5 ms·

Author here. Thanks for explaining your thoughts as you are Icelandic. Really appreciate that. It's not too easy to do research in a non English speaking countr

Author here. Thanks for explaining your thoughts as you are Icelandic. Really appreciate that. It's not too easy to do research in a non English speaking country. I'm not a native English speaker, so forgive the typos. I wrote this article a few months back and since then some things changed. Somebody also enlightened me about the cooperation of Iceland with the US government [1], although no source has been linked. I think governments spying on data is something you can prevent with strong encryption and keeping the data out of the those countries that are known for it a.k.a. Five Eyes. That's what we do with our customers data. I agree with your statement that "xyz never happens in Iceland" shouldn't be a reason for choosing a country. I'm still very confident it's better not to put our servers in any Five Eyes country. For the speed I do think Iceland is not optimal. See the pings from this comment [2]. I realized this after moving to Iceland that the speeds where indeed slower than from Digital Ocean in Amsterdam. I don't think your argument about the connection with cables are relevant. If you send your data encrypted it will not be possible to read the packets, right? Or maybe I don't get your point. I'm thinking of moving our servers to Germany or The Netherlands. There are a few downsides with that for example the environmental impact. We are looking into other solutions to have no carbon footprint with Simple Analytics [3]. [1] https://news.ycombinator.com/item?id=19530972 https://news.ycombinator.com/item?id=19530972 [2] https://news.ycombinator.com/item?id=19528028 https://news.ycombinator.com/item?id=19528028 [3] https://simpleanalytics.com https://simpleanalytics.com

mattlutze 7y ago
5 and 9 and 14 Eyes are all apparently focused on signals intelligence: - https://protonvpn.com/blog/5-eyes-global-surveillance/ https://protonvpn.com/blog/5-eyes-global-surveillance/ - https://www.reuters.com/article/us-china-fiveeyes/exclusive-five-eyes-intelligence-alliance-builds-coalition-to-counter-china-idUSKCN1MM0GH https://www.reuters.com/article/us-china-fiveeyes/exclusive-... Which I think means watching data move across the lines. If you'd like to pull your tinfoil hat even tighter: Germany, Netherlands, Iceland are listed above as broader members of signals intelligence sharing partnerships, as well as members of NATO. They have a discussion here of their policies and activities related to Cyber Defense: - https://www.nato.int/cps/en/natohq/topics_78170.htm https://www.nato.int/cps/en/natohq/topics_78170.htm If a government wants to take your hard drives it will. Unless there's explicit laws against the seizure of physical media, you're mostly relying on them either not having a sophisticated enough internal intelligence capacity that can do it quietly, or trusting in social reaction to a mostly boring, questionable infringement of property rights.
snarf21 7y ago
The parent's point is this. You don't own the undersea cables and Iceland doesn't either. How many companies own these cables that come into Iceland? Are those companies all from Five Eyes countries? What if the undersea cable company says stop sending traffic to this domain or we cut off your access from the data center or ISP provider side? What happens if the Five Eyes place travel/trade restrictions on Iceland unless physical data related to some alleged incident is turned over? The point being that sure no physical access is an improvement but maybe not a panacea. You may have protected data but how does that help you if it can't leave or enter your servers? The internet doesn't have to remain as free and open as it is now.
Havoc 7y ago
Did the move get you off the easylist?
- unixhero 7y ago
  Is that a burn? Pretty veiled, lol :)
jammygit 7y ago
I suppose that the encryption is relevant no matter where you operate from. Does that protect metadata? I assume that all they can learn is that person X is visiting a site that uses your service, which is pretty unhelpful for spooks. In that case, the main security or privacy concern probably revolves around government data requests and/or data center security

mattlutze 7y ago

5 and 9 and 14 Eyes are all apparently focused on signals intelligence: - https://protonvpn.com/blog/5-eyes-global-surveillance/ https://protonvpn.com/blog/5-eyes-global-surveillance/ - https://www.reuters.com/article/us-china-fiveeyes/exclusive-five-eyes-intelligence-alliance-builds-coalition-to-counter-china-idUSKCN1MM0GH https://www.reuters.com/article/us-china-fiveeyes/exclusive-... Which I think means watching data move across the lines. If you'd like to pull your tinfoil hat even tighter: Germany, Netherlands, Iceland are listed above as broader members of signals intelligence sharing partnerships, as well as members of NATO. They have a discussion here of their policies and activities related to Cyber Defense: - https://www.nato.int/cps/en/natohq/topics_78170.htm https://www.nato.int/cps/en/natohq/topics_78170.htm If a government wants to take your hard drives it will. Unless there's explicit laws against the seizure of physical media, you're mostly relying on them either not having a sophisticated enough internal intelligence capacity that can do it quietly, or trusting in social reaction to a mostly boring, questionable infringement of property rights.

snarf21 7y ago

The parent's point is this. You don't own the undersea cables and Iceland doesn't either. How many companies own these cables that come into Iceland? Are those companies all from Five Eyes countries? What if the undersea cable company says stop sending traffic to this domain or we cut off your access from the data center or ISP provider side? What happens if the Five Eyes place travel/trade restrictions on Iceland unless physical data related to some alleged incident is turned over? The point being that sure no physical access is an improvement but maybe not a panacea. You may have protected data but how does that help you if it can't leave or enter your servers? The internet doesn't have to remain as free and open as it is now.

Havoc 7y ago

Did the move get you off the easylist?

unixhero 7y ago
Is that a burn? Pretty veiled, lol :)

jammygit 7y ago

I suppose that the encryption is relevant no matter where you operate from. Does that protect metadata? I assume that all they can learn is that person X is visiting a site that uses your service, which is pretty unhelpful for spooks. In that case, the main security or privacy concern probably revolves around government data requests and/or data center security