Hacker News Reader

Comment by mikl | Hacker News Reader

Seriously creepy stuff. I hate how VPNs are being shilled by e-celebs these days as a privacy improvement.

It’s just using a different middleman. One middleman might be better than another, but if you have a good ISP already, there’s no privacy/security benefits to be had by using a VPN when surfing from home.

It might be worth getting a VPN if you use sketchy WiFi often, or want to bypass geo-blocking or restrictive firewalls. But remember that you’re trusting the VPN provider with all your traffic. DNS is still not encrypted in most browsers, so this traffic is still a goldmine of marketable info. Sure, they can’t see what you post on snapstagram.com or what pages you visit on news.ycombinator.com, but they can infer a lot about your browsing habits from DNS queries.

View on HN

Besides the security implications, if there's no way to legally stream Disney content in my country and I desperately want to watch it for some reason I'll pirate it. Why should I jump through hoops to give them (and an unconnected third party) my money if they don't want me as a customer?

I'm making a genuine effort to keep all my entertainment above board by being a paying customer to Netflix, Amazon, Spotify, Google Play, YouTube Premium, Steam and a few others, but I have to say that my patience is wearing very thin with TV/movie studios and their idiotic licensing shenanigans.

What's worse, is that they can't snap a finger and distribute worldwide. They lobbied themselves into legal corners with all these licensing shenanigans.

They absolutely can if they choose to. They own the rights, they don't need nations' permission to do things with it. However, their lawyers need lots of time to create all sorts of artificially restrictive terms of service and silly contracts with partners rather than just opening the service worldwide.

That's absolutely not true. It's the reason movies like Coco are still on Netflix and not Disney plus. You can't just renege on a previous contract because you started your own streaming service. These things take time.

I was unclear, I meant that the restrictions are artificial; based on contracts and in-company reasoning, not that the law prevents them from letting users in other nations buy subscriptions. Yes, they can't reneg on contracts, but the only reason Disney+ isn't available in other nations is entirely of their own making, and they could let Ukranians or Vietnamese into Disney+ whenever they choose (aside from existing agreed upon obligations), there is no national-legal restriction.

While you are right Disney+ could open everywhere, it makes no business sense to launch in some countries with underwhelming media libraries especially when it's the crux of the Disney marketing.

Many countries that have "Media Laws" that define when movies can be broadcasted on streaming services.

> They own the rights

They don't, and they are tied into long term exclusivity contracts in many territories.

It's pretty well established that in the UK for example they can't launch the service until the exclusive first pay window distribution deal they have with Sky on all the Marvel titles expires, and that's pretty obviously on the 31st March 2020.

As I mentioned to someone else, I was unclear. I meant there's no legislative reason then can't let foreign users into Disney+, contractual obligations are agreements that expire, as opposed to a statute prohibition on being open to other customers.

A lot of it is totally new content; how could they not write up the contracts a few months ago to allow global distro?

About a tenth of 1% is totally new content. There's really a couple of documentaries, two features and the Mandalorian. And that's it.

They couldn't launch the service with just that - Apple are struggling a lot and basically giving away their service and they still have more than that.

Copyright law should have a way to allow the content be shared for free if the copyright holder block the distribution themselves with no good reason.

Define 'good reason'.

Anything where they (the copyright holders) provide content to one group (region, etc) for $X and you are willing to pay at least $X as well but cannot.

That isn't a good reason.

Yeah, reading back it is not a reason at all; just a solution I would agree with (as human and copyright holder).

In some countries, for some media, this is allowed.

Of course the USA tries to prevent this with all its might.

Why do you believe you're entitled to content that the content owner doesn't want to offer you?

Practically speaking, yes, people will pirate it if it's not easily available otherwise. But that doesn't make it morally right.

