We do a lot, but at our core, we're in the business of keeping people connected and keeping the Internet open

Tucows

tucows

Crypto Crash? Not Really... 

Following a massive lawsuit filed by adult entertainment giant MG Premium, video site YesPornPlease temporarily shut itself down. It is now operating behind what appears to be geo-based blocking mechanism that promotes the use of a VPN. Meanwhile, MG Premium wants permission from the court to force several US-based service providers including Cloudflare and PayPal to reveal what they know about the site's operators. In September 2019, MG Premium went to court in the United States against Cloudflare. requesting a DMCA subpoena Alleging mass infringement, the adult giant wanted the CDN company to hand over the personal details of the people behind ‘tube’ site YesPornPlease and partner platform VShare.io. With 100 million visitors in January 2020 alone, YesPornPlease is a huge player in the space. It reportedly carries huge volumes of MG Premium content, including videos published under the Reality Kings, Brazzers, MOFOS, Babes.com, and Twistys brands. Progress on the earlier subpoena is unknown but in February, MG Premium filed a in a Washington court potentially worth hundreds of millions of dollars. full-blown lawsuit In the wake of that legal action both YesPornPlease and VShare went offline. At the time it appeared that the sites may not return but the situation was temporary. Now, however, visitors to the platform are being greeted by a strange ‘welcome’ page. “Our website is banned in your country,” the greeting claims. “Please use Tor Browser, VPN or if you don’t have any get this for free.” The “this for free” is a VPN called VPN4Test and the suggestion is that it can unlock the site. However, there are a number of confusing aspects to the message and the recommendation. Aside from countries where porn may be illegal in general, we’re not aware that YesPornPlease is ‘banned’ in any country it was previously accessible from. That tends to suggest that the website hasn’t been banned by any authority and it’s the site’s operators that have put measures in place at their end to ensure access is hindered. Furthermore, after extended testing with various VPNs and Tor, on what grounds access is granted by the site remains unclear. For example, in some cases UK IP addresses are allowed through yet VPN IP addresses in the same country are blocked. The same is true for those located in other regions, US and mainland Europe, for example. After cycling through a dozen or so Tor IP addresses, access was granted roughly 50% of the time, which will please users of the site. However, people shouldn’t be streaming lots of unnecessary videos using Tor – it isn’t designed for it, especially in the volumes required to service a massive adult video site. That leads to the question of whether one of the main aims of the blocking is to drive traffic to the promoted VPN. While it is reportedly free to use, it should come with all the usual warnings that other free VPNs carry – in a nutshell, free is rarely free and there are probably strings attached. Nevertheless, VPN4Test is doing well out of the referrals. From very little traffic at all in December 2019, the service is now clocking up more than 1.5 million visits per month. Meanwhile, MG Premium is pressing ahead with its legal action. It’s clear from its numerous filings that the main challenge the company faces is positively identifying the people who run the defendant sites. In a motion for early discovery, the adult giant says that can only be achieved with the assistance of several US-based companies that are doing or have done business with the site. “Plaintiff seeks a Court order allowing it to serve discovery demands on PayPal, Inc.; Domain Protection Services; Name.com, Inc.; Cloudflare, Inc.; Namecheap.com; Tucows Domains, Inc.; Internet Security Research Group; and, Comodo, Inc. for identifying information of their customers, the Defendants in this case,” the filing reads. According to MG, Domain Protection Services in Colorado anonymizes the YesPornPlease domain, while Name.com and Cloudflare provide registrar and DNS services. Vshare uses Namecheap and Cloudflare, with the latter being used by both sites to serve content in the United States. It’s further alleged that the affiliate program operated by VShare pays out through PayPal while using an SSL certificate from New Jersey-based Comodo, Inc. MG says that its representatives contacted all of the companies with requests for cooperation but without exception they either “ignored requests for information or previously instructed that information will only be produced upon subpoena.” “Plaintiff is aware of no available information that would identify the infringing users, other than information maintained by the domain privacy service, registrar service and other service providers,” the motion for early discovery notes. “Due to the nature of on-line transactions which in this case includes in certain instances of the crypto currency Bitcoin, Plaintiff has no way of determining Defendants’ identities except through immediate discovery, and follow-up discovery.” As a result, MG requests that the court issues an order allowing it to serve subpoenas on the companies listed above, compelling them to turn over “all information pertinent to the identity of the owners, operators, and principals operating the YesPornPlease.com, VShare.io, and ezcgwym5xp7ty.com websites, domain names, and relevant accounts for each.” The motion for early discovery can be found here ( pdf ) Originally published as “ YesPornPlease Restricts Access as PayPal & Cloudflare Are Asked to Unmask Operators ” with the Attribution-NonCommercial 3.0 Unported (CC BY-NC 3.0) license

