7 ms·

Nukeproof: Manifesto for European Data Sovereignty

109 points by jamesblonde 9mo ago

nkoren 9mo ago
I absolutely appreciate and agree with the sentiment, but can't figure out what the proposition actually is. The thesis seems to be: "Here's a problem. We want to solve it." Aaaaaaaaaaaand ... that's it. Exactly how are you going to solve it? Or, if "exactly" is too much of an ask, could we at least have a "vaguely"? Seems like it needs more meat on the bones!
- kevin061 9mo ago
  Well, then join and help! I joined, waiting for you there :)
  - nkoren 9mo ago
    Glad you've done so. I'm at a point in my life (personal bandwidth hovering near 0%) where I'm not getting involved in anything unless I have not just a good reason ("this is a noble agenda; somebody should do something about it, and hey, I guess I'm a somebody"), but a damned specific reason ("I have unique capabilities which can help this specific initiative in this specific way"). Anyhow, in this particular domain, I'm pretty sure there are people who could be MUCH more useful contributors than I. I'd love to forward the "manifesto" to them -- except I know that they're in the same position as me: essentially zero bandwidth. Any new project they get involved with means dropping something else that's currently on their plate, and is presumably important. They're not going to do that on a lark. They'll need need a damned good reason to participate, before deciding to spend time on something new. To be honest, ANY real power-players will be in this position. They don't have free time on their hands; they won't just join up in the vague hope that maybe it'll be a place where things can happen. You will need power-players on-side, and without a much more specific proposition, you're not going to get them. But I'm glad you've joined. Job no. 1: that manifesto needs to do a lot more manifesting before it's fit for purpose!
- tucnak 9mo ago
  It says so on the tin. "Escape the chokehold of hyperscalers" is all that matters, really. Everything else will follow nicely from it. Compute density is so good these days, you don't even need major datacenter investment. There are modular DC designs that fit in a shipping container. You tow one around, connect power, fiber, cooling lines (to intercoolers in another shipping container) and that's it. You would be surprised how much can be accomplished with so very little. There are many advantages to this approach, like being able to bring up SCIF-equivalent inspectable spaces on the cheap, but considering we're all probably going to war sooner than later, it might as well become necessary. This is akin to how SAAB, and perhaps to a larger extent Ukraine, have changed airplane logistics. Unless you're a hyperscaler yourself, hyperscaling is overrated.
  - nkoren 9mo ago
    Great, now how do you make that actually happen at a political / regulatory / cultural level? It's already an uphill battle, because humans in large organisations seem to have an innately conservative bias which says that "nobody ever got fired for choosing ${giganticEvilStatusQuoCorporation}". That, combined with the fact that the US hyperscalars have, I dunno, hundreds of billions of dollars worth of ability to put their thumb on the political and regulatory scales, make this an uphill battle. There will need to be a specific plan for leveling the playing field. What is that plan?
self_awareness 9mo ago
The cookie banner code is broken, it doesn't show on my browser, making the website not react to cursors when scrolling, and mouse clicks aren't handled. I only knew there is a bad cookie banner when I've opened the website in another browser. Have mercy, webmasters.
- Piraty 9mo ago
  install ublock-origin, right-click on the element, choose the new 'block element...' option, preview, verify, create .done.
  - self_awareness 9mo ago
    I have ublock origin. It's impossible to use the internet without it. Removing the top layer works for fixing mouse clicks, but in cases like these I rather just drop the whole website without reading. I mean, if a project is not able to get a functioning website, then well...
- netfortius 9mo ago
  The site looks horrible in dark theme of multiple android browsers I tried, so I'll have to search for a TL;DR somewhere
Imustaskforhelp 9mo ago
