hckrnws
PSA: UK users can visit all their favourite websites in Tor Browser. Just don't run your torrent client using the tor network. Thank you.
You can also access 4chan, Tattle Life, and other nasty gossip websites that the UK nanny state wants to ban.
And you can access the porn on Reddit and Twitter (though in some cases you'll have to make an account). And of course the "tube" sites work fine.
After you've done that, as a UK citizen, please go to https://petition.parliament.uk/petitions/722903 and ask the government to repeal their awful law.
I don't actually use Reddit or Twitter, but I sometimes come across NSFW posts from links. I've found that old.reddit.com seems to allow you to bypass the filter(s) without needing an account. For Twitter, I tend to use the xcancel.com Nitter instance, though there are other Nitter instances that work fine.
Bonus for using Nitter here, you can also see the latest posts from an account instead of the most popular posts, and see replies/interactions to individual tweets. Oh, and it gives you plain HTML.
Reddit pisses me off so much that despite the fact that I don't even use Reddit, just so that my experience sucks less when I'm linked to Reddit or have another reason to lurk it,
- I use the "Old Reddit Redirect" extension to force the browser to go to old reddit
- I use the "Load Reddit Images Directly" extension to bypass Reddit's hideous image viewer that tries to load if your browser makes the mistake of having text/html in the "Accept" headers when opening an image in a new tab. (Dear Firefox/Chrome/etc: maybe stop doing that? If I open an image in a new tab, there is a zero percent chance I want HTML.)
Reddit is also very aggressive at blocking VPNs. Mullvad is constantly blocked. Occasionally I'll turn it off, but Reddit is just a terrible place so I usually go elsewhere (I'm only going because of Google search results. I'd rather use an LLM than turn off my vpn for Reddit)
Interesting, are you using any particular exit country for Mullvad? I’ve used Canada and never ran into Reddit blocking it.
Mostly US and Sweden. I'll give Canada a go. Thanks for the suggestion
> - I use the "Old Reddit Redirect" extension to force the browser to go to old reddit
if you make a Reddit account, you can flip an obscure setting so that www.reddit.com serves the same site as old.reddit.com
The bypass via old.reddit.com stopped working today as well.
I just googled 'top nsfw Reddit' and aside from some disturbing implications of 'top' all opened fine with 'old.'. The IP is UK based, is coming up as UK on all geoip sites I tried and is in all of the last 30days of maxmind as UK based.
It might be some kind of phased rollout of course.
Oops, I should note that I'm a U.S. citizen in a state without any porn age gate laws. I have no idea what the status of using old.reddit.com to bypass the NSFW filter is in other jurisdictions, or honestly even my own (not sure how to test it.) All I know for sure is that it worked last time I tried it.
Is the reddit equivalent of xcancel/nitter (i.e., redlib https://github.com/redlib-org/redlib) also blocked? Presumably if the instance is hosted outside the UK it would work since I think it effectively proxies your requests.
> Just don't run your torrent client using the tor network. I have never used tor so novice question: why not?
> please go to https://petition.parliament.uk/petitions/722903 Signed!
The tor network essentially relies on donated exit node bandwidth, and there's a finite capacity at any point in time. Torrenting is a bandwidth hog (and a lot of exit nodes will filter it out anyway)
> donated exit node bandwidth
Hey, we pay $100B/yr of tax money into the NSA/CIA/etc budgets every year so they can run exit nodes among other activities, I wouldn't exactly call it donated
Is it really just a matter of my bandwidth being hogged up, or more a risk of getting my IP address (range) banned, if not worse legal risks from activities being traced to me?
You can use the I2P network for torrenting if that's what you want, as that kind of traffic is not frowned upon.
Probably going to be slower than over the Tor network without any manual tweaking.
Yes, an exit node operator will appear as the source of the traffic, which can have legal repercussions. (Personal risk.)
But on a macro scale, the entire Tor network has fairly limited bandwidth and torrenting is a very easy way to saturate it. (Existential risk to the network / tragedy of the commons)
Comment was deleted :(
You can't get banned because no one knows who you are. You can bring down the entire Tor network. Probably not you by yourself, but if enough people do it they can.
I believe OP was responding from the perspective of an exit node operator.
Exit nodes have to deal with much more severe things than copyright infringement. They regularly get raided by law enforcement for accusations of child porn and hacking, and have to defend themselves by pointing out they didn't originate the traffic. There's a whole bunch of tips out there about how to not go to jail for running an exit node (which is legal).
Thanks!
That's why some "tor-torrent" protocol should be invented, where data is sent via torrent network. There's still some bandwidth amplification, but as long as someone is seeding from within tor, the whole transfer could be done there.
...would also help with privacy and nasty telco letters.
Some clients by default leak your IP when using Tor, the last I checked. When announcing to other peers, the IP of the host machine is provided.
So, you anonymously make the requests through an exit node, but the request contains your IP, which defeats the entire purpose of Tor.
Interesting, thanks
> I have never used tor so novice question: why not?
bandwidth is a scarce resource on tor.
No it isn't. https://metrics.torproject.org/bandwidth.html
Thats relay bandwidth, I assume exit node bandwidth is some fraction of that
Tor is great but the bandwidth/latency kinda sucks for casual browsing activity. A VPN is a more realistic workaround to this kind of geofencing.
I almost said "solution" instead of workaround, but of course the only actual solution is to fix the legislation.
> Tor is great but the bandwidth/latency kinda sucks for casual browsing activity
It is reasonably decent these days. Generally there are periods where Tor network is slow.
> A VPN is a more realistic workaround to this kind of geofencing
Generally I tend to use a combination of Tor / VPN depending on what I am doing. Some gossip sites have onion urls and I will use Tor if visiting those. Other sites that are geo-fenced (sites like Odysee) are easier to get to via VPN.
> I almost said "solution" instead of workaround, but of course the only actual solution is to fix the legislation.
That isn't going to get fixed anytime soon. In fact I expect it to get worse over time.
