The former is literally the real legal system, nothing shadow about it. Shadow would be some hidden deal to drop charges or something.

It's also not DDOS when a huge part of what you call "real" is exactly the same, so not unwillingly overloaded but willingly complicit.

At this point, I almost welcome all these laws. The more they restrict us, the more potential felons, but they can't fine and put us all in jail, no? Chronic over-legislation will crush from its own weight.

That said, like the saying of markets staying irrational longer than people can afford to, the realistic outcome is that bureaucracy will survive longer than a functioning society. Legislation will continue until morale improves.

If anything, communications between Mississippi and California would be interstate commerce and would thus fall under federal legal jurisdiction.

Please don't comment like this on HN. We need everyone to avoid ideological flamebait and unkind swipes. Please take a moment to read the guidelines and make an effort to observe them in future.

https://news.ycombinator.com/newsguidelines.html

Also "operate in or leave" doesn't make a lick of sense on THE INTERNET

This is just the start and the trial balloons. The enemy within is a bit nervous about this attack on the most fundamental freedom that the Constitution is protecting, free speech, but they’re also very confident in themselves.

It's just wrong and it breaks the internet. We had it so good for so little.

Ideally, yes. I think the reality however will be that most "perpetrators" will be ignored, and anything else will be easy wins and collateral damage to small site operators that these regulators to happen to notice.

https://en.wikipedia.org/wiki/The_Walker_Montgomery_Protecti...

It is possible some US States and maybe the UK will end up like China.

You don’t need to know all the laws of Mississippi to serve such customer, or any laws from anywhere else other than Italy.

As you say, IP geolocation is unreliable. Unfortunately that's the only option. If it is technologically impossible to comply with the law, you just gotta do the best you can. If someone in MI gets a weird IP, there's absolutely nothing any third party can do. That's on the ISP for not allocating an appropriate IP or the legislators for being morons.

The law in question requires "commercially reasonable efforts"

I run a geolocation service, and over the years we've seen more and more ISPs providing official geofeeds. The majority of medium-large ISPs in the US now provide a geofeed, for example. But there's still an ongoing problem in geofeeds being up-to-date, and users being assigned to a correct 'pool' etc.

Mobile IPs are similar but are still certainly the most difficult (relative lack of geofeeds or other accurate data across providers)

In his concurring opinion, Justice Kavanaugh said it was likely unconstitutional (but apparently not obviously enough to enjoin it) [1]. So it's going into effect, then the lawsuit follows.

Similar laws in California, Arkansas and Ohio were all found unconstitutional, so I am hopeful. That said, these were all district court decisions, and all of them are being appealed. When they lose on appeal, they go to the Supreme Court for (hopefully) the final smack-down.

Interestingly, reading the summary MS HB1126 [2], this law is doing two things. It regulates companies and defines crimes.

States are allowed to set their own criminal codes. If Mississippi drops the mandate part and passes a new law that simply defines certain things as crimes with corresponding penalties, that law would probably be constitutional.

[1] https://www.supremecourt.gov/opinions/24pdf/25a97_5h25.pdf

[2] https://legiscan.com/MS/bill/HB1126/2024

The threat of lawsuits.

> How is this enforceable if a company doesn't have any infrastructure within that state?

If you are intentionally doing business in a US state, and either you or your assets are within the reach of courts in the US, you can probably be sued under the state's laws, either in the state's courts or in federal courts, and there is a reasonable chance that if the law is valid at all, it will be applied to your provision of your service to people in that state. Likewise, you have a risk from criminal laws of the state if you are personally within reach of any US law enforcement, through intrastate extradition (which, while there is occasional high-profile resistance, is generally Constitutionally mandatory and can be compelled by the federal courts.)

That's why services taking reasonable steps to cut off customers accessing their service from the states whose laws they don't want to deal with is a common response.

To enforce all this, states can sue companies and they can take steps to ensure companies can't do business in their state (so like maybe force ISPs to block Dreamwidth?).

It's a good question. Maybe something with interstate commerce laws?