I really like this idea but I have a few questions. Suppose I am an indian developer interested to work with European Data sovereignity because imo I value privacy personally just as much as the EU population and it would be great to be more connected and wishing to connect with them more. So I have thought of using EU options in my servers/services if I use them for the most part and I can even swap out to completely European if need be. So let's say to be a part of this? should I be an European company? If so, I even looked at it on how to establish a company in Europe rather easily (preferably a lean company) and It seems that Estonia seems the best way for me to create an EU company from my country without too much hassle but the costs of operation does feel like a lot for just starting out let's say. I am also not sure about the fact that given I live in India, Some data sharing arrangement can be generated or would I have to actually migrate to say EU (which although I love EU, I currently appreciate my country as well and migration is a hassle right now) I wish if such a manifesto could work for India and EU and a deeper integration could be made between the two countries about such tech related software or other as I have been a vocal supporter of European tech providers like hetzner,ovh etc. and they are even cheaper than american hyperscalers in many/most cases.
- josephg 9mo ago
  At its heart, this is about Europe for Europe. People from other countries “contributing” technology solutions to European businesses and government is what got Europe into the strange mess they’re in now. And there’s been a long line of foreign - American - businesses which have promised that European data will always stay on European soil. And it’s quite clear that promise was not always kept. I’m sure your desire to help is genuine. But Europe might need to find their own feet with an initiative like this before accepting help from foreigners.
  - whizzter 9mo ago
    I'd look at it in another way, hyperscalers exist due to code contributed from all around the world, often in the form of open source, Europe going closed and competing against the rest of the world (literally) isn't going to be a path forward. Clients of mine are on hyperscalers due to the ease of deployment,etc but they are focused on lock-in, if ease could be attained in combination with portability then an ecosystem could exist where mid-scaler providers (that exists in abundance in Europe) could have a better chance against the behemoths.
willtemperley 9mo ago
There's an immediate solution: local-first software. Keeping app data purely server-side is no longer viable for customers with data sovereignty requirements, and having a toggle button saying 'Keep my data in Europe' isn't enough either because it places too much trust in the SaaS provider. With network monitoring verifying local applications are accessing user-verified endpoints, privacy reduces to OS-level security.
- concinds 9mo ago
  Cool. That covers approximately 0% of the data out there. What about your health data? Government data? Corporate data? Financial data?
  - jszymborski 9mo ago
    Health data can reside within your hospital's network. Government data within your government's network. Etc,... I think the point is that your doctor or civil servant or local sushi shop shouldn't have to reach to AWS/GCP/Oracle each time they want to look up an MRI or building permit or loyalty points card status. "local" is a relative term here.
    - moi2388 9mo ago
      You don’t want hospitals to share data in case you are in another city and have to go to the hospital?
      - jszymborski 9mo ago
        Sure! I'm just talking about data residence. They can transfer data over the internet (or some inter-hospital network) no problem. It's just a matter of "local-first".
      - willtemperley 9mo ago
        The data should reside exactly where they’re needed and nowhere else. For the UK NHS that’s probably in a UK data centre run by a UK company. Not AWS. The fundamental problem with SaaS and pure server side applications is we do not know where the data are. With local first we can verify data locality.
sam_lowry_ 9mo ago
There seems to be a scrolling problem with this site. AI slop again?
- self_awareness 9mo ago
  I have the same problem. I think it's related to some disabled autoplay setting.
  - sam_lowry_ 9mo ago
    Cookie banner problem as the sibling comment says. So much for EU-something, riddled with EU-problems.
28304283409234 9mo ago
On a .org domain....
- sirdvd 9mo ago
  ...and on Cloudflare. So much for European Sovereignty.
  - jijijijij 9mo ago
    [flagged]
    - 372927352929 9mo ago
      Your vacuous drivel belongs on reddit.
BiteCode_dev 9mo ago
This is a good thing and a required first step, but it's a drop in the sea. All MacOS, iOS, Windows and Android are all produced by the USA. Virtually all chips as well. It is foolish to assume there are not backdoors in every one of them. Meaning we should assume the USA can shut down the entire Europe's IT if they really want to. Then you got the authentication systems, security software (antivirus, proxies like cloudflare, crowdstrike and so on), the various Saas (docs editors, drives, ticket systems, chats...), the payment systems (including Visa and swift, but also Paypal, google pay, stripe, etc), the software stores, the root DNS, the SSL root certificates and a ton of network hardware. Given the current political situation, it's a very bad spot to be in.