It's actually pretty ok for casual browsing these days. Have you tried it recently?
Funny in a US state I'm finding more and more places are popping up with an age verification. Doesn't really bother me so much content out there but yeah.
It's weird too how I don't want to prove my age, guess it's the taboo aspect of it vs. say showing your id at a bar.
> PSA: UK users can visit all their favourite websites in Tor Browser.
And get to solve a dozen whack-a-mole intentionally-slow-loading reCAPTCHAs just to see the page, or worse, end up in a Cloudflare redirect loop.
I get enough of that between Brave Browser and using Linux as my desktop OS.
They don't show up significantly more often for me than in Brave browser.
Though at that point might as well use Tor in Brave, because the additional ad&trackers blockers improves drastically the load times.
Now, if only Brave would go the extra mile of having the Tor browser window better mimick the Tor Browser.
I've got PiHole and a couple extensions installed that block more than Brave itself does. Not really into Tor, but I did try it a couple times.
I use tor semi-regularly to get around stupid UK geo-fencing of content and honestly it hasn't been like that in a while.
You'll need more than just an account to access "certain mature content" on sites like Reddit - you'll soon need to upload some photographic ID.
I wrote a similar comment but then realised that if you're using tor per GP's recommendation, you'd be fine as long as your exit node isn't in the UK, or other regressive jurisdiction.
It is trivial to create a digital picture of a false ID.
Which is why you will need to provide a cryptographically secure identity credential issued by the government, and you will need to re-verify at regular intervals, not just upload a JPEG.
Make no mistake, the plan is to require 'KYC' for Google, reddit, Facebook, X soon and all that and then later require it for all web sites, even this one.
Australia recently passed a law requiring Google to KYC Australian account holders to check ages to decide if the user will be allowed to control the "safe search" setting.
Well. Certainly for people in the room here. One imagines regulators know that too, and will draw the line accordingly… that they may grudgingly tolerate validation systems that allow some degree of individual fraud, but stomp on the first of us here to vibe-code our way to a fraud-as-a-service site that gets any traction.
I’m reminded of all-around-good-guy @patio11’s evergreen The Optimal Amount Of Fraud Is Non-Zero…
https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...
It might be necessary to ensure that your exit node is not in the UK or another locality that is otherwise blocked.
That procedure depends upon your platform and client.
http://www.b3rn3d.com/blog/2014/03/05/tor-country-codes/
Edit: Use this link instead (thanks mzajc!):
https://web.archive.org/web/20180429212133/http://www.b3rn3d...
I get a "badware" risk on that link from uBlock Origin (Firefox).
"uBlock filters – Badware risks"
The domain has been squatted and displays typical spam advertisements. The last good archive is on https://web.archive.org/web/20180429212133/http://www.b3rn3d...
I hope many UK citizens are going to sign it.
> After you've done that, as a UK citizen, please go to https://petition.parliament.uk/petitions/722903 and ask the government to repeal their awful law.
There is literally no point in signing those petitions. The only disagreement between the major political parties in the UK is how draconian it should be.
If it hits 100k then it needs to be debated in parliament. However the bill was already debated in parliament and got through and the petition doesn’t bring anything new to the table.
There would be more of an impact if, perhaps, everyone in the UK who has had to shut a web site because of this law wrote to their MP.
> If it hits 100k then it needs to be debated in parliament.
I don't think so. It says on the site "At 100,000 signatures, this petition will be considered for debate in Parliament".
I've seen people get excited about petitions before that got to 100,000 signatures and it all fizzled out, or it wasn't debated seriously in parliament. Often you will get a cookie cutter response with these petitions that is a paragraph long.
The reality is that most of the public are indifferent or supportive of the current legislation and most MPs know that.
> There would be more of an impact if, perhaps, everyone in the UK who has had to shut a web site because of this law wrote to their MP.
Each MP would get maybe a max of 10s of emails/letters each. Many of those MPs wouldn't even bother answering you. Those that do will often will probably give you the brush off.
I've written to my MP before (about encryption legislation), spent a lot of time presenting a clear and cogent argument and I got a "well I might have a chat with the home secretary" and they were still singing the same tune years later. What I was telling them was largely the same as other industry experts. They don't care and that is the unfortunate reality.
The fact is that the direction the UK government (doesn't matter whether it was Red Team or Blue Team) has been going in has been clear for well over a decade at this point. It would take a major political shake up for this to change IMHO.
True, but MPs receiving a few mails that say “this law has affected me in this way” is IMO far more likely to be effective than a petition with 100k signatures that says “I don’t like this law which you recently approved”.
MPs have been known to respond to letters. I have had responses to various issues. It obviously depends on the MP. Many MPs were very much opposed to this issue.
> True, but MPs receiving a few mails that say “this law has affected me in this way” is IMO far more likely to be effective than a petition with 100k signatures that says “I don’t like this law which you recently approved”.
I think they are both ineffective. So I don't believe that is true.
> MPs have been known to respond to letters. I have had responses to various issues.
Getting a response is one thing. Having something done is another.
> It obviously depends on the MP. Many MPs were very much opposed to this issue.
The legislation was going to happen at some point or another. The direction of travel was quite clear. There are always going to be some dissenters, but the awful legislation got passed anyway. So what did their dissent achieve? Nothing.
I came to the realisation a number of years ago that for the majority of people, the only care about being able to use their Netflix, shopping on amazon, check their email and post photos on Facebook. Concerns outside of that are simply too abstract/distant to care about.
> I think they are both ineffective. So I don't believe that is true.
I disagree that writing to MPs is always ineffective. Some campaigns have been successful. Whether it will be effective in this case is another matter. Maybe when people start to experience the block it will gain traction.
Of course if you don’t even make low-effort attempts to make your voice heard and exercise your democratic rights, you can be certain that you’ll lose them.
> I disagree that writing to MPs is always ineffective. Some campaigns have been successful. Whether it will be effective in this case is another matter.