YesPornPlease Restricts Access as PayPal & Cloudflare Are Asked to Unmask Operators

Charlemagne crowned Holy Roman Emperor, proclaims GDPR Admittedly we’ve been largely silent on the topic of the new European General Data Protection Rules (GDPR) because frankly, we don’t really know how to deal with it. The reality is, really knows how to deal with it. The Registrar Stakeholders Group (RRSG) has been very frustrated, and ICANN, never missing an opportunity to avoid an issue, has been little help (they’ve issued a temporary specification allowing registrars to not display whois details, but they did not grant a requested moratorium on compliance. The obligation to collect said data still applies. At least one registrar, EPAG, based in Germany, has ceased collecting that data because they believe doing so violates GDPR, and ICANN has duly against them.) nobody filed an injunction We consulted with our external counsel who handled our positioning for the Canadian Anti Spam Legislation (CASL) who told us, in effect, “we don’t know what you should do either, just do what Tucows does”. In practice, because we use the OpenHRS/Tucows registry stack, we’re largely constrained by whatever they do, and for now, they’re redacting whois across the board, even for non-European registrants. Some registries are also following suit. (Tucows also happens to be the parent company of EPAG, mentioned above). The whois database is the big thing across the entire domain business. All registrars are contractually obligated under the terms of their accreditation to publish whois records containing contact info for domain registrants, but doing so , seemingly runs afoul of GDPR. for European registrants But it suddenly hit me as I thought about this more it reminded me of 2016, when changes in the European VAT shifted from those taxes being applied to the location of the vendor to being applied at the location of the consumer. That supposedly meant that on their European clients and remit it back to Europe quarterly. all businesses around the world would have to collect VAT Uh yeah, we’re not going to be doing that. So following on that theme… Why should any business outside of the EU care what the GDPR contains? How is it different from when some foreign court hands down a court order pertaining to one of our customers which we will not take action on until they obtain proper letters rogatory to have it enforced in our jurisdiction? When the FDA sent us a list of domains belonging to Canadian companies that were fully compliant with Health Canada demanding we take them down, did we do it? If we suddenly receive a court order from afar in a language we can’t even read are we going to hire a translator and then do whatever it tells us to do? (Turns out it was Polish and we had somebody here who could read it, but we still didn’t do what it was ordering us to do). When China wants us to prevent any citizen from using our dynamic DNS service which would enable them to circumvent their Great Firewall of China are we going to hire a team of developers to code it into our system? (We were once offered exactly that deal by a large router company wanting to setup a dyndns business there and we turned it down). No, no and no. So why are non-European companies frantically running around, updating their privacy policies, trying to re-permission all their mailing lists, , trying to over-comply with something that at most only affects non-business customers in EU member states? even to non-European users All prior history of internet governance would have us taking the position that being a Canadian company we are going to operate by Canadian law, and not by European law. Here we have PIPEDA which covers data privacy and more recently the CASL, anti-spam legislation. Further, the way CIRA operates the whois system for .CA — where individual registrants have their data redacted by default and companies have it displayed; seems to have hit a happy medium which has more or less worked fine for nearly 20 years. But until such time as the EU enters into an international treaty with Canada to have us enforce the GDPR and collect VAT (oh yeah, I’m gonna vote for the hack who campaigns on that platform), why do we actually care what the GDPR says? totally By even pretending to acknowledge the GDPR’s applicability to non-Euro businesses, we open ourselves up to having to comply with every other political jurisdiction in the world, now and in the future, such as , which really a bag of crap that contains provisions for things like mandatory ISP filtering on user uploaded content and “link taxes”. Europe’s forthcoming Copyright Reform is Sure, Google and Facebook and Apple have to worry about this, because they’ve domiciled their foreign HQ’s in Ireland so that they can shelter all that foreign revenue from US taxation. Karma’s a bitch. But for the rest of us small fries, who pay taxes on our revenues here in our home countries, and who are sheltering billions of dollars in offshore tax havens that happen to be under EU rules, can somebody explain to me how this is in any way our