> error pulling image configuration: download failed after attempts=6: tls: failed to verify certificate: x509: certificate is not valid for any names, but wanted to match docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com
First blaming tailscale, dns configuration and all other stuff. Until I just copied that above URL into my browser on my laptop, and received a website banner:
> El acceso a la presente dirección IP ha sido bloqueado en cumplimiento de lo dispuesto en la Sentencia de 18 de diciembre de 2024, dictada por el Juzgado de lo Mercantil nº 6 de Barcelona en el marco del procedimiento ordinario (Materia mercantil art. 249.1.4)-1005/2024-H instado por la Liga Nacional de Fútbol Profesional y por Telefónica Audiovisual Digital, S.L.U. https://www.laliga.com/noticias/nota-informativa-en-relacion-con-el-bloqueo-de-ips-durante-las-ultimas-jornadas-de-laliga-ea-sports-vinculadas-a-las-practicas-ilegales-de-cloudflare
For those non-spanish speakers: It means there is football match on, and during that time that specific host is blocked. This is just plain madness. I guess that means my gitlab pipelines will not run when football is on. Thank you, Spain.
Every response and comment from LaLiga, the football organization responsible for this, has been so far that this is a minor issue that only affects a few bunch of nerds who talk about "docker images" or "github repositories" or "whatever that means".
Meanwhile, there are testimonies of smart home devices like anti-theft alarms or automatic doors, that stop working whenever there is a football match, because their backends rely on Cloudflare.
Last week, a woman asked for help on social media, as the GPS tracking app she uses to see where her father with dementia is, went offline during a match. It was getting late and he still wasn't back home, and she couldn't locate the tag he was wearing to find him: https://www.infobae.com/america/agencias/2026/04/05/laliga-d...
It's hard to say this, because no one should experience an event like this, but as stressful as these are, it's the only way to make the mainstream people care about this censorship. "I cannot pull a docker image" will never be on nightly news, but safety and personal security is a more powerful driver for discourses.
This is generally how the GFW works in China. Instead of an overbearing nanny like a school or corporation's DNS blocker, you're left with a sense that you're on a version of the Internet that is just intermittently and somewhat mysteriously broken.
And indeed, in China, a lot of things that probably aren't fully intended to be blocked are not reliably accessible. Implementation varies, so you get strange routing and peering issues. It feels like an Internet that isn't fully formed, that hasn't finished coming together yet.
Nation states and corporations obviously gain some things sometimes by having Internet censorship/blocking frameworks in place. Maybe, sometimes, ordinary people even benefit, too, if it helps shut down illegal and genuinely harmful businesses.
But it feels like the whole world is gradually trending towards more and more Internet censorship without realizing that we are un-building a miraculous thing that took enormous effort and cleverness and expense to build. I wish we could think about this not only in terms of freedom (and we absolutely should think about it in terms of freedom), but how we are disintegrating the infrastructure of communication and computing.
Oh boy, an excuse to share my favourite great firewall story on a visit to China. Keep in mind, this is 15 years old, so probably doesn't represent the current state of affairs. At the time, my daily news reading habit had me checking BBC and CBC (Canadian Broadcasting Corporation). The BBC site seemed to be working fine, but whenever I clicked on an article on CBC, it was blocked. A few minutes later, I went to show my wife that CBC articles were blocked, and I clicked on the same one again, and it loaded. I clicked on another: blocked. Tried it again after a few minutes and it loaded. Someone was screening the articles in real time for me. When I was done reading, I clicked on several of the weirdest headlines I could find, and after a few minutes, everything was blocked again including ones that had previously worked.
The counter-reaction to this era will include additional communication control.
These were ripe with espionage, wiretapping and sabotage. Access to it used to be highly restricted as well, up until the 90s for example you were only allowed to connect government-licensed modems to the German PSTN directly.
Just like today's Internet. BGP spoofing, CALEA, DDoS.
> Access to it used to be highly restricted as well ...
And this is where the regression or "downfall" is beginning. Access to the Internet (as in ability to send/receive arbitrary data to the wider Internet) is something I bet is going to be increasingly restricted, but most people won't notice because they don't understand the difference between apps and the Internet.
I'd be surprised if direct access to the Internet is possible for consumers in the next 10 years. Everything will have to be through approved apps (age assurance is going to be the catalyst) that work over registered tunnels contracted through ISPs, if there isn't an outright blurring or merger between the concepts of phone/CPE, ISP and CDN. Your non-tech layperson will not know any difference whatsoever if all they use are their phone plan, streaming/banking apps and Facebook.
This was the same in many places. The cost of hardware and connection time limited connections, and no one had cryptography except the government and ultra nerds.
obviously it can be bumpy and maybe there's a Great Filter or you happen to live during a bad period but life is certainly much longer and less brutal than it was for 99.9% of human history
That's actually just how the Internet is. Nothing to do with the great firewall.
I've claimed financial loss, claimed sanity loss and everything in-between, but I'm afraid unless something reaches the European/EU courts, Spain will continue to be in the pocket of the La Liga owners.
Straight up fucking censorship with wide collateral being completely accepted in a Western country in 2026, beyond comprehension how this is allowed.
Here's some commentary on it:
> Justice Perram discussed the idea of speculative invoicing within Australia
> Representing to a consumer that they have a liability which they do not may well be misleading and deceptive conduct within the meaning of s 18 of the Australian Consumer Law and it may be equally misleading to represent to someone that their potential liability is much higher than it could ever realistically be. There may also be something to be said for the idea that speculative invoicing might be a species of unconscionable conduct within one or other of s 21 of the Australian Consumer Law or s 12CB of the Australian Securities and Investments Commission Act 2001 (Cth).