It won't be effective in this case. It been going in the same direction of travel and none of the parties (including outsider parties such as the Greens, Reform etc) proclaim to believe in in reversing this direction of travel. They are much more interested in other issues that are much more hot button. Those issues are easy for the public to understand because they are likely to have encountered them often.
> Maybe when people start to experience the block it will gain traction.
No it won't. People will either find a way to circumvent via VPN/Tor or some other mechanism (which is what they already do) or they will simply shrug their shoulders and won't bother.
There has already been a large number of forums/sites that have been shutdown or site been blocked in the UK and there hasn't been any significant traction on this issue.
> Of course if you don’t even make low-effort attempts to make your voice heard and exercise your democratic rights, you can be certain that you’ll lose them.
I don't really know how to respond to something like this because I believe it is naive on a number of levels. I consider myself a realist. I believe "making your voice heard and exercising your democratic rights" is about as effective as talking to a brick wall (at least on a national level).
I have personally made attempts. I wrote to my MP often. I cited links, news articles etc to back up my argument. It was an utter waste of time. At best you may get a short response. I realised I was ultimately wasting my time, I stopped and will never do it again. I actually feel stupid for believing that I could make any difference at all. I suspect this is the experience for other people and is often not spoken about.
Moreover much more notable people have tried to make themselves heard around a number of related concerns about freedom of speech, threats to privacy, iffy counter-terrorism laws etc. More often than not has always been either ignored entirely, responses that completely ignored the crux of the issue, or straight up lies from successive governments for almost two decades now.
Realistically our options will be to learn to live with the poor legislation, circumvent it, or leave the country.
Ssshhh
They may work out that UK has a 2 party system where each one just takes turns and none of it makes much difference.
I don't think many of the so called alternatives are going to be any better. Wait til they figure that one out!
Comment was deleted :(
Tor is great but wouldn't an easier and higher bandwidth (for the yarr harr) solution to just buy any VPN service that exits outside of the UK?
Yes
VPNs are yet another Cloudflare and are next in line to implement censorship.
They very well could be, but I doubt they remain in business for very long were they compelled to block the raison d'etre people use them.
Tor is a bit slow for streaming video.
On tor, reddit blocks you from logging in with 90-95% of the exit nodes
You are very unlucky
Reddit runs an onion service. Can you not use that?
Logins almost always give some 4xx error from both their onion address and regular address on Tor
You can browse though
I have no idea what Tattle Life is but two clicks in, first to “Offtopic” and then “The Lucy Letby case”, and Apple Pay pops up.
Not a fake one, but the real deal trying to charge me £0.00.
I don’t have the patience to investigate that further but I am all behind banning scummy sites like that.
Not really been much advance notice of that to account holders. I wonder how the normally sane and well balanced people left using Twitter will react to that. Or even how they determine "UK account" anyway, given all the usual geographical qualifiers.
Crazy stuff
[flagged]
Stop disseminating misinformation by a YouTuber who has no business making judgement calls on a topic they obviously don't understand.
Strange that they would allow such petitions in North Korea.. ehh I mean in the uk.
Blocking is the wrong terminology here. Cloudflare is not an ISP which fetches whatever you ask for from third parties. It's a company contracted by the web site owners to distribute their websites. It's much more accurate to say that Cloudflare is no longer acting as a host for pirate sites in the UK.
The shocking part of this isn't that they aren't participating in that form of crime in the UK, it's that they're somehow able to participate in it in the rest of the world.
And I say this as someone who thinks that copyright laws are largely unjust, preventing people from engaging with their own culture, but that doesn't make them not the law.
Most of the world doesn't bother playing whack-a-mole with pirate sites because it usually doesn't work. The UK, however, is no stranger to enacting policies that are known to be ineffective.
> It's much more accurate to say that Cloudflare is no longer acting as a host for pirate sites in the UK.
I understood from the article that it was for users in the UK, not for hosts in the UK.
The implied parentheses were intended to be "(Cloudflare is no longer acting as a host for pirate sites) in the uk" not "Cloudflare is no longer acting as a host for (pirate sites in the uk)".
See https://cybersecurityadvisors.network/2025/04/15/la-liga-blo... : I'm slightly surprised that this hasn't caught up with them too. It used to be important to stay somewhat "below the radar" when pirating, not creating an account at one of the largest internet services. But then anti-piracy enforcement is about money and going after soft targets.
Comment was deleted :(
> Blocking is the wrong terminology here. This is geo-blocking, by definition.
Personally, it's always sad when a company agrees to censor on their own merit when they don't have legal obligation to.
> > Blocking is the wrong terminology here.
> This is geo-blocking, by definition.
Do you also refer to steam games that only sell in some regions as "geo-blocking"? I don't. Steam doesn't (they call them region restrictions). There's no blocking going on, merely declining to offer something in the first place. Cloudflare is the host here, they aren't blocking anything, they just aren't providing the pirate site in the first place.
> when they don't have legal obligation to.
While I know relatively little about UK law I'm extremely skeptical of the idea that cloudflare does not have a legal obligation to not knowingly host websites committing copyright infringement.
> Do you also refer to steam games that only sell in some regions as "geo-blocking"? I don't. Steam doesn't (they call them region restrictions).
So I am not blocked from buying a game based on my geographic location, I am merely restricted from it based on my region...
Yes? I agree "geo" and "region" are synonymous here, but as I understand the word "blocked" to be "blocked" a transaction has to be in action in the first place - and if one party to the transaction (steam) isn't interested then the transaction wasn't in action.
Similarly you can block a punch, but not if it was never thrown.
sad how your take is one of the only sensible ones in this thread
There are court orders here; it doesn't look voluntary to me.
I came to the realisation recently that the free Internet only happened (in the West) because:
- The Silent Generation, in charge at the time, had no idea what was this Internet thing about.
- The US Intelligence community understood it was a powerful tool to operate abroad.
- Nobody dared derailing the only engine of growth and progress in many economies
It obviously got out of control and is very abnormal in fact if you consider how power really works.
As of today, as a user of a reputable VPN, I am blocked from a lot essential websites or have to prove I am an human every 5 minutes, it sucks.
