| ▲ | zamadatix 4 hours ago |
| I think, usually, in those cases it's that people believe the company did not really do anywhere near everything it could - it did the bare minimum it thought it could get away with then seemed shocked it wasn't enough to matter. Here, if any pair of countries have conflicting rules then you simply can't expose your service to both because it's plain impossible for you to block all means of VPN/proxy regardless of how perfect your service tries to detect it. There's no payment, there's no account, there's no anything - you're just serving DNS to an IP that reports to be out of Germany according to German law. At some point it stops being a mistake/malintent of the company and one of the user. Where that transitions probably depends on the person though. |
|
| ▲ | yorwba 3 hours ago | parent | next [-] |
| > if any pair of countries have conflicting rules then you simply can't expose your service to both Yes. This is also how physical products work. The internet makes it easy and the default to offer a service worldwide, hence also making it easy to get in conflict with the law worldwide. You have to pick and choose which laws to break, which laws to comply with by minimizing exposure, and which laws to comply with by making a tailor-made version for a specific market. |
| |
| ▲ | iamnothere 3 hours ago | parent [-] | | You say this confidently, but this is merely one theory about how things should work. If I make a product in my country, where it’s legal, and a buyer purchases it from me and then brings it to you overseas where it’s illegal, and someone in your county tries to sue me for it, they are typically going to have a hard time. (Unless your country is powerful enough to violate the sovereignty of my nation.) In most cases, you accessing my website is more like this scenario. Intermediaries (ISPs) brought you the product. I simply offered it to anyone who came to my “store” (server). I admit that this dynamic changes if you directly pay me for something. Your framework implies that every social website needs to make a decision on whether or not users are allowed to insult the Thai monarch[0], and then must block access to Thais if they decide it’s allowed. In reality nobody does this, although they may choose not to put a server in Thailand if they are worried about it. [0] https://en.wikipedia.org/wiki/L%C3%A8se-majest%C3%A9_in_Thai... | | |
| ▲ | logifail an hour ago | parent [-] | | See also the UK's Online Safety Act and the UK's regulator Ofcom, which stated: 'Ofcom told the BBC: "We are aware of this lawsuit. Under the Online Safety Act, any service that has links with the UK now has duties to protect UK users, no matter where in the world it is based." A service doesn't have to be based in the UK to be subject to the act, and therefore face action from Ofcom.' The US-based lawyers for the services in question take a very different view.... | | |
|
|
|
| ▲ | warkdarrior 4 hours ago | parent | prev [-] |
| > I think, usually, in those cases it's that people believe the company did not really do anywhere near everything it could - it did the bare minimum it thought it could get away with then seemed shocked it wasn't enough to matter. Yes, and Quad9 could have done better in the German court case. At a minimum they could have asked users to register and provide proof of residency, and then could have ensured that their DNS service is offered only to registered users. |
| |
| ▲ | crote 4 hours ago | parent | next [-] | | > At a minimum they could have asked users to register and provide proof of residency This would have been a massive burden to them, and (as we have seen from the ongoing data leaks) a gigantic privacy risk to its users. It would have also been a big overreach, as the German ruling would have mostly impacted non-German users. | |
| ▲ | zamadatix 4 hours ago | parent | prev | next [-] | | Let's take this level of user tracking for DNS would be accepted & fine by Germany as well as what folks were thinking was feasible for the company to do as a given, how does it prove the user+ip who registered is the user+ip who submitted the request instead of the place it got proxied? Or malware enabling the same? If you can solve this for me it would actually help a lot at work :D | | |
| ▲ | adrianN 3 hours ago | parent [-] | | Just shift the legal burden of ensuring that no unauthorized users use an IP to the legitimate user of the IP /s |
| |
| ▲ | necovek 2 hours ago | parent | prev [-] | | How would you imagine this could work? A recursive DNS resolver is identified just by an IP address for your system level DNS resolver to use (eg. in /etc/resolv.conf). Even if you assigned a random, secret IPv6 address for every individual user, they could simply share that with anyone else too. In IPv4, pretty much impossible. |
|