> Further, even if speculative invoicing was deemed to be lawful within Australia, the damages that the individual may be liable to are often calculated differently to that of the United States. In Australia, damages are compensatory in nature, meaning to compensate the plaintiff for the loss suffered. One Intellectual Property Lawyer has been quoted as saying, ‘If a film costs $20, the damages would ordinarily be expected to be $20.’
https://www.kells.com.au/insights/business/dallas-buyers-clu...
(Sadly as living in Spain for about a year I’m still not in such place to raise this or understand the full steps needed)
Can you expand on that? How would you go about running your own DNS that wouldn't be affected by football leagues?
I don't think any of them will help in Spain case though, I believe the ISP/court choose to block the IP range entirely, which hit Cloudflare customers. DNS hijinks won't solve those.
It takes time, money and a strong legal team, but maybe IT companies maybe can put this together?
Used my digital certificate (which is installed in the browser), but AFAIK, you can use Cl@ve on that page above too.
In the past, I've cited BOE-A-2022-10757 (https://www.boe.es/buscar/act.php?id=BOE-A-2022-10757), done a reclamació for the repeated loss of lawful access on my connection, and a denúncia about a broader overblocking practice affecting access to lawful services.
Also, supposedly, we should be able to make claims to CNMC as well, but haven't figured out how. Also of course, been complaining to my ISP every time it happens too.
We've never guaranteed the right to free speech and because we haven't it's a slippery slope all the way back down to the furnaces of autocracy we sprang from.
The Spanish president has come out on record saying we don't deserve anonymity on the internet.
Some people deemed "russian assets" are not just censored, but stripped of ability to leave EU and prevented from being able to live in EU at the same time by financial sanctions, etc. Of course this doesn't happen to actual politicians in power, for whatever reason those never get sanctioned by EC, despite doing more "damage" than random blabberheads on twitter.
It's a mess.
"EU" doesn't censor anything, there isn't even any authority nor infrastructure that could do that.
Individual countries, like Spain, does have a bunch of censorship though, this is pretty clear and evident already. But I think if you want to share something useful or even informative, you need to add what country this experience of yours is about, because it's not true in any/every EU country.
I mean, didn’t El Salvador and Honduras go to war over football back in the 60’s? And I seem to recall there was a football match which helped precipitate the dissolution of Yugoslavia - national identities coalesced around football tribes.
Snail mail uses up physical space so it might get more attention, it would be hilarious to see news reports of truckloads of complaint mail being dumped in front of the whatever office.
This is a great idea, we definitively should make this happen! If people are curious on collaborating on something, reach out, email in profile (English or Spanish emails welcome!).
And when purchasing a product, there's no "bill of materials" telling you about the services it relies on, beyond "internet connection" at best.
I'm not saying this situation isn't bullshit, but the bigger problem is that CloudFlare is now "fundamental internet infrastructure". This is precisely the situation that the internet was designed to prevent.
Yesterday I got stuck in endless CloudFlare CAPTCHA's, trying to access theretroweb.com. I had to give up. Many such cases. I hate CloudFlare so much, it's unreal.
Right, but on the other hand, our constitution and laws are supposed to give us the rights to access a internet where the government cannot block entire companies who host websites, because a few bad websites are hosted there.
Not to mention all us freelancers, contractors and just in general computing users, who sometimes want to continue working although 90% of the country is watching football, we should be able to do so even if pirates use Cloudflare for shitty stuff.
I agree that Cloudflare sucks, people should avoid defaulting to putting Cloudflare in front of absolutely everything they do and I too get stuck at the CAPTCHAs sometimes. But that doesn't remove the fact that Cloudflare, just like every other lawful company, should be allowed to be visited during La Liga matches.
Geoff Huston discuss this a few months back. The economic incentives helps shape centralized internet, to the point that most of today's traffic is cache push and private peering between major providers, rather than network transit.
https://blog.apnic.net/2025/08/21/podcast-the-inevitability-...
Which kind of make sense, since with peering both end of the infra (if separate entity) can negotiate for better terms upfront. While the latter is basically unpredictable opex based on traffic shape and routing algorithm.
I think lots of countries block Cloudflare whole-sale.
Laundering IP addresses for (or against) shady purposes is, in fact, Cloudflare's whole business. It's a wonder Cloudflare isn't being blocked more often.
Without Cloudflare, you can censor whatever you want. If you have the support of an (undemocratic) government on your side, you can even DeDoS them, making sure that information critical of you cannot see the light of day.
Of course, the standard response against centralization is that the centralized entity can sneak backdoors and turn at the drop of a hat.
Maybe something like a signal-like model might be good, in that regard, as opposed to mesh networks.
You may like that the platform is open by default to everybody, but that's the obvious consequence.
Business-wise it's risky to deliver your service from IPs that also serves dirty content. Technical solutions exists, even if you want to stay on Cloudflare.
Solutions exist if this market is important to your business.
Needing to find solutions to a problem completely manufactured by sports and television is the problem.
Cloudflare could change their policy to take down quickly obvious abuse during live events. They could proactively check new customers before allowing public traffic.
People can vote against protecting property if they think it creates unreasonable effects.
Not sure where you got your stats but top website owners can easily deploy technical solutions to this issue.
We live in a complex word. This problem is not completely manufactured by bad people at sports and television companies. What should right owners do? Accept that content they own is streamed illegally, for profit, and not use recourses the law provides?
The fault here lies 100% with horribly designed IoT devices that turn into bricks when they lose internet connection.
What a wonderful idea!
Translation: go away kid, we're trying to make money here.
A VPN won't help against government blanket outages, where the target is complete control of communications, and attempts to circumvent may result in extreme penalty. In this case, where the government policy is to stop unauthorized streaming, and collatoral damage is acceptable, a VPN hosted in a more favorable location is likely to work enough. Afaik, I don't think Spain has the political appetite to block VPNs and such during football matches.
You can still fight the political issue with political means, but in the mean time, you can also get work done.