problem? do all not But GDPR gives us the opportunity to be better companies So says , and I totally respect his ethos and his aspirations to be a better company. But here’s the thing: Everybody had the opportunity to be better companies all along. Some of us already took that opportunity: easyDNS doesn’t sell our customer data, we don’t datamine it, we don’t track them across the Internet, we’re generally known for our transparency and we don’t take liberties with our clients’ confidence . this post by Hansel Dunlop over on Medium Dunlop warns us: I would be very wary of a company who claims this legislation is onerous. It is potentially life threatening to companies who do very shady things without your consent. That much is true. That is the entire point. I have two responses to this. First, increasing regulatory and compliance burdens are very much asymmetrically adverse to small, medium and independent businesses. Larger companies have greater ability to absorb the additional compliance hurdles, have the market share to pass on any of their additional compliance costs to their customers frequently use their position and influence to lobby and shape legislation so that it often skews in their favour. and Incrementally raising compliance burdens is an actual business tactic, as related to me by somebody I’d call “a crony capitalist insider” who once organized a meeting for me to talk to some folks from one of the big four Canadian banks about Bitcoin. What he told me, point blank was that the way business works was to work policy makers to keep introducing new rules and regulations so that over time, the smaller and weaker competitors would be squeezed out and the larger incumbents could absorb their customers. with They way he talked about the prospect of being first mover in the Bitcoin space was very telling: “Here’s what you need to do if you want to make a go of this. You get big institutional money behind you. You approach the regulators, and you start working with those regulators to shape the actual rules that are going to come out. When the regulations finally come out, you get to be on the right side of them; and then you turn around and you pull the ladder up behind you and bingo. You’re a monopoly.” I always felt that meeting was very educational but I had to take a shower the moment I got home. It was more evidence to what I already suspected, increasing regulatory burdens are usually more about consolidating markets than protecting consumers. I’m not saying that’s the case with GDPR, but I am saying that the additional burden of compliance always does hit the smaller companies harder than the 800lb gorillas. My second counter to Dunlop, (but not aiming at his company), is that I would be skeptical of companies who are suddenly getting religion around their clients’ privacy and personal data sovereignty solely because they think they are to do so. That’s not reassuring. You know those companies will do the bare minimum, you know they’ll be tempted to cut corners and you know they’ll game it. And if they follow the same line of reasoning we are here and surmise that GDPR isn’t applicable to them they’re going to abrogate it anyway. legally compelled (All those re-permissioning email requests your getting? My prediction is first thing that happens is everybody craps themselves because they’ll be lucky to pull a 20% confirmation rate and they realize that if they go through with this then they just killed their lists. Then they’ll pretend it never happened and keep emailing their entire list anyway. If you’ve used proper list building techniques from the outset, you don’t need to re-permission even if you’re within the EU, because you have opt-in and confirmation data for all your subscribers or else you have an active business relationship with them like CASL here in Canada, right?) At the end of the day, a culture of customer respect is either baked-in to the company ethos or it’s conspicuous in its absence. A new set of regulations passed by faceless, unelected bureaucrats in another jurisdiction isn’t going to magically put it there. Like ICANN’s Whois Accuracy Program (WAP), and some complaints I have about CASL, all most new regulations typically do is make life harder for rule followers while not really doing anything about the rule breakers (except maybe to turn what were formerly rule followers rule breakers by hiking the compliance burden over their heads). into For the most part, easyDNS already complies with most of the GDPR that I’m familiar with anyway. In general we deal primarily with data that our clients the entire world to see, and we don’t store any of your billing details. As per the lawyers’ advice we’ll be adjusting our data retention policy which will more clearly specify when we delete your data after you cease being a client, but we’re doing so to make sure we’re onside with PIPEDA, which is Canada’s data privacy laws, not to be onside with Europe’s. want But as long as we keep doing of doing right , hopefully that day will never come. our job by you Originally published at easydns.com on May 28, 2018.