Anyway we are one major cyber disaster away for our the state to switch from a blacklist to whitelist paradigm. A safer and better Internet for everyone.
We will probably still have ways to access the "Free" Internet. It is gonna be fun, slower and might get you in serious troubles.
The thing is, the Internet was supposed to be P2P initially (in Spanish it had the motto "La red de redes" (the network of networks, meaning that it was supposed to connect several LANs together).
But as soon as you had ISPs started, centralization came. Now, most countries will have at most 5 major ISPs, and in reality geographical availability within countries make 1 or 2 available.
Then, originally people had their own websites (I was there!) in their own servers. But Geocities started the centralization trend. And then CDNs, and then MySpace/Facebook and all that.
The only way we are going to get the "freedom" network as it was before is through mesh-networks or similar technologies. Which maybe so far are very slow and cumbersome, but they will have to evolve. I know it is not very fashionable here in HN, but the only see that capable of happening is implementing some kind of "incentive mechanism" that incenvitives people to let data pass through their node in the mesh network; aaaand cryptocurrencies offer an possible solution for that.
> The thing is, the Internet was supposed to be P2P initially (in Spanish it had the motto "La red de redes" (the network of networks, meaning that it was supposed to connect several LANs together).T
The Internet is just a commercialised ARPANet. ARPANet was designed to survive bombs taking out a fair percentage of it's nodes. The Internet still has that robust resistance to damage. You can see it in action when anchors cut ocean cables - barely anyone notices. And as the old saying goes, the internet treats censorship as damage and routes around it.
However, the commercial enterprises built on top of the internet love centralisation. CloudFlare is an interesting case in point. They have been champions of an uncensored internet for as long as I can remember, which is one of the reasons they grew to their current size. That growth was always going to compromise that core principle, because once a significant amount of traffic passed through them they would become an attractive target for groups wanting to inflict their views of what's proper viewing for the rest of the world.
But while CloudFlare can't exist without the internet, the internet will continue on without CloudFlare. So while the self appointed gatekeepers have indeed blocked the large hole in the sponge that is CloudFlare, underneath the sponge is still a sponge. Information people find interesting will just take other routes.
Or to put it another way, if they think they have stopped or even appreciably slowed down teenage boys from accessing porn, they are kidding themselves.
Something I have always been wondering is: how much was WiMAX a threat to this centralisation and the 3 - 5 ISP per country model?
I remember around 2010 there were cities with several small new ISPs providing fast home and mobile Internet for cheap and with very good coverage. Infrastructure costs were probably very low. Order of magnitude I guess compared to 4G, cable or fiber.
You could find phones supporting it (HTC was one of the maker) and it seemed to be the perfect solution for most users. I am not sure if those small ISPs already had a roaming system in place but it would have made a lot of sense.
Anyway, when Intel finally gave up I thought there are probably strong forces wanting to keep access to the Internet in a few hands, expensive and centralised.
The centralized search engine's AI summary says that LTE became more popular, and the people who would buy WiMax hardware ended up buying LTE hardware instead.
From what I remember (and I might be wrong) WiMAX was first competing on the "home" Internet market. Mostly against cable & DSL I guess at the time. It was a USB dongle you would put in your laptop.
Having a one WiMAX enabled smartphones was the cherry on top and probably more of a long term goal. The only one I remember was the HTC Evo 4G [0] (the first 4G enabled smartphone released in the US, and by 4G they meant WiMAX, not LTE).
My guess is there was for sure a big battle between Intel, major phone manufacturers, telcos, infra providers and various patents holders.
There was probably a chicken and egg dilemma for mobile phone manufacturer since they had to wait for the network to grow before risking launching their WiMAX phone but having a WiMAX enabled phone would make WiMAX at home really attractive.
My guess is also that since people usually get their phone from their telco, phone manufacturer had to be careful not to go against their interests. And since most telco wanted LTE, WiMAX couldn't take off.
But there might be more to this story, including the fact Intel was also trying to get in the phone SOC market at this time.
> As of today, as a user of a reputable VPN, I am blocked from a lot essential websites or have to prove I am an human every 5 minutes, it sucks.
I have to do that using corporate and residential US networks, simply because I use Firefox.
As great as Cloudflares services might be to each individual user, the centralization of infrastructure, and by extension the centralization of power, doesn’t seem to be worth it at a macro level. The tragedy of the commons strikes again.
Try disabling third party cookies, and on some sites, you'll be clicking cloudflare captchas every time you open them :)
Ah, I guess that's why I get tons of them, thank you!
Can't they at least set a first-party cookie to avoid repeated captchas per site, given that they're terminating HTTP?
You're forgetting that that the Internet was intertwined with the phone system at a time when the latter was the only reliable form of communication at both local and long-distance levels. Interference with the Internet would be interference with the international telephone system.
I don't see how the fact that dial-up was the norm for the internet "last mile" changes anything wrt the ability to block it. It would be done in exact same way it is done today - by forcing ISPs to do the blocking on internet protocol level.
Thats a good idea, we could moderate the phone system.
Yeah, a lot of stuff only worked because it was a "subculture". That could no longer be sustained once the first Twitter President arrived.
The decline of internet began way before trump, I'd say with the rise of facebook and everything moving on there (your local restaurant used to have a website, then switched to facebook only).
Centralized power, centralized censorship.
At approximately the same time, social networks became less social and more propaganda feeds.... so it went from a feed of content made by your friends for other friends (from complaints in status messages to photos of their plates) and moved to whatever crap they try to serve you now,...
Every computer is a general purpose computer. What would you do to force me to participate exclusively in your nanny-net? I suspect any answer to that question requires an incredible amount of coordination and participation.
The real problem with the internet, as I see it, is centralization. This is a product of monopoly, which is the core feature of copyright. A truly better internet would replace the authoritative structure of copyright with a truly decentralized model.