But the law was signed over a year ago[1]? The recent development was that the injunction blocking the bill from being implemented got struck down. I'm not sure what you'd expected here, that the courts delay lifting the injunction because of the sites that didn't bother complying with the law, because they thought they'd prevail in court?

[1] https://legiscan.com/MS/bill/HB1126/2024

> It should also be based on good faith

Setting the wishes aside, it isn't, the judges easily act in bad faith when it suits them, so this also doesn't explain much.

Neither is it "designed" to take bad faith at face value, again, to be specific - just read the Supreme Court case about this law. The flood/design explain nothing: it would've been just as easy to block the implementation of what the court itself says is an unconstitutional law (see, no "good faith" basis required) and then don't even review it fully because the court has no time (see, the flood can flow in either direction)...

With the internet it's a lot less clear cut. The user is requesting data from Italy, maybe, but is located in another jurisdiction. Add Cloudflare and the data might even be served from the US by a US company you asked to serve your illegal data.

It's becoming a shit show and is breaking up the global internet.

Websites don't have to be a business or be related to one.

Welcome back to the 90s and the PGP, Clipper chip, warez, and DeCSS days.

At some point, they will have outlawed enough things that most people want, that most people will become outlaws.

it is like age verifying current generic access to the Internet. Sure, we'll come to this too (the anti-utopias aren't fiction, it is future :), yet we still don't verify such a generic access because it isn't the time yet, the society isn't yet totalitarian enough.

As a preview - in Russia (i'm less familiar with China to comment on it) they do already attack VPN by making it illegal to advertise it, something like this.

And if you don't do business in the US there is only so much the US can do. Most importantly it can ask ISPs in the US to block your site. As they do for copyright infringement routinely.

We have all accepted that our countries block copyright violations originating from outside their jurisdiction.

But of course this is a disaster for the free internet. While copyright laws are relatively uniform world wide, so if you respect it locally you're probably mostly fine everywhere, incoming regulation like age verification and limits on social media use, or harassment stuff, is anything but uniform.

To some degree this is also maybe more shocking to people in the US, as the US norms have de facto been the internets norms so far. It is, in any case, not entirely new:

"When Germany came after BME for "endangering the youth" and demanded that I make changes to the site to comply with German law, my response was to simply not visit Germany again (and I'm a German citizen). When the US started to pressure us, we moved all of our servers and presence out of the country and backed off on plans to live in the US. No changes were ever made to the site, and no images were ever removed — if anything, the pressure made me push those areas even more."

https://en.m.wikipedia.org/wiki/BMEzine

How do we deal with the fact that we don't have a global mechanism for agreeing (socially and legally) on necessary regulations, whilemaintaining the social good that is a truly global internet?

But yeah, this definitely sounds like a business opportunity for services or hosts.

If I run a server in Utah primarily for myself, and you as a Californian happen to stumble upon it, should I have to abide by California privacy laws?

Regulatory capture in real time!

Same goes for other countries as well. It’s insane.

They can order overflights to land to arrest you, if they so desire. They can also block you from the more-or-less all legitimate commerce globally with sanctions. And if they really don't like you, they can kill you without due process.

All of which the US has done to undesirables over the years, and can do again without any controls or checks or balances, to anyone globally.

Capitalism at its best. We have a definite problem with over-regulation and a judicial system that isn't coping nor keeping up. Capitalism, instead of fixing the problem, makes a business model out of it.

Capitalism: Why fix it when you can make money of it.

Except for very specific things that are forbidden to the states in Art. I Sec. 10, or where Congress has specifically closed off state action in its own actions under the Interstate Commerce Clause, states retain the ability to regulate commerce in manners that impact interstate commerce so long as they do not discriminate against interestate commerce compared to in-state commerce in such regulations.

Oregon merchants are not required to collect sales tax for any other jurisdictions outside of Oregon. And they don’t, any non Oregonian can go to any merchant in Oregon right now, and you will be charged the same as any other customer who lives in Oregon.

Also, it was never a loophole to buy things in Oregon to evade sales tax. All states with sales tax require their residents to remit use tax for any items brought into the state to make up the difference for any sales tax that would have been paid had it been purchased in their home state.

> should I have to abide by California privacy laws?

