8 ms·

SourceHut moves business operations from US to Europe

wyldfire 1y ago
The relevant portion of this change is the addition of "European" in "You must obey all local, US, European and Dutch laws ...", I guess? Not super clear from the link that's the case. Maybe sourcehut will make an explicit publication to this effect.
- diggan 1y ago
  > relevant portion of this change is the addition No, that was there before too. What's new is the legal address in the bottom, that now specifies Netherlands, and a KVK+BTW identifier. "-" prefix on a line in a diff indicates removals, "+" prefix indicates additions. But yeah, I'd expect them to also make some sort of announcement blog post explaining the change.
3D30497420 1y ago
This has been awhile in coming. They incorporated in the Netherlands a few years ago: https://sourcehut.org/blog/2022-10-31-tos-update-cryptocurrency/ https://sourcehut.org/blog/2022-10-31-tos-update-cryptocurre...
- bgwalter 1y ago
  The Netherlands is one of the most surveilled societies on earth. This is from 2016 and it has only gotten worse: https://www.irishtimes.com/news/world/europe/sweeping-surveillance-powers-planned-by-dutch-government-1.2615109 https://www.irishtimes.com/news/world/europe/sweeping-survei...
  - f_devd 1y ago
    This seems demonstrably false, e.g. GFW of China, and similar cases of effectively the entire country being under surveillance: https://www.statista.com/statistics/1290708/top-surveilled-countries-worldwide/ https://www.statista.com/statistics/1290708/top-surveilled-c...
    - thedevilslawyer 1y ago
      I mean if you have to give that as the only example, then GP's point stands very strong.
      - f_devd 1y ago
        It's really not worth my time finding the research for every single fallacious claim made; the Netherlands is not in the top 10 for physical or digital surveillance[0], nor is it likely get close to China or USA even if they wanted[1] [0]: https://www.tooltester.com/en/blog/the-worlds-most-surveilled-countries/ https://www.tooltester.com/en/blog/the-worlds-most-surveille... [1]: https://www.forbes.com/sites/emmawoollacott/2020/10/06/eu-court-limits-government-bulk-surveillance/ https://www.forbes.com/sites/emmawoollacott/2020/10/06/eu-co...
    - bgwalter 1y ago
      The Netherlands essentially has pre-crime units: https://www.theguardian.com/cities/2018/mar/01/smart-cities-data-privacy-eindhoven-utrecht https://www.theguardian.com/cities/2018/mar/01/smart-cities-... The city also keeps track of the number of young people hanging out in the streets, their age group, whether they know each other, the atmosphere and whether or not they cause a nuisance. Special enforcement officers keep track of this information through mobile devices. It calls this process “targeted and innovative supervision”. Other council documents mention the prediction of school drop-outs, the prediction of poverty and the monitoring of “the health of certain groups” with the aim of “intervening faster”.
      - f_devd 1y ago
        Except it's not actually being used anymore [0] with the original operations, scope and data all being documented publicly. That's the downside of referencing 7 year old articles. [0]: https://algoritmes.overheid.nl/en/algoritme/gm0344/78136377/hotspot-tackling-petty-crime https://algoritmes.overheid.nl/en/algoritme/gm0344/78136377/...
  - amiga386 1y ago
    SourceHut isn't under Dutch law because it's the best legal jurisdiction to run a code hosting service from. It's because the sole trader who runs this particular code hosting service personally moved to the Netherlands, so that's the easiest place for him to run his business from. Also, this diff does not say his business has left US jurisdiction: - before: "You must obey all local, US, and Dutch laws" - after: "You must obey all local, US, European, and Dutch laws and regulations"
    - diggan 1y ago
      > Also, this diff does not say his business has left US jurisdiction: That is true, but the commit message also says: > v2: rollback the premature removal of compliance with US law - Will defer this until we finish shutting down the US business entity entirely. So it seems leaving US jurisdiction is planned, it was just a bit premature so they temporarily rolled that particular change back.
  - bee_rider 1y ago
    The country with the most surveillance laws in the books and the most documented phone taps is probably not the most surveilled country on earth (at least, for the worst countries I expect law enforcement to just do whatever they want and not leave a paper trial because… why would they bother? Nobody is going to scrutinize them anyway). Of course, this puts the conversation in a tricky spot. The less-bad actors (no country is great in this context) should have the most well documented abuses, the worst will just do it without bookkeeping. So it is, unfortunately, a “prove a negative” sort of thing.
    - jeroenhd 1y ago
      I think the difference between the Netherlands and other countries is that the Netherlands is quite open about the amount of phone taps they place. You'd be crazy to think other countries don't tap phone lines at the same rate or worse. As bad as the surveillance situation here is, it's still better than the situation in the UK, of that I'm sure. Unfortunately, I can't find any very recent data about wiretaps in the UK. The 2023 report (https://ipco-wpmedia-prod-s3.s3.eu-west-2.amazonaws.com/E03270100-HC_603-IPCO-Annual-Report-2023-Web_Accessible.pdf https://ipco-wpmedia-prod-s3.s3.eu-west-2.amazonaws.com/E032...) shows a sharp rise in communications data applications (441,900 in 2023 alone) but those can range from single phone calls to months of data collection. The Dutch reports only claim 5397+1258 phone taps in 2024, but those don't say anything about their daily volume. If your government's wiretaps per capita is lower, double check that they're not using coded language to exclude most of their activities, and if the numbers are much lower, think twice before taking them for their word.
  - perching_aix 1y ago