Why should any non-Euro companies care about the GDPR?

I walked into Regina Pizzeria slightly late on Sunday night. It was my first time in Massachusetts — my first time on the east coast, in fact — and I wanted to take advantage of the two hours between my flight landing and dinnertime to explore the city. I knew exactly how I would spend that time — walking as much of the Freedom Trail as I could. As I trudged down the red brick line, luggage in hand, I couldn’t help but lose track of time in the history of it all. is where the Boston Massacre happened. is where Benjamin Franklin went to school. is where the meritocratic promise of this nation was incepted — where the ideals that would ultimately allow for me to be included in the program that brought me here were born. This This This Raised in a small town to two immigrant parents, I’d never really had much of a chance to travel. But a few weeks ago, after a couple application essays, a nerve-racking interview, and a lot of finger-crossing, I was offered the opportunity to study cryptocurrencies at the Massachusetts Institute of Technology in an intensive week-long bootcamp. Twenty-four other students from across the country joined me, and as I scanned their faces during the welcome dinner at Regina’s, I noticed that the group was constituted of virtually every tech-underrepresented demographic. This was deliberate — the week-long bootcamp was the brainchild of MIT Media Lab’s Senior Project Manager, Gina Vargas. Gina is a striking woman: a standard deviation or two taller than the mean, poised, eloquent, and deeply concerned with social justice. On the ride back to the hotel, we rave about a mutually favorite TV show: Broad City. She somehow manages to make me — a twenty-year old girl just starting out in my career — feel welcome and included in this technologically-driven world. This is true about her cryptocurrency bootcamp as well: after spending time in the digital currency community and noticing the lack of diversity, she set out to create a program that would allow underrepresented groups to be included in the space. But her work has not been celebrated by everyone, and many continue to ignore the importance of diversity in tech. Even the very first tweet announcing the scholars selected for the camp was met with disdain: Communism Lite: all the centralization — with just half the calories!!! During my time at the bootcamp, I couldn’t help but give these criticisms some thought. Were they right? But what I saw throughout the week cast off any doubt of our value. Not only was each member of the bootcamp exceptionally qualified, not a single one of us saw the world in the same way: met his challenges with humor; had an understated brilliance; saw every second as an opportunity to be leveraged; wanted to prove her talents; was a creator at heart; and formed an easy-going duo; was solid and dependable; had a sophistication about her; was always questioning underlying social implications; came curious and ready to use his smarts to help; was charming and gregarious; was a true socialite; had an entrepreneurial soul; was well-spoken and thorough; was sharp and ready to speak her mind; was organized and knowledgeable; was a soft-spoken brain; was an enthusiastic nerd; was kind and thoughtful; was outspoken and direct; was a friend to all; had a genuine heart; and always had delightfully witty retorts. James Amber Alston Priya America Arturo Caroline Brandon Danielle Edwin Pedro Océane Eric John Jarnickae Jordana Prince Julio Justin Kemi Shana Stephani Tami Alice And yet, even with our drastically different lenses, we all managed to come together for the same vision. Between twenty-five students, all from different backgrounds, there existed a level of collaboration, debate, and empathy I had never seen before. The manner with which ideas bounced was explosive, and by the end of the week, we had all improved each other and benefitted from our differences. It’s a dynamic