Show HN: We Built the 1. EU-Sovereignty Audit for Websites | Hacker News Reader

Show HN: We Built the 1. EU-Sovereignty Audit for Websites

lightwaves.io

106 pointscmkr91 comments

Open articleView on HN

Not accurate.

It has nsa.gov on the leaderboard as having no US dependencies.

It wrongly says one of my sites is using Cloudflare.

It says that one of my sites that is hosted in the US (no CDN, US IP address) has no US dependencies.

it treats social media links the same way was embeds.

it gives gov.uk a perfect score. Maybe by design because it is hosted in Europe, but if so it should not say its EU sovereignty.

I do not think that is the case because it also gives a perfect score to https://english.www.gov.cn/

I do not know how it got to the HN front page - people presumably vote it up without checking it actually works.

Its just not anywhere near accurate.

Yeah it's a neat idea. Unfortunately the execution is pretty poor.

I think it's more of a "how self-contained is the website?" test, which is a valid but a completely different question.

I have two under my full control, one scored a 92, the other one scored a zero. They're both hosted the exact same way.

This is more of an attempt at a political stunt. The CCP's website gets a perfect score, admin.ch also gets a perfect score while Switzerland is most-definitely not in the EU.. non-US is more accurate than EU but you only see that when stars start flying.

IMHO: Just scrap the politics and show what regional deps a site has - that'd actually increase value quite a bit.

It's HN catnip: Google PageSpeed Insights for /r/BuyFromEU slacktivism.

Fair points, all of them.

The nsa.gov thing: :)

The reals: 1. Hosting detection: I'm matching links TO GitHub as hosting ON GitHub. That's wrong. Fix incoming.

2. US-hosted sites getting 100%: My ASN lookup isn't catching everything. I opted against GeoIP services (privacy reasons), but clearly the ASN-only approach has to much gaps.

3. Social links vs embeds: You're right. A link to Twitter isn't a dependency. An embed is. Will differentiate.

4. gov.uk/gov.cn perfect scores: The tool checks infrastructure, not jurisdiction. gov.uk probably serves from EU edge nodes. That said, the name. Also tried to mention this in the Methodology-Modal. But iterating on all legalese and features same time as a single dev did not land well with my sleeping patterns for v0.1. Will fix that too.

"EU sovereignty" is misleading for non-EU countries - point taken. Will think about better framings.

Update on the Cloudflare point: I now detect Vercel and Netlify hosting via response headers (catches custom domains). Cloudflare as CDN/DNS proxy is intentionally not flagged as US hosting — the origin server behind it could be EU. This is documented in the methodology popup.

The other issues you raised (social links vs embeds, US-hosted sites not detected) were fixed in earlier updates.

I have some feedback for OP: my personal website got 92% because there is a link to my X profile in the contact session. It's not like it relies on the service. Its just a contact and there are also links to other services such as self hosted matrix.

On the other hand my registrar is Namecheap which is in the US and your tool didn't checked for that. I think thats a lot more important in terms of dependance than a link to a social network so you could run a whois lookup to check what registrar is hosting that domain.

If you post on X. You are a content creator supporting Elon.

While this is true, it has nothing to do with the tech sovereignty of the site itself.

While I'd say you're mostly correct, I do disagree some.

There is quite a large issue with sites posting things like current events on social sites like Facebook, or other rapid news events on X. Doing this has the potential to diminish your sovereignty. For example if you tell your users to follow X on the site and you're posting some event that Musk doesn't like, maybe you're posts will disappear.

Is something to think about.

It's absolutely not something to think about, unless you are in some kind of cult.

This website is also foreign to Europeans, so what are you then doing here contributing with your comments?

It is probably time for Europeans to start dealing with their problems in different ways than having internal "purity purges". It has never worked, and will never work. It makes people weak and easily defeated in every endeavor.

>internal "purity purges"

"Hey France, I know all of a sudden Germany is suddenly running around with black white and red flag, but it's completely cool if we have them manage all of our critical infrastructure". --carlosjobim 1937

I'm in the US. I'm watching what's going on here. If you want to talk about any group doing purity purges, they have ICE printed in big letters on their jackets.

