Hacker News Reader

Comment by chadsix | Hacker News Reader

AI is mentioned, but the scope is significantly larger if you read the fulltext.

I'm going to need another intelligence to read the full text.

"U.S. IaaS providers and foreign resellers of U.S. IaaS products must exercise reasonable due diligence to ascertain the true identity of any customer or beneficial owner of an Account who claims to be a U.S. person."

So at a minimum, everyone's identity is verified by IaaS provider. If you claim to be a non-U.S. person, additional information is collected.

They mention looking at comments from a previous proposal in 2021, "Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities" https://www.federalregister.gov/documents/2021/09/24/2021-20...

Who counts as IaaS besides Amazon, Azure, and GCS?

Dreamhost, Wordpress, etc

Literally every software that you can host.

This effort will end anonymity on the internet. For everyone.

Crypto was just the beginning. Next is end-to-end encryption. And it's going on worldwide, not just in USA:

https://community.qbix.com/t/the-coming-war-on-end-to-end-en...

This is not the industry-standard or NIST definitions of these terms. Something like Google Workspace Suite is Software as a Service. Something like Heroku (or Dreamhost or Wordpress) is Platform as a Service. Something like EC2 and S3 are Intrastructure as a Service. The distinction is renting out undifferentiated server space that a customer installs their own software onto. If you rent a VPS from Linode and install self-hosted Wordpress, that's IaaS. If you buy Wordpress's managed hosting, that's PaaS.

Well, it may not be the industry standard definition, but it is the definition used in the actual regulation:

-------

Infrastructure as a Service product

IaaS product

means a product or service offered to a consumer, including complimentary or “trial” offerings, that provides processing, storage, networks, or other fundamental computing resources, and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications. The consumer typically does not manage or control most of the underlying hardware but has control over the operating systems, storage, and any deployed applications. The term is inclusive of “managed” products or services, in which the provider is responsible for some aspects of system configuration or maintenance, and “unmanaged” products or services, in which the provider is only responsible for ensuring that the product is available to the consumer. The term is also inclusive of “virtualized” products and services, in which the computing resources of a physical machine are split between virtualized computers accessible over the internet (

e.g.,

“virtual private servers”), and “dedicated” products or services in which the total computing resources of a physical machine are provided to a single person (

e.g.,

“bare-metal servers”).

---

So Dreamhost counts, any web host where you can run arbitrary PHP code would count. Wordpess.com -- where you cannot actually modify the PHP code yourself -- would not count as IaaS. But any web host that allows you to install applications on your own, or run any of your own code, would count as IaaS by this regulation.

> Wordpess.com -- where you cannot actually modify the PHP code yourself -- would not count as IaaS.

However, I am able to write a WP plug-in and install it on my Wordpress.com account. In that case, I am modifying PHP code and running it. Sure, it might not do "AI" stuff but it can do some stuff and I'm assuming that the law would transmute over time to include stuff other than "AI" stuff.

Wordpress clearly does not meet the definition of IaaS in the document.

> provides processing, storage, networks, or other fundamental computing resources, and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications

Can you not add plugins to Wordpress?

You cannot install Debian or Windows 11 on Wordpress.

It applies to any "software that is not predefined". An OS is just an non-exhaustive example of one type of software that applies.

The next sentence is:

> The consumer [...] has control over the operating systems, storage, and any deployed applications.

That was just a snippet of the full definition here:

https://www.federalregister.gov/d/2024-01580/p-46

There are two possibilities here.

First, the rule applies to WordPress and all that kind of thing, and then providers would have to KYC WordPress users. Which is a reason not to pass it.

Second, the rule is completely pointless, because it doesn't, and then anyone could create an AI training WordPress plugin that uses whatever arbitrarily fast hardware the server has and thereby easily bypass the rule. Which is a reason not to pass it.

That's silly, no Wordpress hosting has H100 GPUs hooked up to it.