As far as I can tell, the only hard problem left in decentralized networking is moderation. No one wants to browse an unmoderated internet. The problem is that moderation is structured as an authoritative hierarchy, so it's not compatible with true decentralization.
I propose we replace moderation with curation. Every user can intentionally choose the subset of internet they want to interact with, defined by attestations from other users, all backed with a web of trust. This way everyone is the highest authority, and users can help each other avoid content they are disinterested in.
The internet was a very good tool in subverting dictatorships and influencing elections. Now that adversaries of the West have mastered it and the shoe is on the other foot ,internet bad
Previously, a convenient and low-latency way to bypass UK internet censorship was to proxy via a local datacentre - it's only the residential ISPs that are under pressure to censor traffic, commercial ones less so.
But if the blocking is happening somewhere other than the ISP, this is less effective. A hypothetical TPB user might want to proxy via Luxembourg now (seems like the shortest hop to somewhere with sane legislation)
You didn’t even need to do that. Just needed an /etc/hosts entry for the domain.
My ISP (Virgin Media) does DNS filtering and IP-based blocking and TLS SNI inspection. So you have to use ESNI or domain fronting, which last time I checked my browser could not be easily configured to do.
At this point, what's the difference between the UK and China other than the specific content they block? Some ISPs have even started blocking wireguard here & I've had to resort back to xray/v2ray
Very little difference. But blocking wireguard is huge change, which ISPs are doing that?
I currently live in student accommodation so not sure what they're using upstream. The university network also drops wireguard connections but only to known providers like Mullvad (assuming obfuscation is off)
You may have some success with DPI bypass tools we've been using in Russia for years now, like GoodbyeDPI and Zapret.
Is that common for all ISPs or just Virgin? When I lived in the UK (already a number of years ago) it was all just DNS-based. Running my own DNS resolver unblocked everything. I don't recall which ISP.
I think it's just Virgin doing the SNI stuff, but I wouldn't be surprised if others are doing IP filtering. I'm not sure if anyone's done a good survey of what the different ISPs are doing (it'd be an interesting project).
TalkTalk, Sky, BT & pretty much all domestic mainstream ISPs do DPI down to SNI.
They also exercise an IWF proxy so your already MiTM'd.
This is a big deal. We knew since the beginning that replacing the World-Wide Web with a centralized system would make it vulnerable to government censorship, however well intentioned Cloudflare's founders were. This is only the beginning.
Shouldn't surprise absolutely nobody, once you become the gatekeeper of the Internet, you're going to gatekeep.
Now it's torrent sites and next it's going to be other things the party in charge doesn't like.
Right, it's only natural; they MitM 20% of the internet.
Similarly, I struggle to believe they're not providing much of the data they collect to the CIA.
CIA front like snapchat with all on camera access. Nothing surprising
> Shouldn't surprise absolutely nobody...
...because this is far from the first time this has happened with Cloudflare.
Is it? When did it happen before?
About a decade ago, there were proposals for a "driver's license for the internet."
Nowadays... I actually think it might be a lesser evil. Picture such an ID, if there were a standard for it, enrolled into your computer.
If it were properly built, your computer could provide proof of age, identity, or other verified attributes on approval. The ID could also have micro-transaction support, for allowing convenient pay-as-you-go 10 cents per article instead of paywalls, advertising, and subscriptions everywhere. Websites could just block all non-human traffic; awfully convenient in this era of growing spam, malware, AI slop, revenge porn, etc. Website operators, such as those of small forums, would have far less moderation and abuse prevention overhead.
Theoretically, it would also massively improve cybersecurity, if websites didn't actually need your credit card number and unique identity anymore. Theoretically, if it was tied to your ID, it's like Privacy.com but for every website; much lower transaction friction but much higher security.
I think that's the future at this rate. The only question is who decides how it is implemented.
This is so naive. Big tech would be the first to get various exceptions to train their greedy AIs. They would lobby so hard to lock down personal computers, just to make sure you are not tampering with your digital passport. Google would finally have their wet dream of locked down PCs that have no adblock.
Politicians would be salivating at the idea of getting the real identities of dissenters, and religious fucks would finally have their way of banning porn and contraceptives.
You're assuming this isn't already in the works; I simply see it as we can make the standard now, or let the standard be dictated.
We're already seeing it piecemeal, with Cloudflare supporting skipping CAPTCHAs on verified iOS and macOS devices; mobile driver's license enrollment options on iOS; age verification rollouts for websites with no-doubt people thinking how to streamline things; etc.
I personally think we are one big cyberattack from the whole concept returning fast. One big cyberattack from governments (and people in general) saying they've had enough of the free-for-all status quo. This isn't a good place to be.
I'm aware that this might very well be "in the works", what's your point with that? Who is this "we" you are talking about? Are you going to publish a repository on github about what you believe is the ethical way to do this, and you expect Google to follow, or ???
What is this "one big cyberattack away" that you are talking about? Large sites get hacked all the time, and _nobody_ in power gives a single flying fuck. There are zero people held responsible for storing passwords in plaintext, or the admin password set to "123456" or passwords left as the default.
Seriously, what are you talking about?
German national ID has this built-in; you can cryptographically prove that you are currently in possession of an ID (and its PIN) over a certain age, for example, without revealing your date of birth. It's just not in widespread use.
Thank you for sharing this. I have been frustrated about the lack of chip and pin for IDs for years. We have had digital IDs in the form of debit/credit card since the 90s, and yet the governments have been agonizingly slow to adopt this (at least to me) painfully obvious idea. So good job Germany!
Chip and PIN is almost how electronic passports already work - it's just that the 'PIN' is printed in the passport itself, so in order for anybody to communicate with the chip, it has to see the page which has it printed in order to scan for it first.
CA DMV app lets me add my driver's license to my mobile wallet (which works with NFC).
Of course, it doesn't eliminate my legal responsibility to carry my driver's license while driving, and while the printed piece of plastic lasts five years and my passport booklet is legal I.D. for 10 years at a time, the mobile driver's license needs to be updated every 30 days.
Why have the digital version of you need the plastic copy still?
