> very hard to move off of without convincing a lot of others
In my opinion, you do not need to convince anyone. Just leave. And face the consequences. If you think it is the right thing to do, do it. Do not wait for it to be convenient.
You will still be able to communicate with those people using plenty of other means. They have phones. They have e-mails. Some might even have open access social media accounts such as the Fediverse ones.
Similarly other people will still be able to contact you if they want.
I would be interested in knowing which devices were (or still are) vulnerable to these zero click exploits. And how those exploits (used to) work, specifically.
I assume that it is the current go-to way to operate for many spy agencies. Hire intermediaries. Who are then tasked to hire further intermediaries. Who then do the dirty work. Without a clue of where the actual order comes from.
Such a mode of operation has lower efficiency of course. But it can be done at scale. Which then offsets the losses caused by inefficiency.
I would not be surprised if there are multiple such attempts to spy on businesses all around the place occurring right now. And the person from the article is just one of the unlucky guys that got caught.
This mode of operation is likely also used, in my opinion, in the current hybrid war attacks by the Russian GRU, mainly in the Ukraine and in Europe at large.
Terms of service have no legal binding unless both parties agree to them.
In other words, if X has a public API and Nitter is using it, then neither Nitter themselves nor the Nitter users have to agree to any terms of service in order to do so.
X cannot expect anyone to behave in accordance with terms and conditions they never agreed to.
We need to revise the law around
terms of service, we are allowing companies to impose all kinds of monopolistic, anti competitive, user hostile, privacy invasion, and other measures against the public interest simply by burying provision in a wall of text they know no one will understand even if they read it.
We don't need new laws--we just need existing courts to start finding these terms of service to be unconscionable and refuse to enforce them. They certainly fit the description:
• Unequal Bargaining Power: A large gap in power or knowledge between a large corporation and an individual consumer or employee.
• Lack of Meaningful Choice: "Take-it-or-leave-it" adhesion contracts where the weaker party cannot negotiate any terms.
None of these so-called "agreements" should bind people. There is no actual agreement or "meeting of the minds." It's just one party writing one-sided rules that only they get to enforce.
> Terms of service have no legal binding unless both parties agree to them.
Companies are perfectly entitled to tell people they aren't allowed to use their services anymore. That's what the C&D was. It's perfectly legal to say "here's an API anyone can use, except you, Anish Kapoor."
It's like if Reddit bans you, you aren't entitled to use the site after they've told you you're banned. Even if you can find a technical means around the ban, it's still trespass.
> It does not seem logical to me that Reddit could "ban" anyone from using their public frontends as anonymous users.
It's already there:
"By using the Services, you state that: . . . You have not been permanently suspended or removed from the Services."
They have in other ways, too: "No one under 13 is allowed to use or access the Services." That's literally a prohibition from using Reddit, even anonymously.
Furthermore,
> By accessing or using our Services, you agree to be bound by these Terms. If you do not agree to these Terms, you may not access or use our Services
That right there already says you're legally prohibited from using Reddit, even without logging in, if you don't agree to the terms. It's like how I can say "if you don't agree with the rules of my house, you aren't allowed inside."
Why do you think you have a legal right to use someone's service if you don't abide by their rules? Because they "left their front door unlocked"?
Actually, I hope they do. The faster Reddit puts up more walls and dies, the faster some other upstart can come in and replace them with a more open version, like they did to Digg. Of course, in 5-10 years the upstart will enshittify and we'll all be wishing for the next upstart, and on and on and on...
The circle of shite.
Honestly though it's how internet worked for decades and big players got big headed about their importance. Importance only goes if there is no viable alternative.
In relation to banned entitlement, they talk about being logged in or anonymous, which are technical details pertaining to the ability to enforce, as though the technical enforcement details are what create a ban.
If I ban you from my house and you show up in disguise, you may be able to get in, but you are still not entitled to be there.
IANAL, but if I were a lawyer, I would be making the case that Nitter is not using X's services. Nitter is no different than Firefox or Chrome, it's a user-agent acting on behalf of the user.
At least in Europe, there's an argument to be made about a Nitter instance being an interoperability service for clients that do not use cookies/JavaScript, and could be argued that it's protected under the interoperability exception under EU directive on legal protection of computer programs.
The directive gives quite wide exemptions for reverse engineering, but as there's no reverse engineering here, just documenting public APIs, codifying and interfacing with them, it seems it is more than OK for the compatibility layer to exist.
> they are unknown, anonymous, and untraceable to X. That is unacceptable for any service
Every day we stray further from God's light. Imagine how "unacceptable" the first 30 years of Internet history must have been to a commenter with this mentality.
