IP Geolocation Is Twenty-Five Years Old | Hacker News Reader

IP Geolocation Is Twenty-Five Years Old

sanjayparekh.com

88 pointssanjayparekh66 comments

https://www.ripe.net/publications/docs/ripe-181/

October 1994. which is 28 years ago. Contains the inetnum: object as follows

  The information in the old inetnum object
  inetnum: 192.87.45.0
  netname: RIPE-NCC
  descr: RIPE Network Coordination Centre
  descr: Amsterdam, Netherlands
  country: NL

So.. I hesitate to be snitty, what exactly about IP geolocation did you invent given that by 1994 we already had a formalism to represent IP economy in the records?

I had the same kind of thought, but I think the 'invention' is really figuring out an application of ip geolocation, and a market for that application.

IMHO, it wasn't hard to figure out roughly where servers or peers were in the real world based on their IP address and network routes to them, but it was non obvious why someone would want to pay for a service...

"I worked out how to monetize it"

is very different to

"I invented it"

To clarify, yes whois registries have existed since the start of the Internet. However the location provided by those registries does not equate to the users' location. For example, back in the day, IBM (IIRC) ran a worldwide network of dial-ins and all of their IPs were registered back to their headquarters in Schenectady, NY. So yes, we figured out how to monetize it and maybe in the extreme "invented" is a stretch - maybe I should have said "invented a way for it to be accurate to a city level". In case you're wondering, 94% accurate to a city level, worldwide when I was there.

I think this is a much better tagline, personally. It paints a picture of how it went above and beyond what was there already.

If you read the patent it's clear it's not even that. He filed a patent for an idea, where you would build a database based on geo information provided by the user.

And even before the existence of data privacy laws, this simply would not have worked.

Instead companies like Maxmind implemented the much better idea of sourcing location data from Whois databases and ISPs server-side.

That's what everybody understands when you use the term "IP Geolocation".

we did some early geolocation work at CAIDA/stanford a little later, around 1996

https://graphics.stanford.edu/videos/mbone/

CAIDA had some awesome stuff back in those days. There was also an outfit that generated poster maps of the Internet backbones too. I wish I had bought one back then because I don't know of anyone making things like this anymore. Our data was used by a number of companies to create visualizations too. One even appeared on a 60 Minutes story (I think it was that show).

I can accept that he invented it in the same sense that I invented recursion. I called it the "ouroboros" function and was really quite pleased with myself for thinking of the pattern.

Now, the fact that I called it by an ancient reference should probably have been the first clue that I didn't get there first, and sure enough later I found out that actually no, it's a very old idea in computer programming.

For the record, I can place back reliably to about 2001 the first time I was introduced to someone showing me an actual free application of searching/displaying ip lookups and laying it out on a visual map because it was about the only thing of value I took away from my first year information systems course, and although I can't remember the name of the application or program used, i've never heard of the blog writers company or his competitor: free software that did it must have already been available and mature for doing it and was being passed around during that time because it was already freely available by the time lowly old me turned up.

And given that the theory of doing so probably worked out long before that I think "invented" might be a liiiiiiiitle bit of a stretch...

All I can say is when I first met Vint Cerf, he was pretty enthusiastic about the invention. But maybe he didn't really understand the Internet either. You can see the fireside chat I had with him here (to be clear, we weren't sitting next to a fire either): https://vimeo.com/124048978

It takes some self confidence to share a video where Vint Cerf calls you a nincompoop -- even if jokingly. Thanks for sharing it anyway. I enjoyed watching.

I took one for the team so that no one else had to ask that question. And I'll take Vint calling me a nincompoop any day. Especially when you know how nice of a guy he really is. :-)

25 years old and still constantly misused by tech companies to assume my language preferences while traveling even though my browser explicitly communicates my language and locale preferences. Spotify and Google are particularly notorious offenders.

Wrote about that 7 years ago over here https://kristopolous.medium.com/stop-guessing-languages-base...

I usually mentally filter any links that I see that are on medium, and actively block them from search results.

Old articles like yours can be read to the end, but with a banner blocking a third of the page, and nearly 100% of new articles I've come across in the past year get a nice paywall right at the entire reason I clicked on the article. All the new articles that aren't blocked are worthless content I wish I hadn't clicked on.

I should probably just self host all my stuff and stop assuming decent platforms are going to continue being reasonable because they always seem to break themselves

MDN doesn't like it

> Browsers set required values for this header according to their active user interface language. Users rarely change it, and such changes are not recommended because they may lead to fingerprinting.

> The content of Accept-Language is often out of a user's control (when traveling, for instance). A user may also want to visit a page in a language different from the user interface language.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac...

