Show HN: We Built the 1. EU-Sovereignty Audit for Websites
80 points
by cmkr
2 hours ago
| 27 comments
| lightwaves.io
| HN
graemep
1 hour ago
[-]
Not accurate.

It has nsa.gov on the leaderboard as having no US dependencies.

It wrongly says one of my sites is using Cloudflare.

It says that one of my sites that is hosted in the US (no CDN, US IP address) has no US dependencies.

it treats social media links the same way was embeds.

it gives gov.uk a perfect score. Maybe by design because it is hosted in Europe, but if so it should not say its EU sovereignty.

I do not think that is the case because it also gives a perfect score to https://english.www.gov.cn/

I do not know how it got to the HN front page - people presumably vote it up without checking it actually works.

Its just not anywhere near accurate.

reply
petcat
1 hour ago
[-]
Yeah it's a neat idea. Unfortunately the execution is pretty poor.
reply
input_sh
49 minutes ago
[-]
I think it's more of a "how self-contained is the website?" test, which is a valid but a completely different question.

I have two under my full control, one scored a 92, the other one scored a zero. They're both hosted the exact same way.

reply
_blk
1 hour ago
[-]
This is more of an attempt at a political stunt. The CCP's website gets a perfect score, admin.ch also gets a perfect score while Switzerland is most-definitely not in the EU.. non-US is more accurate than EU but you only see that when stars start flying.

IMHO: Just scrap the politics and show what regional deps a site has - that'd actually increase value quite a bit.

reply
irusensei
2 hours ago
[-]
I have some feedback for OP: my personal website got 92% because there is a link to my X profile in the contact session. It's not like it relies on the service. Its just a contact and there are also links to other services such as self hosted matrix.

On the other hand my registrar is Namecheap which is in the US and your tool didn't checked for that. I think thats a lot more important in terms of dependance than a link to a social network so you could run a whois lookup to check what registrar is hosting that domain.

reply
sjamaan
2 hours ago
[-]
Good point regarding registrar. Thinking a bit further, there's also the top-level domain: if that's under US control (eg .com), it could still be yanked away from you.
reply
jacquesm
1 hour ago
[-]
This is a massive risk that will affect half the internet or so.
reply
_blk
1 hour ago
[-]
.onion might be exempt but while the TLD "." is anycast worldwide for the actual DNS service, Verisign still signs the cert. Isn't that a show-stopper for dependencies on dns-over-https or https altogether or do .cn, .ru, .ir etc all add/replace with their own independent signatures ?
reply
esmIII
2 hours ago
[-]
If you post on X. You are a content creator supporting Elon.
reply
Etheryte
2 hours ago
[-]
While this is true, it has nothing to do with the tech sovereignty of the site itself.
reply
pixl97
1 hour ago
[-]
While I'd say you're mostly correct, I do disagree some.

There is quite a large issue with sites posting things like current events on social sites like Facebook, or other rapid news events on X. Doing this has the potential to diminish your sovereignty. For example if you tell your users to follow X on the site and you're posting some event that Musk doesn't like, maybe you're posts will disappear.

Is something to think about.

reply
carlosjobim
1 hour ago
[-]
It's absolutely not something to think about, unless you are in some kind of cult.

This website is also foreign to Europeans, so what are you then doing here contributing with your comments?

It is probably time for Europeans to start dealing with their problems in different ways than having internal "purity purges". It has never worked, and will never work. It makes people weak and easily defeated in every endeavor.

reply
pixl97
1 hour ago
[-]
>internal "purity purges"

"Hey France, I know all of a sudden Germany is suddenly running around with black white and red flag, but it's completely cool if we have them manage all of our critical infrastructure". --carlosjobim 1937

I'm in the US. I'm watching what's going on here. If you want to talk about any group doing purity purges, they have ICE printed in big letters on their jackets.

Of course feel free to pull an IBM in the 40's and stick with the regime, it evidently has no long term business repercussions.

reply
carlosjobim
31 minutes ago
[-]
Yes, yes obviously everybody who doesn't participate eagerly in purity purges are themselves a nazi collaborator, foreign spy, reactionary saboteur on the MI6 payroll, maybe a crypto-jew, a jesuit, a lutheran, etc etc
reply
trm217
2 hours ago
[-]
Nice, but for me it is reporting false information. I use Vercel, Cloudflare for DNS yet it shows 92%. The only thing it correctly reported was the LinkedIn link. (There is also a GitHub and Bluesky link, which are US companies / services as well).
reply
hannob
2 hours ago
[-]
So their leatherboard of good examples lists nsa.gov with 100 points.