Unfortunately nobody is quite sure what appetite they have, because LaLiga is doing this all on the back of a relatively narrow judicial ruling that hasn't been reviewed in a long time
Obviously, everything can be cut off, but the point is that if encrypted something is allowed, there should be a way to get anything through.
What is this "sweet position" you talk about?
I was trying to refer to an actual rebel position, which is actors which use illegal practices to achieve their goals agaisnt institutions in place. Which might have the cool attitude imagery attached to it, but which is certainly not an easy one in reality.
What technical solutions can't change is the underlying social dynamics.
When the La Liga match starts, everything that's proxied via CF (including zero access reverse tunnels) stops working.
There's even a website made for checking if the match is on: https://hayahora.futbol/
You can check if your host is affected: https://hayahora.futbol/#comprobador&domain=docker-images-pr...
The effort required to change the situation is massive.
[1] https://en.wikipedia.org/wiki/Right_to_Internet_access
Pirates would rather not be blocked, so they create a new, disposable website for every game. Any blocking must happen fast.
Cloudflare would rather not block websites without a court order specifying the sites to be blocked.
The courts would rather not create a special fast lane through the courts, just to resolve a squabble between two huge corporations.
Funny enough, I work in IT and I've had to use a VPN to be able to do my job when soccer is on, but my two non-tech-savy family members that do watch soccer using pirate livestreams say that they've never had any issues with blocked streams.
But the point is that the measure does more to block legitimate use than illegitimate (in my experience). And next they want to go after VPNs. Wonderful.
Surely you understand now. Go about your business, poor person.
why would they?
> squabble between two huge corporations
I think this is just LaLiga using it's cultural and economical power, don't think Cloudflare or the courts should be making exceptions just so they can control how people watch football
Well, in this case, the alternative is all of Spain intermittently blocking lots of Cloudflare.
But if Cloudflare bows to Spain in this case, every jurisdiction will want to pile up lots of special case rules for Cloudflare to try and implement.
Cloudflare literally wasn't even a party to the ruling by which LaLiga has been compelling Spanish ISPs to do the IP-level blocking. They're just an affected third-party because the blocking scheme the courts have allowed LaLiga to impose on ISPs is on a per-IP basis.
Spain hasn't asked Cloudflare to do anything. Only LaLiga has acted like Cloudflare owes them a huge, expensive rework of their CDN's architecture for the purpose of censoring things for LaLiga purely as a favor to LaLiga. What LaLiga has over Cloudflare isn't a court order. It's a protection racket, or maybe a hostage situation, where court orders involving other parties are the gun held to the hostage's head.
Nor did I say they did.
The question was asked, "why would they [without an explicit order]" The answer is they probably shouldn't, but there's still an obvious incentive here.
Either they should police the content they serve themselves or they accept the right holders to do it (which sucks for everyone).
Also they certainly willing take all their customers as hostage, as they could certainly split their network into legitimate customers and shaddy ones so the blocking is not so impactful, but I guess they prefer to make it as impactful as possible to be able to complain.
Anyone can report illegal content on Cloudflare and Cloudflare will remove it. The pirate streaming sites pop up only in or just before the first few moments of the game, and LaLiga insists they must be removed instantly in order to prevent their losses. So what they actually want is preemptive removal without meaningful human review or anything else that could take 10 minutes.
That involves more than being responsive when someone reports abusive content or dropping bad customers. That requires becoming a censorship machine that preemptively treats all new customers as criminals, and probably having some unaccountable AI drive the censorship process. (That latter seems to be what LaLiga is pushing Fastly to do.)
That's beyond the legal obligations of infrastructure platforms, bad for the reliability of their service, and just a slice of what they'd have to do to rework their architecture to support this kind of preemptive censorship.
Yet this would actually be a better solution for everyone (except the pirates).
10 minutes seems like a reasonable response time that would allow a chance for human review. No football fan wants to have their viewing interrupted because they used a dodgy pirate site to watch it. Currently, pirates can simply use a VPN to get around the IP-level block while the huge collateral damage affects legitimate Cloudflare users.
Plenty of companies proactively take action against shady users, even if not 100% required under law. Youtube has content id, social media companies have "community guidelines", and ISPs have AUPs.
Looks like same old regulatory capture.
https://xcancel.com/eastdakota/status/2009654937303896492
Everyone looks bad in this conflict.
When the match starts, Movistar (a big ISP, but also a TV platform that streams legally football matches) sues itself in the following terms: "we, Movistar TV, demand that Movistar ISP blocks the following IPs that are being used to stream our matches illegally", on a special and urgent procedure. The judge tells Movistar-ISP to block the IP, which they do in seconds. Now replace Movistar with the biggest ISPs in Spain, and you have more than 80% of the country with Internet capped for hours (except if you know how to use some kind of tunneling)
As the pirates share the IP with so many sites, because the IP is actually a Cloudflare proxy, a big chunk of the internet goes down. Users complains, and Movistar ask Cloudflare to block the real IP and spare the rest. Cloudflare says that they cannot legally do that as no judge actually told them to.
Our Spanish judges are historically inept when talking about copyright, internet, file sharing and similar stuff. Some of them might be more updated, but there has been cases that they ordered some publications to surrender their lithographic plates, because a cover has to be retired as late as 2007 (https://www.elmundo.es/elmundo/2007/07/20/espana/1184937587....). So I don't think they understand much more about what is an IP other than "a IP is a number assigned to a computer". And Movistar is quite happy with that.
https://www.shadertoy.com/view/lscczl
Performing security verification
This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot. Incompatible browser extension or network configuration
India has consistently been at the top of the number of Internet blackouts anywhere in the world for years (Access Now keeps track of this through its KeepItOn project). These tend to be brief and localized, triggered by something as mundane as an exam or protest or local incident. It’s such a routine occurrence here that there’s even a reflexive response: mobile data works differently from other connectivity types, so go with that, try new DNS settings, rely on Telegram instead of WhatsApp when the latter fails you, and always have a list of mirrors.