>Why do you believe you're entitled to content that the content owner doesn't want to offer you?

pirating something that you can't even legally purchase is about as close to a victimless crime as it gets. If anyone actually feels guilty about this they can donate the value to the against malaria foundation and have done the world a net good

honestly, I find the IP mentality of large companies like Disney immoral who hoard IP like a dragon hoards a lair of gold. I'd be in favour of 'use it or lose it'

Copying information is already victimless. No one is harmed or wronged by magnetizing some disks or tape a certain way in your house.

As much as I hate copyright if someone doesn’t want to sell something to you or licence it or share it they are under no obligation to. I’m sorry but why do you feel you have a right to any content? It’s just a movie/tv show/book.

Thou as a write this I consider the implications of it was educational and only available to a nation or race and not having it would put one at a disadvantage ala scientific papers...

The thing is; they do want to sell it to me; it will appear in a few months/years. At least in case of films/shows. So that ‘the copyright holder does not want’ is not true; they just signed contracts with actors, writers etc for a certain region to pay less and/or get more %.

Copyright is a specific legal right granted to authors, with the (ostensible) intent of balancing the rights of authors against the rights of readers. Copying a bunch of bits is legal by default, but we specifically outlaw copying certain bits under certain specific conditions. Copyright is not unconditional, universal or perpetual. In the EU, there is an element of "use it or lose it" due to the Orphan Works Directive - if the copyright holder cannot be located, then national libraries have the right to digitise and distribute the orphan work.

In the digital age, there is a perfectly reasonable case to be made for some kind of "unavailability exception" to protect the rights of readers in poorly-served markets and prevent anti-competitive hoarding of copyrighted works.

https://en.wikipedia.org/wiki/Orphan_Works_Directive

You're arguing "you don't have a [legal/moral] right" (which is true)

They're arguing "it's a victimless crime" (which is also true)

These are related things, but they aren't contradictory

> pirating something that you can't even legally purchase is about as close to a victimless crime as it gets.

I dunno. I’d say pirating something the owner isn’t willing to provide you at any price is at least as victimful (and a greater offense against the victim) than doing so for something that they are willing to sell you, but at an unacceptable price.

Nobody owns content as ownership does not expire. People are incentivized to create content with a limited monopoly of finite duration. However, this means when they fail to licence it and thus chose to forgo revenue there is zero moral obligation to respect the monopoly.

Watterson famously refused to license Calvin and Hobbes. That does not give you the moral right to start selling C&H branded content.

Jumping from pirating for personal consumption to selling someone else's IP is a bit much, don't you think?

It’s kind of an interesting edge case.

Trademarks don’t have set expiration dates, yet 1/4 of Disney’s toys are for someone else’s original IP. Snow White, Peter Pan, etc and nobody seems to have a problem with this. In fact the oldest US trademark in use fall under the same heading with a Biblical figure Samson wrestling a lion.

And in fact Trademarks do go away without Defence. Which means they can be abandoned at which point it’s fine to use em.

No one's talking about reselling Disney+ content.

Well, I would I agree that watching and not paying is wrong, but I am paying. In the end the show will appear on one of the streaming services I subscribe to and pay for. Like in the olden days I downloaded shows because of this region crap and then bought them on dvd when they came out even though I already watched them. The content owner apparently does want to offer it to me, just not here (sometimes I can drive for one hour across the border and then I can get it; how insane is that; also how is that different than switchting on a proxy of my neighbouring country?) and that is not acceptable (to me and many others).

This. I do what I can but if shows I watch suddenly end in ‘my region’ while it continues in another then I will find a way. It is the internet and it is global; the old way of regions needs to go; it has been gone for a while for but I want to pay for my Netflix to be the same as the US (etc) one. It is not though; I do not watch too much but when ‘they’ get me hooked and then run seasons behind another season, well... I was explained why it is that way, but, like you, that wears thin these days; they had at least a decade to fix it for new content but they keep doing it.

"It might be worth getting a VPN if you use sketchy WiFi often, or want to bypass geo-blocking or restrictive firewalls. But remember that you’re trusting the VPN provider with all your traffic."

I never understand this false dichotomy - especially in a forum which is named ... let me check ... "hacker news".