    This is about drafted, pending changes to legislation. Did these changes actually go through, and do so unmodified?
bilekas 1y ago
Does anyone know the context around this ? It's not clear form the PR at all. Was there some US regulation/requirement that SH didn't agree with ?
- cess11 1y ago
  The political and regulatory climate in the US is quite volatile and has been for years, and perhaps they also disagree with the lack of data protection rights. They have a bit of an ethical track record where they've disallowed use of their services for crypto commodity projects and the like, for example.
  - simianwords 1y ago
    This doesn’t track at all. I’m not an expert but from what I heard startups are moving away from Europe not the other way round. It does seem to be a political or lifestyle choice as a sibling comment pointed out. Edit: I mean ideological not exactly political choice. >I have felt a kind of dissonance with my home country of the United States for a long time now, and I have found it very difficult to resolve. I am not of one mind with my peers in this country on many issues; social, economic, and political. Even limiting this inquiry to matters related to FOSS, it’s quite clear that the FOSS community in Europe is much stronger than in America. In the United States, capitalism is the secular religion, and my values, in FOSS and otherwise, are incompatible with the American ethos. Seems ideological to me.
    - simianwords 1y ago
      For people downvoting may I ask why? Isn’t it common knowledge that Netherlands is not the most favourable place to run a company?
      - bilekas 1y ago
        > I’m not an expert but from what I heard startups are moving away from Europe Where are you getting that info from ? There's more invesment that ever in EU startups. One I know of recently : https://www.eu-startups.com/2025/06/italian-publishing-house-zanichelli-editore-launches-e60-million-edtech-push-for-unlocking-human-potential/ https://www.eu-startups.com/2025/06/italian-publishing-house...
reisse 1y ago
I'd wish there were movement for the privacy-conscious services to escape any regulation, not just choose the currently-politically-correct one. Like piracy sites did in 00-10s (abuse-proof hosting in Ecuador, shady domain registrar from SEA, zero search indexing) or crypto companies now (net of shell companies where not a single one is responsible for anything). My point is, if you trust the company you're using, also trust it to use any means necessary to protect you from bad actors, don't rely on the laws here. Both the corporate and the state ones. If you don't trust it, don't give it anything you cannot afford to leak or lose. Specifically, EU data protection laws are good to protect regular customers from the big corporations, but they offer little protection against the EU (and the member states) themselves. And if the risk you're hedging against is "yourself turning to big corp and abusing customers" moving to EU is okay, but not in any other case.
- gwervc 1y ago
  [flagged]
  - oeitho 1y ago
    What are you talking about? Multiple EU countries have free speech written in their constituion. Article 5 in German basic law (their constitution): https://www.gesetze-im-internet.de/englisch_gg/englisch_gg.html https://www.gesetze-im-internet.de/englisch_gg/englisch_gg.h... (translated) 77th paragraph in the Danish constituion: https://www.thedanishparliament.dk/-/media/sites/ft/pdf/publikationer/the-constitutional-act-of-denmark.pdf https://www.thedanishparliament.dk/-/media/sites/ft/pdf/publ... (translated) Edit: the flagged comment I replied to claimed that no EU country had free speech in their constitution. This is objectively wrong, and is why I wrote my comment.
    - mslansn 1y ago
      Germany? Must be some dark joke. You know how many things can get you fined there?
      - 1y ago
tarkin2 1y ago
Any recommendations for cheap VPSs in Europe? The company should be basee in Europe, not just the server location.
- CalRobert 1y ago
  Ovh is fine
- homebrewer 1y ago
  Hetzner, Scaleway.
  - sigio 1y ago
    Can recommend both, but add netcup and layer7.net to those.
  - graemep 1y ago
    I tried a Scaleway dedi and it was very slow. Turned out storage IO was a problem. Just my experience with one product but it put me off them. Many smaller providers too.
- moooo99 1y ago
  To add to the other comments, had good experiences with Netcup and Contabo
  - nwellnhof 1y ago
    In the last years, many of the smaller German hosting companies were acquired by larger corporations. Netcup is owned by Anexia (Austria) now, Contabo was acquired by KKR (US), Hosteurope by Godaddy (US). If you're looking for hosting in the EU, you probably also want to avoid US-owned providers.
    - mcosta 1y ago
      > you probably also want to avoid US-owned providers. Why?
jl6 1y ago
I’m not sure which is worse, the impersonal, automated, regulatory padded cells of US gov/tech hegemons, or the potentially very personal attention of a local lord with very strong opinions[0]. [0] https://news.ycombinator.com/item?id=41837782 https://news.ycombinator.com/item?id=41837782
- amiga386 1y ago
  If you do read Drew DeVault's The Stallman Report, please also consider reading the rebuttal at https://stallmansupport.org/ https://stallmansupport.org/ and perhaps consider reading the DeVault Report at https://dmpwn.info/ https://dmpwn.info/
prasoon2211 1y ago
This makes sense. And this is only accelerating - I talk to businesses in Germany and there's a genuine, non-insignificant number of people who want their data to be /physically/ in Europe. Take this to its logical conclusion and basically, every company will need to segregate their data in regions. Most cloud platforms aren't really designed this way but it's coming. There was a data locality law that India passed and Stripe had to do this massive migration project to segregate this data. I shudder to imagine what a more complex system would look like under such data locality laws.
- CalRobert 1y ago
  I’m concerned about that being enough considering the CLOUD act. I want a company with no US ties

