5 ms·

I don't understand this decision. Running a website as an individual is a liability risk for all sorts of reasons for which there are simple (and cheap) mitigat

by _fjg8 2y ago

I don't understand this decision. Running a website as an individual is a liability risk for all sorts of reasons for which there are simple (and cheap) mitigations. Even if you believe this legislation is a risk, there are options other than shutting down. The overreaction here is no different than when GDPR came in, and we all collectively lost our minds and started shutting things down and then discovered there was zero consequence for mom-and-pop websites. I assume this isn't a genuine post and is actually an attempt at some sort of protest, with no intention of actually shutting down the websites. Or, more likely, they're just old and tired and ready to move on from this period of their life, running these websites.

baggy_trough 2y ago
What are the simple and cheap mitigations you have in mind?
- aimazon 2y ago
  Don't run a website personally, set up a separate legal entity. The UK is one of the easiest places in the world to do this and has well-understood legal entities that fit the model of a community-operated organisation (i.e: "community interest company"). The fact that the OP is running such a large community as an individual is bonkers in the first place, independent of this new act.
  - baggy_trough 2y ago
    Personally, I think it's bonkers that an individual can't run an online forum.
    - aimazon 2y ago
      I agree but that ship sailed a decade ago. There's no additional risk with the new bill, it's more of the same. If there are concerns about liability because of this new bill then there should be concerns about liability already. I sympathise with the OP because at some point everyone becomes too old to deal with the headaches of running a community. I have no opposition to their choice to shut down the forum. I just don't believe liability as a result of the new bill is the reason.
      - em-bee 2y ago
        but there is additional risk and liability, because the new act creates more work in order to be compliant (which is what increases the liability), and it increases the risk of being attacked. there's never been an instance of any of the proclaimed things that this act protects [...] people from, so he should be safe, right? but despite this, he is already being attacked, and those attacks will not just continue but they are likely to increase because the attack surface has become larger.
      - pavel_lishin 2y ago
        > I just don't believe liability as a result of the new bill is the reason. It seems like OP is commenting on this thread; you can accuse them of lying directly, if you'd like.
    - jodrellblank 2y ago
      Personally, I think it's bonkers that you think "I don't have time to comply with the law so I shouldn't have to" is a reasonable position.
      - baggy_trough 2y ago
        People who think this law is reasonable are bonkers.
        jodrellblank 2y ago
        People who go for reductio ad ad-hom are making low quality internet arguments. Restauranteurs can't say they don't have time to comply with the law. Construction companies can't. Doctors can't. Why should online service providers be able to?
  - tempfile 2y ago
    Are you claiming that setting up a CIC removes individual liability for wrongdoing? So, I set up a CIC for running forums, with $0 of assets and negligible running costs, then in the event of a fine I'm scot free?
    - aimazon 2y ago
      Yes. A CIC is just a limited company with some additional community interest obligations. You can set up a limited company to shield yourself from liability (i.e: if your website is sued by a user, your personal assets aren't at risk) and only in exceptional cases (where serious lawbreaking is involved) could you be held personally liable. Rightly or wrongly, limited companies in the UK provide a high degree of protection for wrongdoing. Defrauding HMRC out of hundreds of thousands of pounds and suffering no consequence is happening day in day out. An Ofcom fine is nothing by comparison.
      - deleted 2y ago
        [deleted]
      - morkalork 2y ago
        How would that work if someone set up a CIC, used it to rent a VPS and did some grey-hat hacking activities?
        jimnotgym 2y ago
        If the person committed a criminal offence under the Computer Misuse Act then they would face criminal sanctions, personally. The Online safety bill gives Ofcom the power to levy regulatory fines, not criminal sanctions, so is very different
      - akoboldfrying 2y ago
        1. Thanks for this very helpful information about how some seemingly quite simple legal manoeuvring can be used to dodge 99% of this law. 2. Doesn't the fact that simple legal manoeuvring can be used to dodge 99% of this law make the law (and laws like it) farcical on its face? Merely an elaborate set of extra hoops that only serves to punish the naive, while increasing everyone's compliance costs?