Public as in being visible to all is not the same as public as in allowing use by all. You appear to be conflating the former definition with the latter. For example, my front door is visible to all, but a person isn't allowed to walk into my house without permission.
> Public as in being visible to all is not the same as public as in allowing use by all
Where's the limit of that? Can I have port 443 open with a website behind it but sue anyone that accesses it because the fact that it being visible doesn't mean that I allow anyone to access it?
The very obvious answer is that penalty is commensurate with suitable advance notice of authorization limits. It's why there are rules about things like how to post "no trespassing" signs when access boundaries are not otherwise clear. But you're also allowed to notify and make someone leave your property if they wander in.
> but sue anyone
There are two very different kinds of "sue anyone". There's sue them to extract resources from them and there's sue them to make them stop. This is the latter not the former. Treating them as though they aren't wildly different is an error.
You effectively just asked whether I should be allowed to escort someone off my property without harm if they accidentally enter it. Yes, because it doesn't harm them in relation to what they didn't know in advance.
Indeed. You can look at the shape of the API but not extract things through it. Look, sometimes seeing and using are the same thing, but calling an API, which causes the machine running the API to do work in response to the call, is not the same thing as looking at the API.
You might make a distinction between looking at the door and walking through that door. But that is a flawed analogy to this particular issue. Because you cannot "look" at API. API has a single purpose. It can be used.
And if the entity operating it does not want public to use it, they need to make it non-public.
An API may be considered to be a specification or even an implementation of a specification, and you can look at a specification, implement a specification, and even look at an implementation of a specification all without using the implementation of the specification to extract data from behind the curtain.
Anyway, public things and spaces often disallow specific uses or uses by specific people. Like a park where you're not allowed to take your dog. Access is not the same as permission.
> The person is allowed to walk to your door.
Not if you notify them of a restraining order saying otherwise. We have a number of social and legal constructs facilitating the establishment of situationally-adaptive permission boundaries.
> In other words, if X has a public API and Nitter is using it, then neither Nitter themselves nor the Nitter users have to agree to any terms of service in order to do so.
That's not true. Publicly available source code with licenses dispute your claim.
(IANAL) That's copyright law and not contract law. Perhaps X could try to put a clause in its ToS that publishing content there grants the copyright to itself, but I'm pretty sure it won't be accepted well even if it's legal.
> Copyright law applies to all citizens whether or not they've agreed to a contract.
Funny enough SpaceX just ignores copyright law a lot of the time by refusing to comply with some of the GPL licenses for their dishy firmware. I think Tesla does as well to some degree. They generally publish some code but not the complete corresponding source code for the firmware they actually ship.
Wild to stare down the entire history of civil disobedience, close your eyes, and say "just because you think rules are unjust, that's no reason to ignore them". Some real "all the orders were on display at your local office in Alpha Centauri" energy.
If you ever find yourself on the pointy end of an unjust system, I hope the people in a position to fight against it for you can see a little further.
> give my phone number to a company to receive various important government alerts
Yeah, in general this is how it works: to send alerts to people, the company needs some contact info. If you want an authenticated user account, they do need to know who you are. You can even apply for blue-check status.
If they were actually "important" then the government would send them through the official channels. The EAS has plenty of tiers of importance, and it works a treat.* There is nothing on X that is so important, that anyone is missing out by not having an account there. I mean, seriously.
In days past, the government sent out alerts via radio and TV. I have reason to believe that EAS and other channels still work over radio and TV, which are 100% unauthenticated and passive, without giving away your phone number. The commercial news channels will even send you unimportant alerts. You just seem envious of X users that we get a nice interface, and global aggregation of stuff there.
X is not a government agency; it's not controlled by "the government", and they can platform anyone and anything. If you really want a quasi-government service, then sign up for TruthSocial, which is owned and operated by TMTG. That is where the truly important alerts are gonna be, like, "I've signed legislation that will outlaw North Korea forever; we begin bombing in 5 minutes..." sort of stuff. ;-)
* Hypothetically. My two Pixels have never once relayed an EAS alert of any kind, not even tests, so I suppose I'm relying on X!
> the entire history of civil disobedience
I'm sorry; I should be accustomed to HN redefining terms like "malware" and "evil" but this is just bonkers. Do you even know what "civil disobedience" looks like?
I know! I'll go to the mall tomorrow, sneak into a movie, toss an e-scooter into the river, and steal a teddy bear from Target! As the cops shove me into the squad car, I'll shout "CIVIL DISOBEDIENCE" and hire Johnny Cochran for my defense!
It's absolutely wild to see, on hacker news of all places, people suggesting that I should have to give my phone number to a company to receive various important government alerts. Not to mention condemnation of someone trying to improve the situation for everyone.