The relevant portion of this change is the addition of "European" in "You must obey all local, US, European and Dutch laws ...", I guess? Not super clear from the link that's the case. Maybe sourcehut will make an explicit publication to this effect.

diggan 1y ago
> relevant portion of this change is the addition No, that was there before too. What's new is the legal address in the bottom, that now specifies Netherlands, and a KVK+BTW identifier. "-" prefix on a line in a diff indicates removals, "+" prefix indicates additions. But yeah, I'd expect them to also make some sort of announcement blog post explaining the change.

3D30497420 1y ago

This has been awhile in coming. They incorporated in the Netherlands a few years ago: https://sourcehut.org/blog/2022-10-31-tos-update-cryptocurrency/ https://sourcehut.org/blog/2022-10-31-tos-update-cryptocurre...

bgwalter 1y ago
The Netherlands is one of the most surveilled societies on earth. This is from 2016 and it has only gotten worse: https://www.irishtimes.com/news/world/europe/sweeping-surveillance-powers-planned-by-dutch-government-1.2615109 https://www.irishtimes.com/news/world/europe/sweeping-survei...
- f_devd 1y ago
  This seems demonstrably false, e.g. GFW of China, and similar cases of effectively the entire country being under surveillance: https://www.statista.com/statistics/1290708/top-surveilled-countries-worldwide/ https://www.statista.com/statistics/1290708/top-surveilled-c...
  - thedevilslawyer 1y ago
    I mean if you have to give that as the only example, then GP's point stands very strong.
    - f_devd 1y ago
      It's really not worth my time finding the research for every single fallacious claim made; the Netherlands is not in the top 10 for physical or digital surveillance[0], nor is it likely get close to China or USA even if they wanted[1] [0]: https://www.tooltester.com/en/blog/the-worlds-most-surveilled-countries/ https://www.tooltester.com/en/blog/the-worlds-most-surveille... [1]: https://www.forbes.com/sites/emmawoollacott/2020/10/06/eu-court-limits-government-bulk-surveillance/ https://www.forbes.com/sites/emmawoollacott/2020/10/06/eu-co...
  - bgwalter 1y ago
    The Netherlands essentially has pre-crime units: https://www.theguardian.com/cities/2018/mar/01/smart-cities-data-privacy-eindhoven-utrecht https://www.theguardian.com/cities/2018/mar/01/smart-cities-... The city also keeps track of the number of young people hanging out in the streets, their age group, whether they know each other, the atmosphere and whether or not they cause a nuisance. Special enforcement officers keep track of this information through mobile devices. It calls this process “targeted and innovative supervision”. Other council documents mention the prediction of school drop-outs, the prediction of poverty and the monitoring of “the health of certain groups” with the aim of “intervening faster”.
    - f_devd 1y ago
      Except it's not actually being used anymore [0] with the original operations, scope and data all being documented publicly. That's the downside of referencing 7 year old articles. [0]: https://algoritmes.overheid.nl/en/algoritme/gm0344/78136377/hotspot-tackling-petty-crime https://algoritmes.overheid.nl/en/algoritme/gm0344/78136377/...
- amiga386 1y ago
  SourceHut isn't under Dutch law because it's the best legal jurisdiction to run a code hosting service from. It's because the sole trader who runs this particular code hosting service personally moved to the Netherlands, so that's the easiest place for him to run his business from. Also, this diff does not say his business has left US jurisdiction: - before: "You must obey all local, US, and Dutch laws" - after: "You must obey all local, US, European, and Dutch laws and regulations"
  - diggan 1y ago
    > Also, this diff does not say his business has left US jurisdiction: That is true, but the commit message also says: > v2: rollback the premature removal of compliance with US law - Will defer this until we finish shutting down the US business entity entirely. So it seems leaving US jurisdiction is planned, it was just a bit premature so they temporarily rolled that particular change back.
