Possibilité de bloquer l'accès à Discourse depuis des régions géographiques ou des pays

Suite à la discussion sur la directive européenne sur le droit d’auteur vient d’être adoptée par le Parlement :

La directive européenne sur le droit d’auteur et le système de censure qui l’accompagne viennent d’être adoptés, et le résultat est plutôt décevant. L’impact complet reste encore inconnu, mais les principaux problèmes que nous connaissons actuellement sont les suivants :

  • Obligation de mettre en place un système de filtrage pour tout contenu susceptible d’être protégé par le droit d’auteur. Cette mesure s’applique au moins aux sites les plus populaires. Mais qu’en est-il d’un forum intégré à un site plus vaste ? La situation reste floue.
  • Taxe sur les liens : le fait de créer un lien vers un site et d’en extraire des extraits contenant plus de quelques mots n’est plus autorisé. Sauf erreur de ma part, cette règle s’applique à tous les sites, pas seulement aux grands.

L’un des éléments constants dans les discussions sur les forums est le fait de faire des liens vers d’autres sites et de citer des extraits de leurs articles pour enrichir la discussion. Cela a toujours été considéré comme un usage équitable (Fair Use), sauf lorsque des personnes publient le contenu intégral d’un article (ce qui arrive également fréquemment et devrait être modéré).

Ma suggestion est d’ajouter cette fonctionnalité à Discourse :

  • Permettre de bloquer l’accès ou l’utilisation du forum depuis une liste de régions géographiques, telles que l’Europe. Idéalement, avec un message à afficher à ces personnes.
  • Permettre de restreindre les lieux d’où les comptes utilisateurs peuvent être créés.

Ces options pourraient s’avérer utiles dans tous les cas, notamment si vous recevez beaucoup de spam provenant d’une région spécifique où il est peu probable que les lecteurs consultent réellement votre forum.

(Je vais de toute façon déplacer mon forum derrière Fastly et je gérerai cela de mon côté. Je fournis simplement un retour d’information.)

3 « J'aime »

As far as I was aware, any site over three years old is caught by this article of the Directive - not just popular sites.

1 « J'aime »

Well that makes it much worse, I guess, if that’s the case. I know the exact details kept changing a little bit, and the member states can implement their own exact versions of the rules — which makes it worse, IMO, because every country there will have slightly different rules. How can anybody navigate that?

1 « J'aime »

It’s been discussed but it is a complex thing to build, and we’d only build it for enterprise customers who absolutely required it.

There are one or two relatively minor related feature things Discourse would gain out of implementing this, but it’d be a lot of work, so the cost/benefit is not quite there outside enterprise.

@sam might have more to add. This is not currently on our roadmap, to be clear, because the enterprise customers who “needed” this suddenly decided they didn’t when we told them the cost :wink:

7 « J'aime »

With the availability of VPN services the user of geographic blocks doesn’t achieve anything. A user originating from Europe on a VPN still exposes you to the same risks. If any part of the traffic passes through europe, it can be considered as included.

Member countries have yet to turn the EU ruling into local laws, and if GDPR is anything to go by they’re free to interpret the EU wording to the limits of the language.

Just like GDPR this is a problem without an easily navigable solution.

2 « J'aime »

Technically now that we ship the maxmind db out of the box, this kind of feature would only take a few weeks to build.

Caveats being:

  1. NGINX would not do any blocking so “anon requests” would unconditionally have to be funneled through the app which would cause perf issues.

  2. CDN support would be tricky, most CDNs out there don’t support a mechanism for this so it is likely you would not be able to use most CDNs.

I don’t see us building this though cause it goes against a lot of our principles. Closet feature I can see us building is “self service, best effort strong IP block” (aka. if your IP matches list then application will return an access denied prior to walking through all the app code) cause this can allow all sorts of forums to protect themselves a bit better against abuse beyond the rate limiting we ship.

If you really really deem that you need this, why not drive all your traffic via cloudfront and have it do it for you?

2 « J'aime »

To be clear though, it’s not just about blocking visitors, it’s about sites embedding re-using or embedding content from EU entities.

