Hacker News Reader

Even DNS services are kicking people off. AR15, a widely trafficked gun forum with an e-commerce store was just kicked off of GoDaddy.

https://www.washingtonexaminer.com/news/amazon-godaddy-boots...

I don't the know the details of that case (and I don't expect the WE reporter does either). It seems as if GoDaddy refused to continue hosting the site. That's quite different from providing just DNS for a server owned and administered by the organization.

From linked article: “As a result, we[=godaddy] informed the site yesterday that they have 24 hours to move the domain to another registrar, as they have violated our terms of service" i.e. domain, not hosting.

Their registrar is and was epik.com, starting in 1997 according to whois records.

I can't find an obvious link between godaddy and epik (though one may exist).

Their current DNS service is provided by ... AWS :)

I'm not convinced that the quote from godaddy is technically informative here, though using the word "registrar" would seem to be more indicative of something other than hosting.

No, Epik is current. They moved this week after GoDaddy set them to ClientHold (which doesn’t resolve)

Source: a thread on the forum

Wierd, since whois says:

   Domain Name: AR15.COM
   Registry Domain ID: 984217_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.epik.com
   Registrar URL: http://www.epik.com
   Updated Date: 2021-01-12T19:30:31Z
   Creation Date: 1997-03-28T05:00:00Z
   Registry Expiry Date: 2023-03-29T04:00:00Z
   Registrar: Epik Inc.

I guess "Creation Date" refers to the original registration of the domain anywhere rather than with the current registrar.

Epik didn't even exist in 1997.

> I guess "Creation Date" refers to the original registration of the domain anywhere rather than with the current registrar.

Correct. Even more interestingly if you backorder a domain name owned by another person and that domain name expires, the creation date reflected in the WHOIS record once you obtain it will be the previous owner's creation date, not the date you obtained the domain. I think this behavior varies by registrar but that is how it seems to function on GoDaddy.

Transfers between registrars do not usually reset the "Creation Date". Actually the creation date field is not correct anymore for most domain names. Some registrars just show a fixed date such as 1985-01-01.

> AR15, a widely trafficked gun forum

Given the amount of time it's been openly operating, if there was anything done related to gun trafficking, the ATF would have shut it down long ago.

Just because a site has a LEGAL private sales section and you don't agree with it doesn't mean it's "trafficking".

it may have simply been an opportunity for a better choice of words. in this case, i think they meant trafficked as in heavily visited.

I meant site traffic, yes. Thank you for clarifying.

I think this is an English thing. That “widely trafficked forum” means to me that it is popular. If I wanted to imply they were a part of trafficking I would write “ar15 a popular forum for the trafficking of firearms” or something like that. Trafficked does imply the illegal part, but the way it’s written that makes no sense.

Meanwhile on top of HN today:

https://www.nasdaq.com/articles/pirated-academic-database-sc...

You forgot:

4. Their hosting provider could pull the power/network from their cabinet.

5. Law enforcement could just come and get their servers.

Both of which definitely happened in the 90s, and no one complained about.

I'm waiting for the not so distant possibility of power companies deciding to cut service to companies who host services they don't approve of. This is not a joke.

Luckily, since they are utilities, they can't.

So, ISPs should be a regulated utility, then?

For: yes, we should have regulation that ensures net neutrality, right down to "complete ignorance of the bitstream".

Against: ISP needs to cover more than just the last mile, and for everything except the last mile, competition seems like a positive thing (though potentially wasteful).

So I'd like to see all physical layer providers bound to absolute net neutrality (service and contracts can never be pulled based on contet), and the last mile regulated similarly to other utilities.

Yes! Most developed countries regulate them as regional monopolies anyways.

I thought about that too. But utility companies ARE legal monopolies. So you DON'T have a choice of providers.

Jeff Bezos wants us to think of Amazon as a utility, but this is obviously one way that it is very different.

I definitely forgot about 4, but since the colo provider is also likely the ISP, I think this is effectively covered by 3, generalized to "ISP cancels its contract based on your bitstream or other reason".

5 doesn't really cover the scenarios that I think we're talking about. Yes, if you believe that we live in a fascist, near-fascist or just plain punitive state, then fear of law enforcement is probably going to make this concern rank fairly high for you. But I think for most of us, if law enforcement is coming to remove your servers from a colo facility, something much bigger is going on.

