Hacker News new | past | comments | ask | show | jobs | submit login
Will browsers be required by law to stop you from visiting infringing sites? (techdirt.com)
225 points by rntn on Aug 5, 2023 | hide | past | favorite | 156 comments



- "There were ways, of course, to get around the SPA and Central Licensing. They were themselves illegal. Dan had had a classmate in software, Frank Martucci, who had obtained an illicit debugging tool, and used it to skip over the copyright monitor code when reading books. But he had told too many friends about it, and one of them turned him in to the SPA for a reward (students deep in debt were easily tempted into betrayal). In 2047, Frank was in prison, not for pirate reading, but for possessing a debugger."

https://www.gnu.org/philosophy/right-to-read.en.html ("The Right to Read" (1997))

It was a very short time ago when ideas in this concept-space were, like, "this is colorfully paranoid nonsense and RMS needs to cut back on the acid", and not, like, "well obviously governments are going to do something like this, that's expected and normal".


The entire AI thing has lead to creators going full Right to Read mode recently asking for insane levels of copyright protection, which had they been under, would likely have had issues with their own stories.

Too many people want a locked down future and it's scary.


People will always prioritize their own interests.

"It is difficult to get a man to understand something, when his salary depends on his not understanding it."

This is going to be invective, but creators who feel insecure are naturally going to lash out against anything that they perceive to affect their income and/or reputation/image.

Great creators, great creations benefit from open sharing, per Gabe Newell's well-known quote. There will always be piracy, but that doesn't impact the creator because people who like a work want to support the creator if they can afford to. Fear of piracy comes from insecure creators, and that insecurity comes from the lack of skill or perceived lack of skill.

To put it bluntly, content creation is extremely oversaturated and most people don't create things that justify their price. I wish they could do what they love and not worry about sustaining themselves, but economic reality is economic reality.


> There will always be piracy, but that doesn't impact the creator because people who like a work want to support the creator if they can afford to. Fear of piracy comes from insecure creators, and that insecurity comes from the lack of skill or perceived lack of skill.

That leads to a reality where creators earn money from charity based on celebrity status, instead of from a trade of goods. A reality where every creator needs to be a celebrity to make ends meet is a horrifying one.


If you have too many creators, something will filter them out. It could be celebrity status. It could be marketing skills. It could be something else. But either way, it will be something... and the people who have a problem passing that filter will complain that it is unfair.

> A reality where every creator needs to be a celebrity to make ends meet is a horrifying one.

More horrifying than a reality where every creator needs business skills to make ends meet?


Currently you can be an anonymous creator and sell your stuff in various places. You can also be a celebrity and live from a mix of Patreon and social media. The suggestion to allow free sharing of everything would remove the first model. I’d prefer the first model to stay viable. And being a celebrity also involves business skills. You’re just selling yourself instead of things.


>Gabe Newell's well-known quote

I don't know it.

>economic reality is economic reality.

Not if the FOMC had anything to say about it since '08. And they did.


"Piracy is a service issue, not a price issue."


"Of all sad words of tongue or pen, the saddest are these: Stallman was right again."


I’m impressed at RMS’s creativity in depicting the dystopian society that we want to prevent, while at the same time failing to depict the utopian society that we want.


Is that not generally the case for all dystopia writers? How many utopias did Orwell write?

I think the consensus among fiction writers is that attemps to create a utopia will always become a dystopia.


Cory Doctorow has a prescient talk: "The coming war on general computation" from 2011 (12 years ago) in which he argues that all general computing platforms (OS, phone OS, browser) would face challenges by governments and corporations. This looks like another way to control content distribution and put more control in Google's hands. They've made a great strategic choice in building Chrome browser and effectively superseded Microsoft and Apple on desktops as a platform.

The talk can be found here: https://www.youtube.com/watch?v=HUEvRyemKSg

When people have means to consume or produce content without control any governmental bureaucrat will try to control this activity. History supports this argument.

No printing press > no cheap books > illiterate population > easy to control what spreads as information and what do not.

Printing press arrived > cheap books > growing literacy > control over the presses. Lenin's first targets were the post/telegraph (communication), bridges and railways (movement of people) and all big printing houses (Lenin's Full Collected works - vol. 32, page 282)

Radio arrived > Fixed Frequencies Radio sets sold & Governmental Radio jamming stations

TV > Licence to broadcast

Internet > Big Firewall of China & etc...

And don't even think about moving money freely as experienced by requirement to show why are you paying someone and those nice people from bank compliance departments.

The cost of enforcement in digital economy is way cheaper than before. The tools are there or can be built cheaply and sadly they're only built one way, from the government to the people. Open governmental data and strong society control over governmental actions is almost non-existent. "Brave new world" is here.

There should be a way to support important open-source projects with fundraising drives for features and etc ... Open source is one of the very few ways to sustain important digital freedoms.


"more control in Google's hands."

I'm much more worried about more control in the government's hands.

