15 ms·

Tell HN: Docker pull fails in Spain due to football Cloudflare block

• sigio 6mo ago
  Time to use a VPN in your docker pipelines ;) Or run your systems outside of Spain. Or can this be avoided by using an alternate DNS?
  • darkwater 6mo ago
    They are planning to also block VPN providers during football matches, see https://www.techradar.com/vpn/vpn-privacy-security/la-liga-wins-court-order-requiring-nordvpn-and-proton-vpn-to-block-illegal-football-streams-in-spain-but-vpn-firms-say-they-have-not-been-notified https://www.techradar.com/vpn/vpn-privacy-security/la-liga-w...
    • prmoustache 6mo ago
      When talking about VPNs, it doesn't have to mean "third party VPN". You can host your own on any VPN service outside of Spain.
      • darkwater 6mo ago
        Yes, but that's not something many can do easily. Also already having to use a VPN is not the "right" solution. The right so solution is to beat some sense inside some politician's head, and force them to write and approve laws that don't let stupid (or conniving) judges pass orders like this one we are talking about.
        • prmoustache 6mo ago
          I agree it is not the right solution. But anyone who is pulling docker images in a sunday afternoon while the rest of the country is glued to their screen to watch a football game or enjoying a sunny sunday outside having beers and tapas and what not should be capable of setting up wireguard.
        • marginalia_nu 6mo ago
          Given the context of the HN audience, it's probably something you can do.
          • darkwater 6mo ago
            I wasn't strictly speaking about HNers. Using NordVPN and the likes is already done by slightly savvier users. Just look at where those products are advertised. Spinning up and provision a VPS to act as a VPN exit node in some other country raises the bar 10x or more.
        • msh 6mo ago
          It takes very light technical skills to deploy algo
    • Mordisquitos 6mo ago
  • skgsergio 6mo ago
    Alternate DNS doesn't help, they block at IP level. Yes, they block IPs belonging to CDNs (CF including R2, BunnyCDN, CDN77, Fastly, Alibaba, Akamai even)...
  • littlecranky67 6mo ago
    It is not a DNS based block, but on the IP level. Once I knew what caused the issue, I figured I use one of my Hetzner vServers as an exit node in tailscale. But come on, this can't be true. I wonder how many other people in IT wasted hours on issues and tickets to find out it is due to a football match taking place. Admittedly, chances are low, as football matches are usually outside of office hours.
  • gred 6mo ago
    > run your systems outside of Spain So much for digital sovereignty :-)
• vaylian 6mo ago
  This is a know issue and it is completely fucked up: https://www.techradar.com/vpn/vpn-privacy-security/cloudflare-wants-to-fix-spains-blocking-of-illegal-football-streams-ahead-of-next-laliga-season https://www.techradar.com/vpn/vpn-privacy-security/cloudflar... What Spain does is basically censorship and it's very poorly executed. The docker image registry is only one out of the many collateral victims of this stupid law.
  • embedding-shape 6mo ago
    > What Spain does is basically censorship and it's very poorly executed Basically? It is censorship, with huge collateral damage and regardless of how much we complain or share evidence that the blocks are actually financially harming us, no one seems to care as long as La Liga gets to freely block whatever hoster of websites as they wish.
    • ryandrake 6mo ago
      It's just like the Great Firewall of China, except in service of football profits instead of political ideology. I don't know which one is dumber and more disgraceful.
      • embedding-shape 6mo ago
        I wouldn't say "instead of", just "also", these "football blocks" are not the first cases of censorship of the internet in Spain. womenonweb.org for example was inaccessible for years, just unblocked some years ago. During the latest Catalan independence referendum, the Spanish government blocked a bunch of websites, not the very least the official website of the referendum itself. This is just one of the most recent cases, and so far the one with widest regular impact.
• utrack 6mo ago
  They block the whole of Cloudflare R2, I believe the Docker hub is just (heh) a collateral. When the La Liga match starts, everything that's proxied via CF (including zero access reverse tunnels) stops working. There's even a website made for checking if the match is on: https://hayahora.futbol/ https://hayahora.futbol/ You can check if your host is affected: https://hayahora.futbol/#comprobador&domain=docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com https://hayahora.futbol/#comprobador&domain=docker-images-pr...
  • mr_mitm 6mo ago
    Why do they do that? Sorry, I don't speak Spanish.
    • deleted 6mo ago
      [deleted]
    • ShowalkKama 6mo ago
      to """"""""""prevent piracy""""""""""
    • quadrifoliate 6mo ago
      Here's a good English-language article about it, with a timeline: https://daniel.es/blog/cloudflare-vs-la-liga/ https://daniel.es/blog/cloudflare-vs-la-liga/ Looks like same old regulatory capture.
      • maest 6mo ago
        Also, a classic tweet from the Cloudflare CEO re their fight with Italians authorities re censorship: https://xcancel.com/eastdakota/status/2009654937303896492 https://xcancel.com/eastdakota/status/2009654937303896492 Everyone looks bad in this conflict.
        • post-it 6mo ago
          How does this make Matthew look bad?
• jimaek 6mo ago
  Off topic but I wonder when Cloudflare is going to launch their own Docker registry as a product.
  • vaylian 6mo ago
    What would the business case be?
    • jimaek 6mo ago
      Capture developers and funnel them to the Workers platform
  • ImJasonH 6mo ago
    It's pretty easy to write your own. I made this one a while ago: https://github.com/chainguard-dev/crow-registry https://github.com/chainguard-dev/crow-registry
  • wqtz 6mo ago
    Well, Cloudflare does not launch anything. They acquire to build products. Look into all their recent product launches. They acquired a relatively small company and converted the founding team to a product team. So, if you want them to build stuff, ask yourself, are there any "Docker Registry" startups out there. If jsdelivr/globalping is not keeping you busy enough... there is an idea
    • jimaek 6mo ago
      Honestly I would build it if I knew how to properly market it to quickly get users. Globalping and jsDelivr took years to gain a meaningful user base
      • wqtz 6mo ago
        I do not think that is the issue. The recent acquisitions from all these big tech companies did not have any "meaningful" user base to begin with. I think your name alone carries significant weight in the industry and you have built a very large community. If you even vibe code something with, you will get a stupid amount of money thrown at you and a contract that bounds your existing projects and the next 3-5 years to a particular company as project lead. Here is a list of acquisitions Cloudflare made recently: https://blog.cloudflare.com/tag/acquisitions/ https://blog.cloudflare.com/tag/acquisitions/ Most of these companies did not have a half dozen paying customer or even a fully fleshed-out product before they were acquired.