What’s fascinating about this case is that it’s identical except for who is pressing the button LaLiga, a privately owned entity, in place of the government.
AFAIK, they're not doing "blanket IP blocking", they're intercepting requests based on DNS and IP, and try to serve their own certificates and their own content. Obviously, in most cases it fails, as the certificate doesn't match the site, so the browser rejects it, but as far as I can see and tell, there is no "blanket IP blocks", more like "DNS and IP interception".
The difference doesn't really matter in practice, sucks regardless, but I thought I'd clarify for the ones who are not experiencing these blocks themselves at least.
Someone needs to write a heist movie set in Spain where a key part of the plan is they steal something while La Liga is blocking some key security route.
For context, Spain is a full constitutional democracy, subject to the jurisdiction of the European Court of Human Rights, with a free(ish) press, independent judiciary, and regular elections — none of which Assemblea itself disputes, because it participates in all of them. The events OP is referencing (the 2017 independence referendum aftermath) were reviewed by European courts, and the outcomes were, shall we say, not quite the narrative Assemblea sells on its website.
If there are genuine, documented human rights concerns, I'd welcome impartial sources from the Supreme Court or the ECHR.
What I'd push back on is treating a political lobby's own press releases as neutral reporting. You should do better than that here, OP.
https://www.ohchr.org/en/press-releases/2022/08/spain-violat...
(why? Let's be honest: Catalunya would benefit enormously from independence, but when the economy goes well, as it did from 2001-2007, they're fine. After that the situation worsened again. The situation is simple: Catalunya has a much better economy than Spain and could maintain government spending, whereas being part of Spain, they need to cut social spending)
The Spanish government has violently repressed this, attacked the people, arrested politicians, tried to threaten other EU nations with invasion (yes, seriously, the current government has a few "rough edges", even if I would agree if someone said that any other party would be worse) unless they arrest Catalunya politicians (then did nothing when they told them to go f themselves), and this mostly with the agreement of regular Spaniards.
Given what is happening in the EU (10+ years of slowly but unrelentingly worsening economy) the situation is slowly worsening again.
I agree the Rajoy government's handling of this was very problematic, but the rest of this isn't really accurate. And the morals of the economy argument is terrible - the rest of the country needs us, so we should cut them off? The same argument would apply for Barcelona cutting off the rest of Catalunya. It's not a good direction.
Spain quietly drops probe into “Russian meddling” in Catalan referendum: https://www.wsws.org/en/articles/2021/06/21/cata-j21.html
Oh and both are pro-China too. I guess they're trying to open the next huge can of worms preemptively. Why wait?
So, yeah, I doubt Ukraine is happy with either side in this conflict, and Catalunya separatists are a somewhat more desperate than Madrid. Doesn't really change anything about the conflict.
My game's server is blocked in Spain whenever there's a football match on: https://news.ycombinator.com/item?id=45358433
Spain’s LaLiga has blocked access to freedom.gov: https://news.ycombinator.com/item?id=47114235
I'd like to suggest some steps that might/should be followed, which I will not pursue personally but in my defense - I do not live in Spain and not affected.
1) (first! low-effort) Somebody should create any space on the internet, where such anecdotes might shared and probably people with common goals of fixing internet access in Spain will meet. E.g. telegram group, discord channel, subreddit...
2) probably create wiki with related research: legal framework and possible actions etc
3) Raise public awareness. Create a resource/website with schedule of past and future "semi-blackouts", simple explanation of possible effects a layman may notice etc
4) Explore legal actions that might be taken. How this issue might be forced to be discussed by politicians? For instance I know that Portugal has official mechanism to put forward petitions, that will be discussed in parliament if get enough votes [1]
Space of possible demands in such petitions is vast. For instance:
- Make LaLiga compensate partly price of internet access
- Force LaLiga to include education notice in the beginning and the of translation with title like "Start of reduced internet connectivity" / "End of reduced internet connectivity"
[1] https://participacao.parlamento.pt/initiatives/
https://hayahora.futbol
Cloudflare’s authoritative DNS uses EDNS Client Subnet (ECS) to return different IP pools based on where the query originates. Spanish resolvers get IPs from a range that La Liga blocks. If your recursive resolver is physically outside Spain (or you use DoH/DoT to tunnel to one), Cloudflare returns a different, unblocked pool.
AdGuard DNS works well for this.
Sometimes it works, sometimes it does not, but doing nothing is never an option if you disagree with what they're doing. To think that doing nothing is better than something, that's incredibly naive.
You're right, it possibly has the same effect. How could we figure out what's the actual answer in practice?
Unfortunately, it does not make sense for the representatives to invest millions of infrastructure, just because of a single event happened. :(
For everyone else, small and big, this is the weekly reminder to not use Cloudflare for user-facing access to anything.
Cloudflare is one of the few companies who can handle that for relatively cheap, Docker could not just "run their own" and have it even be compareable.
Docker must be handling absolute massive amounts of traffic on their (free) docker hub, Cloudflare is one of the only companies in the world willing to handle that is able to handle that cheaply. It’s no secret that Docker is struggling financially. So surely you’re not blaming Docker as well for using Cloudflare?
There are alternatives and any search engine can lead you to them
This is also not new behaviour - Theo posted a YouTube about it nearly a year ago[1].
[1]: https://www.youtube.com/watch?v=1-geGEYEw7g
https://bandaancha.eu/articulos/telefonica-consigue-bloqueos...
(The trial was initiated by LaLiga and Telefonica...).
"Telefonica" is the (exclusive) distributor for the rights of streaming the matches, and is only (of course?) the main consumer (and business) Telco in Spain: they are in a game they cannot lose. This is such an abuse and no government (this, past, whichever) has done anything about it.
