SourceHut moves business operations from US to Europe
lists.sr.ht
lists.sr.ht
My point is, if you trust the company you're using, also trust it to use any means necessary to protect you from bad actors, don't rely on the laws here. Both the corporate and the state ones. If you don't trust it, don't give it anything you cannot afford to leak or lose.
Specifically, EU data protection laws are good to protect regular customers from the big corporations, but they offer little protection against the EU (and the member states) themselves. And if the risk you're hedging against is "yourself turning to big corp and abusing customers" moving to EU is okay, but not in any other case.
Not possible. Anywhere that an entity is able to exist will also see some form of regulation. Regulation is the attempt of society to balance the benefits and harms of business such that its benefits reach as many people as possible, and its harms minimized or eliminated.
Too much regulation is just as bad as too little, and we have centuries of data demonstrating the need for a balanced approach.
As for the nod to piracy sites, what you’re suggesting is instead civil protesting of hostile regulations that harm society to benefit business interests. That’s excellent but the answer there is better regulations, not a lack of regulations.
I certainly trust governments where the rule of law applies more than I trust corporations. I certainly would not input any real data in a service hosted in Equador with a registrar in God-knows-where.
That does not mean that governments get unquestionable faith, but there's still the pretence that they protect their citizens. Corporations only seek profit.
You don't get to opt in to the laws you like and ignore the ones you don't like.
Well, maybe you shouldn't, or maybe you should, but you definitely can if you have the technical know-how. Probably best example is ThePirateBay which people and organizations have tried to take down for more than 20 years, yet it persists.
They're quite literally still alive while still choosing what laws they want to follow.
Obviously, that you can make this choice also means you get to chose if to even expose yourself to the potential consequences of that too, as Silk Road would attest to.
And most privacy-conscious services generally protect you to a certain level by the amount of data they don't keep. Mulvad, for example, when raided kept everything they had. Because they could prove that the data that the warrant was for was not stored on their equipment. PRQ, they're quite happy to work with you without knowing who you are.
If you want to keep yourself private from law enforcement or intelligence agencies, then you shouldn't be using standard services without your own layer of encryption and privacy steps in between. You're always going to be at the behest of some government, that's just how the law works.
> And if the risk you're hedging against is "yourself turning to big corp and abusing customers" moving to EU is okay, but not in any other case.
I mean, this seems like a silly concern (just don’t abuse the customers, lol). But, he can now reasonably offer to his customers the fact that he’ll be bound by EU privacy laws.
In the case of something like SourceHut which has consistently made decisions in favor of having a slow/sustainable business model instead of going for massive growth, this seems to make a lot of sense. He probably isn’t too worried about having to eventually backstab his customers, so why not make the value proposition clear?
Like what if the big plan here is to offer clear business terms backed by customer-friendly local laws and make a nice middle class salary for the rest of his life, while living in a nice friendly country?
And they were only able to do so under the auspices of corrupt politicians in said country. For example, Crypto firms in UAE purchasing property in projects closely affiliated with the Emirs of the Emirate they are domiciled in [0]. And Vietnam cracking down on shady domain registrars for streaming in order to unlock trading opportunities such as not being treated as a "Non-Market Economy".
Tech will always be subordinate to the government, and any techno-libertarian ideal faces that harsh reality fairly quickly.
What's SEA?
There is a word for people who like to unilaterally break social contracts for their own benefits and it has not a lot of positive connotations.
Note: that I totally get the sentiment of wanting to get away from all these complications especially in technically minded people. But the sooner we realize that this can either be lived political resistance or antisocial/sociopathic exploitation the better. Even in an ideal society individuals will have to be bound to certain rules, otherwise everybody will have to fear everybody else violating their boundaries. And different societies will find different forms of rules with different evaluations of how to do things.
TL;DR: Don't want to deal with the rules of a society? Don't interact with it. You cant have your cake and eat it too.
https://www.irishtimes.com/news/world/europe/sweeping-survei...