Just set up your own.

It costs almost nothing to run a EC2 instance in the region of your choice (or at some other provider like GCS or whatever). There are keystroke-by-keystroke instructions everywhere on setting this up.

Extra points for adding the extremely trivial and also very low cost steps of signing up under a corporate name and removing your personal identity from the account altogether.

Some more extra points for multiplying the almost-zero-cost by 3 or 4 or 5 and spinning up extra copies of your endpoint in multiple regions (or even providers) and manually (or automatically) switching between them.

You don't need to trust anyone - adjust your threat model all the way up to "near nation state" (in the case of Amazon or GCS) and assume these actors could already discern all of your Internet traffic even if you weren't doing business with them.

Christ.

Could you provide a good reference for the process you describe, or maybe just a good set of search terms?

I'd like to pursue this, but have just little enough experience with ec2 to not be composing effective search terms.

I think one of the interesting option out there is: https://github.com/StreisandEffect/streisand

Waiting for https://github.com/StreisandEffect/streisand/pull/1668 to be fixed though.

Hey, I wrote the PR you just linked (#1668). Was there an issue with the code changes you ran into? Just asking since you said you were waiting for it to be fixed. If so, I'd love to know what the error was so I can test/fix it. Or did you just mean the underlying issue (ACMEv1 protocol being deprecated)?

Hey, thanks for the fix. I was indeed able to spin off a Streisand server using it without any error <3!

Hey there, I found an issue in the PR recently that affects the auto-renewal process. Nginx will still serve the old certificate after renewal succeeds since it's never restarted or reloaded. I have another PR open to fix this, but there's a manual way to apply the fix if you're so inclined (and you still have that Streisand server up and running).

Obviously this only applies if you don't plan on destroying/recreating your Streisand server after the newer PR gets merged (EDIT--just got merged). But just in case, the steps are pretty easy (it's in the PR here too: https://github.com/StreisandEffect/streisand/pull/1688):

  [root@streisand]# cat > /etc/letsencrypt/renewal-hooks/deploy/01-reload-nginx.sh << EOF
  #!/bin/sh
  systemctl reload nginx
  EOF
  [root@streisand]# chmod u+x /etc/letsencrypt/renewal-hooks/deploy/01-reload-nginx.sh

If your cert was already auto-renewed (unlikely given the timeline), you'll also need to run systemctl reload nginx to serve the new cert, since the deploy script wasn't present when certbot ran the renewal.

https://github.com/trailofbits/algo

It’s an Ansible playbook for easily setting up a VPN with good security defaults. It’s so easy and really the only knowledge you need to know is how to get api keys for the provider of choice.

https://www.digitalocean.com/community/tutorials/how-to-set-...

Their tutorials will hold your hand all the way to the end.

This reminds me of the infamous comment when DropBox was introduced and why geeks don’t get it.

https://news.ycombinator.com/item?id=9224

For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.

> It costs almost nothing to run a EC2 instance in the region of your choice

I might be wrong about EC2 pricing, but at least for me, ~$11 per region is not "almost-zero-cost". Unless we're talking about on demand instances.

I wonder if there is a community run VPN service to utilize instances more efficiently.

[1] https://aws.amazon.com/ec2/pricing/reserved-instances/pricin...

No need for EC2, you can use Digital Ocean or Hetzner Cloud (GDPR ftw) to cut the costs.

> No need for EC2, you can use Digital Ocean or Hetzner Cloud (GDPR ftw) to cut the costs.

Throwing GDPR and `ftw' in the same sentence. Hmm. No GDPR does not work that way hah. At least not in the global context.

GDPR only applies to you _if_ you happen to be a European Union citizen.

> GDPR only applies to you _if_ you happen to be a European Union citizen

There's nothing in GDPR that has anything to do with EU citizenship.

1. GDPR applies to the processing of personal data if the controller or processor is "in the Union", regardless of where the person whose personal data is being processed resides, and regardless of where the processing takes place.

2. It applies to any data subject that is "in the Union".

All the places in it that you might have expected it to say "Union citizen" instead say "in the Union".

> It costs almost nothing to run a EC2 instance in the region of your choice

Sure, the instance doesn’t cost much, but bandwidth does in the case of AWS and GCS. Streaming 4K video chews through bandwidth.

AWS Lightsail is available in 13 regions and comes with a few TB of bandwidth. https://aws.amazon.com/lightsail/pricing/

> Just set up your own.

This entire thread is about using a VPN to watch Disney+ outside of geo restrictions. Many many people use VPNs for this purpose and no other. You can't trivially do this on your own at all. You're making it seems simple, getting an VPS with an IP that won't automatically be banned by all sorts of services looking to protect themselves against botnets and the exact sort of geofence hopping that people want to do is extremely difficult.

I anecdotally have experienced exactly zero service interuptions while using various VPS providers around eastern and western europe while accessing websites. If you avoid the big name providers they dont seem to block you.

Have you checked to see if ec2 isn’t blocked by Disney+? I would expect that to be blocked. I think Google blocks most ec2 IPs. Going thru 10 GB of data per day would have the total cost above $1/day. Not as cheap as the post makes it seem.

Be aware that a lot of streaming services block traffic that doesn't originate from residential IPs, AKA Digital Ocean, AWS, Azure, Google Cloud, Linode etc. Apparently BBC even uses a whitelist instead of a blacklist. ISPs give them the list of ip addresses they use for individual customers, and those are the only ones permitted. No VPS will help you in this case, trust me, I've tried.

If the ispes use dymanic ip assignments they have given an ip range to the bbc. Try a few proxies in the uk you might find a machine on the range.

Residential proxies exist.

True. And I bet that most all of them either use botnet slaves, or people running Hola, Oxylabs apps, and other stuff like them.

>or people running Hola, Oxylabs apps, and other stuff like them.

Those are also botnet slaves.

Using a cloud provider means high bandwidth bills, being blocked by most sites with IP blacklists, and potentially kicked off and banned by the cloud provider for violation of TOS.

You also won't have any anonymity since you're billing details and instances are all logged permanently. It's not really a viable alternative.

I do 1 to 4 TB if traffic in my house each month. That would cost $100-400 each month if I ran it through EC2.

Could you use Amazon Lightsail? The $20/month Lightsail plan includes 4 TB of outgoing bandwidth. ($10/month plan includes 3 TB, $5/month includes 2 TB, and $3.50/month includes 1 TB).

That'd be about $5 a month on Hetzner.

Extra points for adding the extremely trivial and also very low cost steps of signing up under a corporate name and removing your personal identity from the account altogether.

Unless you're paying Amazon in bitcoin you're not removing your personal identity from the account.

Vultr is one provider you can pay in crypto I think; any others?

You have to make your first payment via credit card so it's not anonymous unfortunately.

joepie91 maintains a list, but it looks like it's a couple of years out of date: http://cryto.net/~joepie91/bitcoinvps.html

Ah I did not know that; I inherited an account from a client. Thanks for that list.

EC2 is one of the more expensive options when you add up the bandwidth required. There are tons of small vps and bare metal providers which are cheaper (people named Hetzner, there is OVH and tons of other smaller ones). There is also less chance these are blocked as the streaming providers might not know about them.

Friendly reminder that in the UK all ISPs are required by law to keep your entire browsing history for a year, and that history can be accessed by few dozen agencies, warrant free. That's why I use a VPN personally.

Exactly, they're generally more trustworthy than most governments. Security is about probability and is never 100%.

If you only use HTTPS they can track your DNS queries but they cant track anything other then that. When you do a google for something so let us say google.com?search=searchTerm they see a dns lookup for google.com. They will not see ?search=searchTerm or anything else. They will see a connection open between your computer and another IP after that. In the future that will stop becoming a problem because there will be DNS over TLS or DNS over HTTPS which will even hide your DNS lookups. Which means all the ISP will see is you made a TCP connection to X. Theoretically they could just do a reverse lookup for that IP but that is not always easy.