It seems these are the conditions:

As of January 1, 2023, your business must comply with both the CCPA and the CPRA if you do business in California and meet any one of the following conditions:

* Earned $25 million in gross annual revenue as of January 1 from the previous calendar year

* Annually buys, sells, or shares the personal information of 100,000 or more California consumers or households

* Derived 50% or more of your gross annual revenue from the selling or sharing of personal information

Also lots of states have their own data privacy laws.

https://iapp.org/media/pdf/resource_center/State_Comp_Privac...

What would you have preferred? Of course you'd prefer if the law never existed in the first place, but I don't see having a third party auditor verify compliance is any worse than say, letting the government audit it. We don't think it's "regulatory capture" to let private firms audit companies' books, for instance.

Yes! Make a union of states! How should we call that? States Union... Union of States... United States! Yeah, that should work.

Source: am from Kansas City.

Indeed. It has far more than that. The US is astonishingly diverse.

> Personally I'd say none at all, unless the government itself provides it as a free service, takes on all the liability, and makes it simple to use.

1. There are many commercial services that do identity verification. There are many other commercial websites that have tools to do identity verification themselves. There are industry published best practices for these types of activities. All of these are evidence that you could use to demonstrate how you are making a commercially reasonable effort.

2. It's completely irrelevant whether you consider your website "commercial" or not. The law defines which websites it applies to, based on the activities they engage in.

https://law.justia.com/codes/mississippi/title-45/chapter-38...

3. Since when does the government have to give you compliance tools for free in order to require something of you? This isn't the standard for anything anywhere. Compliance with the law is often quite expensive. Honestly, buying an identity verification service is pretty cheap in the spectrum of compliance costs.

> If a hobbyist just sets up a forum site, with no payment processor and no identified or identifiable information required, it would seem reasonable that the law should not apply. But I'm not a lawyer.

You don't have to guess whether or not this is reasonable or not. If you read the law, you'll see that it says it only applies to sites that collect personally identifiable information.

From the above link, again:

> "Digital service" means a website, an application, a program, or software that collects or processes personal identifying information with Internet connectivity.

> "Personal identifying information" means any information, including sensitive information, that is linked or reasonably linkable to an identified or identifiable individual. The term includes pseudonymous information when the information is used by a controller or processor in conjunction with additional information that reasonably links the information to an identified or identifiable individual. The term does not include deidentified information or publicly available information.

Calling geoip databases "surveillance capitalism" seems like a stretch. It might be used by "surveillance capitalism", but you don't really have to surveil people to build a geoip database, only scrape RIR allocation records (all public, btw) and BGP routes, do ping tests, and parse geofeeds provided by providers. None of that is "surveillance capitalism" in any meaningful sense.

https://en.wikipedia.org/wiki/Zone_of_Death_(Yellowstone)

"The Zone of Death is the 50-square-mile (130 km2) area in the Idaho section of Yellowstone National Park in which, as a result of the Vicinage Clause in the Constitution of the United States, a person may be able to theoretically avoid conviction for any major crime, up to and including murder"

>New York governor rejects Louisiana's extradition request for doctor in abortion pill case

cough

Now, buying a fancy computer or something... but a car?

it's regulatory capture if a cartel of ID verification companies are lobbying for specific requirements that lock out upstart competitors.

Source: am from St. Louis.

How is it not? Most "normal" surveillance works the same way - you look up public records for the person you're going after, cross-reference them against each other somehow, and eventually find enough dirt on them or give up. This is surveillance, and it's being done by and in the interests of capitalism.

I haven't seen it as much in WA, but I used to see a lot of Oregon plates on new vehicles in Northern California where I had reason to believe the driver was a resident of CA. I do know someone who was pulled over for driving like a Californian while having out of state plates, so there's some enforcement that way anyhow. (Changed several lanes from the fast lane to the exiting lane in a continuous motion)

And yes, in this particular circumstance for this specific law as currently written a private blog doing it's own normal things probably wouldn't infringe or be subject to these rules.