Or maybe, just maybe, they have their principles and try to follow and defend them. Yes, it's difficult and you usually seems "the bad guy" when fighting against the status quo.
I'm pretty sure that the ButlerianJihads of the beginning of the 20th century had the same opinion about the suffragettes (saving all the differences, for sure)
I would suggest that, instead of trying to complain about the people copying your products, which I think is practically impossible to avoid, and even from your own experience preventing it has led nowhere so far, you should focus on making sure that your version of the product is the best one. So that the people will naturally use it instead of those repackaged versions.
> take the Javascript code from my website, remove all ads from it
I would assume that this might be one of the reasons why people are modifying and repackaging your product. I would suggest to remove that incentive. So that the people will have no reason to repackage your product because it has annoying features. And so that they could use it directly and be happy about it.
I do not understand how what you have suggested could be considered as an appropriate analogy.
No one implied that the author should offer their product for free. I merely suggested that they need to focus on other aspect of their product rather than the mechanical software parts because they can no longer be the differentiating factor. Precisely because they could easily be recreated or copied.
Which to be fair, would maybe actually work, and there are political positions that want to achieve such an economic system. Not that I would necessarily agree with them.
>you should focus on making sure that your version of the product is the best one. So that the people will naturally use it instead of those repackaged versions.
Do you have any concrete ideas for how to do this or are you just saying this to defend piracy?
It is completely irrelevant why they choose to refuse to provide this information.
From what I understand, disclosing this data is not optional. It is a law. And if they have willfully chosen to operate in a country where such a law applies, they have to obey that law.
> The European Energy Efficiency Directive (EED) obliges data centers with an installed capacity of at least 500 kilowatts (kW) to report data including their energy and water consumption. In practice, few do so, despite the directive being in effect for three years.
I do not understand how that is even possible.
If any law is supposed to have any practical impact on the society, it needs to be enforced. Otherwise it is a guideline at best, not a law.
I think what would help is for these companies to each receive strict and hefty fines for non-disclosing the electricity and water consumption data they are obliged to disclose.
I assume that after that they would report all the required data very quickly.
It's probably because directives have to be read into law at the country level.
(Directives are binding on states. They transpose them into national law, possibly adding additional clauses as it goes past (EU directives set a minimum standard, not a maximum) at which point they're binding on people.)
Nobody ever said the EU was efficient. Look for a deadline for that transposition on the original directive.
You make a very good point. However, in this case, the deadline is two years in the past. From Article 12:
> 1. By 15 May 2024 and every year thereafter, Member States shall require owners and operators of data centres in their territory with a power demand of the installed information technology (IT) of at least 500kW, to make the information set out in Annex VII publicly available, except for information subject to Union and national law protecting trade and business secrets and confidentiality.
> 2. Paragraph 1 shall not apply to data centres used for, or providing their services exclusively with the final aim of, defence and civil protection.
Cool, thanks for looking that up. This gets us closer to where the fault lies. Has the Netherlands implemented the directive yet?
Chatbot says "partially", and "Article 12, concerning data centres, has already been implemented. The relevant Dutch decree was published in May 2024 and entered into force on 7 May 2024." and a link to https://wetgevingskalender.overheid.nl/Regeling/WGK026248
But I neither read Dutch, nor trust the chatbot to do so, so all I can do is report the link.
European Union has procedures for infringement or non-conformity in the reception of directives, but in practice, the fines are relatively small compared to a country budget (or how much money a country gains from taxes by not applying the directive) [1]
It's probably because that 500kw number is too arbitrary. I work in a single warehouse with robotics based logistics that uses 500kw. Nobody is asking us how much water we use.
Reality is if a regulation is too broad it tends to get overwhelmed and dies when it requires 100 people to enforce.
Even a basic in house data center can push 100kw with a few servers.
National governments kind of suck at enforcing these. In some cases, like the notorious Ireland Apple tax shelter, they may not want to enforce the rules because they feel they are benefiting from the evasion.
This kind of basic regulatory work is pretty thankless even when it's important. But I suspect the toxic politics of data centers will kick up some enforcement action sooner or later.
> In some cases, like the notorious Ireland Apple tax shelter, they may not want to enforce the rules because they feel they are benefiting from the evasion.
I thought it turned out the EU had no business in national tax affairs.
The line between a tax break and illegal state aid is exceedingly blurry. (It swung back and forth as it went through the courts, but the final ruling was "illegal state aid")
Extra-national laws are a real minefield, though. Ireland is in a great position without having too do very much of its own to have got there other than sign the right agreements.
The EU is in effect much closer to a confederation than a federation. A lot of the problematic aspects of how the EU is set up are attempts to work around the limitations imposed by not having sufficient public support to reform it into a more federal structure. To some that's a feature, of course, to others it's a significant nuisance.
