Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Many years ago, I worked at a small (3 US states) ISP, roughly 500-600K customers

This ISP was one that mostly absorbed smaller ISP's that weren't able to scale up enough to remain competitive.

One of the ISP's they absorbed was CondoInternet. A Seattle based firm that provided gigabit internet service across Seattle's affluent areas and expensive condos

As it turned out, a lot of the customers ordering the service hailed from a country with a very restrictive censorship regime. A "great firewall" if you will

They'd set up home-made VPN's using Raspberry Pi's etc for family to tunnel into and watch Netflix on typically

Netflix however even in 2017 was smart and their algorithm would see these thousands of people logging in while everyone else in Seattle was typically asleep and eventually ban the entire ISP's IP range. Logging in would give a "please turn off your proxy/VPN" error message

Every time this happened the ISP's phone tree would explode, going from mere seconds to literal 6-10 hour queue times. The NOC was entirely upskilled CS agents who had no idea how to contact Netflix's relevant teams to get the IP ban removed, instead they'd simply tell CS to have customers wait until the IP ban expired (usually a few days)

This would happen almost every other month



Netflix likely spotted the behavior through one of the many other heuristics that can identify this, such as:

- Lower packet TTL than gateway

- Lower packet MTU than gateway

- Much higher latency than gateway

- WAN IP listening on well-known VPN ports for PPTP/IPsec/etc

- Ongoing sessions that suddenly teleported to a Chinese WAN IP when the VPN connection dropped

- Incorrect DNS configurations or stale caches that point toward inappropriate CDN edge nodes

- System time zone (via JavaScript or native app) not matching source region

- Unusual system language preferences for the region

- One of the hundreds of leaky data points revealed by Android devices and other native apps


Nice list.

I tried getting my parents internet funneled through UK so that they could watch some stuff...no good. Both netflix and amazon prime picked up that something was off-sides. I suspect it was latency cause other side of world


thanks for listing these!


I can't help but wonder why Netflix cares this deeply. Are their contractual obligations that incredibly stringent?


You have to remember the movie business has been dragged kicking and screaming into progressively larger and larger buckets of money since forever. VCRs? They'll kill the movie industry. DVDs? Same. Blueray, even worse since quality is so good no one will ever buy a movie again. Streaming services? Last one out of Hollywood please turn out the lights. Blah, blah, blah. The then head of the MPAA Jack Valenti literally compared the VCR to a serial killer named the Boston Strangler.

"'I say to you that the VCR is to the American film producer and the American public as the Boston strangler is to the woman home alone.' Jack Valenti said this in 1982 in testimony to the House of Representatives on why the VCR should be illegal. He also called the VCR an "avalanche" and a "tidal wave", and said it would make the film industry "bleed and bleed and hemorrhage"

As quoted on slashdot: https://news.slashdot.org/story/02/05/31/1622232/valentis-bo...

My point is yes there are incredibly strict covenants in place and I'm sure they're probably preventing more revenue than they're allegedly protecting.


Wherever Jack Valenti is now, I hope it's hot.


Yes of course they are!

Netflix signs licensing deals that are per-country, and the licenses require that Netflix actively enforce that media is steamed only to the country in question.

You think Netflix is enforcing these restrictions because it wants to, or because it thinks it's fun to defeat VPN's?

Of course not. All of this effort costs money that obviously Netflix wouldn't be paying if it weren't required to. It's doing so because it's contractually obligated to.

So don't get mad at Netflix. They don't have a choice. They're just doing what their content providers require them to.


Do their contracts require detailed heuristics for detecting VPNs?

Would it be breach of contract if they were a bit lazy in how they checked what the user's country was (simple IP to country lookup, for instance)?


Probably not, but remember Netflix is constantly having to negotiate new contracts with the content providers. If they don’t feel like Netflix is doing enough, they won’t negotiate another deal, or they will demand more money in return. Netflix will use their success at blocking VPNs as a negotiating tool.


I honestly think they are using the copyright lawyers as a scapegoat.

The have to do all sorts of Infrastructure tricks and optimizations to have the performance that they currently do.

They most likely realized they had a non-insignificant number of vpn connections (that can change country in short notice) and this probably introduced a massive spanner in the works on their Infrastructure/Optimizations.

