A "bulletproof" host or provider is the colloquial term for a business that will not reveal your identity, payment information, provide LEO access, respond to subpoenas, etc.
It's generally used by cyber-criminals as a "safe" vendor, though some privacy-minded individuals like this type of provider as well.
There was an awesome viral video of someone offloading their frustration and a full mag on an HP printer. Now I can't find the original because it started a trend of copiers.
Imagine a rack of servers in some countries where global and even that country's law can't really touch them. "cyber gangs" and the like will use those servers as hosting for their malware and activities.
> even that country's law can't really touch them.
Well, that countries law enforcement could always cut off those servers. It's usually either due to corruption or in case of russia political intent that these servers are kept online.
It kind of depends, a lot of the recent ones are in Myanmar where the state is in not much position to enforce much of anything due to the whole civil war thing.
Others already answered but while I'm chiming in anyway, I'm not in the hosting industry but IT security (for like ten years, say) and for me it's a very normal term. Maybe precisely because of that niche though; many of us are paranoid
Sometimes it feels like the internet is still the wild west.
The EU tries to rope off a single building with velvet ropes, a doorman, ID verification, facial scans, and cookie banners, while next door it's an illegal rave in an abandoned supermarket.
I think blaming the EU for cookie banners is wrong. Those banners are malicious disobedience, and, for the most part a legal violation. What websites should do is that they should assume you reject any tracking as their default, and then they can offer a site setting that you have to seek out, where you can agree to be tracked. What they are sort of allowed to do, is that they can prompt you with a banner, but it has to be a single no-click without requiring you to read much, but that is still not compliance. Anything more annoying is a legal violation.
The real issue is that there aren't a whole lot of consequences when it comes to tracking data. It's a legal violation, sure, but it's not a criminal violation. So it would be up to you to pursue it. In many countries you can't even file a civil lawsuit, but rather, you have to go through your national data protection agency. Which in reality likely means your complaint will be auto-rejected after five years because they need to clean up the queue.
As far as the malicious disobedience goes... well... it's probably because "all the other website do it", but you might as well just give people the option to go to a setting to turn it off. It's not like that would be any less of a legal violation than the banner.
Sort of aside but it’s wild to me that people talk of ab testing all kinds of minor things and yet so many shops immediately cover up the item I’m viewing with a huge banner/full page annoyance about cookies.
The other day I accidentally double-clicked on the the dismiss of a popup and the second click went through to the page underneath and I added an item to cart.
Don't know if it was intentionally positioned like that but I was ready to imagine it was.
You are not wrong, but the fact that they never follow up and allow the practice makes them complicit. Same for the farcical malicious (non-)compliance of the GFPR through 'legitimate intetest' abuse.
They didn't want user data to be sent to third-parties without consent, so they created a law that made it mandatory for web pages to ask for consent to send the data. Most web pages need to send data to third-parties to be profitable, so they need to ask for consent.
What would the next steps be like? The purpose of the law is to give users the power to consent or not consent. In other words, I can pay for the contents of a web page with my data. Removing that option from me doesn't give me power to do whatever I want with my data: it takes that power away from me instead. That would be bad.
I agree with your sentiment, but it would really be a great step to stop calling these things "cookie banners" and use "consent banners" or "tracking banners". Call them what they are.
Because it is not the means, it is the intent that the GDPR tries to protect you from. The GDPR (and EDP) says that tracking, any tracking not just cookies, requires the consent of the tracked one.
That rubric only applies when the users aren’t actively and maliciously sabotaging the system, which privacy-subverting websites absolutely are. (And everyone else is cargo-cutting their behavior.)
Defending yourself from abuse is not an excuse for others to engage in abuse. I have no issue with passive 90's-style ads. I don't need to block them. I use my abuse-blocker to handle more concerning problems.
Note that the most annoying consent banners come from advertising conglomerates (IAB comes to mind). Well who would think they wouldn’t sabotage anything?
