TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Changes to accessing and using Geolite2 databases

172 点作者 anandchowdhary超过 5 年前

18 条评论

saurik超过 5 年前
From CC BY SA 4.0: &quot;No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.&quot;<p>GeoLite2&#x27;s new EULA &quot;incorporate[s] into this Agreement by reference&quot; specifically the CC BY SA 4.0 (&quot;Creative Commons Corporation Attribution-ShareAlike 4.0 International License&quot;) with a statement that this EULA (as well as their data processing addendum DPA, privacy policy PP, and website terms of service WT) take precedent in case of conflict.<p>&quot;This Agreement controls in the event of any conflict with the above-referenced documents. Thereafter, for any conflicts among the above 4 documents, the priority and precedence of interpretation is DPA, PP, WT and Creative Commons License.&quot;<p>The EULA then has a number of what are <i>literally</i> called &quot;additional restrictions&quot; (omg), which restrict (to summarize) 1) how you distribute it (with some kind of weird statement saying &quot;where not inconsistent with the other terms of this Agreement, as in the Creative Commons License&quot;, which seems to invert the prioritization?! I don&#x27;t know what to do with this...), 2) how you secure your distribution (which I guess precludes any ability to distribute the database along with an application? this is now only for backend use?), 3) that you will destroy old copies of the database (which is pretty egregious per CC BY SA, but I can appreciate this is likely the goal of this new EULA for CCPA compliance), and 4) that you won&#x27;t send personal data to MaxMind (was anyone doing that before? ;P).<p>So, I don&#x27;t understand the goal then with respect to &quot;incorporat[ing] into this Agreement by reference&quot; the CC BY SA if it is no longer a license agreement even remotely compatible with CC BY SA. Like, I was expecting this EULA to be an unrelated license, not some attempt to provide an awkwardly incompatible set of provisions. I now need to send this EULA off to my lawyer, who is probably going to come back with something like &quot;we recommend you don&#x27;t use this for any purpose unless we can get legal clarification&quot;.
nahikoa超过 5 年前
Wait a minute, now that I&#x27;ve registered for Maxmind there is a <i>Do Not Sell My Personal Information Requests</i> page with the text:<p><i>The following IP addresses are associated with valid &#x27;Do Not Sell My Personal Information&#x27; requests as required by applicable privacy regulations, and have been removed from (or will be removed from the next releases of) the GeoIP2 and GeoLite2 databases. None of the IP addresses listed or contained within a listed network may be used for advertising or marketing purposes.</i><p>If I had sent Maxmind a request for data removal, the last thing I would expect is that my IP address would be shared with any internet user who bothered to create a Maxmind account. Even if this page were removed, it might not be difficult to obtain the opted-out addresses by doing a diff between GeoIP2 free releases. Perhaps a search for narrow slivers of addresses removed that were previously in California?<p>Law of unintended consequences for CCPA? Bad implementation for CCPA compliance? What interesting things could be done with a list of publicly available list of opted-out IP addresses?
评论 #21916925 未加载
crazygringo超过 5 年前
I&#x27;m glad this was posted here because I never would have heard about it otherwise, until one of my sites&#x27; monthly downloads would have broken.<p>But I still can&#x27;t quite figure out if anything&#x27;s changing technically except a new file location that requires an account to access, and new license terms -- or is there something else?<p>If someone requests a &quot;do not sell&quot; for their IP address that is in the middle of a range... is the range being split in 2, and skipping that address? Or are the ranges staying the same, and is there a separate &quot;blacklist&quot; of some kind that says, if the IP is any of these individual addresses, it&#x27;s against the law to geolocate? And is that blacklist in the same file, or something to do with &quot;we will... communicate all valid “Do Not Sell” requests to you as we receive them&quot;?<p>Wish this post were both clearer, and that it had been announced at least a couple of months in advance, rather than less than 2 weeks before taking effect today. (Still, I can&#x27;t complain too much -- it&#x27;s free so I&#x27;m just glad the public databases exists at all.)