- bee_rider 1y ago
  The country with the most surveillance laws in the books and the most documented phone taps is probably not the most surveilled country on earth (at least, for the worst countries I expect law enforcement to just do whatever they want and not leave a paper trial because… why would they bother? Nobody is going to scrutinize them anyway). Of course, this puts the conversation in a tricky spot. The less-bad actors (no country is great in this context) should have the most well documented abuses, the worst will just do it without bookkeeping. So it is, unfortunately, a “prove a negative” sort of thing.
  - jeroenhd 1y ago
    I think the difference between the Netherlands and other countries is that the Netherlands is quite open about the amount of phone taps they place. You'd be crazy to think other countries don't tap phone lines at the same rate or worse. As bad as the surveillance situation here is, it's still better than the situation in the UK, of that I'm sure. Unfortunately, I can't find any very recent data about wiretaps in the UK. The 2023 report (https://ipco-wpmedia-prod-s3.s3.eu-west-2.amazonaws.com/E03270100-HC_603-IPCO-Annual-Report-2023-Web_Accessible.pdf https://ipco-wpmedia-prod-s3.s3.eu-west-2.amazonaws.com/E032...) shows a sharp rise in communications data applications (441,900 in 2023 alone) but those can range from single phone calls to months of data collection. The Dutch reports only claim 5397+1258 phone taps in 2024, but those don't say anything about their daily volume. If your government's wiretaps per capita is lower, double check that they're not using coded language to exclude most of their activities, and if the numbers are much lower, think twice before taking them for their word.
- perching_aix 1y ago
  This is about drafted, pending changes to legislation. Did these changes actually go through, and do so unmodified?

bilekas 1y ago

Does anyone know the context around this ? It's not clear form the PR at all. Was there some US regulation/requirement that SH didn't agree with ?

cess11 1y ago
The political and regulatory climate in the US is quite volatile and has been for years, and perhaps they also disagree with the lack of data protection rights. They have a bit of an ethical track record where they've disallowed use of their services for crypto commodity projects and the like, for example.
- simianwords 1y ago
  This doesn’t track at all. I’m not an expert but from what I heard startups are moving away from Europe not the other way round. It does seem to be a political or lifestyle choice as a sibling comment pointed out. Edit: I mean ideological not exactly political choice. >I have felt a kind of dissonance with my home country of the United States for a long time now, and I have found it very difficult to resolve. I am not of one mind with my peers in this country on many issues; social, economic, and political. Even limiting this inquiry to matters related to FOSS, it’s quite clear that the FOSS community in Europe is much stronger than in America. In the United States, capitalism is the secular religion, and my values, in FOSS and otherwise, are incompatible with the American ethos. Seems ideological to me.
  - simianwords 1y ago
    For people downvoting may I ask why? Isn’t it common knowledge that Netherlands is not the most favourable place to run a company?
    - bilekas 1y ago
      > I’m not an expert but from what I heard startups are moving away from Europe Where are you getting that info from ? There's more invesment that ever in EU startups. One I know of recently : https://www.eu-startups.com/2025/06/italian-publishing-house-zanichelli-editore-launches-e60-million-edtech-push-for-unlocking-human-potential/ https://www.eu-startups.com/2025/06/italian-publishing-house...