• ahachete 6mo ago
  Yeah, I know. Welcome to the club :( https://x.com/ahachete/status/2035783292549755228 https://x.com/ahachete/status/2035783292549755228
• mathfailure 6mo ago
  Cloudflare is cancer. And the tumor is now too big.
  • deleted 6mo ago
    [deleted]
  • Cpoll 6mo ago
    You've got it backwards. Spain's ISPs are blocking Cloudflare and other CDNs because of LaLiga/football piracy. CloudFlare isn't doing anything here.
    • sph 6mo ago
      You are correct, but Cloudflare is still a cancer on the Internet.
      • petcat 6mo ago
        Rampant bot traffic and scrapers are the real cancer. Until that goes away everyone is going to need cloudflare or some other bot firewall service.
        • Duwensatzaj 6mo ago
          It won’t. Some people are perfectly happy to destroy and destroy as long as they get some small portion as profit for themselves.
          • sph 6mo ago
            That, ironically, includes Cloudflare. Without rampant bots making the internet worse for everybody, they wouldn't have as much work. And their portion of profit is anything but small.
        • adrian_b 6mo ago
          Perhaps that is true, but the Cloudflare anti-bot protection is too stupid and annoying. They should have used a cookie or something else that does not require asking me every few minutes to prove once more that I am not a bot. There was a time when Cloudflare had become less intrusive, but for the last months it has begun again to intervene almost each time when opening some pages. There is no doubt that anti-bot protection can be implemented in a better way than Cloudflare does, but presumably the alternatives would consume more resources on their servers, so probably they choose whatever minimizes their costs, regardless if that ensures maximum discomfort for Internet users.
• anthk 6mo ago
  Yea, La Liga it's crapping out as always. Docker needs either some I2P gateway, or a Tor service.
  • fc417fc802 6mo ago
    The pirate streams need an I2P service that way LaLiga might give up.
• anthk 6mo ago
  CF could just sue LaLiga and the judge as interrupting and intercepting telecomms it's a really serious crime in Spain. Call the AEPD too because of consumers' right against both ISP and LaLiga's snooping. Another huge fine. This is not an issue under the civil code (civilian issues), but something to be dealt under penal (criminal) code. In Spanish https://www.fiscal.es/memorias/memoria2020/FISCALIA_SITE/recursos/pdf/anexos/Circ_2.pdf https://www.fiscal.es/memorias/memoria2020/FISCALIA_SITE/rec... Oh, and BTW, LaLiga has just partnered with a CF rival. Now CF can just sue both like hell because of unfair competition: https://nitter.tiekoetter.com/xataka/status/2042658662850724150#m https://nitter.tiekoetter.com/xataka/status/2042658662850724...
  • quadrifoliate 6mo ago
    Looks like they already tried to appeal the block, and lost: https://x.com/jaumepons/status/1904906677335245294 https://x.com/jaumepons/status/1904906677335245294
    • buzer 6mo ago
      They could potentially file the suit against Spain in European Court of Human Rights if they have exhausted national remedies. ECtHR has previously ruled some blocks to be illegal, but generally in the context where country sought the ban. Of course in both cases Court is the one that actually orders the ban. One relevant would be Yildirim v. Turkey where court ordered blocking access to all Google sites because there was one that where someone insulted the memory of Atatürk. This was due to request from Telecommunications Directorate. This then caused the appellant's website to get blocked as well. Another one would be Vladimir Kharitonov v. Russia.
      • deleted 6mo ago
        [deleted]
  • prmoustache 6mo ago
    I think they are doing it already.
• pjc50 6mo ago
  This is why technology businesses and professionals need to take a little bit of an active role in local politics. Otherwise you get nonsense.
  • DocTomoe 6mo ago
    That's an interesting euphenism for 'spend a massive amount of money on ~~corruption~~ lobbying',
    • lentil_soup 6mo ago
      not necesarilly, any government will make decisions, if there's no one to speak up and inform them why the decision is stupid, like the one from LaLiga, then we end up in this situation
      • afh1 6mo ago
        This is incredibly naive.
        • lentil_soup 6mo ago
          ok, then what do you suggest? we don't get involved and decisions at the government level are made for us? I might be naive, but let's not be restrained by the cynicism of any involment in politics and governance is corruption
        • embedding-shape 6mo ago
          What? This is how governance and public opinion happen, at least in Spain. Government does something bad? Everyone out on the streets to complain, and calling politicians to change their mind. Sometimes it works, sometimes it does not, but doing nothing is never an option if you disagree with what they're doing. To think that doing nothing is better than something, that's incredibly naive.
          • ryandrake 6mo ago
• deleted 6mo ago
  [deleted]
• danirod 6mo ago
  Heh, lucky you, at least you get a message. My ISP just drops traffic to the affected IPs. No ping, no traceroute, just a spinner in the browser until it says "page not found". Every response and comment from LaLiga, the football organization responsible for this, has been so far that this is a minor issue that only affects a few bunch of nerds who talk about "docker images" or "github repositories" or "whatever that means". Meanwhile, there are testimonies of smart home devices like anti-theft alarms or automatic doors, that stop working whenever there is a football match, because their backends rely on Cloudflare. Last week, a woman asked for help on social media, as the GPS tracking app she uses to see where her father with dementia is, went offline during a match. It was getting late and he still wasn't back home, and she couldn't locate the tag he was wearing to find him: https://www.infobae.com/america/agencias/2026/04/05/laliga-desmiente-que-sus-sistemas-antipirateria-hayan-hecho-fallar-un-dispositivo-de-localizacion-personal/ https://www.infobae.com/america/agencias/2026/04/05/laliga-d... It's hard to say this, because no one should experience an event like this, but as stressful as these are, it's the only way to make the mainstream people care about this censorship. "I cannot pull a docker image" will never be on nightly news, but safety and personal security is a more powerful driver for discourses.