And the practical effect of this is you get a race to the bottom: countries compete on how lax they are going to be in enforcing GDPR so as to attract American tech companies.
The Data Protection Commission in Ireland are remarkably lax about enforcing it because the government quite likes the tax revenue that Google, Apple and Meta brings them.
It's not a race to the bottom any more than competition lowering consumer prices is a race to the bottom. It's one of the few checks on governments just demanding more and more tax money for little return.
Perhaps this article is one step in the process of forcing disclosure. The Dutch parliament has recently (April 2026) clarified its law implementing the EED.
All sorts of laws are not being actively enforced, sometimes for good reasons like "It's relatively unimportant" or "it's important but enforcement is costly" ; sometimes because the law is controversial and the people who don't want it to exist at all weren't able to prevent it from being passed but are able to stimy effective enforcement.
500kW is basically 0kW when it comes to data centers. That’s only 600A at 480V three-phase, a McDonalds restaurant has a larger electrical service than that, lol.
I have more than one customer with a single motor that uses that much power.
My account is banned, so for whomever having [showdead] on:
European directive is not a law, it's a directive.
It's up to the national governments to create applicable laws that are to the letter and to the spirit of a European directive. Then national bodies will start applying the law and govern its implementation/adherence.
An by "up to" I mean they are obliged... eventually.
And I wouldn't be so sure on being 'eventually' obliged, someone has to enforce it for that to happen and it's not looking like anyone has profit in it
The purpose of these laws is to give the state the option to crack down on anyone they feel like at any time. They are not meant to be obeyed, and that is obvious to anyone with eyes.
This figure is about the water consumption only. The estimate about the electricity consumption, in that same article, is much higher than that.
The main problem is, in my opinion, that those are just estimates. If we are supposed to accommodate the current and potential future needs, we need real data. Not estimates.
I have recently noticed that e.g. ChatGPT, when used from a web browser, periodically sends unfinished prompts to their servers, namely to the `conversation/prepare` endpoint, without waiting for the user to actually send it.
This partial prompt data might potentially be used to "pre-warm" some kind of cache.
But it may also be used to track the user's writing cadence, error correction style and evolution of their stub ideas as they are being formulated into a prompt. I would assume that such data could also be sold to the advertisers.
This is my concern as well- the same wiggle-room methodology that allowed a business to claim not to “sell or share” PII, because “user data collaboration” was not part of the legal definition prior to CCPA.
OpenAI’s statements in response to the Millenium Prize (and related) disputes I think are a pretty obvious example of this in practice. One man’s “user prompts” is not another’s “reasoning trace scratchpad”.
This comment by Falserum on the mathematics research post articulates it well:
> But it may also be used to track the user's writing cadence, error correction style
I'm pretty sure it is used for this; but rather than for anything nefarious, my guess is that this info is then fed to a classifier model to ensure that users of ChatGPT-the-service (as opposed to the OpenAI inference API) are actual humans, rather than agents trying to circumvent having to pay API pricing.
“Oh, we’ll store your unfinished thoughts, privately typed into a text box, on the off-chance that you want to continue writing it on another device. And no, we won’t ask you nor give you any semblance of true privacy.”
It is also super common on e-commerce websites that will then send you an email about a cart you started to the point of adding an email but then abandoned.
I would be very curious to see how you explain it to your customers.
Is it going to sound similar to this?
> You see, our well-meaning AI-generated code has caused all your data to be permanently deleted. In case you are confused as to who to blame, we would like to clarify that we did not write, nor review the code. So we cannot possibly bear any responsibility for its mistakes. The responsibility lies with the LLMs, not us. We have already fired the LLM which did the coding and the review. And we are already using their main competitors. Hopefully that settles your concern with the quality of our service and we are looking to have you on board of our next products.
This seems to work well enough for people who deploy cloud instances without redundancy to us-east-1 then blame AWS when there's an outage. I say this somewhat unironically because if one pushes the "move fast and break things" slider all the way to the right then they're necessarily assuming that type of risk. Of course some people will try to have their cake and eat it too [1] as regards velocity and quality but that's a separate discussion.
[1] I've never understood this idiom because if one isn't in possession of their cake before eating it then they're eating stolen cake which is a decidedly anti-social activity and orthogonal to the point of the saying. It should be "eat their cake and keep it too" or something.
In my opinion, you do not need to convince anyone. Just leave. And face the consequences. If you think it is the right thing to do, do it. Do not wait for it to be convenient.
You will still be able to communicate with those people using plenty of other means. They have phones. They have e-mails. Some might even have open access social media accounts such as the Fediverse ones.
Similarly other people will still be able to contact you if they want.
reply