But what about a Utah focused social media site that does have $25M in revenue? It's not trying to court California users. Why should they have to be liable to laws in a state they never intended to do business in? It's these Californians leaving California to interact with an org across state lines. Whatever happened to state sovereignty? Should an Oklahoman be required to buy only 3.2% beer in Texas as well or have some Texas beer and wine shop face the wrath of Oklahoma courts for serving an Okie some real beer?

Where did that web transaction actually happen? On the client or on the server? Where did the data actually get stored and processed?

IMO we're past the time of patchwork laws. The social experiment of figuring out what makes some sense is largely over at least for the basics. It's time for real federal privacy laws to make a real, enforceable nationwide policy.

I think it's going to happen one way or another and the most peaceful way to do it would be sooner rather than later.

The free tier does have limits on the number of API calls can you can make. But the good news is you don't have to use their API. You can download the database [1] and do all the lookups locally without having to worry about going over their API limits.

It consists of 10 CSV files and is about 45 MB compressed, 380 MB uncompressed. For just identifying US states from IP address you just need 3 of the CSV files: a 207 MB file of IPv4 address information, a 120 MB file for IPv6, and a 6.7 MB file that lets you lookup by an ID that you find in one of the first two the information about the IP address location including state.

It's easy to write a script to turn this into an SQL database that just contains IP ranges and the corresponding state and then use that with sqlite or whatever network database you use internally from any of your stuff that needs this information.

If you don't actually need Geo IP in general and are only adding it in order to block specific states you can easily omit IPs that are not mapped to those states which would make it pretty small. The database has 3.4 million IPv4 address ranges, but only 5 359 of them are listed as being in Mississippi. There are 1.8 million address ranges in the IPv6 file, and 3 946 of them are listed as being in Mississippi.

Here's how to get the Mississippi ranges from the command line, although this is kind of slow--the 3rd line took 7.5 minutes on my M2 Mac Studio and the 4th took almost 4 minutes. A proper script or program would be a lot faster.

  grep ,MS,Mississippi, GeoLite2-City-Locations-en.csv | cut -d , -f 1 > 1
  sed -e s/^/,/ -e s/$/,/ < 1 > 2
  grep -f 2 GeoLite2-City-Blocks-IPv4.csv | cut -d , -f 1 > MS-IP4.txt
  grep -f 2 GeoLite2-City-Blocks-IPv6.csv | cut -d , -f 1 > MS-IP6.txt

  [1] URL=https://download.maxmind.com/geoip/databases/GeoLite2-City/download?suffix=tar.gz
      curl -L -u userid:license_key $URL > db.tar.gz

The 20 min further south than you I live costs me over $30k/year.

Not by the same definition, no, its not, though there is a crime called "murder" in all states, and there tends to be significant overlap in the definitions.

It’s called a ‘use tax’. In practice, nobody pays (personal) use tax, myself included.

Washington has a use tax: https://dor.wa.gov/taxes-rates/use-tax

California has a use tax: https://cdtfa.ca.gov/taxes-and-fees/use-tax/

Idaho has a use tax: https://tax.idaho.gov/taxes/sales-use/use-tax/online-guide/

So, all of those people going to Oregon to shop without sales tax and not paying use tax were technically breaking the law, not using a loophole. I’m not judging them, I don’t pay use tax either :)

Avoiding taxes. It's different. It was always perfectly legal to travel to another state to buy something expensive and bring it back home. No crimes were committed.

It was a loophole that you could buy in Oregon specifically to avoid $1,000s in sales taxes.

I’ve never understood people like you that say anything and everything to increase taxes.

How does it make any rational or logical sense that you should pay higher taxes for something?

So when you go to Delaware that has 0% sales taxes, you make sure to log everything and pay taxes to your home state upon return?

In some cases this arises in US Constitutional law as the freedom of other people to seek and encounter the speech, though I'm not sure if there's a formal name for the idea. (e.g. "Freedom of Hearing".)

Also there is no need to spend time parsing it yourself, there are plenty of existing libraries you can simply point at the file.

I understand it used to be possible to show ID in store and have sales tax not be applied, but now you need to submit receipts and etc.