Also, this diff does not say his business has left US jurisdiction:
- before: "You must obey all local, US, and Dutch laws"
- after: "You must obey all local, US, European, and Dutch laws and regulations"
That is true, but the commit message also says:
> v2: rollback the premature removal of compliance with US law - Will defer this until we finish shutting down the US business entity entirely.
So it seems leaving US jurisdiction is planned, it was just a bit premature so they temporarily rolled that particular change back.
Of course, this puts the conversation in a tricky spot. The less-bad actors (no country is great in this context) should have the most well documented abuses, the worst will just do it without bookkeeping. So it is, unfortunately, a “prove a negative” sort of thing.
As bad as the surveillance situation here is, it's still better than the situation in the UK, of that I'm sure. Unfortunately, I can't find any very recent data about wiretaps in the UK. The 2023 report (https://ipco-wpmedia-prod-s3.s3.eu-west-2.amazonaws.com/E032...) shows a sharp rise in communications data applications (441,900 in 2023 alone) but those can range from single phone calls to months of data collection. The Dutch reports only claim 5397+1258 phone taps in 2024, but those don't say anything about their daily volume.
If your government's wiretaps per capita is lower, double check that they're not using coded language to exclude most of their activities, and if the numbers are much lower, think twice before taking them for their word.
https://www.theguardian.com/cities/2018/mar/01/smart-cities-...
The city also keeps track of the number of young people hanging out in the streets, their age group, whether they know each other, the atmosphere and whether or not they cause a nuisance. Special enforcement officers keep track of this information through mobile devices. It calls this process “targeted and innovative supervision”. Other council documents mention the prediction of school drop-outs, the prediction of poverty and the monitoring of “the health of certain groups” with the aim of “intervening faster”.
[0]: https://algoritmes.overheid.nl/en/algoritme/gm0344/78136377/...
[0]: https://www.tooltester.com/en/blog/the-worlds-most-surveille... [1]: https://www.forbes.com/sites/emmawoollacott/2020/10/06/eu-co...
Take this to its logical conclusion and basically, every company will need to segregate their data in regions. Most cloud platforms aren't really designed this way but it's coming.
There was a data locality law that India passed and Stripe had to do this massive migration project to segregate this data. I shudder to imagine what a more complex system would look like under such data locality laws.
Not super clear from the link that's the case. Maybe sourcehut will make an explicit publication to this effect.
No, that was there before too. What's new is the legal address in the bottom, that now specifies Netherlands, and a KVK+BTW identifier.
"-" prefix on a line in a diff indicates removals, "+" prefix indicates additions.
But yeah, I'd expect them to also make some sort of announcement blog post explaining the change.
Many smaller providers too.
Why?
If you're doing business in the EU it's actually illegal to store the data about that business in the USA. It's not enforced though.
OVH is also popular but I found their network speeds kind of limiting. It's been a while since I last checked out their offerings, though.
They have a bit of an ethical track record where they've disallowed use of their services for crypto commodity projects and the like, for example.
Edit: I mean ideological not exactly political choice.
>I have felt a kind of dissonance with my home country of the United States for a long time now, and I have found it very difficult to resolve. I am not of one mind with my peers in this country on many issues; social, economic, and political. Even limiting this inquiry to matters related to FOSS, it’s quite clear that the FOSS community in Europe is much stronger than in America. In the United States, capitalism is the secular religion, and my values, in FOSS and otherwise, are incompatible with the American ethos.
Seems ideological to me.
pretty much the other way around. Europe's startup base is still smaller than the US but has been growing faster. It's now 20% or so of global VC capital compared to about 5% a decade ago, and has produced unicorns at faster rates. Just misses the mega-sized companies at the tail end (https://tech.eu/2023/07/05/europes-best-decade-in-tech-reach...)
You can just look at an investor like, ironically enough, Thiel who has been pumping a lot of money into European tech. Defense startups in Germany for example.
Merely showing some startups gaining funding doesn’t show the full picture - I can also show similar statistics from India but you don’t see companies moving to India.
Like if you moved to Saudi Arabia, and the motivating concern was ideological rather than political… I don’t know, what’s the difference? Is it a big picture vs little details thing?
