IdeaWell

Project ideas from Hacker News discussions.

Court agrees with EFF: Utah's VPN law demands a technical impossibility

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

Five prevalent themes in the Hacker News discussion

  1. Technical infeasibility of reliably detecting VPN traffic
  2. “Is it even possible to reliably know that a connection is from a VPN?” – SoftTalker
  3. “It's impossible to have a full and complete list of VPN exit nodes … if you set up an OpenVPN server on digital ocean … no one would know your address is hosting a VPN server.” – gambiting

  4. “You cannot guarantee with 100% certainty that the user isn't using a VPN.” – irenaeus

  5. Constitutional and legal overreach (Dormant Commerce Clause, First Amendment)

  6. “The law likely violates the U.S. Constitution’s prohibition on passing laws that significantly burden businesses and people outside Utah’s borders.” – gchamonlive
  7. “Utah could demand the moon, it doesn't mean that the federal government would agree they have a right to that demand.” – moate

  8. “How is that not a blatant first amendment violation?” – rhcom2

  9. Moral/political motivations (“think of the children”, purity, control)

  10. “It is lawfare against porn. They don't want these companies to exist. They want it to be impossible to comply with the law to shut them down.” – pkilgore
  11. “Moral outrage is an easy win.” – EA-3167

  12. “The inability to immediately and perfectly eliminate a behavior is not a good enough reason to be against any attempt to eliminate that behavior.” – irenaeus (and echoed by Rohansi)

  13. Workarounds and circumvention (residential proxies, self‑hosted VPNs, Tailscale, etc.)

  14. “Folks would just host their own vpns various places and this would be pointless ….” – mmooss
  15. “You can do for free with tailscale exit nodes.” – campbel

  16. “If you cannot determine the traffic type, you can block it and wait until someone appears with proper documentation …” – codedokode

  17. Censorship is ultimately futile; the internet routes around it

  18. “As we’ve said time and time again: the internet will always route around censorship.” – someonebaggy (repeated by multiple commenters)
  19. “The great firewall probes the host ip … it just throttles to a halt the ip.” – whatever1
  20. “You can’t route around censorship if they control the gateways … but the public doesn't really care about it.” – nemomarx / TeMPOraL

🚀 Project Ideas

VPN Egress Intelligence Service

Summary

  • Provides continuously updated, high‑confidence lists of VPN exit IP addresses (including residential proxies) with metadata such as provider, IP type, and reputation score.
  • Core value: lets adult websites block VPN traffic accurately to meet Utah‑style laws while minimizing false‑positive blocks on legitimate users.

Details

Key Value
Target Audience Adult content providers, streaming platforms, any service needing geo/age restrictions
Core Feature API delivering VPN IP ranges with confidence scores and provider attributes
Tech Stack Go/Python backend, PostgreSQL, Kafka for streaming updates, React dashboard
Difficulty Medium
Monetization Revenue-ready: tiered subscription by monthly API calls

Notes

  • HN users questioned the feasibility of detecting VPN traffic (“Is it even possible to reliably know that a connection is from a VPN?” – SoftTalker) and noted that providers publish server IPs but not egress addresses (kevincox). This service directly fills that gap.
  • Would enable sites to comply with over‑broad VPN‑blocking mandates without unnecessarily blocking residential users, a pain point voiced by multiple commenters.

Zero‑Knowledge Age Verification SDK

Summary

  • Offers a privacy‑preserving SDK that lets users prove they are over 18 (or local age of consent) via zero‑knowledge proofs, without revealing personal data.
  • Core value: satisfies age‑verification requirements while protecting user privacy, reducing friction and legal risk.