评论 #21916334 未加载
评论 #21916128 未加载
dsign超过 5 年前
I&#x27;m not sure I understand how the logic of this works.<p>For those that don&#x27;t know, GeoLite2 databases are for the most part prefix trees on IP address space, they <i>can</i> contain concrete IP addresses, but more often they just map an IP address range to some metadata. This is particularly true about GeoLite2, which is a very coarse database.<p>To me, this is equivalent to a database saying in which state is a given zip-code. How can that imply any kind of personal data?
评论 #21915607 未加载
评论 #21915893 未加载
Eikon超过 5 年前
Interestingly enough, some of the information maxmind is providing can be found in RIRs databases, such as RIPE for instance: ftp:&#x2F;&#x2F;ftp.ripe.net&#x2F;ripe&#x2F;dbase&#x2F;split&#x2F;, ARIN: <a href="https:&#x2F;&#x2F;ftp.arin.net&#x2F;pub&#x2F;rr&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ftp.arin.net&#x2F;pub&#x2F;rr&#x2F;</a><p>This is the same information than can usually be accessed using the &quot;whois ip_address&quot; command.<p>I wonder how this is going to be handled as it&#x27;s necessary that this information remains public for network operators.<p>Would ping &#x2F; mtr &#x2F; traceroute need to be banned on a per-ip basis too as these tools can be used to triangulate?<p>The whole thing feels like &quot;please remove my address from maps, it&#x27;s private data&quot;, well yes, ok...
评论 #21918441 未加载
stevenicr超过 5 年前
Well this sucks.<p>I depend on these to keep thousands of user&#x27;s ips private. IPGeoBlock on many of Wordpress installs keep a lot of bad bots (and humans) out - and there are already options baked into that plugin to query several online DB&#x27;s with the user IP to find country code... Most of my sites that allow other users to login, I keep their data private by telling ipGeoBlock to download the DB onto our server, check that, and NOT query the other online services.<p>Sure would be nice if you could still provide GeoLite2 Country GeoLite2 ASN<p>just remove all the USA ones :) - then I could have it query the downloaded DB if it finds a result block them - and if not result then let them try to login..<p>So they are going to offer the DB if registered and agree to whatever so called terms.. we should be able to get someone in a country without a jurisdiction that considers USA agreements legal - to get the DB and put it online right?<p>having to sign up with maxmind alone is reducing privacy for me - I guess unintended consequences - but sheesh!
评论 #21917982 未加载
mpetroff超过 5 年前
The Wayback Machine has copies of the last CC BY-SA 4.0 version:<p><a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227182209&#x2F;https:&#x2F;&#x2F;geolite.maxmind.com&#x2F;download&#x2F;geoip&#x2F;database&#x2F;GeoLite2-City.tar.gz" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227182209&#x2F;https:&#x2F;&#x2F;geolite.m...</a><p><a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227182412&#x2F;https:&#x2F;&#x2F;geolite.maxmind.com&#x2F;download&#x2F;geoip&#x2F;database&#x2F;GeoLite2-Country.tar.gz" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227182412&#x2F;https:&#x2F;&#x2F;geolite.m...</a><p><a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227182527&#x2F;https:&#x2F;&#x2F;geolite.maxmind.com&#x2F;download&#x2F;geoip&#x2F;database&#x2F;GeoLite2-ASN.tar.gz" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227182527&#x2F;https:&#x2F;&#x2F;geolite.m...</a><p><a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227182816&#x2F;https:&#x2F;&#x2F;geolite.maxmind.com&#x2F;download&#x2F;geoip&#x2F;database&#x2F;GeoLite2-City-CSV.zip" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227182816&#x2F;https:&#x2F;&#x2F;geolite.m...</a><p><a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227183011&#x2F;https:&#x2F;&#x2F;geolite.maxmind.com&#x2F;download&#x2F;geoip&#x2F;database&#x2F;GeoLite2-Country-CSV.zip" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227183011&#x2F;https:&#x2F;&#x2F;geolite.m...</a><p><a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227183143&#x2F;https:&#x2F;&#x2F;geolite.maxmind.com&#x2F;download&#x2F;geoip&#x2F;database&#x2F;GeoLite2-ASN-CSV.zip" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191227183143&#x2F;https:&#x2F;&#x2F;geolite.m...</a><p>And the last copy of the download page before the download links were removed, for reference: <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191222130401&#x2F;https:&#x2F;&#x2F;dev.maxmind.com&#x2F;geoip&#x2F;geoip2&#x2F;geolite2&#x2F;" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191222130401&#x2F;https:&#x2F;&#x2F;dev.maxmi...</a>
评论 #21920791 未加载
evantahler超过 5 年前
This is fascinating and I’m sure will have lots of far-reaching effects for the courts to chew on... For example, do I “own” the IP address that my ISP assigned me? Is it really my PII? If enough people ask to be removed, have I harmed the ISPs property? What about dynamic IPs? I like that I know have the power to opt-out... but will it last?<p>As a developer, thinking about this is a great mental exercise for switching my thinking from “use public datasets” to “use user opt-in data” - what would I have used IP-&gt;GEO info for before? Guessing a user’s language? I can use Accept headers. Guessing a user’s real location? Better to use the web&#x2F;mobile GPS api and get explicit consent. I guess the internal maps we make from our server logs will get less accurate... fine?