In theory at least, there can always be browser or search alternatives. And even if not widespread there will be options for motivated individuals who want a more permissive browser and internet experience.

But I can't escape the government - certainly not without the risk of imprisonment or other legal trouble.

I don't want to be controlled by either corporations or the government, but more and more they seem one-in-the-same. The government uses corporations to administer the control, with the force of law to back it up. As in this case - this is censorship that the government wants, but they force browser companies to administer that censorship under penalty of law.


> In theory at least, there can always be browser or search alternatives.

In theory, you can also get a non-Apple/Google mobile phone, but in practice you cannot. In some cases these corporations have more power than the government. It's also very easy for these companies to work with the government to give them access to your data, so there's not really much of a delineation anyway.


Just a reminder dumb phones exist, are still widely available, and very cheap. You may not see them much but you can buy them. It's far from theoretical


Imagine that you have a dumb phone that just makes calls and you have the unfortunate luck to be forced into using id.me while paying your taxes. Guess what your options are:

1) using the id.me app that doesn't work on your phone

2) doing a video call after waiting in line for several hours, which your phone may not have the selfie camera to do

3) going to a physical kiosk that may be hours away

Having a smartphone is practically required in modern life. Commercial services assume them. Government services assume them. Social interactions assume them.


Ah yes I love not being to use Uber , rent scooters, rent municipal bicycles, check in at my gym, use Duo app 2FA to use SSH at work, or open the doors at my apartment complex.

Turns out, dumb phones are not actually an option anymore.


Carry a smartphone that you only use to do those things. Powered off all the way when not using it.

Almost everything in that list, is not actually an impossibility for you to get around using. The first half is basically conveniences you're used to having. Buy a bicycle! Print your gym ID or provide name/phone number (this has worked at every gym I've been to)! Tell your job you need them to provide hardware if they want you to use the app. If your apartment really only opens with an app, I'd see if you can clone the RFID and toss it on a keychain.

Everything is an option, it's a decision of convenience. More and more I am thinking it's not worth the convenience.


Yeah… I kinda need this job. They’ve told me it’s a hard requirement. Maybe some day I won’t be in such a desperate situation. Until then your suggestions sound untenable for my situation, but thanks.

The apartment is not RFID/NFC. It’s HTTPS. Yes, that’s as insane as it sounds.

Also, “you can just hack the HTTPS API to trigger via SMS over twilio” is not a convincing argument towards “people don’t need smartphones”. Arguments towards your thesis are kind of going off the rails there, if I’m being honest.


I understand, but it frustrates me that your job gets to bully you into giving up your mobile devices for them to use. Depending on where you are, you may be able to make them provide a device or subsidize your bill/contract. For them to say it's a 'hard requirement' yet not provide for it.. it's like having employees pay for their safety equipment they need (which is illegal per OSHA). At the very least, if you're using your phone for work, look into tax deductions for your bills...

https://www.jdsupra.com/legalnews/cochran-v-schwans-home-ser...

Also re: the door situation, maybe carrying around a smartphone on airplane/powered down for this? Personally I also need a few apps, so I'd keep it around for that?


> it frustrates me that your job gets to bully you into giving up your mobile devices for them to use.

Hard agree, but it seems that in most places it's perfectly legal. Similar to telling W-2 car mechanics or property maintenance technicians that they must bring their own tools.


That's fair. Definitely write it off on your taxes, then. Could be upwards of $700/yr depending on your contract/device's worth, though it might be a partial deduction?


at least in Germany it's not legal to require use of personal devices such as phones for your job.


This is a good point. Your apartment building requires a smart phone to get into and therefore everyone lives in apartment buildings that require smart phones to enter. It is silly to discuss living without a smart phone given the homogenous nature of our shared reality.


Per this logic, what topics ever can be discussed?


Troubleshooting Bluetooth.


>I'm much more worried about more control in the government's hands.

To paraphrase the Office "find the differences" meme, "it's the same picture".

Corporations are all too excited to do the bidding of the government and vice versa. There's just some token resistance for show.


And honestly, the separation has a lot of utility. Companies like Raytheon or Lockheed might as well be DOD entities, but by having this layer of public private separation you are able to not only firewall sensitive technologies from certain forms of inquiry if they were held in the public government, but also have the opportunity to profit off these public investments through the stock of the private company.


See also: In-q-tel.


The more I read and think about where it will lead, the more I fear it'll go to some kind of digital control with varying degrees of freedom in different countries. Liberal democracies are not the norm in history and for the longest time freedom was achieved by high cost of enforcement. You can do what you want on your farm because no one can see/track what you do there. (The downside is that there are no centralized services available too...)

If people are easily influenced (on mass) and cost to influence them is low enough, the voting system can be gained and the only real mechanism to remove bad government would cease to exist.

I hope I'm wrong, but as Romans knew: “Two things only the people anxiously desire — bread and circuses.”