That’s why the YouTube geoblock is useless, rights holders could still identify their content being shared with other audiences worldwide.

@Stephen totally understood, from reading:

My guess is that @geek is simply saying, “I don’t want to think about this problem, I am worried Europe are going to put me out of business, can I have this feature please”

I think there is a lot of uncertainty when new laws pass, some of us are a lot more risk averse than others

The last thing I want is for this topic to devolve into one of those GDPR scare topics. Where 1 side is saying “Don’t worry be happy” and the other side is saying “The sky is falling”.

Happy to talk about what Discourse can technically do and what we have in our roadmap.

:warning: Warning though for all the readers here, cause we are just in post 7 and this my spidey sense is tingling real bad. :spider:

Lets stay laser focused on discussing:

“Ability to Block Discourse Access from Geographic Regions or Countries”

7 « J'aime »

The only thing I’m saying is that an option to block the entire forum at a country level would be nice. That would neatly solve the issue entirely for anybody that doesn’t want to navigate the legal issues. If you don’t operate in a country you aren’t subject to its laws.

I don’t actually need this personally, as I mentioned in my original post.

Was just giving feedback.

4 « J'aime »

Yep, I get that, but as I said geo-blocking EU users doesn’t achieve that.

Don’t believe this is correct.

First, it’s not a tax, so let’s drop the fear-mongering ‘spin’.

The data in the open graph tags is much more than a couple of words. Given its purpose, despite not being a lawyer (@angus), my hunch is that there exists an implicit licence to use this data as previewing remotely is exactly what it’s meant for. If they didn’t want you to use this text, why include it in their open graph tags? We might need this tested in court to confirm, though why someone would bring a case against you for linking to their site using their link data is anyone’s guess!

I suspect therefore oneboxing will continue to not require an explicit licence.

I will certainly continue to do so without any fear of repercussions.

I appreciate quoting from arbitrary points in the main text is going to be a bit more tricky.

2 « J'aime »

If you dig through the legalese they’re mostly concerned with lifting enough of an excerpt to negate the need to click through to the article.

Opengraph is neither the problem nor the solution. As previous EU decisions it will be down to individual member states as to how this manifests into enforceable laws.

But yes that’s the crux of it, they’re concerned with publisher to publisher, not audience.

2 « J'aime »

And that is at their discretion because they determine the link excerpt.

All blown out of proportion!!

2 « J'aime »

Easy:

  1. Add your site to Cloudflare
  2. Block any country you want
  3. Enjoy your CDN and hiding your server ip for free
  4. ??? profit

The only thing you lose is the ability to see the real IP of users if you are using a reverse proxy + cloudflare, but that can probably be fixed too if you really care about it.

Maybe there are other CDN’s that can do it, but with a free CDN like Cloudflare that can serve the needs of like 90% of the websites for free I don’t see a reason to look for another one.

1 « J'aime »

Does someone really believe, that blocking will solve anything?

It’s a regulatory / compliance question, that will be addressed sooner or later by legislation due international free trade and copyright agreements.

In my opinion, we need to talk about risk management and watch dog processes instead of over-blocking and the chilling effects.

Non merci aux personnes qui ont détourné ce sujet vers un débat politique.

Existe-t-il à présent une implémentation technique (sous forme de plugin) pour bloquer l’accès à un Discourse via une base de données GeoIP ?

Non, il n’y en a pas. C’est une mauvaise idée et les gens consacrent rarement du temps à les poursuivre.

Vous devrez faire quelque chose en amont de la candidature si cela compte vraiment pour vous.

2 « J'aime »

Votre meilleure option est probablement quelque chose comme Cloudflare. Si vous choisissez Cloudflare, vous devrez effectuer plusieurs opérations pour vous assurer que ses services d’accélération ne perturbent pas Discourse. Il existe plusieurs sujets à ce sujet.

3 « J'aime »

Pourquoi ne pas utiliser des règles de blocage geoip dans iptables ?
Pour le faire facilement et sans besoin de maintenance ou de cron : GitHub - friendly-bits/geoip-shell: User-friendly and versatile geoblocker for Linux

Il y a maintenant ceci : Plugin de géo-blocage

4 « J'aime »