评论 #21916345 未加载
anandchowdhary超过 5 年前
OP here. My CI builds started breaking out of nowhere [1] because the public download URL of the Geolite2 database started giving 404s.<p>I reached upon the GitHub issue opened by MaxMind on the package I was using [2] who recommended that every user should create an account and download the package, so I used Git LFS to manually add the package to the repo for now, until I can come up with a better CI-driven solution, because one of the rules is that you need to update the database as soon as a new one comes out, and stop using the older version within 30 days of update, and you might need to provide this in writing as well.<p>[1] <a href="https:&#x2F;&#x2F;travis-ci.org&#x2F;staart&#x2F;api&#x2F;builds&#x2F;630988787" rel="nofollow">https:&#x2F;&#x2F;travis-ci.org&#x2F;staart&#x2F;api&#x2F;builds&#x2F;630988787</a><p>[2] <a href="https:&#x2F;&#x2F;github.com&#x2F;runk&#x2F;node-geolite2&#x2F;issues&#x2F;17" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;runk&#x2F;node-geolite2&#x2F;issues&#x2F;17</a><p>[3] <a href="https:&#x2F;&#x2F;www.maxmind.com&#x2F;en&#x2F;geolite2&#x2F;eula" rel="nofollow">https:&#x2F;&#x2F;www.maxmind.com&#x2F;en&#x2F;geolite2&#x2F;eula</a>
评论 #21916417 未加载
评论 #21917212 未加载
tyingq超过 5 年前
That&#x27;s pretty interesting that an IP address is enough to trigger CCPA. I thought it had to specifically tie to identity versus something broader like zip codes and city names to be covered under CCPA.<p>I wonder if you would be okay geolocating just the first three octets.
评论 #21915567 未加载
评论 #21920629 未加载
hlieberman超过 5 年前
This is deeply unfortunate. I know the folks at Maxmind fairly well, and they&#x27;re good people. I&#x27;m quite sure this isn&#x27;t what they wanted to do, and that they&#x27;ve pushed their lawyers to let them continue distributing this data as much as is possible, in a way that is as gentle as possible. I applaud them for their efforts; it is appreciated.<p>Unfortunately, it&#x27;s also clear to me that this renders the Maxmind geoip databases non-free. I&#x27;ve filed bugs for the removal of the geoipupdate package from Debian main, and I believe the geoip-database maintainer has already terminated updates.