The situation petcat described is tax evasion (illegal, since use tax is due in lieu of paying sales tax at point of purchase, assuming item is brought back to home state).

Tax avoidance is simply minimizing tax liability, completely legal.

If you don't, you are technically violating the law. All states with sales tax also have a use tax.

For example, if you are a resident of neighboring Maryland, this is the form you'd need to fill out for purchases you make in Delaware.

https://www.marylandcomptroller.gov/content/dam/mdcomp/tax/f...

At some point it makes more sense to pass such a law at the federal level since we end up there eventually either way.

I mean it would be absurd if an anti-death-sentence state started trying to extradite the executioners working in pro-death-sentence states for murder, right?

It was legal to do that. If it was purchased out of state with the intent of bringing it back home, then (assuming the home state was California) California use taxes were always owed on it. Other states with sales taxes also tend to have similarly-structured use taxes with rates similar to the sales tax rates.

They were legally avoiding sales taxes, but also illegally evading use taxes, and, moreover, there is very little reason for the former if you aren't also doing the latter, unless you just have some moral objection to your taxes being taken at the point of sale and the paperwork and remittance to the government being done by the retailer instead of being a burden you deal with yourself.

> It's not trying to court California users.

The point that is being made, is that even a site generally designed and expected to be used by Utah citizens can become liable to Californian law because a Californian created an account.

If I operate a healthcare facility in New Mexico and a Texan comes in asking an addition, should I be liable to Texas abortion laws? Should they be held liable for an abortion that happened out of the state?

Expecting laws to instead propagate from neighbor to neighbor as I accidentally suggested—this wasn’t what I meant to suggest, but in defense of the idea:

> At some point it makes more sense to pass such a law at the federal level since we end up there eventually either way.

I do think there still could be some value. Laws could propagate across states that are more receptive to them, and then people can see if they work or not. Porting Masshealth to the whole country at once seems to have been a little bumpy. If it has instead been rolled out to the rest of New England, NY, then down to Pennsylvania… might have gone a little smoother.

AFAIK it's not that Oregon changed anything, either. It's that Washington passed additional laws that require out-of-state merchants to collect the tax when selling to customers in WA, and said out-of-state merchants complied.

And if the police has reason to suspect that there is illegal gambling happening at your dinner party they can obtain a warrant to bust your party.

Hell even if your party is to loud and annoys the neighbours the police can and will shut it down.

Phone number assignments are mostly public, you don't really need to pay for this information, but there are certainly those who will sell it to you.

Of course, phone numbers don't really tie you to a rate center anymore, but a rate center is often much more geographically specific than an address for a large ISP. What I've seen near me, is a rate center often ties the number to a specific community. Larger cities often have several rate centers, smaller cities may have their own or several small cities may have one. Of course, phone company wiring tends to ignore municipal boundaries.

On the other hand, most large ISPs tend to use a single IP pool for a metro area. Not all large providers do it that way, of course, and larger metro areas may be subdivided. You can't really ping time your way to better data there either, most of the last mile technology adds enough latency that you can't tell if the customer is near the aggregation point or far.

It's an uniquely American thing (Canada does it too, but access is regulated much more tightly).

This one[2] I could get reliable results from for free, but it seems to be "under maintenance" right now. Twillio just offers it as a service at 1 cent per number.

[1] https://en.wikipedia.org/wiki/CNAM [2] https://www.sent.dm/resources/phone-lookup

I suppose this is what confused me then, as it seemed obvious that e.g. the Facebook reccomendation algorithm isn't speech, so if a social media site would be considered speech it would be due to the user content. Section 230 doesn't in any way supercede the constitution, but it does clarify which party is doing the speech and thus where the first ammendment would apply.

So if someone is making money off of it it's suddenly "surveillance capitalism"? What makes it more or less "surveillance capitalism" compared to aws selling cloudfront to some ad company?

Moreover you can do better than area level code granularity. When landlines were more common and local number portability wasn't really a thing, can look at the CO number (second group) to figure out which town or neighborhood a phone number was from. Even if this was all information you could theoretically determine yourself, I'm sure there are companies that package up the data in a nice database for companies to use. In that case is that "surveillance capitalism"? Where's the "surveillance" aspect? It's not like you need to stalk anyone to figure out where a CO is located. That was just a property of the phone network.