Now technologies can make this cheap and efficient and the system will change to a worse one, when you don't need so much cooperation from the govern, since you can control them much more efficiently.

Uygur digital control is a telling warning...


History tells us that societies evolve very differently and it’s a bit of a good intellectual exercise to think that maybe what you want now is not what people will want in the future.

That said, assuming human nature remains the same, I logically assume places with a larger degree of freedom will always thrive in comparison to places where there isn’t as much freedom (at least in the long run) simply because we know one central place dictating rules can’t account for all the trade offs and sooner or later will make a terrible decision no one can escape from, many times motivated by the flaws of the few people making those decisions. Meanwhile a larger degree of freedom allows people to choose what’s best for them at scale and trends happen more organically. This seems to be the idea defended in the book “Why Nations Fail” in general terms.

Also it seems to me that the governments don’t and can’t really control their populations as much as we fear it. To do that, it needs too much information, and even though we can process more and more information much cheaper today, I don’t think it makes the big picture any easier to understand. Any visualization of data is doomed to be reduced to simplifications that only tell a very narrow story of what is really happening, or gets locked in a machine learning black box that isn’t interested in helping you particularly. The more complex something is, the less likely it is for us to make sense of it, and I think all the subdivisions of human fields (politics, history, economics etc.) actually do more harm than good because when you isolate those things you lose perspective of how they’re interacting and a whole model of how something works can fall flat (see economists not being able to predict anything in practice).

The world or human behavior remains and I believe will remain unpredictable with all sorts of emergent behaviors in different scales, if that makes sense. Some even predict nation states are declining and will be replaced by smaller city-state governments that are closer to people’s needs or that different forms of organizations will be created to deal with different issues now that companies aren’t subject to one country in particular etc.


As the "cookie law" shows give a bureaucrat easier enforcement, you'll get more stupid laws enforced. The people who got them passed might be long gone from the system, but the laws would remain on the books and will be enforced more by more automation and AI.

I agree that absolute control wouldn't be needed or enforced and freer societies would do better in the long run.

But the main algorithm of populace control over the government can be broken by mass influence/mass control over voting systems. This is the thing that worries me most. Incumbents and people in power both benefit from the tools of automated enforcement of the laws so these would be invested in and improved.


>The downside is that there are no centralized services available too...

Downside?


Yes not all centralization is bad - roads, electricity and emergency services. Cities have economies of scale.


You've done what 99% of this website's userbase cannot, which is grasp this embarrassingly obvious conclusion.


Unfortunately, I think a lot of government control happens because that's what the people demand. Whenever there's a tragedy or major event politicians (the government) are asked to do something regardless whether it's effective or not.


Governments are encouraging monopolies and oligopolies in media, discouraging independent media, and even discouraging foreign media in general. They are leaning heavily on alliances with multi-billionaires in order to do things in partnership that governments have been explicitly prevented from doing themselves. It is in the interest of both the governments and the massive media corporations to eliminate smaller or foreign competition, making the relationship ideal.


There’s not a functional between Google and USG. They act as two branches of the same unit.


As much as I like Doctorow, Max Headroom’s authors were a few steps ahead of current thinking way back in 1988. (S2E13: “Lessons”)

The end game has nothing to do with limiting piracy or controlling political speech. Those are just a means to an end.

Ultimately, there will always be some people in power whose goals are illiteracy and weaponizing general purpose computation.

This phenomenon is not new. We produce more food than humanity needs, but warlords and first world governments routinely cause famines by weaponizing food distribution.


That's pretty bad - I don't think it's a good government pattern to move policing to corporations or the population. It messes quite badly with established principles such as innocent until proven guilty because corporations or individuals won't want to face the risk and it's also inefficient for each entity to figure out a process (and implement that badly).


It’s about convenience for the government. To take a site down by other means requires contacting ISPs to not route packets from an IP address or contact the site owner with legal action. This requires labor on the governments part.

Consequently there are a lot of gaps in this approach. For example, wahapedia is a mirror for Warhammer 40k rules. Games Workshop, the rule book authors, would be happy for the site to be inaccessible, but since the site is hosted in Russia, and they don’t respect western IP laws, it continues to stay up.

The less the government has to do, the lower your taxes in theory. Exporting government functions to private institutions is very common. For example, many legal agreements have forced arbitration clauses. It is perfectly acceptable for two consenting parties to agree to alternative dispute resolutions outside of court. Except one of those parties (the customer) has no ability to influence the wording of the contract and all vendors have the same arbitration clauses. Consumers pay for it in the form of lower value and higher prices.

Many municipalities require new construction to have homeowners associations. They don’t want to have to deal with all the resident disagreements. These HOAs charge a fee to residents for the upkeep of the services in the community (like a government), and have legal means to enforce transgressions such as foreclosure on your home (like a government). But there is also another government over it, they still charge you property taxes (which ostensibly pays for those services) and those taxes haven’t gone down.

So yes, not only is moving government functions to private entities inefficient, and there’s plenty of examples of to back it up, it just shifts responsibility around and ultimately costs regular people more.


I don’t think this is the only reason. Government gains much more control when they can count on bad incentives to avoid people from being able to go through the due process.

When the ISP (or bank) becomes not only the service provider but also police and judge at the same time, they can simply block you and you’re left with no alternative


That train has long left the station. The modern state has outsourced all kinds of policing, surveillance, propaganda, and other functions to corporations.


That principle is about imprisonment.

We have laws about driving properly, not because drivers are guilty of crimes.

"Chilling effects" is a better argument.

Infringing sites are already illegal, so blocking them is in realm of government purview. The objections are not about blocking these sites; they are about the ancillary risks of creating an abusable power.


[flagged]


that and KYC


Seems a poor fit for “government outsourcing…censorship.” Government didn’t do anything to cause it to happen. It looked to me like some companies exercising their first amendment right to choose what they allow on their wholly-owned websites. Nobody was stopped or even discouraged from setting up their own websites to spread their hysteria. But I know Elon Musk thought that was censorship. Idk maybe they didn’t require much constitutional knowledge on his citizenship test.


Which one?


I'm assuming he's referring to the constant attempts at suppression of information.


Much of this information was also BS.

The vaccinated are still pretty much alive and didn't die because of AIDS


1. That is not the point. Truly liberal and progressive societies should tolerate and be immune to disinformation without censorship.

2. What is known to be false now may be true later (and vice-versa). No matter how big the govt. or a company gets, it won't be omniscient.

3. Remember the well documented flip flop about masks. At one point, CDC/Fauci were the ones spreading disinformation. During the flip-flop, real information was censored. Also, the lab leak theory was initially ruled out to be 100% impossible and heavily censored, now the same folks are saying that it might have been possible.


Since the sibling comment has been flagged dead, I find it absolutely hilarious that the commenter who says "we should all touch grass" created a new account to just reply to this comment while sitting in a public park. Apparently, touching grass is not enough for them.

> What’s really happening is a bunch of armchair philosophers are engaged in prosaic armchair philosophy about how much of a police state the world is Meanwhile here I am at a public park launching Estes powered rockets You all should go touch grass. Sedentary exercise or language faculties is not healthy


There is no truly liberal and progressive society, and we are not immune to disinformation.

And Fauci had a reason for that flip-flop.

https://edition.cnn.com/factsfirst/politics/factcheck_e58c20...

What would you have done in that situation?


In theory, an easy workaround would be a clean fork stripped of blacklists etc.

But that is why there is an effort to introduce drm in browsers: to make you unable to use unsigned/non-lcomplying browsers to use the web at all.


The law would actually push people towards freer browser. Browsers made by multinationals like Google, Apple and MS would have to obey, but other browsers could ignore it as long as they don’t have a presence in France.

So the law works against the push to DRM, not for it. Oh glorious unintended consequences.


No, it won't. Sadly most people doesn't have that tech expertise. And how you would run an open source browser in a walled garden like iOS or similar?


You're now betting against the teenage sex drive of the whole planet We've seen mod chips in game consoles go from obscure to everyone-knows-someone-to-install-them, and thats with the brakes of cheater branding. Piracy is unstoppable. The pirate bay just won't die, and that's only 1 location and lost its importance long ago.

People will fight to access copyrighted works. Someone will package an access path in an easily accessible way, and hordes of kids will jump on it.

Netflix as easily accessible platform was the only working piracy solution with some chance, and corporate greed broke it.


> You're now betting against the teenage sex drive of the whole planet

Teenagers want porn. The “infringing sites” discussed in the linked article isn’t about porn. No one thinks that the French government is going to require that browsers block Pornhub, Reddit’s gone-wild subs, or Xvideos.

Your view of hordes of kids keen on pirating is rather dated. Sure, some people still pirate. But due to the rise in streaming and media-as-a-commodity, piracy is no longer even the same marginal cultural force that it was a decade ago.


> No one thinks that the French government is going to require that browsers block Pornhub, Reddit’s gone-wild subs, or Xvideos

Very wrong! France is currently deciding whether to ban five porn sites, including Pornhub, Xvideos, and XHamster.[0]

The new law mentioned in TFA has already passed one chamber of parliament unanimously, and will be passed later this year.[1] It won't just require phishing sites to be blocked by browsers. It'll also require porn sites to authenticate users through government websites (think OpenID but with the tax-filing website or national health insurance website, to check if age > 18), and block porn sites that don't comply (without needing a judge's permission).

It doesn't stop there. The new law requires sites that allow "foreign propaganda" (Russia Today, Sputnik) to be blocked. And though it's not directly relevant here, the law also criminalizes "online contempt" and hate speech, which includes "threats and intimidation against elected officials", and gives the government the right to legally require platforms to ban such people, and to legally punish these platforms if the person finds a way to circumvent the ban.[2][3]

Note that the French government can already block pirate sites (and does, including Sci-Hub and Libgen) without a judge's permission.[4] This isn't done in the browser itself, but all the above will be, and there's no doubt that this will be too eventually.

