Add "test" for hosting location / dependencies / sovereignty

[mxsasha]

There have been recent discussions on some kind of "test" for hosting location / dependencies / sovereignty. This is particularly relevant and current due to the extensive dependency on big tech and specifically US big tech in the current political climate. This issue means to collect questions and ideas on how to approach this, to get us to something practical. Internally we seem somewhat aligned on the use and intention of such a test, but there are many important details.

Questions

• How does this "test" fit into the goals we have as a platform and as a testing tool? We typically refer to correct implementation of normative standards from authoritative bodies, that are supported by a wide consensus. We do not have such a solid backing here, this is more opinionated, both in what is good or bad, and why it is an important thing.
• What do we want to measure? A 100% solid detection of all involved hosting companies is difficult. However, we could focus on detecting dependence on a certain set of big cloud. That aligns with promoting more diversity, and does address the bulk of the issue. But, it may seem like we are targeting certain companies as "bad". Also, there are nuances: does AWS count as EU if it's in their supposed special EU cloud? Is EU inherently good, or perhaps mainly because we don't have such strong centralization?
• Do we include domain registrars? Feels like less of a problem, and it is extra work as it's a very different flow. Perhaps not at first. Whois also has more rate limiting.
• Following from the above, what are the pass/fail conditions? Or is this always informational? It's probably an entirely new category.

Some prior work in #123 and #542, but we never went into much detail. The closest existing resource is probably https://hosting-checker.net which takes data from https://ipinfo.io/ and https://db-ip.com/ - a lot of that data is proprietary. But there are API options. We can not replicate all of it ourselves.

[bwbroersma]

It seems the magic glue to be similar to Hosting-checker would be displaying a flag based on https://ftp.ripe.net/ripe/asnames/asn.txt

[mxsasha]

It seems the magic glue to be similar to Hosting-checker would be displaying a flag based on https://ftp.ripe.net/ripe/asnames/asn.txt

Well, that depends on what country we are identifying. Legal entity? Physical location? Controlling/parent entity? Covered by CLOUD act? We should determine our purposes with the test, then determine what we want to measure, and then see which data sources can help us provide that.

For my tiny AS, it does correctly identify my legal presence, but that is not the location (or EU-ness) of most of my servers. Hosting checker does get those right, as their sources look at latency to various probes (and probably other things).

[bwbroersma]

Agree. Maybe all should be displayed if possible ;)
Somebody once claimed that even is the entity is 🇪🇺 , 🇺🇸 nationals working for that entity still need to comply to the CLOUD Act, not sure if it's true, but if it is, it's very hard to check for this.
BTW Hosting Checker displays 🇳🇱 for Akamai International B.V., NL (which has 20 entries in asn.txt, including ASN names that indicate various non Dutch localities, e.g. London, Munich and New York).