Every response and comment from LaLiga, the football organization responsible for this, has been so far that this is a minor issue that only affects a few bunch of nerds who talk about "docker images" or "github repositories" or "whatever that means".

Meanwhile, there are testimonies of smart home devices like anti-theft alarms or automatic doors, that stop working whenever there is a football match, because their backends rely on Cloudflare.

Last week, a woman asked for help on social media, as the GPS tracking app she uses to see where her father with dementia is, went offline during a match. It was getting late and he still wasn't back home, and she couldn't locate the tag he was wearing to find him: https://www.infobae.com/america/agencias/2026/04/05/laliga-d...

It's hard to say this, because no one should experience an event like this, but as stressful as these are, it's the only way to make the mainstream people care about this censorship. "I cannot pull a docker image" will never be on nightly news, but safety and personal security is a more powerful driver for discourses.

This is generally how the GFW works in China. Instead of an overbearing nanny like a school or corporation's DNS blocker, you're left with a sense that you're on a version of the Internet that is just intermittently and somewhat mysteriously broken.

And indeed, in China, a lot of things that probably aren't fully intended to be blocked are not reliably accessible. Implementation varies, so you get strange routing and peering issues. It feels like an Internet that isn't fully formed, that hasn't finished coming together yet.

Nation states and corporations obviously gain some things sometimes by having Internet censorship/blocking frameworks in place. Maybe, sometimes, ordinary people even benefit, too, if it helps shut down illegal and genuinely harmful businesses.

But it feels like the whole world is gradually trending towards more and more Internet censorship without realizing that we are un-building a miraculous thing that took enormous effort and cleverness and expense to build. I wish we could think about this not only in terms of freedom (and we absolutely should think about it in terms of freedom), but how we are disintegrating the infrastructure of communication and computing.

Oh boy, an excuse to share my favourite great firewall story on a visit to China. Keep in mind, this is 15 years old, so probably doesn't represent the current state of affairs. At the time, my daily news reading habit had me checking BBC and CBC (Canadian Broadcasting Corporation). The BBC site seemed to be working fine, but whenever I clicked on an article on CBC, it was blocked. A few minutes later, I went to show my wife that CBC articles were blocked, and I clicked on the same one again, and it loaded. I clicked on another: blocked. Tried it again after a few minutes and it loaded. Someone was screening the articles in real time for me. When I was done reading, I clicked on several of the weirdest headlines I could find, and after a few minutes, everything was blocked again including ones that had previously worked.

The counter-reaction to this era will include additional communication control.

These were ripe with espionage, wiretapping and sabotage. Access to it used to be highly restricted as well, up until the 90s for example you were only allowed to connect government-licensed modems to the German PSTN directly.

Just like today's Internet. BGP spoofing, CALEA, DDoS.

> Access to it used to be highly restricted as well ...

And this is where the regression or "downfall" is beginning. Access to the Internet (as in ability to send/receive arbitrary data to the wider Internet) is something I bet is going to be increasingly restricted, but most people won't notice because they don't understand the difference between apps and the Internet.

I'd be surprised if direct access to the Internet is possible for consumers in the next 10 years. Everything will have to be through approved apps (age assurance is going to be the catalyst) that work over registered tunnels contracted through ISPs, if there isn't an outright blurring or merger between the concepts of phone/CPE, ISP and CDN. Your non-tech layperson will not know any difference whatsoever if all they use are their phone plan, streaming/banking apps and Facebook.

This was the same in many places. The cost of hardware and connection time limited connections, and no one had cryptography except the government and ultra nerds.

obviously it can be bumpy and maybe there's a Great Filter or you happen to live during a bad period but life is certainly much longer and less brutal than it was for 99.9% of human history

I've claimed financial loss, claimed sanity loss and everything in-between, but I'm afraid unless something reaches the European/EU courts, Spain will continue to be in the pocket of the La Liga owners.

Straight up fucking censorship with wide collateral being completely accepted in a Western country in 2026, beyond comprehension how this is allowed.

Here's some commentary on it:

> Justice Perram discussed the idea of speculative invoicing within Australia

> Representing to a consumer that they have a liability which they do not may well be misleading and deceptive conduct within the meaning of s 18 of the Australian Consumer Law and it may be equally misleading to represent to someone that their potential liability is much higher than it could ever realistically be. There may also be something to be said for the idea that speculative invoicing might be a species of unconscionable conduct within one or other of s 21 of the Australian Consumer Law or s 12CB of the Australian Securities and Investments Commission Act 2001 (Cth).