Something that confused me for a while was the path "docker.io" used for pulling containers. There is not actually a container registry at "docker.io" - rather docker and podman are hard coded to convert it to either "registry-1.docker.io" or "index.docker.io".
I use a little script[0] to automate that when deploying some personal projects, but really it could be as simple as `docker save`/`scp`/`docker load` (especially for a one-off situation or when the images are small).
[0]: https://github.com/mkantor/docker-pushmi-pullyu
The last domestic TV deal they signed recently was worth $6B for 5 seasons or so, which is what you are proposing they buy.
In enterprise value terms that $1B/year growing 6 %YoY is worth a lot more than $5B.
In contrast Cloudflare has a $2.5B revenue albeit growing much faster but also has much smaller earnings or free cash flow, I.e. money they are not spending to make their current revenue.
They make about $25m a year in profit. Cloudflair actually looses a small amount of money on 2.5x the revenue. However, Cloudflairs market cap is about 100x that of RM's and that's because they have a growing business, in a growing industry and can easily become profitable when needed. That's probably not possible for RM and their very pricey lineup of players.
Real Madrid owns the Bernabeu a valuable piece of real estate in the heart of Madrid and many other assets the Real Madrid brand is very monetizable .
Sports team have been consistently growing businesses in every major sport in both Europe and US. Comparing a sports team and SaaS company is hardly going to be apples to apples with different asset , revenue, brand and monopoly and strategic profiles.
——
The risk to the league due to piracy is the value of the television deal. The buyer paying $1B/yr (DAZN) is the reason for this enforcement.
If Cloudflare wants to buy this problem away that is what they need — The $1B deal growing 5-6% YoY and get into the streaming business .
Prime alone is expected to spend $4B on live sports rights this year. It is very expensive space with everyone from Apple to Google and Netflix to sovereign funds going deeper every year .
The streaming revenues otherwise aren’t expected to be massively grow so this is the content play that is least risk - compared to investing in say 4-5 blockbuster movies or tv series this is far more predictable and consistent revenue stream.
[0]: https://news.ycombinator.com/item?id=47750927
https://news.ycombinator.com/item?id=47480926
The situation every weekend is getting worse and worse. Honestly, I cannot understand how any goverment who wants freedom for its citizens can allow to block internet access to a whole country only because a private football company asks for it. I guess LaLiga is the 4th statement in Spain...
A probably will get even worse the situation with Fastly entering the equation: https://www.fastly.com/press/press-releases/fastly-and-lalig...
Humankind is not doing well with implementing new policies. We should really strive for each new policy (like in this case - blocking access to some parts of internet during soccer games):
- Consider running policy in small scale scenario (e.g. testing blocking in small parts of Spain before whole country rollout)
- Implement channels to gather info from those who are faced with results of policy implementation (in this case: the op got webpage with description why the page is blocked - a bit of sanity! It would be better if it was served with HTTP code 451)
- Policy instructions
- When deciding on policy put a date at which policy should be reconsidered and revised using data collected during the time when it was in effect
- ... and some more I have not thought about.
Let's strive to cultivate this principles in all life areas where we can affect how new policies are implemented.
(edit: linebreaks)
It isn't even an authoritative regime censoring something, but much more silly.
But no, it's apparently to stop piracy!? Turning off half the internet, and mostly the legitimate parts at that (since when do pirates use cloudflare?) seems like probably the worst method to go about it.
Someone ought to start streaming those games illegally without using cloudflare just to demonstrate how stupid this policy is
Oh, the icing on the cake is that they already do. While my whole dev stack gets shut off every weekend, my neighbour watches pirate futbol streams just fine - not only is it a stupid policy, it's an ineffective one, and the pirates bypassed the bans ages ago
Talk about unfair business practices!
What Spain does is basically censorship and it's very poorly executed. The docker image registry is only one out of the many collateral victims of this stupid law.
Basically? It is censorship, with huge collateral damage and regardless of how much we complain or share evidence that the blocks are actually financially harming us, no one seems to care as long as La Liga gets to freely block whatever hoster of websites as they wish.
womenonweb.org for example was inaccessible for years, just unblocked some years ago. During the latest Catalan independence referendum, the Spanish government blocked a bunch of websites, not the very least the official website of the referendum itself.
This is just one of the most recent cases, and so far the one with widest regular impact.
https://www.techradar.com/vpn/vpn-privacy-security/cloudflar...
Or can this be avoided by using an alternate DNS?
And even if you managed to get them all beforehand, some VPN providers will adapt and keep some servers in reserve, putting them online just as you managed to block the previous ones. Getting around internet censorship is a large chunk of their business, and some are really good at it.
And then they still need to monitor hundreds of VPN providers for whether they have new IPs, which is not neccssarily as easy as just grabbing a list of them. Once they have some, they then need to forward them to the ISPs and ask for them to be blocked. Their process is significantly less friendly to automation.
No country ever won this fight short of total shutdown/disconnects.
Some countries also throttle pretty effectively. So you can connect but if you're trying to do more than read Hacker News it's not very usable.
Big companies don't hide their VPN ASNs. Obscure, for sure, but getting a good list isn't hard. Usually they get blocked.
Smaller companies may pass under the radar, and have higher tolerance for risky strategies.
The fringe providers are the problem. They aggressively change IP ranges, front-vs-obscure ownership, and play dirty. Shady folks will resell residential ranges. End-users often get tainted goods.
... and you still have the collateral damage game when VPNs host infra with big cloud providers vs colofarms vs self-host, etc.
But anyone who is pulling docker images in a sunday afternoon while the rest of the country is glued to their screen to watch a football game or enjoying a sunny sunday outside having beers and tapas and what not should be capable of setting up wireguard.
Spinning up and provision a VPS to act as a VPN exit node in some other country raises the bar 10x or more.