Comment was deleted :(
oh good, and your authoritarian government can know you're in the closet and trying to figure out how to leave the country, too!
no, fuck this idea so hard. if this is inevitable, our duty is to build technology that defeats it
You can create an ID card system that reliably verifies some sort of personal attribute (such as age) without revealing other personal information or a validation request being sent to the government which shares what sites you may or may not have been browsing
First, while there's research on the math for things like ZNP, there is a shocking lack of research on security vulnerabilities for the actual implementations of such age verification systems which should make anyone using them extremely nervous.
Second, if a porn website, social media, video game or whatever other thing regulators want to discourage people visiting kicks you off into an age verification takes requires you to some system/site, even an independent one, that requires you upload your ID, a fair number of people will simply refuse simply due to lack of understanding in how it works and trust that it actually is anonymous.
Third, every implementation I've seen doesn't work for some/all non-citizens/tourists.
And finally and more importantly, the ease at bypassing those systems means it's unlikely to stop anyone underage and ultimately is no better than existing parental control software, so all one is doing is restricting speech for adults.
To the surprise of many, Google recently announced it is already integrating ZK-proof-of-age into Google Wallet with those kinds of properties, open sourcing the underlying libraries, and working with governments to encourage their ZKP system's adoption for exactly this sort of problem.
- [2025-04-29] https://blog.google/products/google-pay/google-wallet-age-id...
- [2025-07-03] https://blog.google/technology/safety-security/opening-up-ze...
- [2025-06-11] https://zeroknowledge.fm/podcast/363/
I think the point is that "can" is not the same as "will".
Because only people who are engaging in cynicism can predict the future.
Cynicism wins the day because negative outcomes are easier to plan for than positive outcomes. Humans defaulting to optimistic outcomes of the future often end up littering the ground with externalities that they failed to consider. And we also only have a single model for infinite growth (cancer) that always leads to destruction, so relentless optimism as a biological organism means a need for infinite growth, which we only know to be a path to destruction.
The answer, therefore, is not bitching on the internet about all the wet blankets who only see negative outcomes, but acknowledging that everything we know needs to end eventually including ourselves, and balancing optimism for the short term with cynicism for the long term. And thus discovering that a healthy cynicism for the future predictions is probably appropriate, unless you truly want to live forever and have infinite energy for everything. But that's a god.
Easier to plan for is an interesting lens to look through, can't immediately discard it for sure.
From my perspective, negative expectations do have a higher chance of turning out real, but because negative expectations most often are just code for human misalignment. We have some philosophical, instinctual, or aesthetic (etc.) preferences, but then reality is always going to be broader than that. So you're bound to hit things that are in misalignment. It takes active effort to cultivate the world to be whatever particular way. But this is also why I find simple pleas to cynicism particularly hollow. It comes off as resignation, exactly where the opposite is what would be most required.
That's a fair counter argument, and I do genuinely believe (not know) that everyone needs a balance of cynicism and optimism to function optimally as a human. I also believe the resignation you feel from cynicism is rampant exactly because as humans we've become very good at basic survival and beyond that it's not totally clear what our targets for living should be. Certainly we can all agree that trying to harness ever more energy and growing forever can't be the target. But that's all we've done for two millennia now. How to we avoid becoming a cancer to our planet (or any other environment we find ourselves in)?
The rich and powerful have always worked very hard to keep their position. They have vastly more resources than the rest of us to throw at the problem. It's not cynicism to predict that every tool will be used to make our lives worse unless it helps them get richer and more powerful.
Some of us learn from experience and make predictions based on past actions by the governments.
Trauma sufferers also just learned from experience.
These are possible, there are zero-knowledge proof (ZKP) algorithms and whatnot, but it is not going to happen.
the number of people who work for (or defend those who work for) firms like raytheon, northrop grumman, palantir, meta, amazon, microsoft, alphabet, flock et al leads me to believe there are not enough people left to care about building this technology. we're cooked. too many developers lack the moral position necessary to turn the tide in a meaningfully widespread way - at best, it's "if not me, someone else will do this work anyways, so i might as well be the one collecting the paycheck/stock options." at worst, it's "i think it's a good thing to create tools to surveil/manipulate/kill people."
mourn the loss of the internet we knew and be ready to sacrifice ease of use to return to lower-tech/still-underground options.
Local ID Proofs =/= Surveillance
it absolutely will mean surveillance, unless you were born yesterday. governments will implement what you're describing in a way that is not privacy preserving
this is supposed to be HACKER news, not fucking bootlicker news
[flagged]
The level of discourse has drop here.
Someone steals your id creds and uses them as you is the simplest. The methods will range from stealing ids to breaking into auth servers to mitm attacks or fake ids and rogue auth servers. Everything works so well with video game protection methods now.. no one will be able to crack anything?
The recipes and tools for bypassing these kinds of blocks (and far worse ones as well - compared to what Russia and China are doing, this is child play) are one search away. The only thing necessary is the desire to actually do it.
Yes, and we're losing. Why do you think the internet is covered in ads, 25% Cloudflare, infested with CAPTCHAs and IP blocking, and the problem gets worse every year?
There are real problems that haven't been fixed; the driver's license concept correctly implemented might be better than continuing down this path. I view it as we can make a good standard; or let a bad standard be dictated.
Those are trivial problems compared to an internet linked to your identity.
Clicking through some captchas and installing an adblocker just isn't the hard life you're trying to claim it is.
Most ads that I see these days are from Big Tech megacorps. Do you seriously think that having a "driver license for the Internet" would mean that the likes of Google and Meta would stop?
The drivers license id doesn't solve anything but adds a layer of nonsense on top.
That doesn't stop cloudflares marketshare takeover. It doesn't stop CAPTCHA which will filter out bots using these ids. It provides an easy method for hackers to use. It filters out the curious kids.
In the end it solves nothing and creates more problems.
At least in the current system, there are some websites where you don't have to prove your real identity. Hacker News, for example.