109 points by jamesblonde 9mo ago

I absolutely appreciate and agree with the sentiment, but can't figure out what the proposition actually is. The thesis seems to be: "Here's a problem. We want to solve it." Aaaaaaaaaaaand ... that's it. Exactly how are you going to solve it? Or, if "exactly" is too much of an ask, could we at least have a "vaguely"? Seems like it needs more meat on the bones!

kevin061 9mo ago
Well, then join and help! I joined, waiting for you there :)
- nkoren 9mo ago
  Glad you've done so. I'm at a point in my life (personal bandwidth hovering near 0%) where I'm not getting involved in anything unless I have not just a good reason ("this is a noble agenda; somebody should do something about it, and hey, I guess I'm a somebody"), but a damned specific reason ("I have unique capabilities which can help this specific initiative in this specific way"). Anyhow, in this particular domain, I'm pretty sure there are people who could be MUCH more useful contributors than I. I'd love to forward the "manifesto" to them -- except I know that they're in the same position as me: essentially zero bandwidth. Any new project they get involved with means dropping something else that's currently on their plate, and is presumably important. They're not going to do that on a lark. They'll need need a damned good reason to participate, before deciding to spend time on something new. To be honest, ANY real power-players will be in this position. They don't have free time on their hands; they won't just join up in the vague hope that maybe it'll be a place where things can happen. You will need power-players on-side, and without a much more specific proposition, you're not going to get them. But I'm glad you've joined. Job no. 1: that manifesto needs to do a lot more manifesting before it's fit for purpose!
tucnak 9mo ago
It says so on the tin. "Escape the chokehold of hyperscalers" is all that matters, really. Everything else will follow nicely from it. Compute density is so good these days, you don't even need major datacenter investment. There are modular DC designs that fit in a shipping container. You tow one around, connect power, fiber, cooling lines (to intercoolers in another shipping container) and that's it. You would be surprised how much can be accomplished with so very little. There are many advantages to this approach, like being able to bring up SCIF-equivalent inspectable spaces on the cheap, but considering we're all probably going to war sooner than later, it might as well become necessary. This is akin to how SAAB, and perhaps to a larger extent Ukraine, have changed airplane logistics. Unless you're a hyperscaler yourself, hyperscaling is overrated.
- nkoren 9mo ago
  Great, now how do you make that actually happen at a political / regulatory / cultural level? It's already an uphill battle, because humans in large organisations seem to have an innately conservative bias which says that "nobody ever got fired for choosing ${giganticEvilStatusQuoCorporation}". That, combined with the fact that the US hyperscalars have, I dunno, hundreds of billions of dollars worth of ability to put their thumb on the political and regulatory scales, make this an uphill battle. There will need to be a specific plan for leveling the playing field. What is that plan?

self_awareness 9mo ago

The cookie banner code is broken, it doesn't show on my browser, making the website not react to cursors when scrolling, and mouse clicks aren't handled. I only knew there is a bad cookie banner when I've opened the website in another browser. Have mercy, webmasters.

Piraty 9mo ago
install ublock-origin, right-click on the element, choose the new 'block element...' option, preview, verify, create .done.
- self_awareness 9mo ago
  I have ublock origin. It's impossible to use the internet without it. Removing the top layer works for fixing mouse clicks, but in cases like these I rather just drop the whole website without reading. I mean, if a project is not able to get a functioning website, then well...
netfortius 9mo ago
The site looks horrible in dark theme of multiple android browsers I tried, so I'll have to search for a TL;DR somewhere