  • freetanga 6mo ago
    All people affected should file a complaint with your ISP and with Oficina de Atención al Usuario de Telecomunicaciones claiming financial loss for arbitrary service censorship.
    • pixl97 6mo ago
      Yep, flood them with complaints.
    • bakugo 6mo ago
      Sadly, it won't accomplish anything. La Liga seems to have enough political power in the country to bury all of that. Probably bribing everyone involved.
      • cluckindan 6mo ago
• mrvaibh 6mo ago
  This is a great example of why blanket IP blocking is such a terrible enforcement mechanism. Cloudflare hosts hundreds of thousands of services behind shared IP ranges — blocking one IP to stop a piracy stream takes out everything else on that IP, including Docker registries, API endpoints, and CDNs that have nothing to do with football. The real fix on your end until Spain sorts this out: set up a pull-through registry cache (e.g. registry:2 with proxy.remoteurl) on a VPS outside Spain, and point your Docker daemon's mirror config at it. Your GitLab runner pulls from the cache, the cache pulls from Docker Hub via a non-blocked IP. Also insulates you from Docker Hub rate limits. But yeah, the fact that a court order about football streaming can break docker pull for an entire country is genuinely absurd.
  • tom1337 6mo ago
    just wait until they block Azure as well so the official La Liga site also stops working
    • joquarky 6mo ago
      Sounds like the answer here is to host alt streams on Azure.
    • jacquesm 6mo ago
      Hmmm. Don't they have a reporting form or something like that? Down with those filthy Azure pirates on IP 52.166.113.188.
      • hunterpayne 6mo ago
        Starting a new business I see...this actually seems like the best form of protest here so good luck to you.
    • littlecranky67 6mo ago
      I wondered how they actually managed to have their own business to be unencumbered by that. At a certain corporate level, you have to have some piece of tech in your portfolio that relies on cloudflare. I hope one day there companion or "2nd screen" apps stops working during a game, because using cloudflare.
• richwater 6mo ago
  Spain is a failing country. Their economy is in shambles and the government has ceded internet control to a private corporation who runs football games.
  • gruez 6mo ago
    >Their economy is in shambles But it's among the fastest growing in the EU? Granted, part of this is starting from a low base, but it's hardly "in shambles" https://data.worldbank.org/indicator/NY.GDP.PCAP.KD.ZG?locations=EU&most_recent_value_desc=true https://data.worldbank.org/indicator/NY.GDP.PCAP.KD.ZG?locat...
    • nslsm 6mo ago
      They are doing this by artificially inflating the numbers, destroying the country forever: https://i.imgur.com/0MAeFaF.jpg https://i.imgur.com/0MAeFaF.jpg
      • gruez 6mo ago
        >total population change in EU countries The figures I cited are for GDP per capita, which accounts for population growth. Moreover immigration should have the opposite effect of depressing per-capita GDP, because immigrants typically take lower skilled jobs, dragging overall productivity down. So if anything, the figures are artificially depressed, not inflated.
        • hunterpayne 6mo ago
          You should read down that table a bit. Sure the Spanish economy had higher growth rates the last couple of years. The way they managed to have a higher rate was to have the economy shrink by 8% in 2023. So according to my math, the estimated size of the Spanish economy in 2026 is about the same as the 2023 Spanish economy (within 1%). Hard to claim that as a win. Technically you can say that they have been in a depression for the last 4 years and counting as their functional growth rate (accounting for inflation of the Euro) is negative over that period (down about 10% inflation adjusted).
• Jare 6mo ago
  It's a disgrace, but apparently all relevant forces still consider soccer the most important thing in the country.
• renewiltord 6mo ago
  [flagged]
  • post-it 6mo ago
    It's not just docker and tech. Plenty of people depend on tools that use Cloudflare.
    • renewiltord 6mo ago
      And when you are on your deathbed you will say “I wish I had spent more time on Cloudflare-based products”? I doubt it. No peer-reviewed research has shown people say that.
  • Synthetic7346 6mo ago
    This comment has some "you should smile more" energy
    • renewiltord 6mo ago
      Smile more. Touch grease. Roll coal.
  • embedding-shape 6mo ago
    Telling someone what to do is even more American, let people do whatever they want, at the times they want, as long as they don't hurt others, this is the Spanish way.
    • renewiltord 6mo ago
      Touché. Or should I say “me has tocado señor”. Probably not but it would be funny.
• jcalvinowens 6mo ago
  This is the moral equivalent of shutting the water off for a whole city because one dude's house has a leak. The harms to society clearly and obviously outweigh any possible benefits to society. But if that one dude has the power to shut it all off, and doesn't care...
  • spwa4 6mo ago
    [flagged]
    • Ikatza 6mo ago
      Just so everyone here has the full picture: the source linked — Assemblea Nacional Catalana — is not a human rights watchdog, an international observer, or a journalistic outlet. It is the main pro-independence criminal activist organization in Catalonia. Citing them as evidence of Spanish human rights abuses is a bit like citing the murderer's wife as an impartial witness. For context, Spain is a full constitutional democracy, subject to the jurisdiction of the European Court of Human Rights, with a free(ish) press, independent judiciary, and regular elections — none of which Assemblea itself disputes, because it participates in all of them. The events OP is referencing (the 2017 independence referendum aftermath) were reviewed by European courts, and the outcomes were, shall we say, not quite the narrative Assemblea sells on its website. If there are genuine, documented human rights concerns, I'd welcome impartial sources from the Supreme Court or the ECHR. What I'd push back on is treating a political lobby's own press releases as neutral reporting. You should do better than that here, OP.