> I think blaming the EU for cookie banners is wrong. Those banners are malicious disobedience, and, for the most part a legal violation.
The EU's own government websites are littered with the obnoxious cookie banners [1].
It's an unbelievably thoughtless and misguided law that has unfortunately ruined the internet. I think a lot of people rightfully blame the EU and they're terrible lawmaking for this nonsense.
I don't seem to get them from outside the EU (even with my adblocker disabled), so a law saying they need an annoying banners I agree to before they go for it might actually be a step up.
MIRhosting, a leading provider of enterprise-grade colocation and IT infrastructure services in Europe, proudly announces the launch of two dedicated, fully equipped data rooms at its newest location within the NorthC data center in Nieuwegein. This strategic expansion strengthens MIRhosting's colocation capabilities, directly addressing the growing demand for reliable and scalable colocation solutions in the greater Amsterdam region...."
It’s a little bit Ironic that they use the name of an American super hero
WTH is a “bulletproof host”? Been working in the industry for 30 years and never once heard it?
> WTH is a “bulletproof host”?
A "bulletproof" host or provider is the colloquial term for a business that will not reveal your identity, payment information, provide LEO access, respond to subpoenas, etc.
It's generally used by cyber-criminals as a "safe" vendor, though some privacy-minded individuals like this type of provider as well.
> provide LEO access
Those poor astronauts! ("Law Enforcement Officer", for anyone else not in the know).
great
inventing new word when we don't need one
Which word did you think was new?
Especially helpful hint coz the other thread's talking about Elon </SCNR>
My mind first jump to an old video of somebody shooting a Sun Microsystems machine and the bullets did not in fact penetrate the steel.
Are you thinking of HP or did they both do it?
https://www.youtube.com/watch?v=Gnjb1WVkhmU
I forgot about the HP one! I distinctly remember there was a Sun too; it was like a backyard shoot.
There was an awesome viral video of someone offloading their frustration and a full mag on an HP printer. Now I can't find the original because it started a trend of copiers.
Ars covered it in 2013, it's common in security (Risky Business, OSInt, Krebs) https://arstechnica.com/information-technology/2013/01/how-t...
It says so in the article. Isp's who ignore authorities and allow anything to happen on their networks.
Imagine a rack of servers in some countries where global and even that country's law can't really touch them. "cyber gangs" and the like will use those servers as hosting for their malware and activities.
Interesting that Netherlands seems to be one of these lawless places...?
> even that country's law can't really touch them.
Well, that countries law enforcement could always cut off those servers. It's usually either due to corruption or in case of russia political intent that these servers are kept online.
It kind of depends, a lot of the recent ones are in Myanmar where the state is in not much position to enforce much of anything due to the whole civil war thing.
Thanks for the replies. Should have RTFA I guess
Criminal-friendly
> Been working in the industry for 30 years and never once heard it?
obligatory: https://xkcd.com/1053/ Happy ten thousand day!
Others already answered but while I'm chiming in anyway, I'm not in the hosting industry but IT security (for like ten years, say) and for me it's a very normal term. Maybe precisely because of that niche though; many of us are paranoid
Sometimes it feels like the internet is still the wild west.
The EU tries to rope off a single building with velvet ropes, a doorman, ID verification, facial scans, and cookie banners, while next door it's an illegal rave in an abandoned supermarket.
I think blaming the EU for cookie banners is wrong. Those banners are malicious disobedience, and, for the most part a legal violation. What websites should do is that they should assume you reject any tracking as their default, and then they can offer a site setting that you have to seek out, where you can agree to be tracked. What they are sort of allowed to do, is that they can prompt you with a banner, but it has to be a single no-click without requiring you to read much, but that is still not compliance. Anything more annoying is a legal violation.
The real issue is that there aren't a whole lot of consequences when it comes to tracking data. It's a legal violation, sure, but it's not a criminal violation. So it would be up to you to pursue it. In many countries you can't even file a civil lawsuit, but rather, you have to go through your national data protection agency. Which in reality likely means your complaint will be auto-rejected after five years because they need to clean up the queue.