:shrug:

There are a million metrics that can be used for fingerprinting, the notion of avoiding language detection because fingerprinting seems a bit weak - it’s pretty hard to fingerprint me if I’m not willing to fumble your site to configure my language, and I assume for non English speakers hard locking browser resolution to 1920x1080 to prevent resolution fingerprinting would presumably be a more usable limitation.

Edit: and ‘a user might not be the owner of the computer and therefore the accept language might be wrong‘ sounds like a UI problem that a ‘file -> set language’ workflow would solve.

Agreed

Accept-Language is far more under my control while traveling than my IP address. Especially for services that actively block VPNs.

God yes. It's still an uphill battle trying to convince my PC that I indeed want to have english-everything, although my PC is in europe. And boy do some websites go through hoops to be "clever"

I can kind of see why this is all the case: IP geolocating can be assumed to be generally useful, locale settings expressed by the browser and/or operating system could have been explicitly set or just left as what they came out of the box and thus unreliable.

That said: There's a reason I am going to google.com and not google.co.jp, fucking thanks fucking good day fucking fuck.

It is a faulty assumption that IP geolocation is generally useful. It's often not, at all. The only context in which it might seem so is if you live on an English speaking continent. Otherwise, you're going to constantly misidentify people who live near borders, who use a VPN, or who have a different language preference than the offical language where their ISP is located. Locale settings expressed by the browser are the user's explicit preference, and extremely reliable. When was the last time you unboxed a new device, and on the very first OS setup screen when you have to choose your language preference, you chose a language that you don't speak? No one does that! And when was the last time you had to use a device that wasn't yours and had the language set to a language you don't speak? Never! So I don't know where you got this idea that somehow the majority of people are using devices that are set to a language that they don't speak.

>Locale settings expressed by the browser are the user's explicit preference,

From experience watching other people use computers, most people don't even know WTF "locale" is or anything even tangentially related. More than likely they just use whatever was configured by default, which most of the time makes sense for them but it's not a given.

Hence, it's unreliable.

IP geolocation on the other hand, you can at least assume the broad region where they are connecting from (VPNs and proxies aside).

That "default" is typically set by the language choice in the OS, which is exactly why it is reliable, because people understand language selectors just fine.

I know precisely zero people who know how to change the OS's language settings, assuming they weren't already knowledgable with computers.

> I indeed want to have english-everything

english + metric || gtfo

> boy do some websites go through hoops to be "clever"

1. I'm in (east of) France geo

2. My system is set to en_GB

Yet some websites insist in putting me in Germany. Sometimes it even changes between requests (web pages), some are extra nutty and I even get mixed content within the same page.

For the love of all that is holy, please stop being clever. UAs have had Accept-Language headers ever since RFC3282. Use that hint.

> The site owners contended that they could not know where an Internet user was geographically located. Clearly, I had proven the opposite.

I've spent a lot of time working with the Maxmind and other paid datasets for IP geolocation. One thing you'll quickly notice is that they disagree with each other, sometimes giving answers on different continents.

There's challenges here. IP addresses are dynamically assigned. They are bought and sold to different companies regularly.

That's not even getting into problems like VPNs, or remote browser sessions. The details and context are lacking here, but I disagree that you can be certain where a user is located using those tools and its harmful to believe you can.

And IP geolocation is still very relevant as of today.

You can derive an enormous amount of geolocation data by looking at WHOIS data: https://ipapi.is/geolocation.html

lol k

For the last 25 years I’ve hated this invention because it has been continually conflated to make the assumption that my preferred language is based on the country I currently find myself.

Every major global tech company has made this mistake and nearly all of them deliberately override my Accept-Language request header and ignore it.

Did you know that over 8 million people worldwide are native speakers of Catalan, whilst only 4 million people speak Norwegian? Guess which speakers are continually ignored.

When I travel to France, should websites push me to use the website in French, even though I don’t speak it? No.

Incorrect understanding of the problem and badly misused over time. I’d vote to have the IP2Location databases killed off and buried for good.

You're confusing the tech/innovation with the uses. I agree with you that not respecting, or rather assuming, a user's preferences is a bad UX mistake. That said the tech is also used for content control without which streaming of shows and films would be impossible to contractually happen. It is used to protect your bank account. It is used in a myriad of ways that are much less visible than just picking a language or showing targeted advertising.

I understand your article was about the tech.

But you did mention the motivation of geoip for detecting location for selecting a language, and given that's what people still do these days despite Accept-Language headers being available for most clients, I think it's worth a call out.

Oh, I agree with you. I don't really understand why sites don't use language headers which obviously specify the user's preference. I've never been on the implementation side for sites that were clients - I just explained the tech, showed how they could use it, and then they used it in those ways and many times more. Maybe it was just easy rather than having to use multiple variables? Maybe they don't know about this header (which would be shocking IMO)? But back in 1999/2000 time frame, no site was using the language header which may or may not have existed back then - I honestly don't know when that was introduced into browsers (I was a Netscape Navigator user back in those days).