      • spwa4 6mo ago
        Or to put it another way: Catalunya (Barcelona and surroundings) is one of 3 Spanish regions that want to break away from Spain, not counting overseas territories. And yes, the population really wants this: there was a referendum and the outcome was: 92% want out of Spain. https://en.wikipedia.org/wiki/2017_Catalan_independence_referendum https://en.wikipedia.org/wiki/2017_Catalan_independence_refe... (why? Let's be honest: Catalunya would benefit enormously from independence, but when the economy goes well, as it did from 2001-2007, they're fine. After that the situation worsened again. The situation is simple: Catalunya has a much better economy than Spain and could maintain government spending, whereas being part of Spain, they need to cut social spending) The Spanish government has violently repressed this, attacked the people, arrested politicians, tried to threaten other EU nations with invasion (yes, seriously, the current government has a few "rough edges", even if I would agree if someone said that any other party would be worse) unless they arrest Catalunya politicians (then did nothing when they told them to go f themselves), and this mostly with the agreement of regular Spaniards. Given what is happening in the EU (10+ years of slowly but unrelentingly worsening economy) the situation is slowly worsening again.
• torben-friis 6mo ago
  As a Spaniard, I would be very happy it cloudflare stops serving Spain. The situation is beyond stupid and I know without international pressure and shaming we're not getting rid of this abuse.
  • littlecranky67 6mo ago
    They should at least do a single "awareness day" during which they block the same IPs and sites they are ordered by court, as if there was a football match on. Ideally with a 7 days public notice announcement. Probably won't happen though, as their contractual obligation won't allow for voluntary suspension of services.
  • pier25 6mo ago
    As a Spaniard I couldn't agree more. This situation is just absolutely ridiculous.
• yangm97 6mo ago
  Maybe it’s time to reflect upon the reliance on centralized services? Not long ago docker hub started rate limiting access and we all turned to blanket solutions like the GitLab registry cache. I wonder if the IPFS distributed docker registry thing still exists/works.
  • tabwidth 6mo ago
    This isn't really about centralization. ISPs are blocking at the IP level, not Docker Hub specifically. You could self-host a registry behind Cloudflare and still run into the same thing.
    • rrr_oh_man 6mo ago
      "Behind Cloudflare" is the centralisation part
    • yangm97 6mo ago
      Self-hosting a registry is objectively “less bad” than relying entirely on docker hub but, unless all your Dockerfiles start with `FROM scratch` you’ll still need access to Docker Hub to pull the base images and their updates, and that’s true regardless of how many people are running their own registries. If instead of relying on a centralized registry, which just so happens to also depend on a centralized CDN, you could instead pull images using something like IPFS or even torrent, not only ISP IP banlists wouldn’t be an issue but you would also eliminate a whole bunch of failure modes from the system.
      • matt_kantor 6mo ago
        I posted another comment[0] about this, but if you already have the images locally then you can push them directly to the target server without needing a separate registry. [0]: https://news.ycombinator.com/item?id=47750927 https://news.ycombinator.com/item?id=47750927
• Magnets 6mo ago
  BT used to block the entire streamable.com site during football matches
• gchamonlive 6mo ago
  Here in Brazil sometimes my ISP goes into a weird state where I can't SSH into a remote machune. Got two ISP links here and still sometimes I need to resort to Mullvad to get stable internet
• giorgioz 6mo ago
  POSSIBLE FIX: I think changing your default DNS servers to Google 8.8.8.8 or Cloudflare 1.1.1.1 might bypass the spanish sunday ban on Cloudlflare. macOS + Cloudlfare 1.1.1.1 https://developers.cloudflare.com/1.1.1.1/setup/macos/ https://developers.cloudflare.com/1.1.1.1/setup/macos/ Google 8.8.8.8 https://developers.google.com/speed/public-dns/docs/using https://developers.google.com/speed/public-dns/docs/using
  • echoangle 6mo ago
    I don’t think it’s a DNS ban, it looks like they actually ban connections to the IP range. But you can just use a VPN.
  • LtdJorge 6mo ago
    Nope, it’s IP ban. At least for Vodafone and Telefónica.
• lofaszvanitt 6mo ago
  Good. Cloudflare is the next evil entity on the internet.
• breppp 6mo ago
  Vote early, vote often
• lordmoma 6mo ago
  [dead]
• jjcm 6mo ago
  Barring an Internet giant suing them in court, it really feels like this is unlikely to change as most just don’t understand the why or the effect. Someone needs to write a heist movie set in Spain where a key part of the plan is they steal something while La Liga is blocking some key security route.
  • Barbing 6mo ago
    Top notch idea
• Dibby053 6mo ago
  Going to play devil's advocate here but I suspect if Cloudflare had been more cooperative about taking down illegal content, LaLiga would not have resorted to blanket blocking individual IPs. I would really like to understand more about the process that they should follow but didn't / followed but didn't satisfy them / doesn't exist, in order to remove infringing websites quickly from CloudFlare.
  • lokar 6mo ago
    They will take down anything you get a judge to agree with.
  • JoshTriplett 6mo ago
    LaLiga wanted the right to tell Cloudflare to block specific sites without going through a court. Cloudflare, rightfully, said that was ridiculous and unreasonable. A Spanish court, wrongfully, decided to let LaLiga block all of Cloudflare.
    • Dibby053 6mo ago
      I assume the problem is Cloudflare wants a court order that mentions the specific infringing domain name. The problem is: what's faster, spinning up a new frontend for a livestream or getting an order from a court? Courts orders are, rightfully, slow. A court order is a serious thing and we shouldn't be wasting judges' time and resources to determine if hundreds of domains in CloudFlare, during every single match, are infringing on LaLiga. This is why the Spanish ISPs have a fast-lane with LaLiga to block infringing websites quickly. Why is it ridiculous and unreasonable? If LaLiga starts abusing this power to attack competitors or do anything malicious they will lose that power instantly. Fastly understood the problem and will start running detection software to ban infringing livestreams in real time. https://www.laliga.com/en-GB/news/fastly-and-laliga-team-up-on-joint-innovation-to-combat-piracy https://www.laliga.com/en-GB/news/fastly-and-laliga-team-up-... What's CF's solution?