[0]: https://www.20minutes.fr/high-tech/by-the-web/4045390-202307...

[1]: https://www.lemonde.fr/pixels/article/2023/07/06/le-senat-vo...

[2]: https://www.vie-publique.fr/loi/289345-securiser-et-reguler-...

[3]: https://www.20minutes.fr/high-tech/by-the-web/4044754-202307...

[4]: https://www.lefigaro.fr/secteur/high-tech/piratage-sur-inter...


By the way, authenticating porn site visitors through government sites will be done through something extremely similar to Apple's Private Access Tokens (Privacy Pass) and Google's recent Web Environment Integrity (WEI) proposal.[0]

[0]: https://broken-by-design.fr/posts/proto-authz-porn/


There are currently multiple states in the US that require invasive age verification for porn or the site needs to be blocked. Why is it such a leap that they won't just require the sites to be blocked completely to "protect the children"?


Why would no one think that? Here in US we have various legislative efforts to make porn harder to reach.


>We've seen mod chips in game consoles go from obscure to everyone-knows-someone-to-install-them

To them being no longer relevant as security of consoles increased.

>Piracy is unstoppable

L1 DRM is very expensive to break. As the industry's security gets better and better that price will continue to increase. People who can break L1 DRM will not find it worth it to dump a lot of content or share it with a lot of people because they don't want their key to be blacklisted.


Don’t have the tech expertise to install Firefox? How did they install Chrome in the first place then? People are not stupid they are just lazy, Chrome works fine so they use that. The moment Chrome stops being “fine” they will switch.


Think of how WEI plays into this though. They’ll have to use Chrome or equivalent, eventually, to access any commercial site (same as how no banking apps will launch on a jailbroken iPhone). So, they’ll be forced to use a “pirate” browser but only to access unapproved content. Today iOS already doesn’t allow any other browsers except as skins over their Safari engine. Even if it’s possible within those rules though, what makes you think they would allow a future Firefox that “disables important integrity functionality” that Safari includes.


Firefox is adding functionality to disable extensions on websites.

https://news.ycombinator.com/item?id=36602193

What makes you think that they won't add a global website blocker too?

I say this as someone who uses Firefox. They changed when it stopped being just software developers and became a brand.


Of course, WEI will “fix” that. Every commercial website, Google, Gmail, etc. will force you to use Chrome, Edge, or Safari, which will probably use WEI. Those will also be the browsers that implement the blocklists.

Sure, you could also keep a free browser to browse the parts of the web that allow it, but those parts of the web will be starved of ad dollars and viewership, as sponsoring a “dark web” site (a term the proponents of WEI and governments would probably like to popularize for any non-WEI-enforcing site) may become inherently disreputable, and it may develop a reputation like KaZaA or LimeWire, as a hotbed of illegal activity and dangerous malware, scaring average people from “opening themselves up to” those risks by installing Firefox or whatever. Think of how few Apple users jailbreak, or turn off SIP.


If the government mandates MiTM DRM , the next logical step is making non-DRM illegal.


>but other browsers could ignore it as long as they don’t have a presence in France

As long as the idea it "out there", and a country like France does a test drive, it wont be just in France.


Next step, those browsers are declared illegal and users got to jail


Oh please..


But now that makes you a criminal and gives the government that control over you, should you come into their line of sight. Most likely you get away with it - as long as you otherwise keep your head down and don't make trouble for the rulers.


A non compliant website wouldn’t care about that though


A non compliant website wouldn’t be indexed as well.


Sounds like this would spawn an entire second internet.


Tor already exists!


That seems more encrypted then would be necessary. There would be the locked down DRM verified by Google internet then there would be the internet that just requires an open source browser and only works to get to all the non-DRM internet websites. Basically you would simply do nothing to DRM your site and you'd automatically become part of the open internet rather than the DRM internet.


Afraid to point this out, less people get the idea to enforce web integrity at the ISP level, like some of the efforts against music piracy / torrenting.


Right now with how the attempts are structured everything happens at the TLS level, which means anyone wanting to enforce that would require access to the SSL private key. ISPs and other actors already have the toola via DNS and IP blocking to enforce what they want.


Cloudflare already MITMs most of the internet so they will do it when the time comes.


I doubt it. It's much easier to make the ISP's block DNS, and perform deep packet inspection. Require domestic TLS to chain to the government's root-CA, so you have to allow government MITM.

Trying to force this in the browser is too difficult technically, and too easy to circumvent.


When Kazakhstan tried to MITM with untrusted certificate, Google quickly blacklisted this certificate. Hopefully it'll do the same for any other government or company, so nobody would even think of it.


