5 ms·

When I was at Akamai about 5 years ago, I was involved in building the system for making their CDN compliant in China. There were two main features, and they we

When I was at Akamai about 5 years ago, I was involved in building the system for making their CDN compliant in China. There were two main features, and they were activated on all servers running inside mainland china (not HK, macau or Taiwan) 1. Logs of the CDN were sent in real time to the ministry of technology -- there was about a 15 minute delay if I remember correctly, and they could impose fines if they were delayed. The log included the url visited, the IP address of the visitor, and a few other things. Perhaps the user agent? I forget. 2. The ministry of technology had a special API to block URLs on the CDN. Basically, they provided a list of URLs that would return a 451, and of course those logs also went to the government. No other country had this kind of access at the time, but it was considered critical for the business to continue to operate in China. As I understand it, these are required to comply with chinese government regulations, and other CDNs like Cloudflare and Cloudfront have also built similar capabilities. Perhaps jgrahamc can comment on what cloudflare did? I feel quite guilty about being involved with that project, but the business was set on building it, so I did what I could to limit the blast radius. I would not be surprised if someone got arrested or was killed because of it.

stevewatson301 4y ago
While I wouldn't put any authoritarian moves beyond China's reach, the ICP recordal mechanism already requires government approval. In that case, isn't it better for user privacy (not that anyone cares about it in China) to receive an ICP recordal but then wait for an actual request from law enforcement to turn over the logs? Also, while you wouldn't see anyone from Amazon or Cloudflare comment on your thread, both have the ability to stream logs to a destination, and that is also exposed to customers, so I don't think they needed to build anything else.
- 052c7028e 4y ago
  All of the sites served had an ICP license. This is separate, and the CDNs in China have regulations specific to CDNs they need to comply with. At the time, Akamai also had the capability to stream logs, but the ministry of technology required a specific, custom interface to receive them, which required engineering work, especially to do it for an entire country without the customers configuring it themselves. I would be extremely surprised if it required no engineering work at Amazon or Cloudflare to deliver the logs in the way they requested.
throwaway_p 4y ago
- froggychairs 4y ago
  This type of China vs US narrative where existential stakes are implied is just dumb. The technological Cold War we’re in is not going to result in the collapse of either nation.
  - anigbrowl 4y ago
    I think you may have misinterpreted the parent comment, (or perhaps I did). China doesn't have a deep libertarian tradition, so overbearing state surveillance, while odious, isn't a strange concept in Chinese culture. Western governments are/will be unable to resits the urge to deploy such measures because they clearly work so well for authoritarian states, but will fatally undermine their own cultural foundation by doing so. It wasn't so long ago that regimes like East Germany were considered the epitome of totalitarianism, with the Stasi (domestic intelligence service) coopting large numbers of informers, listening in on the citizenry etc. Yet today many of us are subject to far more intrusive surveillance, it's just got super-friendly branding and some people are making money out of it so 'freedom' has nominally prevailed.
    - derangedHorse 4y ago
      That’s the thing though, it doesn’t work that well. China is a huge place that seemingly has many challenges that are underreported in the global landscape. The trade offs the Chinese government makes to better control the people limits their ability to draw from the global talent pool and restricts free thinkers and innovation.
  - throwaway_p 4y ago
    China exports narcotics, sold nuclear tech, grabbed China sea, Tibet, hongkong and Taiwan on the menu. Sure nothing to worry about it.
- stingraycharles 4y ago
xwowsersx 4y ago
Glad you regret it. Not trying to rub it in as I don't think anything productive will come from self-flagellation, but this is truly awful and I think the US should have laws that make it a crime for any US corporation to participate in this sort of thing.
- 052c7028e 4y ago
  I was powerless to stop it. I was just a junior engineer, and it was decided by the CEO to do the project. So, actually, I feel I made the right choice -- I participated in the project but worked hard on making sure it was as limited as possible. I successfully advocated for several categories of logs to not be sent because they were not required by law. So, yes, I regret I couldn't do more, but I don't regret the choices I made with the information I had and the position I was in.
  - notRobot 4y ago
    Just a stranger on the internet, but FWIW I'm proud of you. You did what you could, and you're cognizant of your actions.
    - 052c7028e 4y ago
      Thank you.
  - danuker 4y ago
    > I was powerless to stop it. You could have found a new job, driving up their costs or delaying them slightly.
    - notRobot 4y ago
      And what purpose would that have ultimately served?
      - danuker 4y ago
slim 4y ago
Thank you. This is very informative. And don't feel guilty, nobody will get jailed for visiting a website. This is mostly for censorship.
- iopq 4y ago
  There was a person in Beijing that was arrested for a post on Twitter. Government surveillance was able to track him down in real life, which I think is deeply troubling
  - slim 4y ago
    That's a post not a visit
    - iopq 4y ago
      There's really nothing stopping them from going after people who use VPNs. What are Chinese people going to do? Protest?
- nibbleshifter 4y ago
  > This is mostly for censorship. As if that makes if any better?
- jasonhansel 4y ago
  This is kind of like saying, "don't feel guilty, this weapon won't be used for murder, it's mostly just for arson."
wcerfgba 4y ago
Thanks for sharing your story. I am curious what you would do next time if you found yourself asked to build something that you found unconscionable? Would you refuse to work on the project? Other engineering disciplines have a strong focus on 'engineering ethics' and it may be more acceptable in different branches of engineering to refuse to build something that you consider unethical. I do not know if there are any professional bodies or laws which protect the employment rights of individual engineers who refuse certain work on ethical bases. But I feel that software engineers should be able to exercise their conscience, reference a standard of professional ethical principles, and refuse to work on such projects.
pototo666 4y ago
If I use a VPN like v2ray and write some crazy shit about Dictator Xi, is your system able to know what I write and who I am? I'm very curious because many Chinese people including me are doing that daily.
- ospider 4y ago
  That what I do on a daily basis, so far so good, I haven't been seized by the police for what I published outside of the Great Fire Wall.
jeffrallen 4y ago
Akamai has very tight relations with the US Government. So what was probably happening is that the USG was fine with Akamai treating it's users like this because it was getting a copy of those URL filters and access logs too. Don't know if that should make you more in or less sorry for being involved. (It would make me more sorry. Sorry.)

stevewatson301 4y ago

While I wouldn't put any authoritarian moves beyond China's reach, the ICP recordal mechanism already requires government approval. In that case, isn't it better for user privacy (not that anyone cares about it in China) to receive an ICP recordal but then wait for an actual request from law enforcement to turn over the logs? Also, while you wouldn't see anyone from Amazon or Cloudflare comment on your thread, both have the ability to stream logs to a destination, and that is also exposed to customers, so I don't think they needed to build anything else.

052c7028e 4y ago
All of the sites served had an ICP license. This is separate, and the CDNs in China have regulations specific to CDNs they need to comply with. At the time, Akamai also had the capability to stream logs, but the ministry of technology required a specific, custom interface to receive them, which required engineering work, especially to do it for an entire country without the customers configuring it themselves. I would be extremely surprised if it required no engineering work at Amazon or Cloudflare to deliver the logs in the way they requested.

throwaway_p 4y ago

froggychairs 4y ago
This type of China vs US narrative where existential stakes are implied is just dumb. The technological Cold War we’re in is not going to result in the collapse of either nation.
- anigbrowl 4y ago
  I think you may have misinterpreted the parent comment, (or perhaps I did). China doesn't have a deep libertarian tradition, so overbearing state surveillance, while odious, isn't a strange concept in Chinese culture. Western governments are/will be unable to resits the urge to deploy such measures because they clearly work so well for authoritarian states, but will fatally undermine their own cultural foundation by doing so. It wasn't so long ago that regimes like East Germany were considered the epitome of totalitarianism, with the Stasi (domestic intelligence service) coopting large numbers of informers, listening in on the citizenry etc. Yet today many of us are subject to far more intrusive surveillance, it's just got super-friendly branding and some people are making money out of it so 'freedom' has nominally prevailed.
  - derangedHorse 4y ago
    That’s the thing though, it doesn’t work that well. China is a huge place that seemingly has many challenges that are underreported in the global landscape. The trade offs the Chinese government makes to better control the people limits their ability to draw from the global talent pool and restricts free thinkers and innovation.
- throwaway_p 4y ago
  China exports narcotics, sold nuclear tech, grabbed China sea, Tibet, hongkong and Taiwan on the menu. Sure nothing to worry about it.
stingraycharles 4y ago

xwowsersx 4y ago

Glad you regret it. Not trying to rub it in as I don't think anything productive will come from self-flagellation, but this is truly awful and I think the US should have laws that make it a crime for any US corporation to participate in this sort of thing.

052c7028e 4y ago
I was powerless to stop it. I was just a junior engineer, and it was decided by the CEO to do the project. So, actually, I feel I made the right choice -- I participated in the project but worked hard on making sure it was as limited as possible. I successfully advocated for several categories of logs to not be sent because they were not required by law. So, yes, I regret I couldn't do more, but I don't regret the choices I made with the information I had and the position I was in.
- notRobot 4y ago
  Just a stranger on the internet, but FWIW I'm proud of you. You did what you could, and you're cognizant of your actions.
  - 052c7028e 4y ago
    Thank you.
- danuker 4y ago
  > I was powerless to stop it. You could have found a new job, driving up their costs or delaying them slightly.
  - notRobot 4y ago
    And what purpose would that have ultimately served?
    - danuker 4y ago

slim 4y ago

Thank you. This is very informative. And don't feel guilty, nobody will get jailed for visiting a website. This is mostly for censorship.

iopq 4y ago
There was a person in Beijing that was arrested for a post on Twitter. Government surveillance was able to track him down in real life, which I think is deeply troubling
- slim 4y ago
  That's a post not a visit
  - iopq 4y ago
    There's really nothing stopping them from going after people who use VPNs. What are Chinese people going to do? Protest?
nibbleshifter 4y ago
> This is mostly for censorship. As if that makes if any better?
jasonhansel 4y ago
This is kind of like saying, "don't feel guilty, this weapon won't be used for murder, it's mostly just for arson."

wcerfgba 4y ago

Thanks for sharing your story. I am curious what you would do next time if you found yourself asked to build something that you found unconscionable? Would you refuse to work on the project? Other engineering disciplines have a strong focus on 'engineering ethics' and it may be more acceptable in different branches of engineering to refuse to build something that you consider unethical. I do not know if there are any professional bodies or laws which protect the employment rights of individual engineers who refuse certain work on ethical bases. But I feel that software engineers should be able to exercise their conscience, reference a standard of professional ethical principles, and refuse to work on such projects.

pototo666 4y ago

If I use a VPN like v2ray and write some crazy shit about Dictator Xi, is your system able to know what I write and who I am? I'm very curious because many Chinese people including me are doing that daily.

ospider 4y ago
That what I do on a daily basis, so far so good, I haven't been seized by the police for what I published outside of the Great Fire Wall.

jeffrallen 4y ago

Akamai has very tight relations with the US Government. So what was probably happening is that the USG was fine with Akamai treating it's users like this because it was getting a copy of those URL filters and access logs too. Don't know if that should make you more in or less sorry for being involved. (It would make me more sorry. Sorry.)