that can’t — and won’t — happen in a workplace where everyone looks the same, thinks the same, and comes from the same place. This is why diversity in tech is important, and why I won’t think again about those Twitter trolls. Interestingly, cryptocurrency as a technological concept can be viewed in parallel to the goals of the bootcamp, at least in terms of its potential to effect social change. Currently, for instance, more than half of adults in the poorest households are unbanked. And “being financially excluded is linked to income level: The richest 20% of adults in developing countries are more than twice as likely to have a formal account as the poorest 20%. ” Some cryptocurrency developers and enthusiasts see this problem as a major potential use case. Because (at least in theory) is highly inclusive — you can download a wallet on your smartphone — it can be leveraged as “a means for an otherwise excluded individual to have a decentralized global bank account. bitcoin ” Moreover, because bitcoin carries a negligible transaction fee, it can be used as “a means to facilitate low-cost remittances for those seeking to transfer small amounts of money internationally. This means that someone in Cameroon could now digitally transfer value to someone in the Philippines in relatively little time and with a relatively low fee, facilitating global commerce and pushing wealth and capital to underdeveloped economies. ” This is just the start. As , “digital currency may be the most effective way the world has ever seen to increase economic freedom, making it easier to start a business, enforcing property rights, reducing corruption and bribery, and more. If this happens, he says, digital currencies “could lift many countries out of poverty, improve the lives of billions of people, and accelerate the pace of innovation in the world. Brian Armstrong writes ” ” Of course, it’s important to remember that “ ” technology is not a panacea, as it has been sensationalized. Cryptocurrencies like bitcoin are slow and don’t scale. There are several security challenges, from choosing the correct algorithms to designing the appropriate infrastructure. And there is still a certain level of technical knowledge one needs to exploit bitcoin’s full capabilities. blockchain But — we’re working on it. And it’s good to know that with diverse voices being included in the conversation, all is being done to ensure that digital currency is being done right. With these factors —the diversity of the bootcamp and the social potential of cryptocurrencies — coming together, it shouldn’t have surprised me that every single one of our final projects had something to do with helping others. Some teams focused on bringing awareness of blockchain technology to underrepresented groups, others on leveraging the power of digital currencies to facilitate donations. No matter their missions, however, every project was thorough and comprehensive, and beautifully strung together everything learned throughout the week. It’s Friday as I write this — the last day of the bootcamp — and the promise of a true merit-driven tech world is closer to being fulfilled than it was a week ago. We all promise to stay in touch, and even start planning future events: bitcoin hackathons and Silicon Valley meet-ups. We’ve all still got so much building to do, and something tells me that although this was my first time in Massachusetts, it definitely won’t be my last. Thank you to the MIT Media Lab for this life-changing experience, especially Gina Vargas . Another big thanks to all of our brilliant teachers, speakers, and organizers: Robert Schwentker , Jeff Flowers , Whitney Burke, Tess Rinearson 🕴, Brian Forde , Neha Narula , Monica Orta, Tadge Dryja , Meltem Demirors , Anish Mohammed , Valerian Bennett , Tyler Pate , Kelvin Womack , Balaji S. Srinivasan , and Rick Dudley . And of course, thanks so much to the sponsors of the project: Kapor Center , 21 , Xapo , Tucows, and Deloitte .