The EU is currently proposing to mandate the inclusion of roots that have been government approved, and to limit browsers from removing/distrusting them without notice/approval.

https://www.eff.org/deeplinks/2022/12/eidas-20-sets-dangerou...


They could do that because Kazakhstan doesn’t make them much, if any, money. This amounted to cheap good will marketing.

If this were the EU or US, and Google risked losing access to that market, they would comply. Way too much money on the table.


Google wouldn't comply before first lobbying heavily against it both in government and among their users. The proposed laws would quickly become a major topic of public discourse.


As with other laws ther lobbying position is pretty weak in the EU. They (and other US based big tech) lost the last few rounds of the regulation / lobby game.

They don't employ (many) people here, don't pay a lot of taxes and generally don't do much cooperating on their own.

They can offer literal briefcases of money to politicians but, in General, that is not the way the EU works.


Remember how that went for net neutrality? It’s apparently very easy to get many members of the public to argue against their own interests these days.


Major in our circle probably, but just like most laws we decried as terrible, about half the time they will pass. Like DMCA, Bill C-11, etc. And Google will support anything that helps it maintain its dominance in the ad market in the parts of the world where they make their money.



*China has entered the chat


> Hopefully it'll do the same for any other government or company, so nobody would even think of it.

The security services in my country, Romania (an EU and NATO member), are already doing that, or something similar to that. For example trying to access https://sputnikglobe.com/ sort of times out, either way, it doesn't work.


Sounds like they're sniffing the SNI header and blocking based on its value. Completely unrelated to the Kazakhstan root CA fiasco.


Looks normal to me: https://www.ssllabs.com/ssltest/analyze.html?d=sputnikglobe....

Can you clarify what you mean?


That website (and others like it) is blocked in my country based on a political decision. Interesting that the guys from the Romanian secret services aren’t doing that by messing with security certificates, but the website is blocked nonetheless.


The browser already has built-in controls to prevent the user from visiting "dangerous" sites, and to say that "browser or DNS or SPI" is mutually exclusive is to ignore the Defense in Depth strategy of using all methods in concert, to ensure that at least one will catch the bad requests.

In Chrome, it's called "Safe Browsing", and it's currently optional, Standard, or Enhanced.


Also, corporations and governments should be careful what they wish for, because an iron fist may eventually convince a substantial number of people to either use alternative DNS servers or use Tor and [hopefully] I2P. Possibly not the majority, but enough that any overzealous IP-protection measures on the clearnet will be self-defeating.


I think that’s optimistic, China etc also crack down on VPN’s and related technology. You can also subtly discourage such things. Add a few random lag spikes to all encrypted traffic and see how people respond.


And then they'll ban those. Don't forget that in the end the state has a monopoly on violence.


In the case of US users and Tor, the situation is more complicated. The US military encourages Tor use because it helps to mask their own traffic (Tor was developed by the US Navy for this purpose, after all). It's unclear who would prevail in a political struggle between the copyright cartels and the military.


Yep, at the end of the day what prevents tyranny from taking over everywhere is the fact that the ruling class has to live in the same world and use the same economy as everyone else. You see this dynamic up and down the government. Big business needs to be able to access machines that don't have all this locked-down crap. I'm not super-worried about the copyright lobby's fervent wish to make it impossible to use a general purpose machine. They're going to eventually run right up against corporate America's full-throated embrace of open source.

Sure, ordinary people already are heavily spied on and restricted. But the machines doing the spying and restricting have to run their own OSes as well. The inverse of the 'who watches the watchers' problem.


Violence isn't a market, and continuing to parrot that nonsense gives a false credibility to forces which amount to efficient bullies that entrenched themselves by enslaving or genociding native populations. None of us signed actual social contracts, none of us signed forms agreeing to be governed.

Violence is a choice that no government can take away. They can only threaten violence of their own. What validity does a government have when it claims it has the sole right to hurt others, including you? That is a fiction that led to the current state of things.

What right does sovereignty give a state to oppress its people?


This is a silly objection. The reason the state has a monopoly on violence is because it took a monopoly on violence, through the application of violence and threats of violence.

> What right does sovereignty give a state to oppress its people?

Rights are given by states. Without states, you don't have rights, only capabilities. Rights come into existence when an alliance with a lot of capacity for violence imposes rules on the people within its reach that it allows itself to be bound by.

Governance is not a contest where you are awarded rule for being the best, or a trial where a wise man gives governance to those who deserve it. Governance doesn't care if you give it "credibility" or what "social contract" you have signed unless it decides itself that it cares about those things. The only credibility that a government needs is your belief that it will unleash violence upon you if you do not do what it says.

You have rights under government. Governments themselves don't need rights, unless they are subgovernments of more powerful governments that have granted them. Don't retreat into abstractions and fantasy. You can't defeat fascism by proving it wrong; it's not a Star Trek computer.


