Hacker News Reader

Comment by lolidaisuki | Hacker News Reader

I actually saw the status code 451 in the wild.

First time I saw it was in December and after that in January, both on the same site. The site that was blocked was archive.is.

This block was targeted at Finland and none of the different Internet connections I tried could get to the site, I tried my home connection, cellular and connecting from my school network. It's a shame that anyone even thought of censoring such an useful tool for history and other legitimate uses. I wrote a thing about it to a Finnish newspaper and a few weeks after that the block was gone. I suspect that the newspaper conatcted archive.is and it was removed so they don't get bad publicity.

It was kind of ironical that I had to subvert the archive.is censorship to read an archived version of a thread discussing web censorship in Sweden.

I think this error code is a bad idea as it legitimizes censorship.

View on HN

Just to clarify: Archive.is decided to block all of Finland not because of some Finnish legal requirement, but because the guy running it had a bad experience in Finnish customs and wanted to have revenge of some sort. Not really censorship.

What a hilarious misuse of power. I hope my country doesn't piss off wikipedia or something.

And misuse of status code too. Rejecting a country because you had a bad experience with them should just be the general 403 Forbidden.

Would've been better to use 418 if he was just being petty.

The motivation for censorship doesn't really change the result. 451 is at least more honest than 403 would have been.

That doesn't sound like a good use of HTTP 451.

I don't think it legitimizes censorship. Rather, it makes censorship obvious and unmistakable. A generic status code (like 403) is indistinguishable from a technical error and obfuscates the existence of censorship.

A devious censor probably would not explicitly call out their censorship with a standard HTTP code.

It seems undeniable that this "feature" codifies censorship, making it more "acceptable".

"Oh, well they used the right code anyway"

back to approved activities

IIRC, the general rationale behind the 451 RFC was that this provides a means for a third party to communicate that they are censoring the content, presumably begrudgingly.

So, in the case at hand, GitHub is using 451 to communicate that a government censor has required that they take some content down, not that the company itself has decided to remove the data of its own volition.

If you send a DMCA takedown notice, you don't get to choose the status code that gets displayed after the content is removed.

I think the value of the status code is that it clearly calls out where censorship is happening. If a different status code was used, then you wouldn't know that it was due to censorship.

Interesting thing is, there wasn't any legal requests or censorship attempts by Finnish government. The maintainer of the website was angry at Finnish customs or something. (There was a slightly incoherent rantish post about that purportedly written by him floating around the internet but I'm not sure if it really was the person in question.)

edit. language + explanation.

Exactly.

Censorship (external legal request) exists and this is a fact. The mere engineering projection of it does not strengthen it. On the contrary, through the 451 status code we can know that you cannot have access due to an "external legal request".

Do you think you'd have found out and been able to do anything about it if you hadn't gotten that code? Legitimizing censorship is obviously not desirable, but having it masquerade as generic 404's doesn't solve the problem either, it just hides it.

> Do you think you'd have found out and been able to do anything about it if you hadn't gotten that code?

Yes because I really wanted to see that thing. If I get 404 on something I want to see I will try through Tor and I will try with at least a few circuits. And if Tor gets through I then usually test with other networks just as I did with this.

I know that many people probably don't do that and you have a valid point with the masking but a better solution would be stopping censorship, not a new errorcode

Well, I suppose the point is, we're not going to stop censorship with a vote from IETF.

But, we can enable Internet companies to better-expose when rights requests and censorship has been used to block information.

Before, all you'd get on GitHub (per the release) was a 403, which could have been any number of things and was, in any case, an obfuscation of why you couldn't access the resource. If a person doesn't see a reason to investigate, they'll just move on.

This gets us closer to conversations about censorship.

If I visit a website and get a 404 error, I'll assume that the website is down or my URL is incorrect.

If I get a 451 error, I'll know it's censorship and can use something like Tor to get around it.

Actually, I'm sure there will be some browser extensions soon to automatically use a proxy if a 451 error is returned.

But there's the rub: most of the time, most people aren't looking hard for something they know to exist. They are just casually passing through. The 451 is more about raising the alarm for that much larger group.

Stopping censorship would be good, but there are a lot of DMCA takedowns which are rightfully. Censorship is more complicated.

This status-code is a great solution to inform the public about it.

The problem with the DMCA takedown process is that it makes it easy to get information removed without having to prove anything, so it does get used for censorship (and harassment of competitors and to force anonymous speakers to choose between being silenced or revealing their identities in a counter-notice and ...)

It's pretty much the go-to thing for anybody nefarious who wants to have something censored without all the trouble and blatant impossibility of having their claims vindicated in court.

This code is meant for censorship, not DMCA. Replacing the content with "sorry, this thing broke copyright laws" is how you deal with DMCA, not stopping people from accessing whole sites.

It is not! Read the RFC - http://tools.ietf.org/html/rfc7725 - helpfully entitled "An HTTP Status Code to Report Legal Obstacles."

Those obstacles could be censorship, or copyright infringement, or illegal mathematics - anything.

That's what I was thinking as well. DMCA is just an excuse. Github already blocked content at the request of Russian government, and I'm sure they will block more stuff that they're not legally required to remove in the future.

Er, citation required? IME they do what's required by U.S. law and have previously been fairly principled about not complying with extrajudicial requests.

https://en.wikipedia.org/wiki/Censorship_of_GitHub#Russia

A 500 error doesn't legitimize bad server side code.

I don't think it legitimizes anything. Without it you'd just know the page was removed and not have any idea it was due to censorship.

I agree. Censorship hidden behind a 403 (or national security letter, for that matter) is worse than censorship for all to see. It's our response to it that legitimizes it or not.

451 legitimizes censorship about as much as 403 legitimizes hacking. Which is to say, not at all.

Reply on news.ycombinator.com