Do you think Parler's servers would still be in their possession if they had bare metal at a colo? I'm pretty sure the USSS would have already grabbed them to investigate threats against the life of the Vice President and Congress. In fact, being in the cloud probably saved them.

It's a good question. Did the USSS do anything re: investigating Parler while it was still up on AWS? What did they do? Did they grab servers? Did they grab anything?

Most likely yes, but of course we'll never know.

From your question & answer, I assume that you think it likely that the USSS (or FBI or whoever) would have moved to grab the hardware had there been hardware to grab?

It happened many times to Pirate Bay and plenty of people complained. They just had options on how to route around it.

Also, the pirate bay is still alive to date, so clearly it's doable. They've seen orders of magnitude more deplatforming than Parler did and they survived it, same for sci-hub. This is proof that it very much is possible to survive online, Parler just doesn't either doesn't have the skills or doesn't want to put in the effort.

They want to make as much noise about it as possible, because Parler has an axe to grind. If they got back on air too quickly they wouldn’t be able to make such a fuss.

>I believe that even the progressive end of the tech community would have been extremely negative about any company that did any of these 3 things

Strongly disagree. The comments here would be overwhelmingly in support with crap like "you can't force a private company to give you a certificate!"

Lets Encrypt has (AFAIK) no TOS that would provide any basis to revoke a certificate.

Looks like they can refuse to issue you a certificate:

>"ISRG may, in its sole discretion, refuse to grant Your request for a Let’s Encrypt Certificate, including for any lawful reason stated or not stated in this Agreement."

From:

https://letsencrypt.org/documents/LE-SA-v1.2-November-15-201... (Section 3.3)

Reading the rest now to see if they can revoke.

Edit. Aaaand there it is:

>"You also acknowledge and accept that ISRG may, without advance notice, immediately revoke Your Certificate if ISRG determines, in its sole discretion, that [...]

(v) You have violated any applicable law, agreement (including this Agreement), or other obligation;

(vi) Your Certificate is being used, or has been used, to enable any criminal activity (such as phishing attacks, fraud or the distribution of malware);

(ix) ISRG is legally required to revoke Your Certificate pursuant to a valid court order issued by a court of competent jurisdiction;

(x) this Agreement has terminated; or

(xi) there are other reasonable and lawful grounds for revocation "

OK, so I was at least somewhat wrong, since presumably (xi) is the means-what-you-want clause.

Refusing to grant the initial cert. seems unlikely for a new organization, so revocation is the key problem. And indeed (xi) is a problem there.

I wonder if LE really thinks this way. Their primary role is to say "foobar has certified that they really are foobar". I wonder how suspectible they are to the sorts of considerations that have driven FANGT to take the steps that they did.

It's likely more of a failsafe. All CA's, registrars, DNS providers, CDN's and hosting providers have some variant of that wording so that they can terminate your account without facing legal recourse. It's easy to miss it, some AUP's are massive and default to tiny font.

Did you just refer to using global cloud providers as "dumbification of online presence?" I'm not even sure how one comes up with that.

REAL programmers use a magnetized needle and a steady hand

https://xkcd.com/378/

F** that, I use Butterflies and Murder Hornets.

when my code doesn't work. I send in the murder hornets for retaliation.

easy - think about the pain and toil of standing up a webapp in 1992, compare it to logging into aws and spinning up a template that uses managed databases and lambda functions with some templating engines, write minimal code, lots of configs, etc.

the latter requires much less knowledge and enginnering than the former.

the process has been dumbified

There were only a handful of websites in 1992, all using CERNLIB [0] and was easy to setup. AWS is 10000x more complicated to understand and setup.

[0] https://cernlib.web.cern.ch/cernlib/

That's only true if you plan to use some of the many AWS "services".

Get an instance, choose some linux distro image that comes with ssh and nginx installed, start it up, configure a few files, grab an elastic IP, you're done.

I set up the first public web server in the pacific northwest in 1993. It wasn't that hard, but mostly because I already admin'ed the machine(s) it ran on anyway.