I see where you're coming from, but some governments also recognize "natural" or "God-given" rights, recognizing there are powers higher than they are that grant privileges or capabilities considered sacred. Granted, this set of rights will be different shapes and sizes depending on culture, but it's not so clear-cut that rights do not exist without government. There are moral rights that we can argue via philosophy. The state is truly only necessary to adjudicate conflicts between its subjects and maybe defend them.

I also concede it takes more than an argument to fend off government, but playing along with "monopoly on violence" is so defeatist and pre-loads conversation with a guaranteed end result, when that end is not actually guaranteed. It can be fought.


> What right does sovereignty give a state to oppress its people?

None, I'm just telling you what will happen. The argument was not that people consented, but that first they'll outlaw circumvention and then hunt you down for continuing to try. The point is that there is no technological solution to oppression. Some people here have a certain naïveté that everything can be solved with technology but that view ignores actual power in the actual world.


With 20,000+ non-statw homicides in the US last year it's hardly a monopoly.


Yeah, they misquoted the original phrase.

It's supposed to be monopoly on _legitimate_ violence.

Which is why organized crime and vigilantism are generally so much higher up on a government's priority list than single acts of violence. They represent legitimate threats to the government.


They represent subgovernments. All governments are overgrown street gangs. Royalty in Europe are the descendants of Roman generals who divided up the land between them after Rome fell.


I've always conceptualized them as competing governments personally (or, possibly, potential governments), not subgovernments myself.


> Don't forget that in the end the state has a monopoly on violence.

People have a monopoly on casting votes.


This would cross a line in the US where there would be 1A challenges, although there have been other stupid things accepted which are even more obviously unconstitutional. If they do this, I hope they do it on a very broad basis so the vast majority of people evade and it feels "normal", followed by legal, electoral, or other action to address the underlying problem.


Usually corporations are used to side-step 1A protections, because corporations are not subject to the 1A. Corporations were routinely "encouraged" to censor information throughout the last election and covid, at least. It was likely going on before that, and continues today.


Vivek Ramaswamy argues that these actions are still first amendment violations because the government pushed corporations to do this, under something called “state action in private enterprise.”


Yes, but while it takes years to work these cases through the courts USG can continue rights infringement with no consequences for its staff. And once the court cases rule against USG, it can either ignore the case or find new workarounds. 1A only works with popular support that it doesn’t have, most people only support free as in beer.


Ironically at the same time as the Digital Markets Act makes it legal to use third party browsers on the only platform this could affect: iOS. Missed the boat much?


The browsers all already have a centralized, real-time censorship registry. It's called "Safe Browsing" and run by Google and is used to block "malicious software". Everyone (incl Safari and Mozilla) uses it. It's got something like five billion clients.

Occasionally, there are false positives and you hear people screaming about it on HN because their personal site is now a giant red malware warning in 99.9% of browsers.

Google AFAIK has not yet been compelled to use it to censor at the behest of the state. It has existed now for many years.


Passing a law would be too much work.

Easier to just get it adopted as a W3C standard as with past DRM lockdowns.

That way all the browser manufacturers are just following orders.

https://en.wikipedia.org/wiki/Encrypted_Media_Extensions


This is precisely why I turn a skeptical eye to any standards efforts. Just like with law, if you control the spec, you control the ecosystem.


Feels like this would be akin to requiring a car manufacturer stop the car if it detects you trespassing. Feels both intrusive & difficult to enforce, which is always a horrifying combo.


e-Scooters and eBikes are already geofenced in this way. For example, speed limited to 5mph if you're in the wrong place (happened to me on a 35mph road) or they'll stop altogether if you enter a college campus, or attempt to leave the service area.


Rentals yeah, but not the ones you own.


You don't own software, not even open source software. You just license it.


Nah, you own free software. The problem is that you don't own the bike if they don't let you swap out and edit the software at will. If somebody sells you a safe but doesn't allow you to open it, they haven't sold you a safe, they've let you hold theirs.



sounds like a censorship mechanism

i'm certain that any website "suspected" of breaking the law will go through multiple bureaucratic hurdles where they need to prove their innocence to a committee, as opposed to someone else proving their guilt in a courtroom. in the mean time, sorry, your website is blocked because its election season and we don't want this information getting out right now.


I'm sorry, but even that is too optimistic. Your website will be banned and they wont tell you why. They will provide an appeal button that says denied when you press it.


This is easily achievable already and yet it is not happening. So consider that you are wrong?


That's because there isn't much legal pressure on browsers to censor. The pattern I described can be seen where there is such pressure.


It does not make sense: you would need region-locked browsers. That's already an impossible target. But then how would you deal with people just using proxies, VPNs, ssh tunnels?

It would just be easier for a government to block these sites at the ISPs as the article mentions and even that could be circumvented if the site is in another country.


The French government has been covering itself in glory of late hasn't it?


Is wget and curl next? Seems like a really flawed approach.


Wget and curl mostly likely don't count. Browsers are explicitly defined as applications for end-users, which wget and curl are typically not.