In an internet driver's license system, remember that your computer would have to be locked down, and only able to access government-approved websites using government-approved clients - something like they have in China, or like using an iPhone but worse.
Once the ability for any site to verify your identity was set up, all sites would have to verify your identity, or lose their own verification, under one of many standard excuses like protecting the children.
> Yes, and we're losing. Why do you think
Obviously. Why do YOU think I'm angry-posting about it on the orange shithole site with the username "dingnuts" ?
I'm in favour of A) a restricted internet with an encryption scheme based on state controlled hardware devices, like Estonia has, that's accessible by default from browsers, and B) an unrestricted internet that's available to anyone who clicks through a few scary browser warnings, but is generally regarded as weird, dangerous, and not commercially viable except for weird or dangerous stuff.
Realistically, the moment the two are decoupled, B) is going to be banned and blocked outright - and the more they are decoupled, the easier it would be to ban. By and large, the only reason why it's still possible to access "dark" content online is because it's so intermeshed with the more mundane stuff on infrastructure level that the most efficient blocking methods have unacceptably high levels of collateral damage.
I don't see how you'd decouple one from the other, given that it's essentially just giving the user their own encryption certificate. Have the EU pass legislation saying that you can't request that the user sign anything unless they're in the process of making an account.
And then wait for when the well-funded and publicly supported A decides that B is evil and needs to be taken down.
Classic mafia racket economics would claim that Cloudflare themselves created the botnet ddos problem so that they themselves could solve it, and now they have the power to do this, especially when governments ask them very sternly to do so.
Being that botnet DDOS existed before CF that's a pretty strong statement.
They existed before, but websites selling DDoS as a service were easier to track down and competitors would DDoS eachother. Cloudflare provided a strong layer of protection for everyone, including these DDoS websites, and took no action to take them down when reported
Classic NSA tactics would be to setup a giant American Man-In-The-Middle company that most of the traffic of the world passes through.
And classic Washington Consensus tactics would be to manufacture a fake enemy to demonize in the media, such as Non-Western botnet makers
botnets are usually coming from residential networks due to infected hosts/IoT devices.
if cloudflare were to host malware on their own IPs, it would have been trivial to see CF's steps.
Unless you want to suggest that CF is developing and distributing sophisticated malware and making botnets across the world
Though certain mafia economics would suggest exactly that, I personally am not suggesting it. It's just an extremely interesting possibility that could only be proven with evidence.
Is this because the torrent sites are using cloudfare on their end? If so, seems like a simple solution
Torrent sites use Cloudflare to hide their origin IPs, among other things, so just not using it isn't an easy option.
Easier for torrent sites to tell people to use VPNs.
Comment was deleted :(
[flagged]
That seems less plausible than other pirate sites, random asshole teenagers, or even streaming companies DDosing them.
i thought people in the west used these things called seedboxes? basically computers in low risk countries like romania etc, download the torrent there, then copy the file over or something like that.
I have one of these. However it is connected to a VPN 24/7 in my own home. It can't access the net without the VPN being connected and I've checked for IP leaks.
https://github.com/qdm12/gluetun
However at some point I will have a machine setup in a foreign country as a jump box.
As per the URLs listed in the article, many people don't download movies nowadays.
They stream them on streaming websites.
While I don't think it's reasonable to blame corporations for complying with legal orders in the end, I don't see any evidence that they tried to fight it. I really wish they did.
They have no legal grounds to fight it. So there would be no point in trying to.
Why would they fight it? It plays right into their MO as gatekeepers of the Internet.
The site suggests that VPNs may be effected. What's the mechanism here? Is this likely to cause trouble for all VPNs?
DNS blocking via 1.1.1.1 is suggested. So, change to another dns.
This is how I block VPNs for game servers: https://zolk3ri.name/cgit/schachtmeister2/about/. It could work for any servers. It is very easy to do so. It gives you a "score" of the IP address (README.md explains it) that connected to your server, and you can decide what to do based on that, for example in my game servers there are certain thresholds. It has been working great.
realistically blocking low cost personal VPNs / proxies is pretty easy. Any new servers they stand up are gonna get picked up by commercial threat intel services with an hour and then just blocked. Especially if the CDNs are working with the government.
You could roll your own but wireguard/openvpn going to random hosting provider is gonna achieve the same thing if they are playing hardball.
They're not playing hardball, it's all on a "will this do" basis, like the US state-level bans. They're certainly not going to start blocking random IPs in hosting providers, that's reserved for email spammers.
Comment was deleted :(
Why is Cloudflare providing its services to known pirate sites?
Is the site illegal? If yes, where? And is CF required to follow the laws of that jurisdiction?
To prevent a competitor popping up with a USP.
I guess renting a vps and setup wireguard should still work?
Yes.
And you can buy VPS using crypto.
So pirate sites cannot use CloudFlare. But isn’t that against their ToS?
Im just confused - can somebody explain me this?
Pirate Sites are stupid. And the need for a Site is a stupid limitation of Bittorrent. People should use real distributed protocols like SoulSeek, Kademila or other similar file sharing protocols that do not require a website for discovery.
SoulSeek still relies on central servers for some things. Every time they go down, people go to the sub reddit to ask what's happening.
> Pirate Sites are stupid. And the need for a Site is a stupid limitation of Bittorrent.
Cloudflare used to have really open ToS and would host anybody. This included all sorts of far-right sites, and eventually they accepted that they were going to be held responsible for what their customers were doing.
Time to make our own internet…
there are so many approaches already tho. yggdrasil, ipfs, tor, freifunk, meshtastic, i2p (mixing a lot of things here, but there is tech out there). so much cool stuff, we just gotta use it.
> ipfs
IPFS have content blocking already: https://badbits.dwebops.pub/
Just when streaming site are turning extra crappy and user hostile
The Internet sees censoring as damage and routes around it accordingly.
No, that was Usenet. John actually said "the Net", but he was talking about Usenet. Usenet routing does work that way, although it's vulnerable to spoofing. Internet routing basically doesn't work that way at all and never has.