As far as the malicious disobedience goes... well... it's probably because "all the other website do it", but you might as well just give people the option to go to a setting to turn it off. It's not like that would be any less of a legal violation than the banner.
Sort of aside but it’s wild to me that people talk of ab testing all kinds of minor things and yet so many shops immediately cover up the item I’m viewing with a huge banner/full page annoyance about cookies.
The other day I accidentally double-clicked on the the dismiss of a popup and the second click went through to the page underneath and I added an item to cart.
Don't know if it was intentionally positioned like that but I was ready to imagine it was.
The two aren't necessarily mutually exclusive, it's very possible the same places found the tracking data is worth the annoyance.
You are not wrong, but the fact that they never follow up and allow the practice makes them complicit. Same for the farcical malicious (non-)compliance of the GFPR through 'legitimate intetest' abuse.
What are they supposed to do about it?
They didn't want user data to be sent to third-parties without consent, so they created a law that made it mandatory for web pages to ask for consent to send the data. Most web pages need to send data to third-parties to be profitable, so they need to ask for consent.
What would the next steps be like? The purpose of the law is to give users the power to consent or not consent. In other words, I can pay for the contents of a web page with my data. Removing that option from me doesn't give me power to do whatever I want with my data: it takes that power away from me instead. That would be bad.
I agree with your sentiment, but it would really be a great step to stop calling these things "cookie banners" and use "consent banners" or "tracking banners". Call them what they are.
Because it is not the means, it is the intent that the GDPR tries to protect you from. The GDPR (and EDP) says that tracking, any tracking not just cookies, requires the consent of the tracked one.
If the majority of users use the system wrong, it's the system that's wrong, not the users.
That rubric only applies when the users aren’t actively and maliciously sabotaging the system, which privacy-subverting websites absolutely are. (And everyone else is cargo-cutting their behavior.)
To be fair, I’m sabotaging it from the other side with my ad-blocker.
Defending yourself from abuse is not an excuse for others to engage in abuse. I have no issue with passive 90's-style ads. I don't need to block them. I use my abuse-blocker to handle more concerning problems.
Note that the most annoying consent banners come from advertising conglomerates (IAB comes to mind). Well who would think they wouldn’t sabotage anything?
> I think blaming the EU for cookie banners is wrong. Those banners are malicious disobedience, and, for the most part a legal violation.
The EU's own government websites are littered with the obnoxious cookie banners [1].
It's an unbelievably thoughtless and misguided law that has unfortunately ruined the internet. I think a lot of people rightfully blame the EU and they're terrible lawmaking for this nonsense.
https://european-union.europa.eu
At least it has a 'only necessary cookies' option and you don't have to click through a lot of 'settings' to get them off.
It's also easy to hide with the element picker of uBO. It's a DOM element with a straightforward id #cookie-consent-banner
I don't seem to get them from outside the EU (even with my adblocker disabled), so a law saying they need an annoying banners I agree to before they go for it might actually be a step up.
The physical world is like that too!
If anything the internet has become more of the wild west and will continue to do so as the internet is incredibly useful for state actors.
this is more common and easier than people think, and I think this conflict was necessary to exposure the hubris behind global superpowers
they think they're omnipotent but really don't control the world, rendering economic sanctions and service blacklisting to be null and moot
Sanctions?! What sanctions? They don't even hide, right in the heart of Western Europe:
https://www.swedbank-aktiellt.se/telegram/WOzsdcJG
"AMSTERDAM, April 10, 2025
MIRhosting, a leading provider of enterprise-grade colocation and IT infrastructure services in Europe, proudly announces the launch of two dedicated, fully equipped data rooms at its newest location within the NorthC data center in Nieuwegein. This strategic expansion strengthens MIRhosting's colocation capabilities, directly addressing the growing demand for reliable and scalable colocation solutions in the greater Amsterdam region...."