kwoff超过 5 年前
This might not be a common experience nowadays (sigh), but I encountered this problem a few weeks ago in Perl. The long-used module at <a href="https:&#x2F;&#x2F;metacpan.org&#x2F;pod&#x2F;Geo::IP" rel="nofollow">https:&#x2F;&#x2F;metacpan.org&#x2F;pod&#x2F;Geo::IP</a> now mentions &quot;the GeoIP Legacy file based database&quot; and has a link to <a href="http:&#x2F;&#x2F;dev.maxmind.com&#x2F;geoip&#x2F;geolite" rel="nofollow">http:&#x2F;&#x2F;dev.maxmind.com&#x2F;geoip&#x2F;geolite</a> which actually redirects to <a href="https:&#x2F;&#x2F;dev.maxmind.com&#x2F;geoip&#x2F;geoip2&#x2F;geolite2&#x2F;" rel="nofollow">https:&#x2F;&#x2F;dev.maxmind.com&#x2F;geoip&#x2F;geoip2&#x2F;geolite2&#x2F;</a> . Interestingly, now that I look there again, it no longer refers (at the top of the page) to the January 2019 deprecation of the version 1 database, but now to &quot;making significant changes to how you access free GeoLite2 databases starting December 30, 2019&quot;. (I now have to also review that for my workplace...)<p>Anyway, the new CPAN modules are under <a href="https:&#x2F;&#x2F;metacpan.org&#x2F;pod&#x2F;GeoIP2" rel="nofollow">https:&#x2F;&#x2F;metacpan.org&#x2F;pod&#x2F;GeoIP2</a> and can be confusing. One confusing thing: despite a prominent Perl developer such as Dave Rolsky working (still?) at MaxMind, it says that the &quot;module is deprecated and will only receive fixes for major bugs and security vulnerabilities&quot;.<p>For porting purposes, please note that the module you want to use is <a href="https:&#x2F;&#x2F;metacpan.org&#x2F;pod&#x2F;GeoIP2::Database::Reader" rel="nofollow">https:&#x2F;&#x2F;metacpan.org&#x2F;pod&#x2F;GeoIP2::Database::Reader</a> . (They also mention <a href="https:&#x2F;&#x2F;metacpan.org&#x2F;pod&#x2F;MaxMind::DB::Reader" rel="nofollow">https:&#x2F;&#x2F;metacpan.org&#x2F;pod&#x2F;MaxMind::DB::Reader</a> which can makes things unclear...) I didn&#x27;t see any other info on the github page about Perl support. Also the interface is definitely more tedious and object-oriented in the worst way. I&#x27;m sure there are good reasons... And in my experience it&#x27;s much slower if you use the pure-Perl interface (this is something you should read the MaxMind::DB::Reader perldoc for: it mentions installing a C library in &quot;PURE PERL VERSUS XS&quot;).<p>Good luck
alias_neo超过 5 年前
It&#x27;s a shame this only made it into here after the restriction was already in place.<p>Or of interest, does anyone know how long a historic copy might be considered valid? How regularly do people update their &quot;copy&quot; generally?
评论 #21917230 未加载
unilynx超过 5 年前
This provision in the EULA might be troublesome when dealing with backups:<p><i>You shall cease use of and destroy (i) any old versions of the Services within thirty (30) days following the release of the updated GeoLite2 Databases</i><p>I&#x27;m sure I can get customers to otherwise agree with the GeoLite2 terms when I install&#x2F;get them to download the database, but how to get the GeoLite2 database out of their three-months-retained VM snapshots ? I can ensure we &#x27;cease use&#x27; of a restored database, but ensuring destruction is a problem...<p>(The GDPR explicitly acknowledges this problem and allows you to keep data in your backups if it&#x27;s too burdensome to remove it as long as you&#x27;ve taken measures to reapply data deletions on restore)
bullen超过 5 年前
The biggest problem with the new Maxmind data is that it requires many MB of dependencies: <a href="https:&#x2F;&#x2F;github.com&#x2F;maxmind&#x2F;MaxMind-DB-Reader-java&#x2F;issues&#x2F;48" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;maxmind&#x2F;MaxMind-DB-Reader-java&#x2F;issues&#x2F;48</a>
WGeorge480超过 5 年前
I do not work for any company that uses GeoLite2 but I do have a gaming server that I want to display the country of a player to the staff team. I signed up 3 days ago but no email received as of now. Should I contact maxmind and will I be able to get a license for such an intend use?
justinclift超过 5 年前
Seems to <i>only</i> cope with fixed IP addresses, which only some places use.<p>For example, my IP address (not in the US) changes ~18 hours or so and can come up in at least 30 different IP ranges that I&#x27;ve so far seen. (Used to make writing out SSH rules for remote access a pita, until automating it)
foota超过 5 年前
How is IP to broad location even PII?
评论 #21916714 未加载