'The Internet' is not a thing and won't route anything around. Censured sites stay censured.
This is not cloudflare’s job.
Also, don’t they have bigger problems than this as country?
Comment was deleted :(
In my opinion, this article does a terrible job of explaining the technical mechanisms by which these blocks have been implemented, and the relationships between the entities involved.
Trying to piece together the details, here's my undewrstanding:
- Until recently, major British residential ISPs were blocking access to torrent/pirate/porn sites for their customers ("BT, Virgin Media, Sky, TalkTalk, EE, and Plusnet account for the majority of the UK’s residential internet market")
- Cloudflare has recently been ordered by courts in the UK to block access to these torrent/pirate/porn sites
- The reason that Cloudflare is involved is because many of these sites use Cloudflare as a content delivery network. A CDN is <waves hands> basically an application-layer distributed cache that sits between end users' web browsers and the origin HTTP servers that they're trying to access.
- Cloudflare geolocates clients connecting to its CDN. It undoubtedly has many reasons to do this, besides just court-ordered geoblocking: these would include routing queries efficiently within its globally distributed datacenters, DDoS prevention, bot blocking, etc.
- Cloudflare's geolocation techniques are, unsurprisingly, more sophisticated than just determining a country based on a client's IP address.
If I've got all that right (do I???)… then the tl;dr is:
It used to be possible for UK users to circumvent the blocks of these sites simply by using any VPN to acquire a non-UK IP address. Now the order to block these sites has been imposed on Cloudflare, which plays a critical role as an intermediary in distributing their content in a scalable way. For a variety of reasons, some of which end-users probably approve of and others not, Cloudflare uses more sophisticated techniques to geolocate clients. So "just use a VPN" is not enough to circumvent the blocks anymore.
I think "block" is a misnomer here.
Cloudflare has said pirate sites as clients - they are not (and cannot) block any pirate sites that are not their clients. The remedy is for those sites to no longer be patrons of Cloudflare.
If an analogy helps anyone understand better - imagine you have a lemonade stand. You use your neighbor's yard to set up the stand for some reason (maybe since its closer to a main road, the why doesn't really matter). The city tells your neighbor that they will be fined if they continue to have a lemonade stand in their yard, so your neighbor parks their truck in front of the stand, hiding it from the street.
In that analogy, cloudflare is the neighbor and your lemonade stand is the pirate site. You aren't prevented from selling your lemonade, but you can no longer freely use your neighbor's yard unless you want to direct people around the truck ahead of time.
Is this affecting anyone else in Canada
I wonder how long it will take their most loyal client state, Ireland, to implement mirror legislation. I give it a year.
Setting my VPN to the UK or Ireland is blocking the sites for me. Mainland Europe is fine.
Are you getting a 451 error though? Think that's something else.
Well that didn't take long! Truly, we are the least independent non-member member of the United Kingdom.
It's truly United.
UK is speed-running the Orwellian police state. They're already arresting people for Tweets, and logging "non-crime hate incidents" on your record, available to prospective employers.
They have been speed-running for decades. Remember "anti-social behaviour orders"? Those were introduced in 1998.
I think a better Orwell reference for this isn't 1984 though but rather https://www.orwellfoundation.com/the-orwell-foundation/orwel.... This is the essay that was originally meant as a preface to Animal Farm - and, ironically, was itself censored (by publishers).
Can you quote one of the Tweets that resulted in someone being arrested?
https://downforeveryoneorjustme.com/google
Anyway, few examples of many:
>A teenager who posted rap lyrics which included racist language on Instagram has been found guilty of sending a grossly offensive message.
https://www.bbc.com/news/uk-england-merseyside-43816921
>A man has been accused of sending a "grossly offensive" tweet in which he claimed "the only good Brit soldier is a deed one" the day after fundraising hero Captain Sir Tom Moore died.
https://news.sky.com/story/man-accused-of-sending-grossly-of...
>UK police arrest veteran because anti-LGBTQ post 'caused anxiety'
https://www.foxnews.com/world/uk-police-british-army-veteran...
>Officers from 37 police forces made 12,183 arrests in 2023 [over offensive posts on social media], the equivalent of about 33 per day.
Wow, that last statistic on arrests for offensive posts is staggering.
Comment was deleted :(
Yes centralising power was such a good idea. Well done big tech. Another footgun.
cloudflare is big tech now?
It sits between millions of users and the websites they desire to visit, and if they're on the right network using the right browser, they won't even know it.
It's #24 on this list https://companiesmarketcap.com/software/largest-software-com... so I'd say it's big tech.
How is this a footgun? Big Tech will protect Big Tech, it's only an advantage to have a service that will bend to their will. The centralization is the point.
Everyone opted to use Cloudflare, not just big tech. They now control much of the internet in a way that any nation state could only dream of.
The bit where we hand everything over and then take the consequences for doing so.
Anything centralized is easier to capture.
[dead]
First, they came for 8chan...
This isn't part of that slippery slope, since that was Cloudflare's voluntary choice, but this is legally required of them. (I do think both kinds are bad, though.)
Cloudflare also blocked a popular Internet celebrity gossip site and actionably -defamed them in the process, and a popular blog, yet still has customers who run animal crushing sites (which is literally illegal content in many countries).
Don't defend them. Their decisions are arbitrary and it's really sad so much of the web has chosen to use their garbage services.
Honestly I really don't care if countries want to ban sites that obviously exist to facilitate breaking the law. Yeah yeah but muh linux isos. If they call themselves PIRATE BAY, EZTV, SPORTSCULT or whatever, and everyone who uses it talks only about pirating movies and stuff with a wink wink "linux ISOs" it's pretty clear why it exists.
Visit others like ext.to and literally the entire front page is stuff like the new Superman movie, etc. You sound like a fool if you try to argue it's mainly for legitimate purposes. (Contrast with freenet and stuff, where if you've ever used it, you'll find most of the stuff there is people's boring ass personal webpages and stuff
Comment was deleted :(
Crafted by Rajat
Source Code