If you skim the full context of this proposal and the topics it focuses on (dedicated servers, virtual servers, AI acceleration), and you've been paying attention to current geopolitics in these areas (top chips being sanctioned), it is completely obvious that goal here is to prevent things like evading sanctions by renting hardware instead of buying it.

What stops them? You could have a WordPress plugin that uses Stable Diffusion to generate images, or encodes uploaded video, or provides an AI chatbot, and needs fast GPUs because there are a lot of users. Providers will supply anything the customer is willing to pay for. The expected AI plugins would be doing inference rather than training, but the user could use the same hardware for plugins that do something else.

> Providers will supply anything the customer is willing to pay for.

I suppose every company and every service should be in scope for KYC then. /s

But the reality is that Wordpress hosts are not in the business of renting people dedicated servers the price of a nice house. And if they were asked to do so, it wouldn't be a simple automated request without scrutiny.

In 2010 it wouldn't have been an automated request. Now there is plenty of demand for it to do inference and some providers are likely to start offering it if they don't already. You're also assuming the providers are interested in preventing foreigners from using their systems for AI training, rather than being interested in making as much money as possible without violating the letter of the law.

The latter is one of the reasons rules like this are simultaneously so expensive and ineffective. Provider A decides to KYC everybody because they're big and risk averse, so the rules inconvenience millions of innocent people. Provider B wants to make money selling GPUs to foreigners, so they implicitly choose a structure that allows that to happen if the rules contain any loopholes whatsoever. (This ignoring that foreign customers could just switch to foreign hosts and cost US companies business for no reason.)

And if the premise is the level of resources being consumed rather than the type of service then why don't the rules exempt anyone spending less than e.g. $50,000/month? That would be almost everyone while still not being anyone buying enough compute to do major AI training. It still wouldn't work but at least it would have much less overhead.

I don't think anyone is under the presumption that these requirements are bulletproof. The point is to just target one big glaring loophole.

> $50,000/month? That would be almost everyone

It might be almost every individual developer. But that isn't really a huge cloud spend at all for an organization.

https://www.cloudzero.com/wp-content/uploads/2023/10/flexera...

But speaking of loopholes, what do you think bad actors would do if you told them that they weren't subject to KYC under a certain dollar amount? lol

> It might be almost every individual developer. But that isn't really a huge cloud spend at all for an organization.

That's kind of the point. It excludes all of the individuals and small businesses and makes it unambiguous that it doesn't apply to someone paying $10/month for a VPS to use as a VPN endpoint for privacy.

> But speaking of loopholes, what do you think bad actors would do if you told them that they weren't subject to KYC under a certain dollar amount?

In some hypothetical world where the rules were actually effective? Spend $49,000 and then create a new account, which would be highly suspicious and still cause them to get caught.

In practice? Use a cooperative provider (Wells Fargo as a hosting company), or one in another country, the same as they would do regardless.

The whole SUV category of vehicles was spawned as a workaround for the 1975 Energy Policy and Conservation Act of 1975. Demand blocked by laws leads to weird mutations.

I'm thinking that this will simply promote cloud providers that operate outside America, sort of like Binance and FTX were "forced to exit" the US market. Not a bad result.

I think it’s most reasonable to read that as “includes [all of these examples]” not “excludes if it can’t [any of these examples]”

AWS Lambda would clearly (IMO) be in-scope as IaaS by this definition, as an example, even though I can’t install another OS.

AWS Lambda qualifies because it is part of AWS and an AWS account gives you access to EC2 which definitely qualifies.

"and applications", not just operating systems.

Services like Github Actions, Google Collab, and web-based IDEs likely meet this definition though as it lets users execute their own custom code on their cloud. So basically all developer stuff may require an ID check.

That was just part of the definition that I quoted.

In the full context, it is quite clear it is targeting things like EC2, dedicated hosting, etc.

https://www.federalregister.gov/d/2024-01580/p-46

I don't think it's reasonable to read this as if MS Excel qualifies as an IaaS.