I doubt the studios understand half of what Netflix has to do backend wise to appreciate any of it on a negotiation table.


There's no reason why VPN's would create any engineering headache for Netflix at all. So no, Netflix has absolutely zero engineering reason to crack down on VPN's.

And the studios are a lot smarter than you think, they've been doing regional licensing for a long time now. Everyone doing negotiations knows VPN's are the tool to get around region restrictions, and any exec can just ask their assistant or teenage kid to sign up for a handful of VPN services and see if they're able to watch Netflix through it. VPN's aren't some secret only hackers know about, they've had widespread consumer use for a long time.

The studios don't need to understand much of what Netflix is doing on the backend. They just put in the contract that Netflix must make all reasonable effort to ensure region restrictions can't be evaded via VPN, maintaining up-to-date lists of blocked IP ranges, which will be periodically verified via e.g. the current top 10 most popular VPN providers.

It's all quite simple and straightforward. No scapegoating.


I wish it would be made transparent how Netflix acquired the licence and made that contract transparent. I would evade media with unreasonable enforcement that doesn't live up to the modern world of media anyway.


I suspect you won't get an answer because they are probably not contractually obliged to go to this length. I doubt these contracts would go into such a deeply tech savvy specification.

However it is a pretty good scapegoat convenience to point your fingers to copyright lawyers.

The thing is they probably realized that if they continued to do nothing, everyone and their dog would be connected through a Canadian ip which gives people the most content out of any country out there.


> everyone and their dog would be connected through a Canadian ip which gives people the most content out of any country out there.

Honestly all I care about is the Columbian soap opera that only streams in Columbia and Argentina ¯\_(ツ)_/¯


> Of course not. All of this effort costs money that obviously Netflix wouldn't be paying if it weren't required to. It's doing so because it's contractually obligated to.

I feel like this was probably true five years ago, but not today. The whole point of publishers slowly setting up their own streaming services (like Disney -> Disney+) and streaming services slowly vertically integrating with studios (Netflix, Amazon Prime Video + Amazon Studios) is to bypass this stupid shit.

If Netflix financed the show, and Netflix streams the show, and Netflix has global distribution, then why, pray tell, does Netflix give a shit any more about whether a user is using a VPN or not?


The article mentions that if Netflix detect that you're connecting via a VPN then the content is restricted to Netflix Originals.


> If Netflix financed the show, and Netflix streams the show, and Netflix has global distribution

The number of shows where Netflix has genuinely global distribution can be counted on one hand, since they don't operate in China and tend to very deliberately not pay a bunch of money for rights they can't do anything with.


That's not what I'm asking. I'm asking how above and beyond are they required to go with ensuring this. Technically they could require a Netflix employee to be present to verify identity whenever you stream to ensure you are in the correct country, but obviously they aren't going to that extreme of lengths. But if they're actively using heuristics to target blocks of legitimate residential IPs that might be secretly using VPNs, well that sounds like above and beyond what they may be obligated to do.


Wouldn't there come a time when they can plausibly say "What else do you want me to do?"

Did they have to do damned ML to catch people?


Of course there are. Pretty much every stupid geo-restriction, restriction on downloads, restrictions on the number of downloads (why??), etc comes down to some stupid rights holder think this is something they want.


More like pressure than contractual obligations


This makes a lot more sense why CondoInternet and other small ISPs joined Wave Division Holdings now.

What do you think the future of Wave is since their leadership exited the firm and convinced an SPAC to put them in charge of a new regional competitor (Ziply Fiber)?


I'm guessing that was probably a blatant abuse of the residential service. Not that I agree, but ISPs already block port 25 for the most part. I'm surprised they didn't just start banning customers abusing the service.


> I'm surprised they didn't just start banning customers abusing the service.

One of CondoInternet's advertised selling points before they sold to Wave Broadband is that you could buy the 1Gbps service and do whatever you wanted, including run your own servers.

So it wasn't an abuse of the service. Everyone I knew on CondoInternet would buy the highest speed package so they could run Minecraft and Plex and other servers for their friends. It was like having Speakeasy Internet Services SDSL back again but with 200 times the upload.


Port 25 is for unsecured SMTP

VPN's can be on any port




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: