7 ms·

AI is mentioned, but the scope is significantly larger if you read the fulltext.

kube-system 2y ago
Given that top GPUs are sanctioned, I'm sure preventing access to them remotely is a part of this. But just generally speaking, doing any malicious crap out of an EC2 instance is an easy way for a foreign actor in China/Russia/Iran to look more legit.
- Repulsion9513 2y ago
  As if they won't just use a stolen identity. And like usual the victim will never even find out because it won't show up on their credit report.
  - kube-system 2y ago
    Of course, people who want to circumvent laws will always attempt to do so. That doesn't mean all legal mitigations are useless.
    - Repulsion9513 2y ago
      Indeed it does not. But that also doesn't mean this legal mitigation is either useful or worthwhile.
lolinder 2y ago
It's still just for IaaS companies, though, right? Not that that makes this all okay, but it is a much more limited proposal than "internet services" makes it sound.
- chadsix 2y ago
  Legally speaking, internet service providers are infrastructure providers.
  - lolinder 2y ago
    Do you have a basis for this claim or are you just throwing it out there to see if it catches on? The document linked refers to IaaS, which as an acronym definitely does not include ISPs.
    - erie 2y ago
      Some AI services such as Synthesia https://www.synthesia.io https://www.synthesia.io › ethics " Your avatar can be created only with your explicit consent, following a thorough KYC-like procedure. Complete control: Our platform ensures you can decide"
    - chadsix 2y ago
      There are probably very few ISPs that can fall outside of this standard. For example if your provider provides e-mail, it's providing infrastructure. And yet, the slope can get much more slippery than this.
      - zinekeller 2y ago
        Please read EO 13894 before proceeding further. Is the user able to run custom software directly with a customary ISP (because that's in the definition)? I agree with EGreg that they can possibly twist this, but as written it's actually narrower than you think.
    - EGreg 2y ago
      In practice, as long as a definition can conceivably cover something, the DOJ or some agency will use it. Case in point from yesterday: money transmitter as applied to arresting the developers of a NON-CUSTODIAL wallet, as part of a wider war on crypto mixing: https://www.coindesk.com/policy/2024/04/24/samourai-wallet-founders-arrested-and-charged-with-money-laundering/ https://www.coindesk.com/policy/2024/04/24/samourai-wallet-f... This comes amid a war on end-to-end encryption, and so on. It's not like they are going to stop here.
      - deleted 2y ago
        [deleted]
- chlodwig 2y ago
  IaaS is defined as a provider of computing resources the allows you to run software that is not predefined. So that would seem to include basically every web host. If you can install Wordpress or Mastodon on the servers they provide, they are an IaaS.
axus 2y ago
I'm going to need another intelligence to read the full text. "U.S. IaaS providers and foreign resellers of U.S. IaaS products must exercise reasonable due diligence to ascertain the true identity of any customer or beneficial owner of an Account who claims to be a U.S. person." So at a minimum, everyone's identity is verified by IaaS provider. If you claim to be a non-U.S. person, additional information is collected. They mention looking at comments from a previous proposal in 2021, "Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities" https://www.federalregister.gov/documents/2021/09/24/2021-20430/taking-additional-steps-to-address-the-national-emergency-with-respect-to-significant-malicious https://www.federalregister.gov/documents/2021/09/24/2021-20... Who counts as IaaS besides Amazon, Azure, and GCS?
- OgsyedIE 2y ago
  Dreamhost, Wordpress, etc
  - EGreg 2y ago
    Literally every software that you can host. This effort will end anonymity on the internet. For everyone. Crypto was just the beginning. Next is end-to-end encryption. And it's going on worldwide, not just in USA: https://community.qbix.com/t/the-coming-war-on-end-to-end-encryption/214/ https://community.qbix.com/t/the-coming-war-on-end-to-end-en...
  - nonameiguess 2y ago
    This is not the industry-standard or NIST definitions of these terms. Something like Google Workspace Suite is Software as a Service. Something like Heroku (or Dreamhost or Wordpress) is Platform as a Service. Something like EC2 and S3 are Intrastructure as a Service. The distinction is renting out undifferentiated server space that a customer installs their own software onto. If you rent a VPS from Linode and install self-hosted Wordpress, that's IaaS. If you buy Wordpress's managed hosting, that's PaaS.
    - chlodwig 2y ago

Given that top GPUs are sanctioned, I'm sure preventing access to them remotely is a part of this. But just generally speaking, doing any malicious crap out of an EC2 instance is an easy way for a foreign actor in China/Russia/Iran to look more legit.

Repulsion9513 2y ago
As if they won't just use a stolen identity. And like usual the victim will never even find out because it won't show up on their credit report.
- kube-system 2y ago
  Of course, people who want to circumvent laws will always attempt to do so. That doesn't mean all legal mitigations are useless.
  - Repulsion9513 2y ago
    Indeed it does not. But that also doesn't mean this legal mitigation is either useful or worthwhile.

lolinder 2y ago

It's still just for IaaS companies, though, right? Not that that makes this all okay, but it is a much more limited proposal than "internet services" makes it sound.

chadsix 2y ago
Legally speaking, internet service providers are infrastructure providers.
- lolinder 2y ago
  Do you have a basis for this claim or are you just throwing it out there to see if it catches on? The document linked refers to IaaS, which as an acronym definitely does not include ISPs.
  - erie 2y ago
    Some AI services such as Synthesia https://www.synthesia.io https://www.synthesia.io › ethics " Your avatar can be created only with your explicit consent, following a thorough KYC-like procedure. Complete control: Our platform ensures you can decide"
  - chadsix 2y ago
    There are probably very few ISPs that can fall outside of this standard. For example if your provider provides e-mail, it's providing infrastructure. And yet, the slope can get much more slippery than this.
    - zinekeller 2y ago
      Please read EO 13894 before proceeding further. Is the user able to run custom software directly with a customary ISP (because that's in the definition)? I agree with EGreg that they can possibly twist this, but as written it's actually narrower than you think.
  - EGreg 2y ago
    In practice, as long as a definition can conceivably cover something, the DOJ or some agency will use it. Case in point from yesterday: money transmitter as applied to arresting the developers of a NON-CUSTODIAL wallet, as part of a wider war on crypto mixing: https://www.coindesk.com/policy/2024/04/24/samourai-wallet-founders-arrested-and-charged-with-money-laundering/ https://www.coindesk.com/policy/2024/04/24/samourai-wallet-f... This comes amid a war on end-to-end encryption, and so on. It's not like they are going to stop here.
    - deleted 2y ago
      [deleted]
chlodwig 2y ago
IaaS is defined as a provider of computing resources the allows you to run software that is not predefined. So that would seem to include basically every web host. If you can install Wordpress or Mastodon on the servers they provide, they are an IaaS.

axus 2y ago

I'm going to need another intelligence to read the full text. "U.S. IaaS providers and foreign resellers of U.S. IaaS products must exercise reasonable due diligence to ascertain the true identity of any customer or beneficial owner of an Account who claims to be a U.S. person." So at a minimum, everyone's identity is verified by IaaS provider. If you claim to be a non-U.S. person, additional information is collected. They mention looking at comments from a previous proposal in 2021, "Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities" https://www.federalregister.gov/documents/2021/09/24/2021-20430/taking-additional-steps-to-address-the-national-emergency-with-respect-to-significant-malicious https://www.federalregister.gov/documents/2021/09/24/2021-20... Who counts as IaaS besides Amazon, Azure, and GCS?

OgsyedIE 2y ago
Dreamhost, Wordpress, etc
- EGreg 2y ago
  Literally every software that you can host. This effort will end anonymity on the internet. For everyone. Crypto was just the beginning. Next is end-to-end encryption. And it's going on worldwide, not just in USA: https://community.qbix.com/t/the-coming-war-on-end-to-end-encryption/214/ https://community.qbix.com/t/the-coming-war-on-end-to-end-en...
- nonameiguess 2y ago
  This is not the industry-standard or NIST definitions of these terms. Something like Google Workspace Suite is Software as a Service. Something like Heroku (or Dreamhost or Wordpress) is Platform as a Service. Something like EC2 and S3 are Intrastructure as a Service. The distinction is renting out undifferentiated server space that a customer installs their own software onto. If you rent a VPS from Linode and install self-hosted Wordpress, that's IaaS. If you buy Wordpress's managed hosting, that's PaaS.
  - chlodwig 2y ago