      • JoshTriplett 6mo ago
        > If LaLiga starts abusing this power to attack competitors or do anything malicious they will lose that power instantly. Because everything demonstrated so far has suggested that LaLiga is reasonable and measured? Courts exist for many reasons, among them that we do not trust plaintiffs to always be right or reasonable. By way of demonstrating that such power is unacceptable, it sounds like LaLiga is also trying to get Spanish ISPs to block all VPNs whenever a game is on. This is not an entity that can be trusted with power. This is an entity that rightfully should take its whining to a court who can keep its abuses in check. (Unfortunately, the Spanish courts also don't seem willing to keep its abuses in check, which brings us back to the collateral damage problem.) > Fastly understood the problem No, Fastly accepted the blackmail that Cloudflare refused.
• dmitrygr 6mo ago
  The last sentence of this submission makes no sense. You are in Spain. Allegedly, the country has a representative government. That means that you should have a way to influence the government to fix this idiocy. If, in fact, you don’t, then it is not a representative government and …ahem… further steps may be warranted to remind the government whom they work for.
• pfortuny 6mo ago
  > instado por la Liga Nacional de Fútbol Profesional y por Telefónica Audiovisual Digital, (The trial was initiated by LaLiga and Telefonica...). "Telefonica" is the (exclusive) distributor for the rights of streaming the matches, and is only (of course?) the main consumer (and business) Telco in Spain: they are in a game they cannot lose. This is such an abuse and no government (this, past, whichever) has done anything about it.
  • swiftcoder 6mo ago
    It is also educational to look up the overlap between Telefonica directors, LaLiga directors, and the government officials who granted the defacto monopoly
    • pfortuny 6mo ago
      Educational indeed.
• ordersofmag 6mo ago
  Interesting alternative. Cloudflare (market cap $58B) buys La liga (market value $5 billion), drops suit.
  • lokar 6mo ago
    Set an example. Buy them, fire everyone, shut it down and liquidate the property.
  • outside2344 6mo ago
    Less headaches, free futbol matches!
  • msully4321 6mo ago
    I'm not sure where that number comes from but I don't think it's right, and I don't think that's how La Liga is structured anyway. It's governed by an association of all of the teams in the top two flights of spanish football.
    • ordersofmag 6mo ago
      Right. The number is the result of Claude adding up the public information about the aggregate value of all those clubs plus the association. So it would mean buying all the clubs; or at least enough to have a controlling interest in the association. Clearly there are big challenges to that (e.g. clubs not being for sale for one). But I thought it was an interesting thought experiment. Of course if you're just trying to play the money = power card then it'd probably be cheaper to purchase the influence of some government officials.
      • duckmysick 6mo ago
        Did Claude point out that under this proposal the Spanish clubs would be bared from entering European competitions? Since the clubs under the same ownership (more than 30%) can't enter the same UEFA club competitions.
  • manquer 6mo ago
• Kamshak 6mo ago
  I'm in Spain as well and it sucks a lot. What I do now is I go thorough Cloudflare 1.1.1.1 VPN (set up on my router). Fixes the issue and there is practically no latency or bandwidth impact.
  • baobabKoodaa 6mo ago
    You mean 1.1.1.1. DNS? Or do they also serve a VPN through that IP?
    • drnick1 6mo ago
      It's probably just DNS (port 53). It's the way Europeans tend to implement their censorship, with the ISPs as executors. It's trivial to bypass, but most non-technical users don't know how, so it's good enough to comply.
    • Kamshak 6mo ago
      They also have a wireguard VPN service called 1.1.1.1 (with WARP). My understanding is you basically VPN into a cloudflare datacenter so you don't have issues with cloudflare IPs being blocked
• LtdJorge 6mo ago
  Thankfully, Adamo hasn’t implemented the blockade yet (if ever).
• Myzel394 6mo ago
  Just use a VPN
• PocketBot 6mo ago
  [dead]
• mschuster91 6mo ago
  Cloudflare could resolve this without negatively impacting fundamental services... just place all newly registered sites (e.g. <30 days) on a dedicated block of IP addresses. That way, Spain's government-ordered censorship could be limited to (mostly) pirate sites. Or they could invest money in vetting customers properly. But of course, Cloudflare rather prefers to hold their actual large customers (who don't have much of an alternative to CF) and everyday Spaniard users hostage.
  • fc417fc802 6mo ago
    What would prevent a pirate site operator from registering a domain a few months in advance and sitting on it in the meantime? How do you propose customers ought to be vetted? Why should a host be expected to take on the duties of a hall monitor? Isn't that the judiciary's job? I think it is actually Spain using their residents as hostages in an attempt to extort Cloudflare and other large providers. The current situation is best described as blatantly corrupt regulatory capture.
    • mschuster91 6mo ago
      > What would prevent a pirate site operator from registering a domain a few months in advance and sitting on it in the meantime? It's driving up the cost and expenses. Operators of legitimate sites don't have to worry during that probation time about anything with the exception of customers in Spain during LL match hours. LL has ~10 matches / weekend (Fri/Sat/Sun/Mon), that means pirates have to have about 40 domains/CF integrations per month plus more in standby - and more, for longer probation periods. > How do you propose customers ought to be vetted? I dunno... stuff like basic KYC measures would be a good start. Copies of ID cards. Government business licenses. Private entities (credit bureaus). Even phone number verification is a serious hurdle for malicious actors, and it ties activities to real world identities that can be held accountable. Dangerous stuff (e.g. streaming) could only be made available upon a security deposit. > Why should a host be expected to take on the duties of a hall monitor? Isn't that the judiciary's job? No, and that we let ISPs get away with ignoring abuse@ emails is part of why the Internet is such a nasty place these days. You need a license to drive a car on public roads, you need an expensive license to fly a small plane, and you need a goddamn massively expensive license to fly a widebody aircraft. So why shouldn't you need to pass some set of verification before you get access to inarguably the Internet's most powerful data pipes?