I'll also say that even though I invented IP location technology, I am an avid user of privacy-shielding VPNs. Just because you invent something doesn't mean you don't regret some of the uses of said thing.

> I don't really understand why sites don't use language headers which obviously specify the user's preference.

Accept-Language headers aren't obviously the user's preference, though. There's the four users that manually set it, and for them it is their preference. Mostly everyone else is getting a default based on their OS language, which often isn't really something they set either.

There's also the problem where the country appropriate website for where you are may not have a language you understand.

Obviously it would not be contractually impossible to allow streaming. The contracts would just not require IP based fencing/allow for global distribution, or e.g. use the billing account's jurisdiction, which is a more reasonable solution anyway.

None of the ways you mentioned are the most optimal, or do I say, even valid ways to achieve a certain social goal.

Content control geo fencing is only recent, and streaming was there and will continue to be there long after IP geofencing stops being a practice. In fact, I believe if the technology wasn't around, streaming would have been accessible to more people.

Any amateur "carder" (what credit card thieves call themselves) knows that IP geolocation is in fact good for them, because they can easily load up a proxy or VPN, making this arbitrary, problematic (read: tracking) factor in their favour to steal money and commit identity fraud. There are easily accessible programs online that provide ZIP code accurate IP proxies.

I can go on and on about how terrible IP Geolocation is for almost everyone.

> whilst only 4 million people speak Norwegian? Guess which speakers are continually ignored.

yaml says "NO"

And what a privacy nightmare, particularly with IPv6. When I see a map of my home IPv4, it's within a mile or two. With IPv6, it's on my block.

But at least the companies I consult can block Chinese IP addresses from their public web presence. Chinese security will never think to stand up a server in the US or Europe.

(Yes, I know it can help block noisy log generation).

If you're getting targeted to your block with IPv6, your ISP is likely giving away your data. VPNs are your friend.

ime geoip is at best able to identify the country, but yours are both scarily accurate, which isp?

ATT.

Very cool read! I wasn’t working during your time, but I recently have been working on maxmind db datasets.

How different was it to what was offered in the past?

I used to think this data was sourced from ISPs and could not be deduced from how you mentioned in your post

This is a great question. So when I came up with IP location back in 1999, there was nothing for location-based targeting. Any advertising that happened would be because a user shared a location (ZIP code, etc.) and then got cookie'd and that information was brokered between sites. This obviously doesn't work for more secure uses (content control, fraud detection, etc.), so some of these uses were made possible once we launched. The shift to streaming content would never have happened without a secure way to accurately know a user's location.

The other part of your question, I think, deserves its own blog post. One of my tenants was to NEVER be reliant on someone else's willingness to give us data or access. So, everything was designed with the idea that we would have to gather first-hand data and knowledge. If an ISP gave us data, that would be great and make things easier. But being beholden to ISPs would mean we would be hosed if the sands shifted. This is why I am still flabbergasted when people build their entire company based on someone else's platform, API, etc., and then are upset when those platforms change their models. If you build the foundation of your company on someone else's land, be prepared to lose the house.

I was doing legit music downloads and streams for the major labels in late 1999/early 2000 and I was using some sort of paid IP database to determine which of the 34 countries we covered the user was connecting from, so I could pay the right royalties.

Was the market really that small for IP geolocation 25 years ago? I don't remember it being a problem to source the data...

I think a lot of people are confusing access to some kind of IP location data with access to high(er) accuracy data. Yes, you could scrape whois data to create a IP location database but even country level would be in the mid-80s and then dramatically drop off from there. In the early dot-com boom, that was good enough since there was nothing really better.

Got you. I can't remember how accurate the database was. I think as long as you were "in" one of the 34 countries then the app worked fine, even if it had you pegged in the wrong place.

I used your product when building my start-up. Fascinating to hear the back story!

Whoa! That is awesome. I get chills whenever people tell me they've actually used something I've built. Hoping I get the chance to write more about the stories from my time building Digital Envoy. Congrats on your startup too - I hope it is/was wildly successful!

Looks like people just aren't buying it. The self-aggrandisement and the unjustified certainty of the 25 years ago claim. Modesty in line with the achievement will be received much better.

Source of so many problems

Agreed. But also the source of so many new possibilities. Like most things, the bad comes with the good.

What's with the `?ref=sanjayparekh.com` query parameter? It's present on every link, is that some new tracking standard?

Huh. Good question. Must be something Ghost added because I didn't do that manually. I'll have to take a look.

browsers started to limit referrer info a few years ago, this might be a workaround.

Yeah it looks like that, but is this an official standard that's defined somewhere. I am not sure what to search for.

hope this helps

https://en.wikipedia.org/wiki/HTTP_referer

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...

https://developer.chrome.com/blog/referrer-policy-new-chrome...