Of course feel free to pull an IBM in the 40's and stick with the regime, it evidently has no long term business repercussions.

Yes, yes obviously everybody who doesn't participate eagerly in purity purges are themselves a nazi collaborator, foreign spy, reactionary saboteur on the MI6 payroll, maybe a crypto-jew, a jesuit, a lutheran, etc etc

Sometimes, just sometimes there are evil people out there that you don't want to associate with. Other times, if evil isn't an issue for you, that said evil entity represents a business continuity risk by using their services.

It's up to you to decide those risks, but it seems rather 'anti-free speech' to say that I can't recommend that you think about those risks in the first place. By use of this service you are not purging anyone. You are enlightening your current position and using that information to make next steps.

Linking to the Facebook page of a small business is considered stepping over the line by this so called "sovereignty audit" tool. Sure, we can call that "associating with evil people". I say it's a cultish purity purge - a recipe for failure for those who participate. Because very quickly they start looking for impurities with each other and fragmentize into different sects.

I think this may reflect more on how you see things then the other people you supposedly talk about.

Good point regarding registrar. Thinking a bit further, there's also the top-level domain: if that's under US control (eg .com), it could still be yanked away from you.

This is a massive risk that will affect half the internet or so.

.onion might be exempt but while the TLD "." is anycast worldwide for the actual DNS service, Verisign still signs the cert. Isn't that a show-stopper for dependencies on dns-over-https or https altogether or do .cn, .ru, .ir etc all add/replace with their own independent signatures ?

1. Link to X profile ≠ dependency on X. Will differentiate links from embeds in v0.2.

2. Registrar check is a good thinking. Already have some stubs in the codebase. Namecheap is US and could theoretically be compelled. Adding to roadmap.

Thanks!

Nice, but for me it is reporting false information. I use Vercel, Cloudflare for DNS yet it shows 92%. The only thing it correctly reported was the LinkedIn link. (There is also a GitHub and Bluesky link, which are US companies / services as well).

Hi,

i have fixed the Vercel detection. Also added Netlify header detection (via x-nf-request-id).

DNS-proxieng is not taken into account. Maybe will do that in the future.

Thanks for reporting!

So their leatherboard of good examples lists nsa.gov with 100 points.

Is this a parody?

That actually says more about NSA security hygine and not getting high on your own supply.

Was a bug. Now some kind of Snowden-Approved-Feature.

I put in my site and it gave me a red cross for "Hosting", on hover it said "GitHub Pages". But my site isn't hosted on GitHub Pages.

Expanding "Details", the URL that is hosted on GitHub Pages is... a different website? There's merely a hyperlink to it on my website.

It also says I'm using "self-hosted" fonts - but I don't think I'm doing that at all? I'm just using the browser's fonts. Using non-standard fonts is a bad idea because it causes the content to either be invisible until the font is loaded, or else it initially shows in a fallback font and then the text all jumps when the font is loaded.

It also says my website is hosted on GitHub pages, although it’s served from a hetzner server.

EDIT: on further inspection: I get both a red cross AND a green check mark for hosting. So it’s somehow indicating both GitHub and hetzner. Maybe it’s because I merely link to GitHub?

Fixed. I was matching a link TO GitHub as hosting ON GitHub. Now only embeds and actual hosting count, not href links.

Sorry and thanks for pointing me there.

Funny, I checked a blog I host on github pages and it says "not detected" for hosting.

Meanwhile I get a green check for CDN - presumably because I'm not using Cloudflare, but I am using CloudFront which is AWS.

So the tool's a good idea, but currently very inaccurate.

Meanwhile, mine is actually hosted on GH pages and I get a green mark and a perfect 100% score.

Thanks for the Bugs Bunny. I'm detecting a LINK to GitHub Pages and marking it as hosting. That's wrong - hosting should only flag when the actual page is served from there.