A Week at the MIT Media Lab, A Lifetime of Impact

You won’t (maybe) ever ask again, “what’s a webhook, mom?” Photo by on Efe Kurnaz Unsplash I’m the kind of person who practices a habit to explain technical terms with everyday examples so that I don’t need to memorize them just as a technical jargon. Maybe this process oversimplifies the term in some cases but who cares? As long as I understand how it works and doesn’t struggle to remember it, I think I’m fine, right? As a ‘Homo techians’ these days, we are bound to learn millions of things to keep ourselves up-to-date and it’s already hard enough to do that. So, some oversimplifications can’t hurt more. So, as my attempt to explain ‘Webhook’ to you today, I’ll first tell you a ‘knock-knock’ story(not a joke — serious story) and then we will move on to the itsy-bitsy technical part. ready? There was a guy, let’s call him Mr. Walter white. Yup, you got it — the nice guy from the TV series . By the way, our story isn’t from the TV series but will have the flavor of it. Breaking bad Mr. Walter white So, Mr. white wanted to start his own drug business and is in need of some illegal chemicals to do that. So, he contacted with some gangster guy, named Tuco Salamanca, who promised him to get the chemicals and they made a deal. Tuco Salamanca (this guy is crazy but good at his job) Some days over but Mr. white didn’t get the chemicals. So, he went to tucos house— knock! knock!- who’s there?- It’s me, Walter white.- What do you want?- I’ve paid for some stuff and didn’t get them yet. - I know. You will get them soon. Now leave. Walter white knew that this guy is crazy and he didn’t want to piss him off, so he left immediately. But after couple more days, he got impatient and came back again to tucos house- knock! knock!- who’s there?- Me, Walter white. - what the @#$@ do you want?- where is my stuff?- I already told you, you will get them soon. - how soon? It’s more than a week. - Are you calling me a liar?- No, no. I just need an update. - I’ll let you know when the package arrives. Don’t ever come back again. Now get the hell out of here.(when Mr. white turned to go back, tuco called him)- Hey, just before you go, leave your $#@#ing phone number, so that i can call you. So, Mr. white left his number. And the next day, he got a call from tuco that the package arrived. Our little story ends here. Let’s now get back to the tech business and discuss webhook. Shall we? We saw that in our story tuco taught Mr. white that he is comfortable with the philosophy. Well, that’s the same philosophy lies behind the Webhook concept. You see, when we use some (you know API, right?), we call it when we need it. The process works in a request-response manner. We will request for the data and the API will response. So, if there is some service API from which you need to get update regularly, you will call it frequently. The more frequent you call it, the more real-time update you will get. This is call ‘ ’. But that’s not a good approach because most of the cases you will not get any update, as there aren’t any. Also, it’s a massive overhead for both sides in terms of resource usage. On the other hand, if these services have any webhook available then we just have to connect or ‘hooked’ our application URL with it and it will knock us every time there is our data available. Just like tuco did, when the package arrived, he called Mr. White. Simple as that. “Don’t call me, I’ll call you” API API polling Image Credit: thenewstack And that’s all you need to understand how webhook works. Neat, huh? As most of the communications over the internet are done through the HTTP, both API and webhook use it extensively. But webhook doesn’t use all of the GET, POST, PUT, DELETE methods like API. It only makes an HTTP POST request (which also known as HTTP callback) to the listener or the service which wants to get the update. To the webhook, the listener will be just a simple URL which it will call with HTTP POST request for the specific event. So, why would someone need a webhook or where do people use them? Webhooks are mostly used for in cases where a real-time notification or action needs to be taken place for certain events, like slack notifications, continuous integration services, and other integrations. Webhooks can be used to exchange data between systems, components within a system, or microservices — anything attached via HTTP. Say, you built an application which will show you an alert if there is a possibility to rain today, so you can bring your umbrella. Or say, if somebody makes a commit in your project repository and you want to receive that as a notification in one of your slack channels. You see, in these cases, some actions are being taken place after some specific event occurs. So, for your weather application, you can connect it to some weather service webhook which will only send you a notification if there is a possibility of rain. If you want to get the real-time update in slack channel for commits, you need to connect your to so that it will receive messages on each commit. github account Slack incoming webhooks Why are webhooks awesome? In the earlier era of the internet, all of the web applications work in a silo, and most them are still operating the same until these days. With the rise of the APIs, the communication and integration between these applications happened. But as we’ve seen in our example that a key part of this communication which is ‘event driven communication’ was missing. And Webhook comes to the rescue to save the day. So, if you understand what I’m saying for the last of couple of minutes, then you’ll be fine with using the webhooks out in the wild provided by some fancy web services or applications. Or you can build your own webhook if need. They ain’t pretty hard. are they?

Stories, News & Mentions about TUCOWS

Tucows’s Stories on HackerNoon