• amarant 6mo ago
  I had to Google why this happens, blocking cloudflare during football games seems.. Arbitrary, to say the least. Maybe something to do with hooligans trashing entire cities when their team loses? I could almost get behind that, if I thought it would work.. But no, it's apparently to stop piracy!? Turning off half the internet, and mostly the legitimate parts at that (since when do pirates use cloudflare?) seems like probably the worst method to go about it. Someone ought to start streaming those games illegally without using cloudflare just to demonstrate how stupid this policy is
  • swiftcoder 6mo ago
    > Someone ought to start streaming those games illegally without using cloudflare just to demonstrate how stupid this policy is Oh, the icing on the cake is that they already do. While my whole dev stack gets shut off every weekend, my neighbour watches pirate futbol streams just fine - not only is it a stupid policy, it's an ineffective one, and the pirates bypassed the bans ages ago
    • amarant 6mo ago
      Makes you wonder why they keep the ban up? Are more people watching more football now that everything else stops working during matches? Talk about unfair business practices!
  • HDThoreaun 6mo ago
    Pirates use cloudflare because it solves their biggest problem, DOS attacks. Rights owners figured out that they can shut down these sites by DDOSing them which bypasses the courts and can be done instantly, so the pirates put their sites behind cloudflare ddos protection.
    • Parodper 6mo ago
      According to the court, the real reason is because ECH would make it impossible to block through DPI.
• jesuslop 6mo ago
  Just to confirm it is true. This is LaLiga bringing down essential country-wide infrastructure on soccer hours if your internet access is through main ISPs.
• blurb4969 6mo ago
  Welcome to the club, buddies! Here, in Russia, the government doesn't care about collateral damage at all when shutting down whole Internet in cities. They turn on white list mode, when only approved sites and IPs work. Businesses stop working and start losing money? They don't care. Important IT systems stop working? They don't care. People can't communicate with each other? Don't care. And seems like it will happen everywhere else. Sad to see the whole world goes down apart.
  • fc417fc802 6mo ago
    I think perhaps there's a difference in expectations between wartime versus a country at peace going after pirates.
    • blurb4969 6mo ago
      I wanted to say that Internet freedom dismantlement is a global trend.
      • fc417fc802 6mo ago
        Fair enough, I completely agree. However in the case of Russia specifically, I understand that at one point Ukrainian drones were making routine use of mobile internet within the county. Temporary internet whitelists seem like a reasonable alternative to complete blackouts in that scenario. There are plenty of historic examples of malware using just about any communication platform for the C&C transport.
• postepowanieadm 6mo ago
  Why are you working instead of watching the match?
  • userbinator 6mo ago
    That's what crossed my mind too: It's like a nationally-mandated break to watch football.
• swiftcoder 6mo ago
  Hah. I have had to use a US-based VPN to access GitHub pretty much every weekend lately. La Liga's efforts to curb pirate TV streams are basically undermining the internet itself at this point. This is also not new behaviour - Theo posted a YouTube about it nearly a year ago[1]. [1]: https://www.youtube.com/watch?v=1-geGEYEw7g https://www.youtube.com/watch?v=1-geGEYEw7g
• thomasjudge 6mo ago
  Could you bypass this with a VPN?
  • tossandthrow 6mo ago
    Yes, and all of Spain is learning how to use VPNs
• Chrisszz 6mo ago
  LOL this is so hilarious, blocking a portion of a web infra for a football match
  • sva_ 6mo ago
    It is somewhat funny until you realize the amount of power some copyright mafia knuckleheads have over the (local) internet. It isn't even an authoritative regime censoring something, but much more silly.
• rcarmo 6mo ago
  Ah, so that's why my site is "down" there: https://hayahora.futbol/#sobre-los-bloqueos&domain=taoofmac.com https://hayahora.futbol/#sobre-los-bloqueos&domain=taoofmac.... They're blocking the CDN too, not just R2.
• r2vcap 6mo ago
  [dead]
• deleted 6mo ago
  [deleted]
• samgranieri 6mo ago
  This is inexcusable. Just because sports right holders are worried about piracy doesn’t give them license to break normal internet operations. Spain, get your act together and put your equivalent of the content cartel in the penalty box.
• genericacct 6mo ago
  same thing happens in italy
• aftbit 6mo ago
  What's the current state of the art for VPN'ing through deep packet inspection firewalls? I have imagined building something around TLS and Websockets that connects to a popular cloud provider which is "too big to block". Of course, if they'll block Cloudflare, or all connections outside of the country, maybe _nothing_ is too big to block. I remember some solutions to this in the 2010s, like obfsproxy and shadowsocks, but are there any newer or better options?
• rmonvfer 6mo ago
  As a Spaniard, this also happens to me. You can either use a VPN or just switch DNS servers to one that doesn’t have anycast nodes in Spain. Cloudflare’s authoritative DNS uses EDNS Client Subnet (ECS) to return different IP pools based on where the query originates. Spanish resolvers get IPs from a range that La Liga blocks. If your recursive resolver is physically outside Spain (or you use DoH/DoT to tunnel to one), Cloudflare returns a different, unblocked pool. AdGuard DNS works well for this.
• zeafoamrun 6mo ago
  I don't even like televised sport but this makes me want to figure out how to pirate it at scale
• archon810 6mo ago
  I found out about this a month ago when a confused Spanish user showed me all downloads on https://apkmirror.com https://apkmirror.com (powered by Cloudflare R2) are blocked in Spain during LaLiga soccer matches https://x.com/i/status/2030361569691898237 https://x.com/i/status/2030361569691898237. It was so idiotic, I couldn't believe it. Glad it's getting more attention now.