Is this a parody?

reply
throwa356262
1 hour ago
[-]
That actually says more about NSA security hygine and not getting high on your own supply.
reply
rorylawless
11 minutes ago
[-]
How are they estimating migration costs? It claims my tiny personal website hosted on Netlify would cost between $2500 and $5800 to migrate.
reply
jstanley
2 hours ago
[-]
I put in my site and it gave me a red cross for "Hosting", on hover it said "GitHub Pages". But my site isn't hosted on GitHub Pages.

Expanding "Details", the URL that is hosted on GitHub Pages is... a different website? There's merely a hyperlink to it on my website.

It also says I'm using "self-hosted" fonts - but I don't think I'm doing that at all? I'm just using the browser's fonts. Using non-standard fonts is a bad idea because it causes the content to either be invisible until the font is loaded, or else it initially shows in a fallback font and then the text all jumps when the font is loaded.

reply
Jaxan
2 hours ago
[-]
It also says my website is hosted on GitHub pages, although it’s served from a hetzner server.

EDIT: on further inspection: I get both a red cross AND a green check mark for hosting. So it’s somehow indicating both GitHub and hetzner. Maybe it’s because I merely link to GitHub?

reply
dcminter
2 hours ago
[-]
Meanwhile I get a green check for CDN - presumably because I'm not using Cloudflare, but I am using CloudFront which is AWS.

So the tool's a good idea, but currently very inaccurate.

reply
grodriguez100
1 hour ago
[-]
Meanwhile, mine is actually hosted on GH pages and I get a green mark and a perfect 100% score.
reply
schnapsidee
2 hours ago
[-]
Funny, I checked a blog I host on github pages and it says "not detected" for hosting.
reply
netsharc
2 hours ago
[-]
In English, unlike German, "1." doesn't mean "1st"/"first".
reply
telesilla
2 hours ago
[-]
I find it ironic that in Europe the defacto language for intercommunication is from a country that chose to disassociate itself from the EU. In all, I think it's great that every EU country uses the English language with all their idiosyncrasies and hell be damned about "proper" english.
reply
handelaar
1 hour ago
[-]
"Fortunately", that country forced its language onto a number of others who remain in the EU, and one of them conveniently has English as its EU language because another country also speaks its actual primary language.
reply
jacquesm
16 minutes ago
[-]
I actually think that having English as the default language of the EU without England in the EU is kind of elegant, it side-steps the 'natural advantage' problem.
reply
jacquesm
1 hour ago
[-]
English is the lingua franca (hah!) of the business world, on HN any website posted is supposed to be in English, so effectively you are saying that EU digital sovereignty can not be discussed on HN.
reply
blell
2 hours ago
[-]
You can also tell the guy is German because of the strange hyphen between EU and Sovereignty. :P
reply
juahan
1 hour ago
[-]
Could be also Finnish!
reply
Matticus_Rex
1 hour ago
[-]
Apparently you get dinged for using AWS even if you're using an EU datacenter.

I'm sure you can define "EU sovereignty" in a way that's consistent with that, but that's not very useful.

reply
wongarsu
1 hour ago
[-]
Is there any evidence that the US executive branches and three letter agencies care about the physical location of the data center? Never mind the dependency on AWS, which is a US company

I doubt datacenter location matters for anything beyond latency

reply
storystarling
1 hour ago
[-]
The US CLOUD Act explicitly asserts jurisdiction over data controlled by US companies regardless of the physical server location. So relying on AWS Frankfurt doesn't actually protect the data from US warrants if the provider is a US entity.
reply
bigblind
2 hours ago
[-]
Any recommendations for good European alternatives to Clooudflare? Is there an EU company that's as trustworthy when it comesq to DDoS protection?
reply
embedding-shape
2 hours ago
[-]
Bunny CDN (https://bunny.net) is great, HQ located in Ljubljana, Slovenia and also have great support which seems most faster and gives better responses than most others out there, but might just been my luck, YMMV.
reply
direwolf20
2 hours ago
[-]
First off, do you actually need it? I know cloudflare sells fear, but was you or anyone you know affected by a DDoS?
reply
pixl97
1 hour ago
[-]
>but was you or anyone you know affected by a DDoS?

Yes, all the damned time.

Some people must have experienced a completely different internet from the one I've had to run servers on over the years. I've had tiny, local sites for customers randomly get gigabytes of traffic per second for days. No rhyme or reason why. Try to run anything with a forum on it where people have strongly held beliefs, yea eventually you'll get a DDOS. Have a site where some global competitor can influence your sales by slowing traffic on important holidays... you can see where this is going. Heck, I've even worked at ISPs where we had to take particular IPs out of the DHCP pool and null route them because for some reason they were getting traffic blasted for weeks at a time.