Yes, they block IPs belonging to CDNs (CF including R2, BunnyCDN, CDN77, Fastly, Alibaba, Akamai even)...
So much for digital sovereignty :-)
But come on, this can't be true. I wonder how many other people in IT wasted hours on issues and tickets to find out it is due to a football match taking place. Admittedly, chances are low, as football matches are usually outside of office hours.
It took me a while to debug.
Was working on mobile.
Was not working on desktop.
Mobile was using mobile internet from the UK.
Made a meme about it: https://x.com/marsXRobertson/status/2043789192946163734
I think changing your default DNS servers to Google 8.8.8.8 or Cloudflare 1.1.1.1 might bypass the spanish sunday ban on Cloudlflare.
macOS + Cloudlfare 1.1.1.1 https://developers.cloudflare.com/1.1.1.1/setup/macos/
Google 8.8.8.8 https://developers.google.com/speed/public-dns/docs/using
But you can just use a VPN.
But of course, Cloudflare rather prefers to hold their actual large customers (who don't have much of an alternative to CF) and everyday Spaniard users hostage.
How do you propose customers ought to be vetted? Why should a host be expected to take on the duties of a hall monitor? Isn't that the judiciary's job?
I think it is actually Spain using their residents as hostages in an attempt to extort Cloudflare and other large providers. The current situation is best described as blatantly corrupt regulatory capture.
It's driving up the cost and expenses. Operators of legitimate sites don't have to worry during that probation time about anything with the exception of customers in Spain during LL match hours.
LL has ~10 matches / weekend (Fri/Sat/Sun/Mon), that means pirates have to have about 40 domains/CF integrations per month plus more in standby - and more, for longer probation periods.
> How do you propose customers ought to be vetted?
I dunno... stuff like basic KYC measures would be a good start. Copies of ID cards. Government business licenses. Private entities (credit bureaus). Even phone number verification is a serious hurdle for malicious actors, and it ties activities to real world identities that can be held accountable.
Dangerous stuff (e.g. streaming) could only be made available upon a security deposit.
> Why should a host be expected to take on the duties of a hall monitor? Isn't that the judiciary's job?
No, and that we let ISPs get away with ignoring abuse@ emails is part of why the Internet is such a nasty place these days. You need a license to drive a car on public roads, you need an expensive license to fly a small plane, and you need a goddamn massively expensive license to fly a widebody aircraft. So why shouldn't you need to pass some set of verification before you get access to inarguably the Internet's most powerful data pipes?
That's an interesting point. Are their margins so slim that they can't afford less than ~$50 per domain? I'm not familiar with their revenue model.
This is the sort of thing that could be done via the legislature if Spain were serious and playing by the rules. They could require ISPs to do DNS filtering based on domain age during matches. If they really wanted to do service level filtering they could require hosts such as CF to perform geoblocking in a similar manner during matches.
> Dangerous stuff (e.g. streaming) could only be made available upon a security deposit.
Let's set aside for a moment that I think this suggestion is completely absurd. Are these sites using some prepackaged streaming solution? Do you not realize that I can stream video from any machine using software I control? To an approximation the only thing required to scale streaming up to lots of customers is raw bandwidth. If you don't accommodate seeking you can potentially serve thousands of simultaneous streams with a single cheap VPS (in practice this won't work because a cheap VPS won't have a 100 Gbit pipe).
> So why shouldn't you need to pass some set of verification
Since when have you needed a license or verification to publish? You're acting as though a global impressum requirement is the natural state of affairs. Your demand is an affront to free society.
> we let ISPs get away with ignoring abuse@ emails
That seems like an entirely separate matter, if it's even true at all.
> No
Ah yes, a rousing argument. Obviously you must be correct.
You've failed to make a convincing case as to why deciding what is and isn't permissible isn't the job of the judiciary. If Spain wants to change that then they need to pass laws to that effect but in practice those won't have global reach. Thus they might (for example) engage in international lobbying efforts to incorporate a DMCA equivalent for illegal streaming into the global copyright regime.
Failing the above it is Spain that is in the wrong here and I'm happy to see that CF isn't going along with their overbearing and entirely unreasonable nonsense.
It's not (just) about driving up the financial cost, that works out decently to combat "normal" spam. The thing is, it drives up the organizational effort - you need to acquire and maintain a constant fresh stream of fake identities, payment credentials and the likes.
> Let's set aside for a moment that I think this suggestion is completely absurd. Are these sites using some prepackaged streaming solution? Do you not realize that I can stream video from any machine using software I control?
At the moment, the pirates are streaming through Cloudflare, which is why CF is being targeted with the mass bans in the first place.
And yes, Cloudflare could go and say "we block everything looking like m3u8 HLS, DASH or other forms of video streaming for young accounts". Cloudflare has enough AI to dynamically detect and ban abusive clients - you can't seriously assume they could not detect someone running video streams on the server side.
> Since when have you needed a license or verification to publish? You're acting as though a global impressum requirement is the natural state of affairs. Your demand is an affront to free society.
One man's freedom ends where another man's freedom begins, society cannot survive without an "immune system" to ward off abuse, and Cloudflare are an accomplice to a whole lot of abusive behavior that is worthy to call out and confront.
> That seems like an entirely separate matter, if it's even true at all.
Have you ever heard about the term "bullet-proof hosting"?
Domains aren't free to begin with so I'm not sure what your point is. You claimed a small hike would price them out so I asked about their revenue model.
> And yes, Cloudflare could go and say "we block everything looking like m3u8 HLS, DASH or other forms of video streaming for young accounts".
Yes, they could start doing DPI and arbitrarily censoring things similar to the Chinese. As I previously stated your position is an affront to free society. You ought to be ashamed to advocate such viewpoints.
Also it would not go as smoothly as you seem to think. Without access to the plaintext stream they would be guessing using heuristics and there would be at least some false positives.