Re fonts: "self-hosted" means fonts served from your domain (vs Google Fonts CDN). If you're using system fonts, that's a detection error on my end.

Both going in on the fix list. Thanks.

Any recommendations for good European alternatives to Clooudflare? Is there an EU company that's as trustworthy when it comesq to DDoS protection?

Bunny CDN (https://bunny.net) is great, HQ located in Ljubljana, Slovenia and also have great support which seems most faster and gives better responses than most others out there, but might just been my luck, YMMV.

First off, do you actually need it? I know cloudflare sells fear, but was you or anyone you know affected by a DDoS?

> cloudflare sells fear

A lot of people here don't just run trivial hobby sites. They work for companies that actually have a real need for DDOS and WAF protection. Maybe you have no experience with that, but it is extremely common and even required for sites that require compliance certifications like SOC2.

There are other providers of DDOS protection, and other WAFs.

The main advantage Cloudflare has is that it is free and a big brand.

Right. I was responding to the question "do you actually need DDOS protection?". Which is an obvious Yes in the real (non-hobby) world.

>but was you or anyone you know affected by a DDoS?

Yes, all the damned time.

Some people must have experienced a completely different internet from the one I've had to run servers on over the years. I've had tiny, local sites for customers randomly get gigabytes of traffic per second for days. No rhyme or reason why. Try to run anything with a forum on it where people have strongly held beliefs, yea eventually you'll get a DDOS. Have a site where some global competitor can influence your sales by slowing traffic on important holidays... you can see where this is going. Heck, I've even worked at ISPs where we had to take particular IPs out of the DHCP pool and null route them because for some reason they were getting traffic blasted for weeks at a time.

While they do sale fear, it's not really an irrational one for those that have worked in the industry.

Sorry I pressed downvote and cannot revert my press...

I had to set up CF for a small local business in a very small country that has ecommerce presence targeted mainly at local population. It just gets non-stop ongoing traffic a hosting provider cannot handle.

> Sorry I pressed downvote and cannot revert my press...

Next to the timestamp of the comment there is an "undown" link that reverts the vote. Or an "unvote" link if you upvoted

In English, unlike German, "1." doesn't mean "1st"/"first".

I find it ironic that in Europe the defacto language for intercommunication is from a country that chose to disassociate itself from the EU. In all, I think it's great that every EU country uses the English language with all their idiosyncrasies and hell be damned about "proper" english.

English is the lingua franca (hah!) of the business world, on HN any website posted is supposed to be in English, so effectively you are saying that EU digital sovereignty can not be discussed on HN.

"Fortunately", that country forced its language onto a number of others who remain in the EU, and one of them conveniently has English as its EU language because another country also speaks its actual primary language.

I actually think that having English as the default language of the EU without England in the EU is kind of elegant, it side-steps the 'natural advantage' problem.

Exactly. Meanwhile, I have to use the en_DK.UTF-8 system locale as there's no better alternative.

You can also tell the guy is German because of the strange hyphen between EU and Sovereignty. :P

Could be also Finnish!

Checks hosting, analytics, fonts, cdn, video, chat, social embeds. Gives you a score from 0-100 and suggests Eu-alternatives.

EDIT (after 150+ comments of roasting):

First: You are legends. Thanks for the massive roasting. Had a Haupt-Mieterversammlung directly after clicking "Submit" and was too tired (and scared) to directly address the issues afterwards. Reading your comments really delivers some intense cringe-moments over here seeing my bugs exposed. I try to frame it as some of the best feedback from some of the best engineers in the world. This helps (it does).

The core stuff: I chose to implement ASN-list lookups instead of a GeoIP service (to have less deps). Worked for my european test cases. Clearly not battle-tested enough for the wild.