Except that they cant really get your browsing history. Just the domains you used. At least on the 90% of https sites most ppl visit

> * Seriously creepy stuff. I hate how VPNs are being shilled by e-celebs these days as a privacy improvement.*

You may enjoy Tom Scott's video:

> I tried to write a more honest VPN commercial. The sponsor wasn't happy about it. • Get ■■■ days of ■■■ VPN free at ■■■■.com/honest

* https://www.youtube.com/watch?v=WVDQEoe6ZWY

I already did ;)

A VPN provider is basically a choice to trade one country’s passive adversary for another. I.e., if you’re in the US and using a VPN with German corporate headquarters, then your Internet transactions are able to be wiretapped by the German government, but not by the US government. Either way, yes, your data will also be wiretapped by your carrier themselves and sold on the open market—but not usually in a form that will result in legal problems for you, since ad-targeting data tends to be semi-anonymized (in the sense that it isn’t in a form where a court would accept it as evidence of who you are; not in the sense that it couldn’t be used to deanonymize you by a sufficiently-motivated private researcher.)

Actually, legally speaking, by using a German VPN you are effectively allowing the NSA to spy on you, since the traffic is now “overseas” — which is always fair game for any US agency. Conversely, you might be protected from German surveillance (depending on German law).

(This said, obviously no agency is going to come after you for the occasional lootin’ of moving pictures, and if you are doing anything more serious, then you should have your own VPN infrastructure.)

This is correct, however in theory the NSA is not allowed to spy (let's not argue about "wittingly" here, I get it) on American citizens without FISA or 702 approval:

https://www.newamerica.org/oti/blog/scope-standards-and-prot...

So if they did not know you were an American through your identifiers, they could intercept foreign traffic. However, once they identified you they would need to stop unless the above exceptions were met. IN THEORY. Exceptions have occurred, the most egregious that I can think of is that the FBI has NO ACCOUNTING WHATSOEVER of how many agents accessed the 702 database:

https://www.justsecurity.org/66622/how-to-address-newly-reve...

Yeah, they'll just ask the German intelligence service to spy on Americans for them using NSA tools.

https://www.spiegel.de/international/world/german-intelligen...

Wasn’t the whole point of five eyes that we’d spy on the British and they’d spy on us and merrily round we go, merging data together to bypass domestic spying laws?

This is why I hate Canadian ISPs.

Their in-Canada peering is so terrible, it's common for local Toronto traffic to have round-trip through Chicago or NYC.

Yep. Bell, Telus, Videotron, Rogers have preferred to interconnect in the US for a long time (Chicago & NYC). During the mid 2000s the CRTC made bell and Rogers peer domestically over an OC12 (622Mbps) which was congested all the time (they shed some of load into the US). The Canadian IP transit market was a disaster until Cogent came into Toronto at 151 Front which paved the way for several other providers after.

In that case a Russian VPN service is indeed preferable.

> A VPN provider is basically a choice to trade one country’s passive adversary for another.

Plus, whatever VPN provider you're using. Unsurprisingly, most seem to be based in countries with very lax telecommunication laws and that make it very easy to start shell companies.

Yes, pretty much this.

The Lithuanian government has no interest in me, and even if they did, they have no jurisdiction here. One should always be more interested in privacy from the government that has authority to no-knock raid your home than the one that does not.

> Either way, yes, your data will also be wiretapped by your carrier themselves and sold on the open market [ ... ]

Woah. Hold your bong son! ;)

Any reference to documentation or any information of what you mean by `sold' on the open market?

If you wanted to prove a point by saying that internet is an insecure medium then yes I agree but `tapped' and `sold' is a whole different ball game that I am not aware of. At least in the internet I know of.

>But remember that you’re trusting the VPN provider with all your traffic.

May I suggest hosting youe own VPN using Streisand (https://github.com/StreisandEffect/streisand)? It's an absolutely fantastic VPN that runs on just about any cloud system out of the box (or your own hardware of course).