> Further, even if speculative invoicing was deemed to be lawful within Australia, the damages that the individual may be liable to are often calculated differently to that of the United States. In Australia, damages are compensatory in nature, meaning to compensate the plaintiff for the loss suffered. One Intellectual Property Lawyer has been quoted as saying, ‘If a film costs $20, the damages would ordinarily be expected to be $20.’

https://www.kells.com.au/insights/business/dallas-buyers-clu...

(Sadly as living in Spain for about a year I’m still not in such place to raise this or understand the full steps needed)

Can you expand on that? How would you go about running your own DNS that wouldn't be affected by football leagues?

I don't think any of them will help in Spain case though, I believe the ISP/court choose to block the IP range entirely, which hit Cloudflare customers. DNS hijinks won't solve those.

I mean, didn’t El Salvador and Honduras go to war over football back in the 60’s? And I seem to recall there was a football match which helped precipitate the dissolution of Yugoslavia - national identities coalesced around football tribes.

It takes time, money and a strong legal team, but maybe IT companies maybe can put this together?

We've never guaranteed the right to free speech and because we haven't it's a slippery slope all the way back down to the furnaces of autocracy we sprang from.

The Spanish president has come out on record saying we don't deserve anonymity on the internet.

Some people deemed "russian assets" are not just censored, but stripped of ability to leave EU and prevented from being able to live in EU at the same time by financial sanctions, etc. Of course this doesn't happen to actual politicians in power, for whatever reason those never get sanctioned by EC, despite doing more "damage" than random blabberheads on twitter.

It's a mess.

"EU" doesn't censor anything, there isn't even any authority nor infrastructure that could do that.

Individual countries, like Spain, does have a bunch of censorship though, this is pretty clear and evident already. But I think if you want to share something useful or even informative, you need to add what country this experience of yours is about, because it's not true in any/every EU country.

Other ways EU censors centrally are EU wide travel bans that individual countries can issue to prevent political speech by foreigners, under the guise of preventing "incitement" and preserving "stability". Doctor Ghassan Abu Sitta from UK is one prominent example.

Yet other way EU censors centrally are EC sanctions on individual journalists or "journalists" to prevent them from any economic activity within EU, incl. publishing.

Other way EU censors centrally is via DSA, which results in seemingly random bans of channels on "social media" like Telegram, under the guise of fighting "terrorism". Basically this way it tries to silence people it otherwise supports killing without due process.

Used my digital certificate (which is installed in the browser), but AFAIK, you can use Cl@ve on that page above too.

In the past, I've cited BOE-A-2022-10757 (https://www.boe.es/buscar/act.php?id=BOE-A-2022-10757), done a reclamació for the repeated loss of lawful access on my connection, and a denúncia about a broader overblocking practice affecting access to lawful services.

Also, supposedly, we should be able to make claims to CNMC as well, but haven't figured out how. Also of course, been complaining to my ISP every time it happens too.

Snail mail uses up physical space so it might get more attention, it would be hilarious to see news reports of truckloads of complaint mail being dumped in front of the whatever office.

This is a great idea, we definitively should make this happen! If people are curious on collaborating on something, reach out, email in profile (English or Spanish emails welcome!).

And when purchasing a product, there's no "bill of materials" telling you about the services it relies on, beyond "internet connection" at best.

I'm not saying this situation isn't bullshit, but the bigger problem is that CloudFlare is now "fundamental internet infrastructure". This is precisely the situation that the internet was designed to prevent.

Yesterday I got stuck in endless CloudFlare CAPTCHA's, trying to access theretroweb.com. I had to give up. Many such cases. I hate CloudFlare so much, it's unreal.

Right, but on the other hand, our constitution and laws are supposed to give us the rights to access a internet where the government cannot block entire companies who host websites, because a few bad websites are hosted there.

Not to mention all us freelancers, contractors and just in general computing users, who sometimes want to continue working although 90% of the country is watching football, we should be able to do so even if pirates use Cloudflare for shitty stuff.

I agree that Cloudflare sucks, people should avoid defaulting to putting Cloudflare in front of absolutely everything they do and I too get stuck at the CAPTCHAs sometimes. But that doesn't remove the fact that Cloudflare, just like every other lawful company, should be allowed to be visited during La Liga matches.

Geoff Huston discuss this a few months back. The economic incentives helps shape centralized internet, to the point that most of today's traffic is cache push and private peering between major providers, rather than network transit.

https://blog.apnic.net/2025/08/21/podcast-the-inevitability-...

Which kind of make sense, since with peering both end of the infra (if separate entity) can negotiate for better terms upfront. While the latter is basically unpredictable opex based on traffic shape and routing algorithm.

I think lots of countries block Cloudflare whole-sale.