  - graemep 2y ago
    It raises the cost and hassle involved from "I need a cheap hosting package" to I need to do paperwork, keep and file accounts, etc.
EpicQuest_246 2y ago
I used to frequent the forum about 15 or so years ago. This guy is very level headed and has been around the block a lot. Therefore I don't believe this is purely performative.
- aimazon 2y ago
  I like and respect the OP and their work. I do not think this is consistent with his previous levelheadedness. edit: removed unintentional deadnaming
  - buro9 2y ago
    thank you for removing the deadname.
  - EpicQuest_246 2y ago
    As I said I haven't frequented the forum for years, so maybe things have changed but I highly doubt this is a knee jerk reaction.
ceinewydd 2y ago
A fair number of sites hosted and operated outside the European Union reacted to GDPR by instituting blocks of EU users, many returning HTTP 451. Regardless of whether you believe GDPR is a good idea or not (that's beyond the scope of this comment), the disparity in statutory and regulatory approaches plus widely varying (often poor) levels of 'plain language' clarity in obligations, and inconsistent enforcement, it all leads to entirely understandable decisions like this and more of a divided internet. Thank you to those who have tirelessly run these online communities for decades, I'm sorry we can't collectively elect lawmakers who are more educated about the real challenges online, and thoughtful on real ways to solve them.
- FMecha 2y ago
  >A fair number of sites hosted and operated outside the European Union reacted to GDPR by instituting blocks of EU users, many returning HTTP 451. My outlook on doing this is that this is not the way to do it because these things exist: - EU citizens living in non-EU countries (isn't GDPR supposed to apply EU citizens worldwide?) - EU citizens using VPN with exit node to/IP address spoofing a non-EU country Either comply with GDPR or just don't exist, period.
  - vikarti 2y ago
    China or Russia also have "interesting" data protection / "let's protect children" laws. Some of they also formulated in same way as GDPR so VPN doesn't help. Why should they be ignored? (other than "but it's DIFFERENT thing, EU is good ones")
buro9 2y ago
the real risk I see is that as it's written, and as Ofcom are communicating, there is now a digital version of a SWATing for disgruntled individuals. the liability is very high, and whilst I would perceive the risk to be low if it were based on how we moderate... the real risk is what happens when one moderates another person. as I outlined, whether it's attempts to revoke the domain names with ICANN, or fake DMCA reports to hosting companies, or stalkers, or pizzas being ordered to your door, or being signed up to porn sites, or being DOX'd, or being bombarded with emails... all of this stuff has happened, and happens. but the new risk is that there is nothing about the Online Safety Act or Ofcom's communication that gives me confidence that this cannot be weaponised against myself, as the person who ultimately does the moderation and runs the site. and that risk changes even more in the current culture war climate, given that I've come out, and that those attacks now take a personal aspect too. the risk feels too high for me personally. it's, a lot.
- IanCal 2y ago
  > the real risk I see is that as it's written, and as Ofcom are communicating, there is now a digital version of a SWATing for disgruntled individuals. I'm sorry, what precisely do you mean by this? The rules don't punish you for illegal content ending up on your site, so you can't have a user upload something then report it and you get in trouble.
  - buro9 2y ago
    Yes you can https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/illegal-content-codes-of-practice-for-user-to-user-services.pdf?v=387711 https://www.ofcom.org.uk/siteassets/resources/documents/onli... A forum that isn't proactively monitored (approval before publishing) is in the "Multi-Risk service" category (see page 77 of that link), and the "kinds of illegal harm" include things as obvious as "users encountering CSAM" and as nebulous as "users encountering Hate". Does no-one recall Slashdot and the https://en.wikipedia.org/wiki/Gay_Nigger_Association_of_America https://en.wikipedia.org/wiki/Gay_Nigger_Association_of_Amer... trolls? Such activity would make the site owner liable under this law. You might glibly reply that we should moderate, take it down, etc... but we, is me... a single individual who likes to go hiking off-grid for a vacation and to look at stars at night. There are enough times when I could not respond in the timely way to moderate things. This is what I mean by the Act providing a weapon to disgruntled users, trolls, those who have been moderated... a service providing user generated content in a user to user environment can trivially be weaponised, and it will be a very short amount of time before it happens. Forum invasions by 4chan and others make this extremely obvious.