It's extremely {whatever}-centric to assume that IP location in any way implies anything about one's preferred language. There are multi-lingual countries. There are cultural minorities. People travel. (Not to mention VPNs becoming more popular these days.)

So I always found it infuriating that web sites would try to guess my language from geoip when my browser already sends Accept-Language headers. They spend resources doing this stuff, think they're doing their users a service, give themselves a pat on the back, and then unnecessarily screws up the UX for a significant portion of the users.

I have no idea why companies keep doing this.

See my comment about this on another response.

"That comment of "crushing us" was infuriating. We decided to go it alone, and the results show this was the right decision."

Very satisfying to read!

It was very satisfying to live through and now reflect back on. :-)

No, IP Geolocation is not Twenty-Five Years old, you did not invent it, and you do not have a patent for it.

Let's see what your patent is about:

A method, computer program product and electronic device are provided for providing hyper-local geo-targeting based on validated, user-supplied geographic information, wherein the user's anonymity may be maintained. In particular, user-supplied geographic information may be collected in association with a truncated IP address. Once collected, the user-supplied information may be validated using geographic data previously derived from one or more complete IP addresses corresponding to the received truncated IP address. The derived geographic data may have been derived using a system that maps the routing infrastructure of the Internet in order to determine where endpoints on the Internet are located. The validated, user-supplied geographic information, which may be more specific than the derived geographic data, may then be used to provide more granular and accurate geo-targeting, all the while maintaining the privacy of the individual users.

User-supplied geographic info. Aha.

First claim:

1. A method comprising:

receiving, by a computer over a network, a truncated internet protocol (IP) address associated with a user device related to a specific user;

receiving, by the computer, user-supplied geographic information associated with the truncated IP address, the user-supplied geographic information not being linked to the specific user;

retrieving, by the computer from a database, geographic data derived from one or more complete IP addresses corresponding to the truncated IP address;

validating, by the computer, the user-supplied geographic information based at least in part on the geographic data, the validating comprising determining if the user-supplied geographic information is the same or equivalent to the derived geographic data associated with at least one of the one or more complete IP addresses corresponding to the truncated IP address, wherein in response to the user-supplied geographic information being validated, the user-supplied geographic information permits providing geo-targeted information.

I may not be perfect at reading patent legalize, but this "Invention" does not make any sense to me. So someone is providing his geo location, to then receive his geo location? Yay.

I've been using geo location for over 25 years now. And I have never heard about your company. And pretty much everybody uses Maxmind for 22 years now. Because they have an actual product, a website, pricing, and a free offering that's deployed on hundreds of thousands of servers.

Your company website on the other hand makes me want to puke. No way to actually see any IP Geolocation services. No products, no pricing. Just BLABLABLA WHY WE ARE SO GREAT.

So, guess what: No, nobody stole your idea. Nobody every heard about you or your idea, and nobody cared.

Maybe instead of posting this here actually invent something that is of use, and then come back here?

Yes, these have been rude words. But did you REALLY come here to get praise on this whiny narcissistic blog post of yours? Next time, please have this discussion in front of your bathroom mirror instead.

Maybe it wasn't clear, but I left my operating role at the company in 2005 and we exited the company (it was acquired) in 2007. I don't think I ever said anyone stole my idea - because they never did. Others were in the same space (Maxmind included) but came up way after us - and we never pursued anyone in court for patent infringement. Why? Because we always wanted to win in the marketplace and not in the courtroom.

Also, you probably don't know what data goes into Maxmind but that's okay. It doesn't matter to me since I exited a long time ago and have no dog in the fight anymore. But just because you don't know Digital Envoy doesn't mean you aren't using (and paying for) their data. ;-)

I am very sure I am not paying for that data, and no-one else is.

The patent is absolutely trivial and would be thrown out in 5 minutes on the first objection. It does not even specify an implementation. Yes, patent language makes it sound important, but basically your "invention" can be summarized in one sentence. That's not an invention.

It's all bullshit. The company website now reads "50 patents on this!". It's a single patent, and yes, in the EU every copy of a patent is registered for each country and therefore you get 50 patent numbers.

Sorry to hurt your feelings, but as you are still insisting to be an inventor. You are not. You may be a great marketer if someone really paid you for this, but that's all.

(I also have "50" patents. But I would not brag about it, and my invention at least consists of a complex idea and 15 pages describing the implementation.)

And finally: The idea is illegal in the EU, where an IP is regarded as personal data, and you would need a written approval by every single user. And I have seen GDPR cookie popups, but never a sanjay popup.

Please just stop trying to impress tech people with a trivial sales person idea. You are abusing the patent system as a troll, and exactly this makes everyone in the industry hate it.

New goal: A "Sanjay popup". Hahaha.

Reply on news.ycombinator.com