I bet the reasons for the move were: ideological, political, lifestyle (maybe they have better weather and nicer cities)—moving countries is a big decision.
The difference between ideological and practical (not political) is crucial. Practical reasons can generalise to everyone but not ideological reason. I wouldn’t move to Saudi for example because I’m not a Muslim. But if I were to understand that he moved due to practical reasons that matter for his core business then that is generalisable.
> Practical reasons can generalise to everyone but not ideological reason. I wouldn’t move to Saudi for example because I’m not a Muslim. But if I were to understand that he moved due to practical reasons that matter for his core business then that is generalisable.
I think I sort of disagree that practical reasons are universally generalizable in a way that ideological reasons aren’t.
Practical reasons are generalizable in some cases, but your ability to learn practical lessons from somebody else will depend on how your situations are practically similar.
Ideological reasons are also generalizable in some sense—I mean, lots of people have similar ideological beliefs. And SourceHut was founded on ideological principles that are not universally held, but which are widespread enough for folks here to at least be curious about them here.
Netherlands, and the EU in general, are cumbersome to deal with regardless of all the "startup incentives" they've been pushing in the past few years. Compare the incorporation, maintenance and closure processes of a Delaware/Wyoming/New Mexico/Florida LLC with anything even remotely comparable in Europe (e.g. a BV/NV/SRL in the Netherlands) and you will quickly see why the US has become the world's center-stage for doing business.
For SourceHut Estonia and Romania would have probably been a better choices, as from my understanding, they are not investor-driven and do not seem to head that way, they are fully digital/remote, and they require disproportionally more infrastructure than office workers to operate.
However, when living in the EU one has to take into account various (frankly absurd) taxation laws that might ultimately prevent founders from incorporating their company in any of the neighboring countries. Hence it would be necessary to look at the details of the founder's circumstances to evaluate if incoporation in a different country would have made sense to begin with.
That said, I agree with the top rated comment [1] as for the broader topic of where to incorporate.
Doesn't the ease of incorporation get erroded by the ongoing burden of filing taxes in multiple places? I remember looking at this years ago as an alternative to a GmbH and thinking it wasn't worth it. Maybe for this type of company it is.
Since you're mentioning a GmbH I'm assuming you're based in either Switzerland, Germany or Austria. Generally speaking, regulation and tax codes in these countries have made it very unfavorable to operate any foreign entity, unless there's a fair amount of substance and structure in the target jurisdiction that make it worthwhile.
However, it is important to mention that while it is often the "natural" thing to do, operating a business in the same country that the founder is based in is almost never ideal from a regulatory and tax perspective. Unforunately, though, proper planning and execution of advanced structures is usually not something the average startup founder is a) primarily interested in and b) able to afford.
Given the other comments in this thread mentioning the founder's rather left-leaning political views, I assume that regulatory and, specifically, tax optimization were none of the founder's main goals to begin with.
My theory is that they are eyeing to get rid of their US citizenship and naturalize in the Netherlands, which is possible after 5 years when certain criteria is met. Having economic ties to the country you're trying to get citizenship in helps immensely. The logical next step for them would be to open a physical location and employ Dutch citizens to further solidify their case.
You have to remember: As long as the founder is still citizen of the United States, they will inevitably support the country and its policy with the taxes on their world income. After all, the US is one of only three countries in the world that taxes based on citizenship rather than residency.
Having that said, there have been various attempts across Europe to change from residency-based taxation to citizenship-based taxation in the past decades. All of which have been unsuccessful so far.
This is true, but only on taxable income over $130,000. Drew is probably not making over that from Sourcehut, so he’s not going to be paying any taxes to the US anyway.
Where are you getting that info from ? There's more invesment that ever in EU startups.
One I know of recently : https://www.eu-startups.com/2025/06/italian-publishing-house...
Simply proving that there are some startups is not useful. I still think it has to do with the founder’s personal ideology.
https://www.globalfounderscapital.com/
Then there are many niche VC-networks, like https://www.timetoraise.co/.