Hacker News Reader

Comment by evilmonkey19 | Hacker News Reader

Personally, myself I have been greatly impacted by this measures. Several services of mine were unavailable because LaLiga said so. No notification, no justification, they block and that's all. It has been a shame since the beginning.

View on HN

What would it look like if you sued La Liga for using their lawful blocking power in a way that injured you?

A very expensive lawsuit that, even if successful, will result in a difficult to enforce judgment?

What's difficult about enforcing a judgment against La Liga? They're as public as it's possible to be.

Might they appeal?

They have deep pockets for dragging this on much longer than you can afford it.

I doubt that will work outside of the U.S.A.

I think it’s a universal tactic. Maybe it’s even more extreme in the US (what isn’t), but you can drag court proceedings on pretty much anywhere there are courts and legal costs.

I don’t know that this would work that well given Spain is civil law, not common law

(Disclaimer: I don't know the first word about law)

But I have been thinking about this quite a lot recently (mostly because I get angry at the power states sometimes have over individuals). Would the distinction really matter in this case?. I would think that in a "civil law" contry things could be even worse for the aggressor

It depends on the law in question. Civil law typically requires that the plaintiff's cause of action and desired remedy be defined in the relevant code or statute. This doesn't mean the average person is powerless; every civil code I know of will let you file a lawsuit for breach of contract, for example. I have no knowledge at all of Spanish law, though, so I have no idea who has grounds to sue whom and under what code. If a similar situation happened the US, you'd probably file a lawsuit against Cloudflare, the ISPs, and the relevant sports league and sort it out in court.

You would do the same in a civil law country, sue the sports league and ISP. State that an "unlawful act" happened (blocking your service) and claim damages due to loss of traffic and the extra work it caused you.

But is it actually an unlawful act? A judge decreed that La Liga can demand the blockage of certain IPs. La Liga demanded the blockage of certain IPs. Does the fact that it had an unintended consequence on others somehow make it illegal?

Judges aren't perfect and just because they decree something, doesn't mean that the remedy implemented by the ISPs isn't also a violation of some law or regulation. Normally this would be handled by yet another court case, possibly going to a higher court to decide if there are contradictions or conflicts.

The law is no stranger to "damned if you do, damned if you don't" scenarios.

I mean, really, the appropriate avenue is for the legislature to clarify law, which is the subject of the article

It doesn't have to be an unlawful act. You can recover damages for a lawful act.

Here's France, the Platonic embodiment of European civil law:

> To get damages, you must compile a file that gathers all the elements that make it possible to determine that your damage is compensable

> You must demonstrate that you are the victim of harm: [snip]

> In order for your damage to be repaired, you must also determine:

> - A fault, negligence or infringement committed by another person

> - And that your injury occurred as a result of that fault, negligence or breach.

> Example :

> A person walking down the street hits you because he is looking at his phone. You fall and you break your arm. So you are suffering bodily harm that was caused by the negligence of the person who shoved you. It was precisely this negligence that led to your damage, because if the person did not hit you, you would not have fallen. You can therefore ask him for damages.

( https://www.service-public.gouv.fr/particuliers/vosdroits/F1... ; note the banner saying "This page has been automatically translated. Please refer to the page in French if needed.")

Do they not have a charge of "tortious interference with business" in civil law like in common law? It's where one company just goes out of their way to fuck up your business for no good reason.

The legal system in many countries is very, very different from that is the US (or UK).

> No notification

What ISP? I'm using Vodafone and if I accept the insecure connection (because of mismatched certificate), I get served the notification. You don't get that?

Presumes you're using the ISP's DNS and not custom servers or DoH.

Bit hard to get notified by the ISP if you effectively try to side-step the way they notify you, don't you think? Also bit weird to blame them for that.

If I recall correctly, if you try to access the IP directly you get the same notification. No football game on right now though so cannot check.

Edit: In fact, I'm not sure they do DNS filtering at all actually, it may be just based on IP, can't remember off-hand, considering the collateral damage, I'd say IP blocks mainly.

ISPs have your contact information, and they can also put up notices on their own website. Hijacking somebody else's website with forged replies isn't "the way they notify you," it's a man-in-the-middle attack, and users shouldn't be trained or encouraged to accept it.

> ISPs have your contact information, and they can also put up notices on their own website.

So whenever you see "Connection Refused" your instinct is to go to your ISPs website?

I also don't think it's "hijacking someone's website", then it'd be global, instead it is a man-in-the-middle attack, serving different traffic than the user intended.

Hijacking secured connections to inject a payload that doesn’t actually come from the source is not a legitimate form of notification - it’s a malicious infrastructure attack.

Why would you ever accept a mismatched certificate? Even assuming that you think your ISP has no nefarious plans, are you going to be able to rigorously confirm it's their certificate? At that point you've bypassed all the mechanisms in your browser that do this heavy lifting for you.

Why wouldn't you? Your computer is not gonna be hijacked by it, and you want to see what shit your ISP is now up to.

Obviously I don't do my banking like that...

Erm, where is the danger in a mismatched certificate, if all I want is to get some noncritical information from a blog or something?

Local privilege escalation in your browser is a danger. They can also abuse any privileges you gave to the website, such as camera and microphone.

Why would I give a "random blog" access to my camera or microphon?

And how can a wrong certificate lead to local privilege escalation?

Reply on news.ycombinator.com