by _fjg8 2y ago

baggy_trough 2y ago

What are the simple and cheap mitigations you have in mind?

aimazon 2y ago
Don't run a website personally, set up a separate legal entity. The UK is one of the easiest places in the world to do this and has well-understood legal entities that fit the model of a community-operated organisation (i.e: "community interest company"). The fact that the OP is running such a large community as an individual is bonkers in the first place, independent of this new act.
- baggy_trough 2y ago
  Personally, I think it's bonkers that an individual can't run an online forum.
  - aimazon 2y ago
    I agree but that ship sailed a decade ago. There's no additional risk with the new bill, it's more of the same. If there are concerns about liability because of this new bill then there should be concerns about liability already. I sympathise with the OP because at some point everyone becomes too old to deal with the headaches of running a community. I have no opposition to their choice to shut down the forum. I just don't believe liability as a result of the new bill is the reason.
    - em-bee 2y ago
      but there is additional risk and liability, because the new act creates more work in order to be compliant (which is what increases the liability), and it increases the risk of being attacked. there's never been an instance of any of the proclaimed things that this act protects [...] people from, so he should be safe, right? but despite this, he is already being attacked, and those attacks will not just continue but they are likely to increase because the attack surface has become larger.
    - pavel_lishin 2y ago
      > I just don't believe liability as a result of the new bill is the reason. It seems like OP is commenting on this thread; you can accuse them of lying directly, if you'd like.
  - jodrellblank 2y ago
    Personally, I think it's bonkers that you think "I don't have time to comply with the law so I shouldn't have to" is a reasonable position.
    - baggy_trough 2y ago
      People who think this law is reasonable are bonkers.
      - jodrellblank 2y ago
        People who go for reductio ad ad-hom are making low quality internet arguments. Restauranteurs can't say they don't have time to comply with the law. Construction companies can't. Doctors can't. Why should online service providers be able to?
- tempfile 2y ago
  Are you claiming that setting up a CIC removes individual liability for wrongdoing? So, I set up a CIC for running forums, with $0 of assets and negligible running costs, then in the event of a fine I'm scot free?
  - aimazon 2y ago
    Yes. A CIC is just a limited company with some additional community interest obligations. You can set up a limited company to shield yourself from liability (i.e: if your website is sued by a user, your personal assets aren't at risk) and only in exceptional cases (where serious lawbreaking is involved) could you be held personally liable. Rightly or wrongly, limited companies in the UK provide a high degree of protection for wrongdoing. Defrauding HMRC out of hundreds of thousands of pounds and suffering no consequence is happening day in day out. An Ofcom fine is nothing by comparison.
    - deleted 2y ago
      [deleted]
    - morkalork 2y ago
      How would that work if someone set up a CIC, used it to rent a VPS and did some grey-hat hacking activities?
      - jimnotgym 2y ago
        If the person committed a criminal offence under the Computer Misuse Act then they would face criminal sanctions, personally. The Online safety bill gives Ofcom the power to levy regulatory fines, not criminal sanctions, so is very different
    - akoboldfrying 2y ago
      1. Thanks for this very helpful information about how some seemingly quite simple legal manoeuvring can be used to dodge 99% of this law. 2. Doesn't the fact that simple legal manoeuvring can be used to dodge 99% of this law make the law (and laws like it) farcical on its face? Merely an elaborate set of extra hoops that only serves to punish the naive, while increasing everyone's compliance costs?
- graemep 2y ago
  It raises the cost and hassle involved from "I need a cheap hosting package" to I need to do paperwork, keep and file accounts, etc.