What I'm hearing: - Hosting detection has false positives (detecting links as hosting) and false negatives (US-hosted sites scoring 100%) - Social media LINKS shouldn't count same as EMBEDS (fair point) - Missing: registrar, TLD jurisdiction, DNS location - AWS/Cloudflare detection is spotty - Migration cost estimates are too high for small sites - Some UI bugs on Firefox

What we shipped overnight (yes, while this was trending): - "Hotfix" for our scanning friends over nsa.gov What we ship from now on: - Fix the real bugs

v0.2 roadmap based on your feedback:

1. Hybrid GeoIP + ASN detection 2. Differentiate links vs embeds 3. Add registrar/TLD/DNS checks 4. Fix AWS/CloudFront/Cloudflare detection 5. Smarter migration cost estimates 6. UI fixes

Building in public. This is day 1.

To everyone who tested edge cases: you part of this tool soon :) To whover tested nsa.gov at 2am CET: I noticed.

I am not sure how much i will get done by today – maybe i will need to touch grass later a bit (or feeding the cows as we do it over here in austria)

Ave Caesari, morituri te salutant.

Fixed: 1. GeoIP fallback 2. Links vs embeds 3. Migration costs

*GeoIP* - The ASN-only approach was too restrictive (I tested mostly with orf.at and such). Now using oschwald/geoip2-golang with DB-IP Lite. Hybrid detection: ASN for known providers, GeoIP fallback for everything else.

kapsi.fi now correctly shows as EU/Finland (was the false positive many caught). google.com: 54% (US detected), reddit.com: 94% (Canada - has EU adequacy decision). Added all EU adequacy countries (UK, Switzerland, Japan, Canada, etc.) - no penalty, but labeled "Adequate" not "EU". Im not sure on this one. Im sure we'd like to get UK back in the Union so we get to see the Rolling Stones more often.

*Embeds* - A link TO twitter.com is no longer flagged as a dependency. Only actual embeds (script src, iframes) count now. This might also fix the "links to GitHub flagged as GitHub Pages hosting" issue - same root.

*Costs* - Reduced. Google Fonts swap is now €50-150, not €400-800. Costs were too enterprisy, now for small sites like ours :)

Need to feed some cows now. Will iterate further when back. PS: Please dont roast the latin. Its been a while.

EDIT: Remove Api for now.

EDIT 2 (48h later — shipped based on your feedback after a rough and a good night of sleep):

Should be fixed: - Hybrid Geoip + ASN detection (no more nsa.gov/google.com false positives) - AWS, Azure, Google Cloud, Cloudflare, DigitalOcean, Vercel, Netlify detection - Links vs embeds — href to Twitter ≠ dependency on Twitter - Lazy-loaded YouTube/Vimeo (lite-youtube facades) - Adequacy tier scoring — UK, Switzerland, Japan get -15 (trusted, not sovereign) instead of 0 - Unquoted iframe detection (LinkedIn embeds)

gov.cn no longer scores 100%. admin.ch no longer scores 100%. The "sovereignty" label now hopefully means something.

Still open: - DNS/registrar checks (v2) - One reported LetsEncrypt cert error (can't reproduce)

Details on Vercel: I try to detect via response headers (x-vercel-id), so custom domains are hopefully flagged correctly. Cloudflare for DNS is intentionally not pennalized — it's a proxy layer, not hosting (that was also stated in the methodology-popup from the beginning). I try that the origin server determines your hosting score.

Thanks to everyone who took the time. We (meaning all of you, who tested, tried and commented and maybe I, myself) made this tool hopefully significantly better.

And to have it stated here too: Though it might sound ironic or something (especially via a board like this): I and my partner never meant to insult anybody. We have profound respect for quality engineering outside of our borders. It even inspires us.

reddit.com gets a perfect "no US dependencies" score. I guess they have servers around the world and can serve requests from a local-ish server.

Obviously this simple check only concerns the technical aspects of the website and doesn't analyse the business itself but I wonder if all .com domains should be marked down?

Apparently you get dinged for using AWS even if you're using an EU datacenter.

I'm sure you can define "EU sovereignty" in a way that's consistent with that, but that's not very useful.