> One man's freedom ends where another man's freedom begins
A vacuous rebuttal seeing as violating IP law doesn't infringe on anyone else's freedoms. By the same logic an impressum for printed works could be justified on the basis of people who publish "harmful" viewpoints such as those that might lead to social discord.
I would really like to understand more about the process that they should follow but didn't / followed but didn't satisfy them / doesn't exist, in order to remove infringing websites quickly from CloudFlare.
They just refuse to take down random things that some media company representatives send their way, without a court order or any oversight. And this is a good thing.
>And this is a good thing.
Disagree. Demanding a court order for every single clear-cut case of infringement reported by the rightful owner of ephemeral content that is a infringed upon hundreds of times every day, causing nearly a billion dollar of losses per year... This is what the ISPs were trying to do and LaLiga successfully sued them, creating the modern fast-lane that CloudFlare complains about. Furthermore, unlike CloudFlare, the ISPs were not even profiting from the illegal content! This is a huge difference in the Spanish legal system. This will not end up good for them or for the open Internet they claim to defend (presumably as an excuse for taking their cut from cybercrime.)
Clear-cut by whose judgement? Surely not the plaintiff, who has demonstrated no care for collateral damage. Witness the many, many fraudulent DMCA takedowns that are regularly sent, for a demonstration of what happens when prospective plaintiffs are given a power of "guilty until proven innocent".
> causing nearly a billion dollar of losses
I thought we were long past people believing the funny-money fake numbers claiming every download is a lost sale.
Cloudflare, rightfully, said that was ridiculous and unreasonable.
A Spanish court, wrongfully, decided to let LaLiga block all of Cloudflare.
Courts orders are, rightfully, slow. A court order is a serious thing and we shouldn't be wasting judges' time and resources to determine if hundreds of domains in CloudFlare, during every single match, are infringing on LaLiga. This is why the Spanish ISPs have a fast-lane with LaLiga to block infringing websites quickly. Why is it ridiculous and unreasonable? If LaLiga starts abusing this power to attack competitors or do anything malicious they will lose that power instantly.
Fastly understood the problem and will start running detection software to ban infringing livestreams in real time. https://www.laliga.com/en-GB/news/fastly-and-laliga-team-up-...
What's CF's solution?
Because everything demonstrated so far has suggested that LaLiga is reasonable and measured? Courts exist for many reasons, among them that we do not trust plaintiffs to always be right or reasonable.
By way of demonstrating that such power is unacceptable, it sounds like LaLiga is also trying to get Spanish ISPs to block all VPNs whenever a game is on.
This is not an entity that can be trusted with power. This is an entity that rightfully should take its whining to a court who can keep its abuses in check. (Unfortunately, the Spanish courts also don't seem willing to keep its abuses in check, which brings us back to the collateral damage problem.)
> Fastly understood the problem
No, Fastly accepted the blackmail that Cloudflare refused.
What LaLiga did was get some VPN providers (NordVPN and ProtonVPN) to start blocking pirate streaming websites. They're not trying to block VPNs themselves unless there's other news I didn't find.
https://news.ycombinator.com/item?id=47739695
It is not the job of an intermediary ISP or VPN to help construct a country-wide firewall. If a company wants to go after streaming sites, go take down the streaming site. If the streaming site is out of its jurisdiction, talk to the other jurisdiction. If the that jurisdiction does not care, give up and lose.
https://hayahora.futbol/#sobre-los-bloqueos&domain=taoofmac....
They're blocking the CDN too, not just R2.
This is not an issue under the civil code (civilian issues), but something to be dealt under penal (criminal) code.
In Spanish
https://www.fiscal.es/memorias/memoria2020/FISCALIA_SITE/rec...
Oh, and BTW, LaLiga has just partnered with a CF rival.
Now CF can just sue both like hell because of unfair competition:
https://nitter.tiekoetter.com/xataka/status/2042658662850724...
https://x.com/jaumepons/status/1904906677335245294
One relevant would be Yildirim v. Turkey where court ordered blocking access to all Google sites because there was one that where someone insulted the memory of Atatürk. This was due to request from Telecommunications Directorate. This then caused the appellant's website to get blocked as well.
Another one would be Vladimir Kharitonov v. Russia.
But it's among the fastest growing in the EU? Granted, part of this is starting from a low base, but it's hardly "in shambles"
https://data.worldbank.org/indicator/NY.GDP.PCAP.KD.ZG?locat...
The figures I cited are for GDP per capita, which accounts for population growth. Moreover immigration should have the opposite effect of depressing per-capita GDP, because immigrants typically take lower skilled jobs, dragging overall productivity down. So if anything, the figures are artificially depressed, not inflated.
Technically you can say that they have been in a depression for the last 4 years and counting as their functional growth rate (accounting for inflation of the Euro) is negative over that period (down about 10% inflation adjusted).
That conclusion does not seem to check out just by eyeballing the charts.
https://data.worldbank.org/indicator/NY.GDP.PCAP.KD?location...
It shows a divergence from the EU back in the 2010s, but afterwards is recovering at the same pace or even faster than the EU. Could be better, but not "in shambles" either.
> The Spanish economy shrank by 8% in 2023
The Spanish economy grew by 2.5% in 2023 - https://www.idealista.com/en/news/financial-advice-in-spain/...
> So all those gains in the last couple of years are just catching up to 2023
Since there was no drop, there was no "catching up". 3.2% growth in 2024 (https://www.caixabankresearch.com/en/economics-markets/recen...) and estimated 2.8% in 2025 (https://tradingeconomics.com/spain/full-year-gdp-growth)
> Add in inflation and the average Spaniard has lost 10% of their income over that period (2023-now).