The idea here is to make it harder for the public to access banned websites. Tech savvy people will be able to recompile their browser from source anyways, just like they can easily work around DNS-based blocking and pretty much every blocking attempt, even the "great firewall".

It is mostly a punishment for services that don't comply with the rest of the law. By blocking it in the majority of browsers, it will drive away a lot of traffic.

Anyways, I don't expect that part of the law to pass, and if it does, it will be very unlikely to be enforced, France is a major economy, but I don't think it has the international power to do that, call me back when the entire EU or the US is on it.


> Browsers are explicitly defined as applications for end-users, which wget and curl are typically not.

By no coherent definition, though. Just by professional convention.


wget and curl give out html files, these are useless to the end user unless they are opened with other software, typically a browser.

I don't know of any online service that expects end users to use something like wget and curl, maybe in niche cases, or for personal use, but I don't think it can be considered a primary use case for these software.


What if I write a small proxy that uses wget in the backend[1] to fetch files and only use browsers to render the webpage/resources? Blocking at this level makes little sense. The French government is shooting itself in the foot (as usual).

[1] which I would absolutely do if legislators are stupid enough to pass this law. No one gets to control what I read.


"Cruelty and injustice, intolerance and oppression. And where once you had the freedom to object, to think and speak as you saw fit, you now have censors and systems of surveillance coercing your conformity and soliciting your submission. How did this happen? Who's to blame? Well certainly there are those who are more responsible than others, and they will be held accountable, but again truth be told, if you're looking for the guilty, you need only look into a mirror. I know why you did it. I know you were afraid. Who wouldn't be? War, terror, disease. There were a myriad of problems which conspired to corrupt your reason and rob you of your common sense." -- V for Vendetta


If I was a browser developer and that law passes, I would just block France from downloading our browser. Solve that problem right there.

Maybe they would stop Microsoft's ridiculous strategy to integrate their browser into the operating system.


I've been writing some science fiction that interpolates where things are going with the Internet and online surveillance (ala 1984 v2), but reality always trumps fantasy; this one hadn't occurred to me.


Laws are only as strong as the enforcement can be.

For commercial entities the government can go for financial or operational penalties to encourage compliance, at least if they operate commercially in the country in question.

But for open-source web browsers, which might not have any commercial entities operating in the country, how could they even enforce that law?

There's nobody to punish, nobody to coerce.


> But for open-source web browsers, which might not have any commercial entities operating in the country, how could they even enforce that law?

They’ll put something like a WEI token outside of the encrypted payload and force ISPs to refuse transit for anything that’s not attested by the “good guys”.


Much simpler: They'll make WEI-verification mandatory for all government sites. And then banking. And then anyone doing commerce.


Which encrypted payload?


Web traffic (https). Think of an “anonymized” attestation token in the same place as SNI.


While I’m proud my country has made it to the HN frontpage, I’m ashamed that it’s always for the wrong reasons :(

Of course this law will pass, like all the authoritarian bullshit other laws that did the past few years. Remember the one about the government legally using your phone’s camera and mic? This was mere months ago.


One thing I like to think about, when we debate these "how could this be abused?" laws...is how many unrealised futures we've already missed, both good and bad, when enacting laws.

Eg if absolutely no one fought for net neutrality, would we be in a world where we're all comfortable with IPSs dropping traffic "they don't like". I do realise this example probably isn't far enough in the past to truly have had a cultural impact like this, but you get the point.


A wonderful idea if we could always know that the government was always a good actor acting in good faith.

Since that is impossible, this is not a wonderful idea.


Are banned books good ideas? Maybe the ring of power is in of itself a bad thing.


You can ban books and censor websites however you want as long as you are a good person acting in good faith i.e. me.


The absurd thing about this is that a browser is just a single kind of IP client. If you want to stop that content you have to actually stop IP connections to the host IP address(es), and to all non-compliant IP addresses (vpn / tor servers) .

It'd make more sense to have the ISP do it, as they actually could have a meaningful effect on what you can / cannot connect to.


Instead of passing a law, the French government should publish a blacklist and encourage their citizens to use it.


Hopefully no... But seeing government actions I would say yes... Fuck the way the web is going


of course they will. keyword here is "infringing websites" which means there is such a thing as "illegal information" and that law enforcement must prevent you from accessing that information


There's absolutely no way that the West could go back to the long ago dark days of "illegal information" way back in [checks watch] 1995. Of course, in 1995 I could download the Anarchist Cookbook; hell, I could buy it at the bookstore.

I'm starting to suspect that secret police were always focused on illegal information, surveillance, and the prevention of communication between potential conspirators.


This law would inadvertently be a good thing for the open source movement.


Please do it, by all means! It's high time we go back to Gopher.


I am eager to see how they going to enforce these requirements on a locally built fork of Firefox.


So is this a counter example to Betteridge's law of headlines


So a list with all blocked sites is distributed to all browsers. Sounds like a good idea.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: