Hacker News Reader

Comment by DoingIsLearning | Hacker News Reader

I will admit that after the RIAA/youtube-dl story I felt that it confirmed my belief that it was a mistake for anyone to host anything on US based servers. This takedown with complete lack of transparency from a French provider (OVH) really proves me wrong.

Unless this is some extreme security situation/investigation where it was being used for communication between groups I can't really see this holding up in a European Court?

As an aside Guerrila Mail/ Shark Lasers was my go to service for that kind of 'subscribe this' throw-away email. Anybody has recommendations for alternatives?

View on HN

OVH do have datacentres in a number of countries, a dig of guerillamail.com and WHOIS suggests they may have been hosted in Montreal, Canada.

Is 'Montreal' an approximation for Beauharnois[1] or is there another OVH data centre in the region?

[1] https://goo.gl/maps/g31VwjMtvr7GwCsf8

"With three offices in Montreal, Quebec and Toronto as well as a data centre in Beauharnois, OVH Canada offers a full range of cloud solutions"

https://www.ovh.com/ca/en/discover/canada.xml

The IPs are probably registered to their Montreal office but indeed, the data centre is in Beauharnois. Think they introduced their services there ~5 years ago.

Since the domain is using an ARIN IP it seems a decent bet that's where they were hosted.

>>> Unless this is some extreme security situation/investigation where it was being used for communication between groups I can't really see this holding up in a European Court?

I feel the need to point out that each EU country has its own judiciary system and laws. There isn't such a thing as an European court. There's are laws/agreements set at the European level that are supposed to trickle down to each country and the process is fairly complicated and messy.

It's a very strong misconception from US readers to think that there is an Europe court, like there is a supreme court or something in the US.

What is this then?

https://en.m.wikipedia.org/wiki/European_Court_of_Justice

> The European Court of Justice (ECJ, French: Cour de Justice européenne), formally just the Court of Justice, is the supreme court of the European Union in matters of European Union law. As a part of the Court of Justice of the European Union, it is tasked with interpreting EU law and ensuring its equal application across all EU member states under Article 263 of the Treaty of the Functioning of the European Union (TFEU).

The EJC is there to handle discrepancies between EU regulations and nations (not fully/correctly) implementing them.

So this is not a general supreme court. Cases which don't run in local law conflicting EU regulations can't end up there.

EU regulations don't cover everything and do often have large margins of interpretation. They are generally not laws but regulations about making laws.

So there is a good chance your case will never have a chance to end up there even if it continues to escalate.

Edit: also the ECJ does work different in the results they produce then you think, e.g. they can rule that a certain court action/law/etc. is in beach if regulations and anull it to some degree, but that didn't mean they can e.g. force gurillamail to be rehosted. At most they could "annul" a france court discussion that the takedown for given reasons was legal. Which seems similar but is a massive difference as they then could argue that the takedown was still legal due to other reasons and still win (or just delay it further).

This view is not accurate. There is at least the European Court of Justice[1], and there are directives[2], which are laws written and enacted by the European Union, without any national act being necessary. Of course, the Court of Justice (sadly) doesn't have a European Constitution to rule on, but it does overturn national laws sometimes.

[1]: https://en.wikipedia.org/wiki/European_Court_of_Justice [2]: https://en.wikipedia.org/wiki/Regulation_(European_Union)

Nice to know if you can afford to stand still while your case works its way through the courts for years. Most companies can’t.

The siblings are half-right; there is the ECJ, and a lot of law is harmonised, but far from everything. But it has nowhere near the political significance of the USSC. And both are appeal courts, so you have to exhaust your country's system first and be granted leave to appeal.

I don't really see there being much of a case to answer, although it may be possible to get the alleged secret law enforcement request. OVH terms of service will undoubtedly allow them to terminate your account for any reason.

European Courts are the ultimate court of appeal in the EU. In this instance I'd say the European Court of Human Rights would absolutely find shutting down these servers as a violation of the European Convention on Human Rights.

European Court of Human Rights is also not exclusive to European Union, other countries signed the convention as well and ratified at least parts of it. There appeals can reach ECHR and its rulings have to be enforced locally.

Human rights have to do with things like torture, unfair detention, having a fair trial, etc...

You are not going there because an hosting company shutdown your mail service.

Last cases for reference: https://hudoc.echr.coe.int/eng#{%22languageisocode%22:[%22EN...}

Actually, a hosting company challenging the police in jurisdiction where ECHR is ratified would go exactly there once it exhausts options in local courts. But not a customer of a hosting company challenging the decision of a hosting company.

.. on what basis? (a) you've not checked whether the OVH user agreement allows this kind of termination, which it almost certainly does, and (b) we don't know any of the underlying facts about the alleged police letter.

A court action might bring some facts to light, but it's unlikely to reinstate the service.

Without knowing the inside story, it seems like an overreaction for OVH to take down an entire service based on law enforcement requests, unless there's more to the story, which there probably is.

