Dreamhost, Wordpress, etc
-------
Infrastructure as a Service product
or
IaaS product
means a product or service offered to a consumer, including complimentary or “trial” offerings, that provides processing, storage, networks, or other fundamental computing resources, and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications. The consumer typically does not manage or control most of the underlying hardware but has control over the operating systems, storage, and any deployed applications. The term is inclusive of “managed” products or services, in which the provider is responsible for some aspects of system configuration or maintenance, and “unmanaged” products or services, in which the provider is only responsible for ensuring that the product is available to the consumer. The term is also inclusive of “virtualized” products and services, in which the computing resources of a physical machine are split between virtualized computers accessible over the internet (
e.g.,
“virtual private servers”), and “dedicated” products or services in which the total computing resources of a physical machine are provided to a single person (
e.g.,
“bare-metal servers”).
---
So Dreamhost counts, any web host where you can run arbitrary PHP code would count. Wordpess.com -- where you cannot actually modify the PHP code yourself -- would not count as IaaS. But any web host that allows you to install applications on your own, or run any of your own code, would count as IaaS by this regulation.
However, I am able to write a WP plug-in and install it on my Wordpress.com account. In that case, I am modifying PHP code and running it. Sure, it might not do "AI" stuff but it can do some stuff and I'm assuming that the law would transmute over time to include stuff other than "AI" stuff.
> provides processing, storage, networks, or other fundamental computing resources, and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications
> The consumer [...] has control over the operating systems, storage, and any deployed applications.
That was just a snippet of the full definition here:
First, the rule applies to WordPress and all that kind of thing, and then providers would have to KYC WordPress users. Which is a reason not to pass it.
Second, the rule is completely pointless, because it doesn't, and then anyone could create an AI training WordPress plugin that uses whatever arbitrarily fast hardware the server has and thereby easily bypass the rule. Which is a reason not to pass it.
If you skim the full context of this proposal and the topics it focuses on (dedicated servers, virtual servers, AI acceleration), and you've been paying attention to current geopolitics in these areas (top chips being sanctioned), it is completely obvious that goal here is to prevent things like evading sanctions by renting hardware instead of buying it.
I suppose every company and every service should be in scope for KYC then. /s
But the reality is that Wordpress hosts are not in the business of renting people dedicated servers the price of a nice house. And if they were asked to do so, it wouldn't be a simple automated request without scrutiny.
The latter is one of the reasons rules like this are simultaneously so expensive and ineffective. Provider A decides to KYC everybody because they're big and risk averse, so the rules inconvenience millions of innocent people. Provider B wants to make money selling GPUs to foreigners, so they implicitly choose a structure that allows that to happen if the rules contain any loopholes whatsoever. (This ignoring that foreign customers could just switch to foreign hosts and cost US companies business for no reason.)
And if the premise is the level of resources being consumed rather than the type of service then why don't the rules exempt anyone spending less than e.g. $50,000/month? That would be almost everyone while still not being anyone buying enough compute to do major AI training. It still wouldn't work but at least it would have much less overhead.
> $50,000/month? That would be almost everyone
It might be almost every individual developer. But that isn't really a huge cloud spend at all for an organization.
https://www.cloudzero.com/wp-content/uploads/2023/10/flexera...
But speaking of loopholes, what do you think bad actors would do if you told them that they weren't subject to KYC under a certain dollar amount? lol
That's kind of the point. It excludes all of the individuals and small businesses and makes it unambiguous that it doesn't apply to someone paying $10/month for a VPS to use as a VPN endpoint for privacy.
> But speaking of loopholes, what do you think bad actors would do if you told them that they weren't subject to KYC under a certain dollar amount?
In some hypothetical world where the rules were actually effective? Spend $49,000 and then create a new account, which would be highly suspicious and still cause them to get caught.
In practice? Use a cooperative provider (Wells Fargo as a hosting company), or one in another country, the same as they would do regardless.
I'm thinking that this will simply promote cloud providers that operate outside America, sort of like Binance and FTX were "forced to exit" the US market. Not a bad result.
AWS Lambda would clearly (IMO) be in-scope as IaaS by this definition, as an example, even though I can’t install another OS.
In the full context, it is quite clear it is targeting things like EC2, dedicated hosting, etc.
https://www.federalregister.gov/d/2024-01580/p-46
I don't think it's reasonable to read this as if MS Excel qualifies as an IaaS.
This effort will end anonymity on the internet. For everyone.
Crypto was just the beginning. Next is end-to-end encryption. And it's going on worldwide, not just in USA:
https://community.qbix.com/t/the-coming-war-on-end-to-end-en...