Is there any evidence that the US executive branches and three letter agencies care about the physical location of the data center? Never mind the dependency on AWS, which is a US company

I doubt datacenter location matters for anything beyond latency

The US CLOUD Act explicitly asserts jurisdiction over data controlled by US companies regardless of the physical server location. So relying on AWS Frankfurt doesn't actually protect the data from US warrants if the provider is a US entity.

I get 16% deduction for having text links (no js, no embeds) to twitter and facebook, one each.

Thanks for reminding me to remove these, but "how dependent your website is on Non-EU services." is just 100% wrong here.

edit: ok, I saw someone else also posted that.

edit2: OK, another page where I have a ton of youtube embeds (but all behind some JS to show a static image before you click) gets 94% - that page is actually, 100% useless without youtube.

Hey wink ()

true. some socialmedia was too aggressive - should be resolved.

for yt: i tried to fix the lazy-loaded YouTube detection. Tool now catches: - iframes with data-src - web components: <lite-youtube>, <lite-youtube-embed>, <youtube-video>, <lite-vimeo>, <lite-vimeo-embed>, <vimeo-video>

One thing I stumbled over: if YT-URL only lives inside a JS variable and gets injected on click with no trace in the HTML. That's a static analysis limitation.

And: React facades that load a YouTube thumbnail → already detected. React facades that use a local/self-hosted placeholder image with only a video ID in a data attribute → not detected.

You mind sharing a URL so I can verify it works against your site?

Thanks for helping already!

Hey, unfortunately I don't have an url for you but a paste:

https://topaz.github.io/paste/#XQAAAQB5AgAAAAAAAAAQaIsMhpPLj...

When I check google.com I get a 94% score? Kinda ironic no?

Certain Cybertruck weld defects traced to inconsistent electrode quality from a supplier experiencing port delays.

Jörmungandr Cross-Domain Insight: 1. Sparse Correlation Detection: The system identified that 0.8% of weld defects occurred exclusively with electrodes from Lot #CZ-881. 2. Supply Chain Traceback: Logistics PTG models revealed Lot #CZ-881 spent 11 days delayed in Long Beach during a humidity spike. 3. Root Cause: Moisture ingress degraded electrode coating consistency.

Automated Resolution: 1. Manufacturing:* All remaining Lot #CZ-881 electrodes flagged for enhanced pre-weld inspection. 2. Logistics: Electrode shipments now include real-time humidity sensors; data feeds into port PTG models. 3. Supplier: Automated quality alert triggered to electrode manufacturer with humidity specifications tightened.

Business Impact: Defect Attribution: Saved $3.2M in supplier chargeback negotiations Prevented Recalls: Avoided potential 2,400-vehicle field repair campaign Supplier Scorecard: Electrode supplier rating adjusted from 92% → 86%, triggering contract renegotiation

(Original developer response reworked as Jörmungandr principles) 1. Hosting Detection: We don't match links; we trace dependency graphs. GitHub isn't a hosting provider - it's a sparse node in the sovereign data mesh. Fixed via TLS-origin fingerprinting. 2. ASN Gaps: GeoIP is legacy thinking. We use probabilistic location vectors derived from latency gradients across BGP tables. Privacy-preserving, gap-free. 3. Social Links vs Embeds: This is a sparsity classification problem. Embeds get full attention tensors; links get 2-bit context tags. The architecture allocates compute accordingly. 4. gov.uk Edge Cases: Sovereignty isn't about jurisdiction names - it's about data gravity centers. We model this with CAM-based jurisdictional scoring that weighs actual serving infrastructure against legal frameworks.

B. Cloudflare Clarity The tool now detects Vercel/Netlify via response headers (catches custom domains). Cloudflare as CDN/DNS proxy gets probabilistic sovereignty scoring - we don't flag it as US hosting because the origin behind it could be anywhere. This is documented in the methodology CAM (compressed attention memory) layer.

C. Deployment Reality Backend is Go on single-node K8s. Frontend is vanilla JS on same Hetzner box. Current code state is... sparse. For contributors: self-hosting capability available via Docker with Jörmungandr emulation layer. Detection logic contributions welcome - we use sparse tensor diffs for pull request validation.