EpicQuest_246 2y ago

I used to frequent the forum about 15 or so years ago. This guy is very level headed and has been around the block a lot. Therefore I don't believe this is purely performative.

aimazon 2y ago
I like and respect the OP and their work. I do not think this is consistent with his previous levelheadedness. edit: removed unintentional deadnaming
- buro9 2y ago
  thank you for removing the deadname.
- EpicQuest_246 2y ago
  As I said I haven't frequented the forum for years, so maybe things have changed but I highly doubt this is a knee jerk reaction.

ceinewydd 2y ago

A fair number of sites hosted and operated outside the European Union reacted to GDPR by instituting blocks of EU users, many returning HTTP 451. Regardless of whether you believe GDPR is a good idea or not (that's beyond the scope of this comment), the disparity in statutory and regulatory approaches plus widely varying (often poor) levels of 'plain language' clarity in obligations, and inconsistent enforcement, it all leads to entirely understandable decisions like this and more of a divided internet. Thank you to those who have tirelessly run these online communities for decades, I'm sorry we can't collectively elect lawmakers who are more educated about the real challenges online, and thoughtful on real ways to solve them.

FMecha 2y ago
>A fair number of sites hosted and operated outside the European Union reacted to GDPR by instituting blocks of EU users, many returning HTTP 451. My outlook on doing this is that this is not the way to do it because these things exist: - EU citizens living in non-EU countries (isn't GDPR supposed to apply EU citizens worldwide?) - EU citizens using VPN with exit node to/IP address spoofing a non-EU country Either comply with GDPR or just don't exist, period.
- vikarti 2y ago
  China or Russia also have "interesting" data protection / "let's protect children" laws. Some of they also formulated in same way as GDPR so VPN doesn't help. Why should they be ignored? (other than "but it's DIFFERENT thing, EU is good ones")

buro9 2y ago

the real risk I see is that as it's written, and as Ofcom are communicating, there is now a digital version of a SWATing for disgruntled individuals. the liability is very high, and whilst I would perceive the risk to be low if it were based on how we moderate... the real risk is what happens when one moderates another person. as I outlined, whether it's attempts to revoke the domain names with ICANN, or fake DMCA reports to hosting companies, or stalkers, or pizzas being ordered to your door, or being signed up to porn sites, or being DOX'd, or being bombarded with emails... all of this stuff has happened, and happens. but the new risk is that there is nothing about the Online Safety Act or Ofcom's communication that gives me confidence that this cannot be weaponised against myself, as the person who ultimately does the moderation and runs the site. and that risk changes even more in the current culture war climate, given that I've come out, and that those attacks now take a personal aspect too. the risk feels too high for me personally. it's, a lot.

IanCal 2y ago
> the real risk I see is that as it's written, and as Ofcom are communicating, there is now a digital version of a SWATing for disgruntled individuals. I'm sorry, what precisely do you mean by this? The rules don't punish you for illegal content ending up on your site, so you can't have a user upload something then report it and you get in trouble.
- buro9 2y ago
  Yes you can https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/illegal-content-codes-of-practice-for-user-to-user-services.pdf?v=387711 https://www.ofcom.org.uk/siteassets/resources/documents/onli... A forum that isn't proactively monitored (approval before publishing) is in the "Multi-Risk service" category (see page 77 of that link), and the "kinds of illegal harm" include things as obvious as "users encountering CSAM" and as nebulous as "users encountering Hate". Does no-one recall Slashdot and the https://en.wikipedia.org/wiki/Gay_Nigger_Association_of_America https://en.wikipedia.org/wiki/Gay_Nigger_Association_of_Amer... trolls? Such activity would make the site owner liable under this law. You might glibly reply that we should moderate, take it down, etc... but we, is me... a single individual who likes to go hiking off-grid for a vacation and to look at stars at night. There are enough times when I could not respond in the timely way to moderate things. This is what I mean by the Act providing a weapon to disgruntled users, trolls, those who have been moderated... a service providing user generated content in a user to user environment can trivially be weaponised, and it will be a very short amount of time before it happens. Forum invasions by 4chan and others make this extremely obvious.