Details

Key Value
Target Audience Adult websites, platforms required to perform age checks
Core Feature JS/Wasm widget that interacts with ID verifiers to generate a zk‑proof of age
Tech Stack Rust/Wasm client, Circom/SnarkJS for zk‑SNARKs, Node.js backend
Difficulty High
Monetization Revenue-ready: per‑verification fee (e.g., $0.005 per check)

Notes

  • Commenters highlighted the burden of Utah’s law: “the law’s ‘actual‑location provision in practice requires an entity to perform age verification services for every user visiting its site from any location’” (spuz). A ZK‑based solution addresses both compliance and privacy concerns.
  • Would appeal to privacy‑focused HN readers who dislike invasive ID collection, while giving sites a defensible compliance path.

FriendlyResidential VPN Mesh

Summary

  • A peer‑to‑peer VPN application that lets users route traffic through trusted friends’ home internet connections (residential IPs) with zero configuration, using encrypted tunnels and NAT traversal.
  • Core value: provides VPN‑like privacy and geo‑spoofing that appears as ordinary residential traffic, evading simplistic VPN‑blocking measures.

Details

Key Value
Target Audience Privacy‑conscious users, expats, anyone needing to bypass geo‑blocks in restrictive jurisdictions
Core Feature Simple app that creates an encrypted mesh (Wireguard‑like) and lets users select a friend’s exit node
Tech Stack Go, Wireguard, libp2p for peer discovery, React Native/Electron clients
Difficulty Medium
Monetization Hobby (open‑source core, optional premium relay nodes)

Notes

  • Users pointed out the usefulness of friend‑based VPNs (“I could proxy/VPN through a friend's house and nobody would ever know it wasn't them.” – ranger_danger) but noted the technical barrier for self‑hosting. This project lowers that barrier.
  • Would resonate with HN’s tradition of building tools that restore practical privacy in the face of overreaching legislation.

VPN/Proxy Detection API with Behavioral Scoring

Summary

  • Delivers a real‑time scoring API that estimates the probability a connection is using a VPN/proxy based on TLS fingerprints, traffic timing, ASN/IP reputation, and browser attributes.
  • Core value: enables risk‑based, nuanced blocking instead of blunt bans, reducing collateral damage to legitimate users.

Details

Key Value
Target Audience Websites needing to enforce geo/age restrictions (adult, gambling, streaming)
Core Feature API returning a VPN probability score with explainable signals (e.g., “high‑volume ASN”, “non‑residential IP”)
Tech Stack Python microservice, Redis cache, ML models (XGBoost/TensorFlow), Kubernetes deployment
Difficulty Medium‑High
Monetization Revenue-ready: pay‑per‑request (e.g., $0.0005 per 1k requests)

Notes

  • HN discussants acknowledged that traffic‑pattern and fingerprinting approaches can get “pretty damn close” (ad_fontes) and noted heuristics like “100 different users from a single IP” (a4isms). This product operationalizes those ideas.
  • Would give sites a tool to satisfy laws that demand “best effort” VPN blocking while avoiding over‑blocking, a frequent complaint in the thread.

Compliance Automation Platform for Adult Sites

Summary

  • SaaS dashboard that aggregates jurisdictional regulations (e.g., Utah SB 73, UK age‑verification, etc.) and automatically recommends mitigation actions: IP blocklists, age‑verification integration, geofencing, and legal risk scoring.
  • Core value: reduces legal overhead and helps sites stay compliant without resorting to over‑broad blocks.

Details

Key Value
Target Audience Legal/compliance teams at adult content platforms, gambling sites, other regulated services
Core Feature Rule engine that maps a visitor’s IP to jurisdiction and suggests compliant actions (block, verify age, allow)
Tech Stack Node.js/Express API, PostgreSQL, React admin UI, AWS Lambda for edge enforcement
Difficulty Medium
Monetization Revenue-ready: subscription based on monthly active users or volume of processed requests

Notes

  • Commenters noted the impossibility of perfect compliance (“Utah could tell VPN providers that if they service a customer in Utah then the VPN provider can't route traffic to adult sites.” – irenaeus) and the constitutional concerns raised by the law (gchamonlive). This platform helps navigate those complexities.
  • Would spark discussion on HN about balancing legal compliance with user privacy and technical feasibility, while offering a pragmatic solution for businesses.

Read Later