reisse 1y ago

I'd wish there were movement for the privacy-conscious services to escape any regulation, not just choose the currently-politically-correct one. Like piracy sites did in 00-10s (abuse-proof hosting in Ecuador, shady domain registrar from SEA, zero search indexing) or crypto companies now (net of shell companies where not a single one is responsible for anything). My point is, if you trust the company you're using, also trust it to use any means necessary to protect you from bad actors, don't rely on the laws here. Both the corporate and the state ones. If you don't trust it, don't give it anything you cannot afford to leak or lose. Specifically, EU data protection laws are good to protect regular customers from the big corporations, but they offer little protection against the EU (and the member states) themselves. And if the risk you're hedging against is "yourself turning to big corp and abusing customers" moving to EU is okay, but not in any other case.

gwervc 1y ago
[flagged]
- oeitho 1y ago
  What are you talking about? Multiple EU countries have free speech written in their constituion. Article 5 in German basic law (their constitution): https://www.gesetze-im-internet.de/englisch_gg/englisch_gg.html https://www.gesetze-im-internet.de/englisch_gg/englisch_gg.h... (translated) 77th paragraph in the Danish constituion: https://www.thedanishparliament.dk/-/media/sites/ft/pdf/publikationer/the-constitutional-act-of-denmark.pdf https://www.thedanishparliament.dk/-/media/sites/ft/pdf/publ... (translated) Edit: the flagged comment I replied to claimed that no EU country had free speech in their constitution. This is objectively wrong, and is why I wrote my comment.
  - mslansn 1y ago
    Germany? Must be some dark joke. You know how many things can get you fined there?
    - 1y ago

tarkin2 1y ago

Any recommendations for cheap VPSs in Europe? The company should be basee in Europe, not just the server location.

CalRobert 1y ago
Ovh is fine
homebrewer 1y ago
Hetzner, Scaleway.
- sigio 1y ago
  Can recommend both, but add netcup and layer7.net to those.
- graemep 1y ago
  I tried a Scaleway dedi and it was very slow. Turned out storage IO was a problem. Just my experience with one product but it put me off them. Many smaller providers too.
moooo99 1y ago
To add to the other comments, had good experiences with Netcup and Contabo
- nwellnhof 1y ago
  In the last years, many of the smaller German hosting companies were acquired by larger corporations. Netcup is owned by Anexia (Austria) now, Contabo was acquired by KKR (US), Hosteurope by Godaddy (US). If you're looking for hosting in the EU, you probably also want to avoid US-owned providers.
  - mcosta 1y ago
    > you probably also want to avoid US-owned providers. Why?

jl6 1y ago

I’m not sure which is worse, the impersonal, automated, regulatory padded cells of US gov/tech hegemons, or the potentially very personal attention of a local lord with very strong opinions[0]. [0] https://news.ycombinator.com/item?id=41837782 https://news.ycombinator.com/item?id=41837782

amiga386 1y ago
If you do read Drew DeVault's The Stallman Report, please also consider reading the rebuttal at https://stallmansupport.org/ https://stallmansupport.org/ and perhaps consider reading the DeVault Report at https://dmpwn.info/ https://dmpwn.info/

prasoon2211 1y ago

This makes sense. And this is only accelerating - I talk to businesses in Germany and there's a genuine, non-insignificant number of people who want their data to be /physically/ in Europe. Take this to its logical conclusion and basically, every company will need to segregate their data in regions. Most cloud platforms aren't really designed this way but it's coming. There was a data locality law that India passed and Stripe had to do this massive migration project to segregate this data. I shudder to imagine what a more complex system would look like under such data locality laws.

CalRobert 1y ago
I’m concerned about that being enough considering the CLOUD act. I want a company with no US ties