While they do sale fear, it's not really an irrational one for those that have worked in the industry.

reply
petcat
2 hours ago
[-]
> cloudflare sells fear

A lot of people here don't just run trivial hobby sites. They work for companies that actually have a real need for DDOS and WAF protection. Maybe you have no experience with that, but it is extremely common and even required for sites that require compliance certifications like SOC2.

reply
graemep
1 hour ago
[-]
There are other providers of DDOS protection, and other WAFs.

The main advantage Cloudflare has is that it is free and a big brand.

reply
petcat
1 hour ago
[-]
Right. I was responding to the question "do you actually need DDOS protection?". Which is an obvious Yes in the real (non-hobby) world.
reply
jve
1 hour ago
[-]
Sorry I pressed downvote and cannot revert my press...

I had to set up CF for a small local business in a very small country that has ecommerce presence targeted mainly at local population. It just gets non-stop ongoing traffic a hosting provider cannot handle.

reply
wongarsu
1 hour ago
[-]
> Sorry I pressed downvote and cannot revert my press...

Next to the timestamp of the comment there is an "undown" link that reverts the vote. Or an "unvote" link if you upvoted

reply
NoboruWataya
2 hours ago
[-]
reddit.com gets a perfect "no US dependencies" score. I guess they have servers around the world and can serve requests from a local-ish server.

Obviously this simple check only concerns the technical aspects of the website and doesn't analyse the business itself but I wonder if all .com domains should be marked down?

reply
N-Krause
2 hours ago
[-]
When I check google.com I get a 94% score? Kinda ironic no?
reply
grodriguez100
1 hour ago
[-]
I get a 100% for a site hosted in GH pages and which embeds YouTube videos and Google fonts. So this does not seem to be very reliable.
reply
woile
2 hours ago
[-]
Very nice tool!

The UI has a few errors on desktop, I cannot see all the issues. The leaderboard... doesn't work ? and the topbar hides some elements

browser: firefox

reply
lpcvoid
2 hours ago
[-]
Nice, good idea. I need to move away from Github pages finally ;)
reply
gue-ni
1 hour ago
[-]
How is this calculated? A suspicious amount of people (including myself) get 92%...
reply
pixl97
1 hour ago
[-]
Do you have links to any US social media on your site, that's getting a lot of people.
reply
savolai
2 hours ago
[-]
Seems to treat finnish kapsi.fi hosting as US?
reply
cmkr
2 hours ago
[-]
Checks hosting, analytics, fonts, cdn, video, chat, social embeds. Gives you a score from 0-100 and suggests Eu-alternatives.
reply
causalscience
2 hours ago
[-]
Happy to see mastodon.xyz score 100%.

Mastodon is pretty cool and proof that we can make federation work.

reply
riffraff
2 hours ago
[-]
nice idea!

If I may, and not trying to be annoying, on my screen the navigation bar (.navigation-wrapper) covers 90% of the top left buttons (aria-label=breadcrumbs).

Happens with both Chrome and Firefox, macOS, 15" macbook pro.

reply
reppap
2 hours ago
[-]
My customer's site got a 100% while running on azure.
reply
socialismsvks
2 hours ago
[-]
I am proud my website would score a nice round 0% even though I am pure blooded european
reply
vldszn
2 hours ago
[-]
nice idea, are you planning to open source this project?
reply
kome
2 hours ago
[-]
hmm... it really miss a lot of infrastructure.

take my website for example mrtno.com - it's hosted in europe, ok. but under what legislation the domain register is based? and where is the dns server?

those a crucial information. and they are missing.

reply
m00dy
2 hours ago
[-]
thanks for this checker, we also need HN alternative for EU only. As Europeans, I'm sure we can do this.
reply
pembrook
1 hour ago
[-]
I really wish this existed so that HN could go back to being a tech community of nerds and builders. Somehow HN has become overrun with more and more urban monoculture euro-fetishists and actual Europeans in the last few years. I haven't seen a headline mentioning Rust or Lisp in days! That's how you know things have really gone downhill.

European HN could focus on its favorite topics of privacy paranoia, "what regulation can we make next?" and tech safetyism, while maybe real HN could go back to Bay Area tech esotericism and fun historical anecdotes.

reply
iknowstuff
1 hour ago
[-]
nsa.gov got PERFECT! NO US DEPENDENCIES lmao
reply
pembrook
1 hour ago
[-]
This 'website' is a pile of steaming vibecoded garbage that doesn't even work or do what it claims.

It remaining alive on the frontpage here only serves to underline how politically irrational the userbase of HN has gotten.

reply
self_awareness
1 hour ago
[-]
microsoft.com got 92%

my blog which is hosted on namecheap.com, server whois is Los Angeles, got 100%

I guess this is another vibe coding AI slop service which doesn't even render its own top buttons properly (they're covered by some white div).

Have mercy, web devs!

reply