FWIW, DNSimple was blocked by an entire country because we adhere to our local laws in the US and we didn't take down a site that was illegal in their country. This is the Internet we have today.

10minutemail.com and anonbox.net are both good.

If I need a new service, I look at the list of temporary email services supported by the Bloody Vikings Firefox extension [1]. There are quite a few there.

[1]: https://addons.mozilla.org/en-US/firefox/addon/bloody-viking...

I personally use https://temp-mail.org/en/.

Unlike others I've tried before, they seem to have a fairly large amount of domains in rotation, making them difficult to block as a website admin.

Last time I had problems with throwaway email domains being blacklisted, emailondeck.com worked for me, they also seem to regularly change domains.

I don't know your use-case, or what your purpose for the throwaways are, but my solution is a domain I only use for email where *@mydomain.tld is redirected to something I read.

So when I register for hackernews I would likely just register hackernews@mydomain.tld, and if their data is ever leaked, or they sell it, I know who did it, or can block that email.

It's obviously not anonymous if that's your use-case, but it solves my issues of not wanting one email registered everywhere and eventually getting spam, and having accountability per service.

I do something similar, except that I add entries to the MTA configuration to do the redirects, rather than use a wildcard. That requires positive action (adding the entry), and I don't have to worry about spammers bugging me by just sending stuff to random addresses. If I start getting spammed (and it HAS happened) I can revoke the address by just removing the redirect.

Amusingly, spam is still getting sent to some of these addresses that I revoked years ago, only to get bounced. I guess it's too much work for spammers to clean the deadwood out of their lists, especially since that inflates the number of addresses they can sell. The good thing is that these addresses are excellent spam traps for fail2ban.

The US is a toxic jurisdiction as far as any technology is concerned. They were the ones to give us the wonderful gifts of forever Disney copyright and the DMCA.

This may be unrelated and a coincidence, but:

France has a strong and growing body of anti-terrorist legislation, and I believe that some of it prevents providers from discussing some law enforcement notices (I believe that the same also exists in the US, hence some companies disclosing that they have NOT received any such requests. So when they stop saying that, you know what's up).

As other commentators have stated, OVH have datacenters in multiple jurisdictions. For example the US and European services are distinct entities and while product offerings are similar there are some specific differences. Also worth noting that while they use support teams across continents, the teams rarely have much context of what's happening in the other continents (has been as issue in the past for my teams).

It is unclear which entity was providing the service to Guerrilla Mail.

8chan which was banned by USA based CNServers and Cloudflare uses Russian based : ddos-guard[.]net

This is only my personal opinion but considering how weak the European cloud market is compared to the US one, it wouldn't surprise me if European cloud providers would bend to police requests because they are already in a vulnerable position.

getnada.com has been great for me, I used to use guerrilla but it often got blacklisted on some forms getnada usually goes without issue

> I will admit that after the RIAA/youtube-dl story I felt that it confirmed my belief that it was a mistake for anyone to host anything on US based servers. This takedown with complete lack of transparency from a French provider (OVH) really proves me wrong.

There is a huge difference between these two cases. Most hosting providers in the world are not going to challenge law enforcement in their jurisdiction and will just cooperate. That's what OVH did, as everyone should have expected.

But at the same time most hosting providers in the world will oppose overreach of copyright trolls. That's what Github didn't do.

Still, if you need some minimal resilience it's never enough to rely on a single hosting provider from a single jurisdiction. Multiple different providers in different countries for frontend servers with some primitive DNS failover can easily solve this and similar problems.

"Still, if you need some minimal resilience it's never enough to rely on a single hosting provider from a single jurisdiction."

Or don't use a "hosting provider" at all.

A full rack at he.net with 15a of power is USD $350/mo[1] - and that's probably not a super competitive rate. You can probably do better elsewhere.

Now you are the host. The notices go to you.

I don't know why we have this collective amnesia about what it takes to run a simple website.

[1] At their Fremont, CA HQ building.

I thought the issue with doing that kind of thing is that they can easily go after the colo provider as well. "xxx is in your building, please pull the plug or you're liable also" is pretty convincing. Or am I mistaken?

Sure but then the solution is that you go and pick up the servers and move them somewhere else, instead of suddenly finding yourself with absolutely nothing and no way out.

Until you are served with a court order to preserve evidence for forensic inspection and then you are stuck with a powered off pile of hardware while you wait for the forensic analyst to show up and make bit level copies of everything; or you are served with a temporary restraining order/preliminary injunction forbidding you from reconnecting the hardware at all until the case is decided.

A better approach is to have a reverse proxy in a difference account/hosting provider. That way the take-down is of the proxy which should be minimal config and no data.

Setting up another reverse proxy in the event of a take-down should be minimal effort.

It then becomes a game of whack a mole if anybody wants to take down a service. I assume this is how The Pirate Bay stayed up for so long.

Downside is doubling bandwidth costs.

Reply on news.ycombinator.com