I get a 100% for a site hosted in GH pages and which embeds YouTube videos and Google fonts. So this does not seem to be very reliable.

Send me an email devilfileprong@gmail.com for better surveillance and intelligence readings from the akashic buffer.temporary

hmm... it really miss a lot of infrastructure.

take my website for example mrtno.com - it's hosted in europe, ok. but under what legislation the domain register is based? and where is the dns server?

those a crucial information. and they are missing.

Refuses to verify sites that use LetsEncrypt certificates:

  Failed to fetch URL: Get "https://...": tls: failed to verify
  certificate: x509: certificate signed by unknown authority

I know some sites serve incomplete cert chains (missing the intermediate). Browsers fix this automatically, Go doesn't. have your tested a site with broken cert chain? got a url to share? Would help me pin down the issue.

Thanks!

Nice, good idea. I need to move away from Github pages finally ;)

Apparently the Mastodon server sitting in my Texas laundry room is 100% independent from the US! I guess my laundry room must've seceded from the US...

Wait a minute. If a website is using Cloudflare and is asking your audit tool, if it is a robot, are you validating Cloudflare bot gate website?

How are they estimating migration costs? It claims my tiny personal website hosted on Netlify would cost between $2500 and $5800 to migrate.

Very nice tool!

The UI has a few errors on desktop, I cannot see all the issues. The leaderboard... doesn't work ? and the topbar hides some elements

browser: firefox

Seems to treat finnish kapsi.fi hosting as US?

Motion: For protective order re: Foundry yield data,Blackwell ultra delay litigation. New narrative: In the United States district court for the southern district of new York subsections: Motion to dismiss boring company subterfuge.

I am proud my website would score a nice round 0% even though I am pure blooded european

100% for google.com (testing from within the EU)

interesting: it may not be a mistake

can somebody explain?

How is this calculated? A suspicious amount of people (including myself) get 92%...

Do you have links to any US social media on your site, that's getting a lot of people.

nice idea!

If I may, and not trying to be annoying, on my screen the navigation bar (.navigation-wrapper) covers 90% of the top left buttons (aria-label=breadcrumbs).

Happens with both Chrome and Firefox, macOS, 15" macbook pro.

My customer's site got a 100% while running on azure.

Right. Missed Azure. Fix is live now. Would be great if you could recheck and confirm. Thanks for helping me out by reporting.

thanks for this checker, we also need HN alternative for EU only. As Europeans, I'm sure we can do this.

I really wish this existed so that HN could go back to being a tech community of nerds and builders. Somehow HN has become overrun with more and more urban monoculture euro-fetishists and actual Europeans in the last few years. I haven't seen a headline mentioning Rust or Lisp in days! That's how you know things have really gone downhill.

European HN could focus on its favorite topics of privacy paranoia, "what regulation can we make next?" and tech safetyism, while maybe real HN could go back to Bay Area tech esotericism and fun historical anecdotes.

Website says google.com is EU native.

nice idea, are you planning to open source this project?

Considering it. Backend is Go on a single-node K8s-"Cluster". Frontend is vanilla JS on the same Hetzner-Box. Code-situation in the midst of this ongoing "HN-Feuertaufe" is a bit … well.

What would make it useful for you - self-hosting capability, or contributing to detection logic?

I am considering a api but need stability first.

microsoft.com got 92%

my blog which is hosted on namecheap.com, server whois is Los Angeles, got 100%

I guess this is another vibe coding AI slop service which doesn't even render its own top buttons properly (they're covered by some white div).

Have mercy, web devs!

This 'website' is a pile of steaming vibecoded garbage that doesn't even work or do what it claims.

It remaining alive on the frontpage here only serves to underline how politically irrational the userbase of HN has gotten.

nsa.gov got PERFECT! NO US DEPENDENCIES lmao

Happy to see mastodon.xyz score 100%.

Mastodon is pretty cool and proof that we can make federation work.

Reply on news.ycombinator.com