• Self-Perfection 6mo ago
  [Meta comment] Humankind is not doing well with implementing new policies. We should really strive for each new policy (like in this case - blocking access to some parts of internet during soccer games): - Consider running policy in small scale scenario (e.g. testing blocking in small parts of Spain before whole country rollout) - Implement channels to gather info from those who are faced with results of policy implementation (in this case: the op got webpage with description why the page is blocked - a bit of sanity! It would be better if it was served with HTTP code 451) - Policy instructions - When deciding on policy put a date at which policy should be reconsidered and revised using data collected during the time when it was in effect - ... and some more I have not thought about. Let's strive to cultivate this principles in all life areas where we can affect how new policies are implemented. (edit: linebreaks)
• deleted 6mo ago
  [deleted]
• redbell 6mo ago
  This behavior of blocking some domains and IP ranges during LaLiga games has become a routine by now. You might also want to check these similar submissions: My game's server is blocked in Spain whenever there's a football match on: https://news.ycombinator.com/item?id=45358433 https://news.ycombinator.com/item?id=45358433 Spain’s LaLiga has blocked access to freedom.gov: https://news.ycombinator.com/item?id=47114235 https://news.ycombinator.com/item?id=47114235
  • flobosg 6mo ago
    See https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=laliga&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... as well.
• Self-Perfection 6mo ago
  This is far from the first time that I see on HN indignation on LaLiga blockings. Sadly all this rage does not seem to lead to any change. I'd like to suggest some steps that might/should be followed, which I will not pursue personally but in my defense - I do not live in Spain and not affected. 1) (first! low-effort) Somebody should create any space on the internet, where such anecdotes might shared and probably people with common goals of fixing internet access in Spain will meet. E.g. telegram group, discord channel, subreddit... 2) probably create wiki with related research: legal framework and possible actions etc 3) Raise public awareness. Create a resource/website with schedule of past and future "semi-blackouts", simple explanation of possible effects a layman may notice etc 4) Explore legal actions that might be taken. How this issue might be forced to be discussed by politicians? For instance I know that Portugal has official mechanism to put forward petitions, that will be discussed in parliament if get enough votes [1] Space of possible demands in such petitions is vast. For instance: - Make LaLiga compensate partly price of internet access - Force LaLiga to include education notice in the beginning and the of translation with title like "Start of reduced internet connectivity" / "End of reduced internet connectivity" [1] https://participacao.parlamento.pt/initiatives/ https://participacao.parlamento.pt/initiatives/
  • Self-Perfection 6mo ago
    kudos to guys who already started to work in that direction! They track blockings: https://hayahora.futbol https://hayahora.futbol
• Robdel12 6mo ago
  How is this cloudflares problem? This is on LaLiga.
  • danpalmer 6mo ago
    It might not be Cloudflare's fault, but it is their problem. If their customers can't use their products sporadically, it doesn't really matter why. Cloudflare taking a principled approach hurts their users in the short term, so they have to make a business trade-off between pragmatism and principle. Currently they're choosing principle, so it's reasonable to be angry at them for the short term issues that causes.
• ethin 6mo ago
  This is exactly why random corporations need to be gone from government. Or copyright needs to be abolished, one of the two. No corporation (no matter how beloved) should ever have this kind of power. IMO the more powerful an organization becomes, the deeper the scrutiny should be.
• dlahoda 6mo ago
  Just use Nix. 1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler). 2. Nix has several ways to build OCI images, some even faster to assemble and slimmer output of official Docker tooling. 3. It is allowed several providers for same artefact to resolve pull.
  • TheDong 6mo ago
    > 1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler). If nix fails to pull things from its binary cache, it will download the "sources" of the derivations, which are hosted in various places and so it's even more likely an overly broad block impacts one of them. This football block very well could also cover GitHub, cdn.kernel.org, and so on, so nix building things could fail just as easily. The solution isn't to use something else which can download source code from 100s of sites across the internet to compile as a fallback, it's to not use internet which sporadically blocks sites hosting developer assets. The solution is not technical, it's political.
    • dlahoda 6mo ago
      1. We are more on OCI images? Assuming source available, run nix build and docker load of result. 2. Even if kernel.org or GitHub.com will be blocked, it likely than not it already was cached by nixos org cache or community cache or cachix or by your CI or by you workstation.
• shamcleren 6mo ago
  [flagged]
• martmulx 6mo ago
  [dead]
• krick 6mo ago
  Is it exclusively football or do they try to fight piracy this way for some other major streaming events? I am just curious, because it's just comical to go this far over some dumb ball-game.
  • sammy2255 6mo ago
    It's just football. Once the game is over they revert the block
• xkbear89 6mo ago
  [flagged]
• madbo1 6mo ago
  Reading this from India, where stuff like this is pretty much Tuesday business. But that’s not the problem; the problem is precisely the one hour of your life spent trying to figure out whether the issue is your DNS, your VPN, your configuration, or your programming. “The government in the country I’m accessing this from just decided to shut down my IP for the next two hours” rarely crosses your mind. India has consistently been at the top of the number of Internet blackouts anywhere in the world for years (Access Now keeps track of this through its KeepItOn project). These tend to be brief and localized, triggered by something as mundane as an exam or protest or local incident. It’s such a routine occurrence here that there’s even a reflexive response: mobile data works differently from other connectivity types, so go with that, try new DNS settings, rely on Telegram instead of WhatsApp when the latter fails you, and always have a list of mirrors. What’s fascinating about this case is that it’s identical except for who is pressing the button LaLiga, a privately owned entity, in place of the government.
  • teitoklien 6mo ago
    [flagged]
  • deleted 6mo ago
    [deleted]
• panstromek 6mo ago
  Yea, when there's a match, our app stops playing videos in Spain and we get some bad reviews. It's pretty annoying.
  • jeroenhd 6mo ago
    At some point apps should just start pointing the finger at the cause of these problems. Linking users with Spanish IPs to a page explaining soccer internet censorship won't stop the bad reviews entirely but at least it'll be more useful than doing nothing.
• maxlin 6mo ago
  sportsball more importanter than your nerd stuff. regards: spanish authorities (who are watching the sportsball and so are better spaniards than you!)
• lloydatkinson 6mo ago
  Probably the only even slightly relevant thread I’ll ever find for this so here goes. There is a certain visitor in the “Madrid Autonomous Community” (whatever that is) which frequently requests just my homepage, no other page on my site, over and over again. It comes in waves, and it’s not enough to affect anything, but it’s very weird because when I did some digging by looking at the ASN there was actually only one active IP address and if I browse to it I get someone’s Synology NAS login page. Why would someone setup their NAS to randomly keep pinging my homepage?