Right now I use Linode for hosting ($5/month) but there are lots and lots of other ways to set it up.

Importantly, setup is easy for all kinds of clients, including mobile devices.

Making your own VPN sure seems like the safest option but something as popular as Linode won’t be of a use to someone who wants to stream geoblocked services as they most likely are already blacklisted from many.

> if you have a good ISP already

That's a big IF. Not all of us share the luxury of being able to get internet service from companies like Sonic.net.

There is currently a difference in business interest for VPNs and ISPs. ISPs sell your data, since people mostly don't have much choice here anyway. A VPN service who becomes known to share data can probably close their business soon, new ones will quickly fill the void. They have less infrastructure requirements than ISPs and a subset of users with different expectations to privacy.

So yes, I do think there is quite a difference, although you should still be critical of your VPN provider.

I disagree. The comments here are based on a specific threat model. There are many other threat models where a good VPN dramatically increases a users security.

One middleman might be better than another, but 10 middleman are better than 1 if you are truly interested in mitigating the invasion of your privacy. There's nothing preventing you from using multiple VPNs to make it harder for any one middleman to build a profile of your internet activity.

Which is basically TOR

> Which is basically TOR

Last time I checked Tor's technical paper (probably been 10 or so years), it stated the fact that a relay? node in between can only decrypt the information required to route to next hop and not the actual packet's payload. Is that correct or am I dreaming?

Also, I recall that if someone malicious flooded the tor network with malicious exit nodes, then all traffic details can be `inferred' right? i.e., the assumption was that exit nodes need to route the packet to destination thus it needed to look at every packet but couldn't infer the originating IP address (based on my dated knowledge :))

If a malicious person now floods the tor network with bazillion exit + relay nodes - then essentially all contents (payload + IP src/dst) can be aggregated. Is this still problem in tor network?

Also worth noting that while VPN providers don't care what DNS servers you use, the geo-blocking protection features usually require that you use their DNS servers.

Why can't your VPN see what pages you visit on sites? They can see every URL you request, can't they?

For https, the only thing sent in plaintext (and this is only if you don't use DoH or similar), is your DNS query (google.com). The rest of the page (search.php?=goat+snuff+videos) is encrypted.

Ah, I see. Thanks!

Yes. To add, any number of middle boxes during egress from the VPN provider can also sniff the SNI in TLS packet (SNI stands for Server Name Indication and stands on its own as a plain text traffic) before a TLS sessions is established (assuming DoT/DoH DNS scheme is in use)

Effort and RFCs are underway to establish what would become part of TLS protocol stack. One of which is eSNI (encrypted SNI).

If you’re using “sketchy WiFi”, you’re still more than likely using https so your traffic is encrypted.

The VPN providers pay the bills for them. Why would they not shill them?

Yeah, why would someone ever consider their moral responsibilities and credibility before endorsing a product they do not understand the technical details of?

I get what you're saying, but that would then mean that you couldn't advertise essentially anything. Chances are very high that you will never get an endorsement/advertisement deal for a product that you do understand well.

There is lots of advertisement you can do without making misleading (or even downright false) claims.

Not that advertising mobile games or g-fuel is great, but you’re at least not pushing (dangerously) false claims on people and imperiling their privacy and security.

> but if you have a good ISP already, there’s no privacy/security benefits to be had by using a VPN when surfing from home.

This is just not true. You cannot sign up for an ISP without disclosing at least your name and address. Many VPNs support complete anonymity.

It's a different middle man that--if you choose the right one--will absolutely know less about you.

How are you going to access a completely anonymous VPN provider without a non-anonymous internet connection?

If your traffic is interesting enough, the money trail will eventually lead back to you.

Micah Lee did a talk about how he does it. In essence he uses Tor to connect to the VPN. He also explains how to pay for the VPN anonymously.

I think it was part of his Qubes OS talk: https://youtu.be/f4U8YbXKwog

Reply on news.ycombinator.com