Imustaskforhelp 9mo ago

I really like this idea but I have a few questions. Suppose I am an indian developer interested to work with European Data sovereignity because imo I value privacy personally just as much as the EU population and it would be great to be more connected and wishing to connect with them more. So I have thought of using EU options in my servers/services if I use them for the most part and I can even swap out to completely European if need be. So let's say to be a part of this? should I be an European company? If so, I even looked at it on how to establish a company in Europe rather easily (preferably a lean company) and It seems that Estonia seems the best way for me to create an EU company from my country without too much hassle but the costs of operation does feel like a lot for just starting out let's say. I am also not sure about the fact that given I live in India, Some data sharing arrangement can be generated or would I have to actually migrate to say EU (which although I love EU, I currently appreciate my country as well and migration is a hassle right now) I wish if such a manifesto could work for India and EU and a deeper integration could be made between the two countries about such tech related software or other as I have been a vocal supporter of European tech providers like hetzner,ovh etc. and they are even cheaper than american hyperscalers in many/most cases.

josephg 9mo ago
At its heart, this is about Europe for Europe. People from other countries “contributing” technology solutions to European businesses and government is what got Europe into the strange mess they’re in now. And there’s been a long line of foreign - American - businesses which have promised that European data will always stay on European soil. And it’s quite clear that promise was not always kept. I’m sure your desire to help is genuine. But Europe might need to find their own feet with an initiative like this before accepting help from foreigners.
- whizzter 9mo ago
  I'd look at it in another way, hyperscalers exist due to code contributed from all around the world, often in the form of open source, Europe going closed and competing against the rest of the world (literally) isn't going to be a path forward. Clients of mine are on hyperscalers due to the ease of deployment,etc but they are focused on lock-in, if ease could be attained in combination with portability then an ecosystem could exist where mid-scaler providers (that exists in abundance in Europe) could have a better chance against the behemoths.

willtemperley 9mo ago

There's an immediate solution: local-first software. Keeping app data purely server-side is no longer viable for customers with data sovereignty requirements, and having a toggle button saying 'Keep my data in Europe' isn't enough either because it places too much trust in the SaaS provider. With network monitoring verifying local applications are accessing user-verified endpoints, privacy reduces to OS-level security.

concinds 9mo ago
Cool. That covers approximately 0% of the data out there. What about your health data? Government data? Corporate data? Financial data?
- jszymborski 9mo ago
  Health data can reside within your hospital's network. Government data within your government's network. Etc,... I think the point is that your doctor or civil servant or local sushi shop shouldn't have to reach to AWS/GCP/Oracle each time they want to look up an MRI or building permit or loyalty points card status. "local" is a relative term here.
  - moi2388 9mo ago
    You don’t want hospitals to share data in case you are in another city and have to go to the hospital?
    - jszymborski 9mo ago
      Sure! I'm just talking about data residence. They can transfer data over the internet (or some inter-hospital network) no problem. It's just a matter of "local-first".
    - willtemperley 9mo ago
      The data should reside exactly where they’re needed and nowhere else. For the UK NHS that’s probably in a UK data centre run by a UK company. Not AWS. The fundamental problem with SaaS and pure server side applications is we do not know where the data are. With local first we can verify data locality.

sam_lowry_ 9mo ago

There seems to be a scrolling problem with this site. AI slop again?

self_awareness 9mo ago
I have the same problem. I think it's related to some disabled autoplay setting.
- sam_lowry_ 9mo ago
  Cookie banner problem as the sibling comment says. So much for EU-something, riddled with EU-problems.

28304283409234 9mo ago

On a .org domain....

sirdvd 9mo ago
...and on Cloudflare. So much for European Sovereignty.
- jijijijij 9mo ago
  [flagged]
  - 372927352929 9mo ago
    Your vacuous drivel belongs on reddit.

BiteCode_dev 9mo ago

This is a good thing and a required first step, but it's a drop in the sea. All MacOS, iOS, Windows and Android are all produced by the USA. Virtually all chips as well. It is foolish to assume there are not backdoors in every one of them. Meaning we should assume the USA can shut down the entire Europe's IT if they really want to. Then you got the authentication systems, security software (antivirus, proxies like cloudflare, crowdstrike and so on), the various Saas (docs editors, drives, ticket systems, chats...), the payment systems (including Visa and swift, but also Paypal, google pay, stripe, etc), the software stores, the root DNS, the SSL root certificates and a ton of network hardware. Given the current political situation, it's a very bad spot to be in.