. You mention the UK acting like a petulant bully: yes, sometimes a good way to counteract a bully is to ignore them, but other times it's good to fight back, even when the current bullying wouldn't be effective... because future kinds of bullying might be.

Re: IP blocking the UK is not enough to comply with the Online Safety Act

#269

Post by dreamcompiler »

Danjoe4 wrote: post #260
Hizonner wrote: post #55

You shouldn't even be expected to geoblock. If I'm operating a Web site in country A, I should not have to care about country B's laws unless I am taking specific action intended to attract users in country B in particular . That's doesn't mean just to target the whole world, either. If you don't want your citizens to access something in another country, take it up with your citizens. It was obvious from the minute t…

That's the current status quo. The UK can't sue you, extradite you, or really do anything. Assuming that your service providers are US based and you follow US law, they can pound sand. In practice, the US is the only country powerful enough to enforce its laws extraterritoriality. The UK trying to enforce its internet laws on me? An American citizen? Funny joke

As long as you don't set foot on British soil you'll be fine. But that's less simple than it sounds. Don't book a flight that connects in the UK, sure. But what if your NYC-to-Munich flight has engine trouble and needs to make an emergency landing in London? You are screwed: You'll be pulled off the plane and taken to jail.

Will the US embassy get involved? Of course. Will they get you released? Maybe, but it's not guaranteed. And you are in for a bad time regardless.

Re: IP blocking the UK is not enough to comply with the Online Safety Act

#270

Post by Danjoe4 »

qball wrote: post #70
zdragnar wrote: post #50

Earlier quoted context omitted.

Extradition of a foreign citizen to a third country is not a simple matter, diplomatically speaking. The US might not have the hegemony it enjoyed 20-30 years ago, but it certainly has plenty of sway. When it's a matter of drug charges or other obviously criminal activity, the US embassy and diplomats don't normally raise a fuss, but for something like this where the person made first amendment protected speech in th…

Why would it? Plenty of US citizens would actively cheer the notion of having a foreign government arrest their political opponents as an end-run around the fact they're not allowed to do it at home. After all, 1A/"freeze peach" laws should only protect you from your government, right?

Nope. US law is international law (because we have all the guns). The UK government would never defy us; they know their place.
Post reply on HN