• znnajdla 6mo ago
  How timely. I was just moving off Github to self-hosted docker registries.
  • TiredOfLife 6mo ago
    Bad bot.
• schnitzelstoat 6mo ago
  The government really needs to step in, it's surprising that the PSOE and Sumar have allowed private companies to block so much of the internet.
• egeres 6mo ago
  I wasn't able to pull some images and I lost 1h trying to diagnose network problems in my setup, but it didn't occur to me that "la liga" was the root cause . My workaround was to add "registry-mirrors": ["https://mirror.gcr.io https://mirror.gcr.io"] in my /etc/docker/daemon.json
  • chaz6 6mo ago
    This is the correct answer. Something that confused me for a while was the path "docker.io" used for pulling containers. There is not actually a container registry at "docker.io" - rather docker and podman are hard coded to convert it to either "registry-1.docker.io" or "index.docker.io".
  • matt_kantor 6mo ago
    Depending on your use case, you may not require a hosted registry at all. You could instead push images to your servers from wherever they're built. I use a little script[0] to automate that when deploying some personal projects, but really it could be as simple as `docker save`/`scp`/`docker load` (especially for a one-off situation or when the images are small). [0]: https://github.com/mkantor/docker-pushmi-pullyu https://github.com/mkantor/docker-pushmi-pullyu
• snickerer 6mo ago
  The Internet was originally designed to survive a nuclear war. Now we downgraded it deliberately to not survive a football game. Decentralised infrastructure: good Centralised infrastructure: bad Good and bad for you, of course. For the big companies selling and controlling this stuff, it's vice versa. Just stay alert and don't chain yourself with big tech dependencies. The reason Git is great is its decentralised nature. If you got so far, why cripple yourself by running your traffic through a single American company like Cloudflare?
• sschueller 6mo ago
  Just wait until a bank moves their 2FA to CF... Netblock do not work and will never work.
  • cryptonym 6mo ago
    A bank may use another provider and/or their own IPs
• christkv 6mo ago
  Companies should start suing La Liga for danaged please
• evilmonkey19 6mo ago
  Last weekend happened as well :/ https://news.ycombinator.com/item?id=47480926 https://news.ycombinator.com/item?id=47480926 The situation every weekend is getting worse and worse. Honestly, I cannot understand how any goverment who wants freedom for its citizens can allow to block internet access to a whole country only because a private football company asks for it. I guess LaLiga is the 4th statement in Spain... A probably will get even worse the situation with Fastly entering the equation: https://www.fastly.com/press/press-releases/fastly-and-laliga-team-up-on-joint-innovation-to-combat-piracy https://www.fastly.com/press/press-releases/fastly-and-lalig...
• isodev 6mo ago
  Very good example as to why using a single, centralised proxy globally by all services is a bad idea. Docker would never have a reason to block anything if they were simply running their own. For everyone else, small and big, this is the weekly reminder to not use Cloudflare for user-facing access to anything.
  • pajamasam 6mo ago
    There are multiple good reasons to use a CDN though. What’s your suggestion for an alternative?
    • dnnddidiej 6mo ago
      All the other ones. I wonder can you just set up fallback to origin in DNS
      • pajamasam 6mo ago
        > I wonder can you just set up fallback to origin in DNS Then you origin needs to be publicly accessible and you lose the DDOS protection that a CDN gives you. > All the other ones. They're just as susceptible to outages as Cloudflare is.
  • gempir 6mo ago
    The amount of traffic that must go through the docker hub, must be insane, the images go into the gigabytes and everyone expects it to be super fast. Cloudflare is one of the few companies who can handle that for relatively cheap, Docker could not just "run their own" and have it even be compareable.
    • isodev 6mo ago
      One of few doesn’t mean they’re the only ones. Imagine how much easier it would be for CDNs to have revenue if they didn’t have to battle Cloudflare’s obscenely broad portfolio
    • 6mo ago
• sam_lowry_ 6mo ago
  I am walking the Camino de Santiago now, and there were piligrims complaining about random issues with their phones, e.g. an elderly German lady was totally lost as her Google Maps was not working, so we got to an albergue, asked for wi-fi and downloaded CoMaps on her phone.
• markstos 6mo ago
  It appears Cloudflare is responding to a legal requirement to implement this IP blocking. https://www.techradar.com/vpn/vpn-privacy-security/cloudflare-wants-to-fix-spains-blocking-of-illegal-football-streams-ahead-of-next-laliga-season https://www.techradar.com/vpn/vpn-privacy-security/cloudflar...
• laxmanclo 6mo ago
  Thats crazy
• marsxr360 6mo ago
  YES. It took me a while to debug. Was working on mobile. Was not working on desktop. Mobile was using mobile internet from the UK. Made a meme about it: https://x.com/marsXRobertson/status/2043789192946163734 https://x.com/marsXRobertson/status/2043789192946163734
• admiralrohan 6mo ago
  Few years back when Indian govt banned porn websites, they also blocked football news websites like Bleacher report. People at the top has no idea about ground reality.
• sminchev 6mo ago
  We had a strange case in Bulgaria. There was a big event on the national stadium. Full with people. Some of the equipment for light/sound was based on modern 5G-based technologies. But because of all the people, caring their devices, the 5G network was so overwhelmed that the light/sound equipment was not able to communicate at all! Of course, they found this at the beginning of the event! :D To overcome this, one of the organizers went to stage and asked all the audience to stop their 5Gs so that the whole network be released from the traffic. Unfortunately, it does not make sense for the representatives to invest millions of infrastructure, just because of a single event happened. :(
• albertfdp 6mo ago
  It looks like this is only going to get worse, as Telefonica will now block on Champions League matches but also on tennis and golf tournaments. https://bandaancha.eu/articulos/telefonica-consigue-bloqueos-ips-11731 https://bandaancha.eu/articulos/telefonica-consigue-bloqueos...
• jason-festa 6mo ago
  [dead]