>GeoIP databases are much higher resolution and use active scanning methods like ping timing. If a company was spam calling me to estimate distance based on call connection lag, yes that would be surveillance capitalism.

Why is the fact it's "active" or not a relevant factor in determining whether it's "surveillance capitalism" or not? Moreover spam calling people might be bad for other reasons, but it's not exactly "surveillance".

* The First Amendment generally prohibits the government from enacting any laws or regulations that limit speech based on its content (anything you might reasonably call "moderation" would definitely fall into this category!).

* Private companies are not the government. Social media networks are therefore not obligated to follow the First Amendment. (Although there is a decent argument that Trump's social media network is a state actor here and is therefore constitutionally unable to, say, ban anybody from the network.)

* Recommendation algorithms of social media networks are protected speech of those companies. The government cannot generally enact a law that regulate these algorithms, and several courts have already struck down laws that attempted to do so.

* §230 means that user-generated speech is not treated as speech of these companies. This prevents you from winning a suit against them for hosting speech you think injures you (think things like defamation).

* §230 also eliminates the liability of these companies for their moderation or lack thereof.

There remains the interesting question as to whether or not companies can be held liable via their own speech that occurs as a result of the recommendation algorithms of user-generated content. This is somewhat difficult to see litigated because it seems everybody who tries to do a challenge case here instead tries to argue that §230 in its entirety is somehow wrong, and the court rather bluntly telling them that they're only interested in the narrow question doesn't seem to be able to get them to change tactics. (See e.g. the recent SCOTUS case which was thrown out essentially for this reason rather than deciding the question).

No, it immunizes certain parties from being held automatically liable (without separate proof that they knew of the content, as applies to mere distributors [0]), the "publisher or speaker" standard being the standard for such liability (known as publisher liability.)

It doesn't "clarify" (or have any bearing on) where the First Amendment would apply. (In fact, its only relevant when the First Amendment protection doesn't apply, since otherwise there would be no liability to address.)

[0] subsequent case law has also held that Section 230 has the effect of also insulating the parties it covers against distributor liability where that would otherwise apply, as well, but the language of the law was deliberately targeted at the basis for publisher liability.

People who are not “the speaker or publisher” for liability purposes have Constitutional first amendment free speech rights in their decision to interact with content, this includes distributors, consumers, people who otherwise have all the characteristics of a “speaker of publisher” but are statutorily relieved of liability as one so as to enable them to make certain editorial decisions over use generated content without instantly becoming fully liable for every bit of that content, etc., yeah.

And arguing the alternative is you making the exact inversion of statute and Constitution I predicted and which you denied, that is, thinking Section 230 could remove First Amendment coverage from something it would have covered without that enactment.

______

* See UDHR articles 12, 18, 19, and 20. This is not an issue limited to the provincial laws of one small country.

† Unless the site operators also use of the site, in which case they too do suffer it; this is in my experience virtually always the case with the noncommercial sites that it is most important to protect.

> They're upset about google building dossiers on people.

Their location being in that dossier is part of what upsets people.

If social media sites are shut down but I am free to post my opinions on my personal blog site, how is my freedom of speech affected?

Did I not have freedom of speech before social media existed?

Is there an implication in freedom of speech that any speech facilitating service that can be offered must be allowed to operate? That's at least not obvious to me.

I echo what others said: There are good reasons to oppose all this, but blanket cries of "free speech" without any substance don't exactly help.

Except I'm not aware of any geoip databases that operate on a per-IP level. It's way too noisy, given that basically everyone uses dynamic IP addresses. At best you can figure out a given /24 is used by a given ISP to cover a certain neighborhood, not that 1.2.3.4 belongs is John Smith or 742 Evergreen Terrace.

At least in some cases, e.g. when multiple devices that are logged into their respective Google accounts are using that IP, and Google knows what location those usually reside at when together.

I've had Google pop up reliable location results for me, to the granularity of a small town, even if they had no information about me specifically to help them deduce this. It doesn't always happen though.