OK, "dumbification" is unnecessarily antagonistic. But one can bring up an online presence today with astoundingly little knowledge of the technology or the implications. So maybe "massive simplification" is a fairer, nicer and more reasonable tone.

You also need DDoS protection. Cloudflare has booted people off for naughty speech before and got away with it, so no reason to expect anyone else in the game wouldn't.

Booted people from its hosting services, or booted people from their DNS service? These are not the same.

Booted people from its DDoS-protection services.

Was that when the CEO penned a letter that started "I kicked X off the internet because I was in a bad mood this morning"?IIRC, even they felt this power was a bad thing at the time, even if the instance of it was ok

You're thinking of when they quit providing DDoS protection for The Daily Stormer. I don't think it was an easy decision for him at all.

Here's the full quote:

>Literally, I woke up in a bad mood and decided someone shouldn’t be allowed on the Internet. No one should have that power.

Here's the EFF article about it with some good links for context:

https://www.eff.org/deeplinks/2017/08/fighting-neo-nazis-fut...

> naughty speech

Neo-nazis who claimed that Cloudflare supported them.

DNS can clearly be a target, same for TLS certificates.

Could have, should have. This isn't material to the discussion at hand. (It is however good advice in general.)

It is material to any discussion of whether or not AWS, Amazon or Silicon Valley or corporations in general have "Monopolistic Force" abilities in this area.

I fully agree, and even with all these points I don't think it's likely.

1. You should be running your own authoritative DNS, it's not hard. The only thing that can really happen to you is your registrar pulling your domain name, so you need to have a bunch registered piratebay-style. You should also own your IP space but that can be a bit pricey -- but once you own it it basically can't ever be revoked and you can advertise it to whoever you wish.

2. I sincerely doubt Let's Encrypt / ISRG would blacklist a domain name for cert issuance. Even if they did there's a whole lotta roots in the trust stores, I'm sure you'd find an issuer happy to make you a cert for a fee.

3. I deal with T1/T2 carriers in $dayjob and I promise they don't give a triangular shit about what you push through their pipes, given the constant stream of phishing/spam/ddos/malware they're happy to carry as long as someone pays the bills.

1- They could host their own DNS servers.

2- Signing an SSL certificate is a one-time thing.

3- A bit more complicated but still doable to have fiber to more than one ISP. To say nothing about net neutrality.

> 2- Signing an SSL certificate is a one-time thing.

Certificates are definitely the weak spot here, as many of them already have a poor track record regarding security so probably poor spines too. Certificates requires central authority somewhere in the chain, and if they don't let you in, you don't stand a chance. Self-signed certificates are not gonna fly for most parts, unless you teach people to self-validate certificates with out-of-band ones.

It is, but if a CA refuses do sign a certificate without a good reason, I'd say it would make a lot of noise.

I can't imagine LetsEncrypt refusing to sign certificates for Parler.

Section 4.3 vi) of their subscriber agreement prohibits use of the certificate to enable ‘criminal activity’.

Which might cover incitement to insurrection.

TOS and documents like that are written by lawyers. What an organization might or might not do in practice has almost no bearing to their "subscriber agreement" and other legal documents.

I'd say the same about CloudFlare some time ago when it comes to blocking "enemies" that are not explicitly breaking the law, but here we are. Never say never, and even if an organization would never do such a thing today, who knows who is controlling the organization tomorrow.

Point taken.

Yeah, here I thought the same would happen if technology companies started banning people without any anti-criminal justification but again, here we are. Parler built a platform that could be used for bad, so instead of letting the country deal with the bad outcomes of the platform (like how we deal with Twitter and Facebook), the "modern" western world decided, without any intervention from the government, that Parler is not allowed to exist anymore.

You should still renew your SSL certificate every year (397 days to be exact).

Your certificate can be issued for as long as your issuer wants. It's not uncommon to have 5y certs.

Technically yes, but no issuer will provide long expiry certificates anymore [1]. They won't be recognised by major browsers even if they do anyway.

Some still sell 2 or 3 year certificates but that's a marketing ploy. You pay the price for the next 3 years in advance but you still have to renew it every year.

[1] https://docs.digicert.com/manage-certificates/end-2-year-pub...

The app could still get blocked.