You're right that there was high inflation in 2022-2023 (like everywhere in Europe). However, wages grew and even outpaced inflation in 2024 (https://santandertrade.com/en/portal/analyse-markets/spain/e...), real incomes did not collapse by 10% over 2023–2025. Another fun fact, employment has been growing strongly, unemployment has been falling.
> The median citizen losing 10% of their income in real economic terms does qualify for the vaunted "shambles" title.
Not really, Spain is "outperforming peers" (https://www.euronews.com/business/2025/03/26/the-spanish-eco...) and is currently outperforming major EU economies like Germany and France.
Before trying to respond with some more outrageously incorrect claims, please learn to provide any sort of source before embarrassing yourself further.
I think most people care more about these things than the GDP statistics tbh.
Decentralised infrastructure: good
Centralised infrastructure: bad
Good and bad for you, of course. For the big companies selling and controlling this stuff, it's vice versa.
Just stay alert and don't chain yourself with big tech dependencies. The reason Git is great is its decentralised nature. If you got so far, why cripple yourself by running your traffic through a single American company like Cloudflare?
So, if you want them to build stuff, ask yourself, are there any "Docker Registry" startups out there. If jsdelivr/globalping is not keeping you busy enough... there is an idea
If there's something you'd want out of a registry that you think the market would want, I'm all ears.
Globalping and jsDelivr took years to gain a meaningful user base
I think your name alone carries significant weight in the industry and you have built a very large community.
If you even vibe code something with, you will get a stupid amount of money thrown at you and a contract that bounds your existing projects and the next 3-5 years to a particular company as project lead.
Here is a list of acquisitions Cloudflare made recently: https://blog.cloudflare.com/tag/acquisitions/
Most of these companies did not have a half dozen paying customer or even a fully fleshed-out product before they were acquired.
1. If nix fails to pull anything, it builds (up to and including Linux kernel and compiler).
2. Nix has several ways to build OCI images, some even faster to assemble and slimmer output of official Docker tooling.
3. It is allowed several providers for same artefact to resolve pull.
If nix fails to pull things from its binary cache, it will download the "sources" of the derivations, which are hosted in various places and so it's even more likely an overly broad block impacts one of them.
This football block very well could also cover GitHub, cdn.kernel.org, and so on, so nix building things could fail just as easily.
The solution isn't to use something else which can download source code from 100s of sites across the internet to compile as a fallback, it's to not use internet which sporadically blocks sites hosting developer assets.
The solution is not technical, it's political.
2. Even if kernel.org or GitHub.com will be blocked, it likely than not it already was cached by nixos org cache or community cache or cachix or by your CI or by you workstation.
https://x.com/ahachete/status/2035783292549755228
It comes in waves, and it’s not enough to affect anything, but it’s very weird because when I did some digging by looking at the ASN there was actually only one active IP address and if I browse to it I get someone’s Synology NAS login page.
Why would someone setup their NAS to randomly keep pinging my homepage?
regards: spanish authorities (who are watching the sportsball and so are better spaniards than you!)
Netblock do not work and will never work.
They should have used a cookie or something else that does not require asking me every few minutes to prove once more that I am not a bot.
There was a time when Cloudflare had become less intrusive, but for the last months it has begun again to intervene almost each time when opening some pages.
There is no doubt that anti-bot protection can be implemented in a better way than Cloudflare does, but presumably the alternatives would consume more resources on their servers, so probably they choose whatever minimizes their costs, regardless if that ensures maximum discomfort for Internet users.
> every uBlock filter enabled and Cookie Auto-delete
Hmm
They're in the walls!
It’s precisely because CloudFlare isn’t responding like other CDNs to reasonable demands to cut off pirate origin sites that this mess exists. If they reacted quickly to remove configurations that are obviously facilitating copyright infringement, Spain wouldn’t resort to full scale ASN blocking.
How do we know it’s CloudFlare? Because other CDNs like CloudFront, Akamai, Fastly, etc. respond to takedown demands and aren’t being blocked. (Those also cost money and require customer identification.)
In an escalating war between the state and a corporation, the state will always prevail if they have the public’s backing. In Spain it’s clear that most people are happy to watch the match through legitimate channels even at the cost of blocking CloudFlare.
Apropos of anything else, CF is (reasonably) requiring a court order to remove offending material rather than just "well, company said so, so eh, just do as they say". La Liga complains that "oh, that's too slow for what we want" and just got a blanket ruling.
I am not a fan of CF but your argument seems to be "CF should just roll over any time someone says "hey, delete this", because, obviously, everyone knows it's problematic, right? Right?".
CloudFlare uses legal chicanery to try to subvert the DMCA by claiming that because they’re not the origin server, they’re not subject to takedown demands. So far no court has told them to knock it off. I expect that day will eventually come. Every lawsuit against them to date has ended in a settlement because CloudFlare would rather pay up than get an unfavorable ruling on the books.
CloudFlare has consistently treated loss of DMCA safe harbor protection as a material business risk; it’s been cited in every SEC filing from the 2019 IPO S-1 through the FY2025 10-K.
You'd think so, but no.
DMCA came into effect 28 years ago. All those decades, all those billions of takedowns, and you don't even need the fingers of one hand to count those who've been hit with perjury for a false takedown request, because the number is ... zero.
See 17 U.S.C. 512(c)(3)(A):
"(A) To be effective under this subsection, a notification of claimed infringement must be a written communication provided to the designated agent of a service provider that includes substantially the following: ...
"(vi) A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed."
In other words: someone issuing a notice of infringement relating to a Disney work must declare under penalty of perjury that they represent Disney. They don't have to declare under penalty of perjury that the work is in fact a Disney work, that the title is correct, that the use in question is not fair use, etc.
This would explain why you're not seeing what you expect to see.
Both blanked IP blocking and creating single points of failure are bad.
I'm not from Spain and instead of Spanish ISP I get a block from CloudFlare.
Now take a wild guess: which one is bigger - some Spanish ISP or CF?