Does Scratch count?

edit: Vultr info is wrong. They don't have anonymous use anymore.

Vultr, for example.

There are high-quality IaaS providers that accept bitcoin for payment, allowing someone to host a server on their platform without revealing their identity.

Vultur requires a card linked for ID verification even if paying for BTC. Or at least they did in the past when I tried.

Interesting. I can't even create an account with a privacy address (passmail.net forwarding). Wankers.

You are correct. "Account must be funded by credit card or PayPal before making a Bitcoin deposit." No more anonymity on Vultr.

In their definition, everything does, HN included.

Given that top GPUs are sanctioned, I'm sure preventing access to them remotely is a part of this. But just generally speaking, doing any malicious crap out of an EC2 instance is an easy way for a foreign actor in China/Russia/Iran to look more legit.

As if they won't just use a stolen identity. And like usual the victim will never even find out because it won't show up on their credit report.

Of course, people who want to circumvent laws will always attempt to do so. That doesn't mean all legal mitigations are useless.

Indeed it does not.

But that also doesn't mean this legal mitigation is either useful or worthwhile.

It's still just for IaaS companies, though, right?

Not that that makes this all okay, but it is a much more limited proposal than "internet services" makes it sound.

Legally speaking, internet service providers are infrastructure providers.

Do you have a basis for this claim or are you just throwing it out there to see if it catches on? The document linked refers to IaaS, which as an acronym definitely does not include ISPs.

Some AI services such as Synthesia https://www.synthesia.io › ethics " Your avatar can be created only with your explicit consent, following a thorough KYC-like procedure. Complete control: Our platform ensures you can decide"

There are probably very few ISPs that can fall outside of this standard. For example if your provider provides e-mail, it's providing infrastructure. And yet, the slope can get much more slippery than this.

Please read EO 13894 before proceeding further. Is the user able to run custom software directly with a customary ISP (because that's in the definition)? I agree with EGreg that they can possibly twist this, but as written it's actually narrower than you think.

In practice, as long as a definition can conceivably cover something, the DOJ or some agency will use it. Case in point from yesterday: money transmitter as applied to arresting the developers of a NON-CUSTODIAL wallet, as part of a wider war on crypto mixing:

https://www.coindesk.com/policy/2024/04/24/samourai-wallet-f...

This comes amid a war on end-to-end encryption, and so on. It's not like they are going to stop here.

Reading the definition https://www.federalregister.gov/d/2024-01580/p-46 and the paragraph following it, it's intentionally broad and i'd say it's not that much of a stretch to say ISPs provide services that match this.

Definitely not in this case (unless you're using Digital Ocean as a VPN end point or something). EO 13984 (which is cited as the enabling act) has a narrow definition:

(e) The term ‘‘Infrastructure as a Service Product’’ means any product or service offered to a consumer, including complimentary or ‘‘trial’’ offerings, that provides processing, storage, networks, or other fundamental computing resources, and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications. The consumer typically does not manage or control most of the underlying hardware but has control over the operating systems, storage, and any deployed applications. The term is inclusive of ‘‘managed’’ products or services, in which the provider is responsible for some aspects of system configuration or maintenance, and ‘‘unmanaged’’ products or services, in which the provider is only responsible for ensuring that the product is available to the consumer. The term is also inclusive of ‘‘virtualized’’ products and services, in which the computing resources of a physical machine are split between virtualized computers accessible over the internet (e.g., ‘‘virtual private servers’’), and ‘‘dedicated’’ products or services in which the total computing resources of a physical machine are provided to a single person (e.g., ‘‘bare-metal’’ servers)

(https://www.govinfo.gov/content/pkg/FR-2021-01-25/pdf/2021-0...)

That's not a narrow definition.

IaaS is defined as a provider of computing resources the allows you to run software that is not predefined. So that would seem to include basically every web host. If you can install Wordpress or Mastodon on the servers they provide, they are an IaaS.

Reply on news.ycombinator.com