Laundering IP addresses for (or against) shady purposes is, in fact, Cloudflare's whole business. It's a wonder Cloudflare isn't being blocked more often.

You may like that the platform is open by default to everybody, but that's the obvious consequence.

Business-wise it's risky to deliver your service from IPs that also serves dirty content. Technical solutions exists, even if you want to stay on Cloudflare.

Solutions exist if this market is important to your business.

Needing to find solutions to a problem completely manufactured by sports and television is the problem.

Without Cloudflare, you can censor whatever you want. If you have the support of an (undemocratic) government on your side, you can even DeDoS them, making sure that information critical of you cannot see the light of day.

Of course, the standard response against centralization is that the centralized entity can sneak backdoors and turn at the drop of a hat.

Maybe something like a signal-like model might be good, in that regard, as opposed to mesh networks.

The fault here lies 100% with horribly designed IoT devices that turn into bricks when they lose internet connection.

What a wonderful idea!

Translation: go away kid, we're trying to make money here.

A VPN won't help against government blanket outages, where the target is complete control of communications, and attempts to circumvent may result in extreme penalty. In this case, where the government policy is to stop unauthorized streaming, and collatoral damage is acceptable, a VPN hosted in a more favorable location is likely to work enough. Afaik, I don't think Spain has the political appetite to block VPNs and such during football matches.

You can still fight the political issue with political means, but in the mean time, you can also get work done.

Obviously, everything can be cut off, but the point is that if encrypted something is allowed, there should be a way to get anything through.

What is this "sweet position" you talk about?

I was trying to refer to an actual rebel position, which is actors which use illegal practices to achieve their goals agaisnt institutions in place. Which might have the cool attitude imagery attached to it, but which is certainly not an easy one in reality.

What technical solutions can't change is the underlying social dynamics.

When the La Liga match starts, everything that's proxied via CF (including zero access reverse tunnels) stops working.

There's even a website made for checking if the match is on: https://hayahora.futbol/

You can check if your host is affected: https://hayahora.futbol/#comprobador&domain=docker-images-pr...

The effort required to change the situation is massive.

[1] https://en.wikipedia.org/wiki/Right_to_Internet_access

Pirates would rather not be blocked, so they create a new, disposable website for every game. Any blocking must happen fast.

Cloudflare would rather not block websites without a court order specifying the sites to be blocked.

The courts would rather not create a special fast lane through the courts, just to resolve a squabble between two huge corporations.

Funny enough, I work in IT and I've had to use a VPN to be able to do my job when soccer is on, but my two non-tech-savy family members that do watch soccer using pirate livestreams say that they've never had any issues with blocked streams.

But the point is that the measure does more to block legitimate use than illegitimate (in my experience). And next they want to go after VPNs. Wonderful.

Surely you understand now. Go about your business, poor person.

why would they?

> squabble between two huge corporations

I think this is just LaLiga using it's cultural and economical power, don't think Cloudflare or the courts should be making exceptions just so they can control how people watch football

Well, in this case, the alternative is all of Spain intermittently blocking lots of Cloudflare.

But if Cloudflare bows to Spain in this case, every jurisdiction will want to pile up lots of special case rules for Cloudflare to try and implement.

Cloudflare literally wasn't even a party to the ruling by which LaLiga has been compelling Spanish ISPs to do the IP-level blocking. They're just an affected third-party because the blocking scheme the courts have allowed LaLiga to impose on ISPs is on a per-IP basis.

Spain hasn't asked Cloudflare to do anything. Only LaLiga has acted like Cloudflare owes them a huge, expensive rework of their CDN's architecture for the purpose of censoring things for LaLiga purely as a favor to LaLiga. What LaLiga has over Cloudflare isn't a court order. It's a protection racket, or maybe a hostage situation, where court orders involving other parties are the gun held to the hostage's head.

Nor did I say they did.

The question was asked, "why would they [without an explicit order]" The answer is they probably shouldn't, but there's still an obvious incentive here.

Anyone can report illegal content on Cloudflare and Cloudflare will remove it. The pirate streaming sites pop up only in or just before the first few moments of the game, and LaLiga insists they must be removed instantly in order to prevent their losses. So what they actually want is preemptive removal without meaningful human review or anything else that could take 10 minutes.

That involves more than being responsive when someone reports abusive content or dropping bad customers. That requires becoming a censorship machine that preemptively treats all new customers as criminals, and probably having some unaccountable AI drive the censorship process. (That latter seems to be what LaLiga is pushing Fastly to do.)

That's beyond the legal obligations of infrastructure platforms, bad for the reliability of their service, and just a slice of what they'd have to do to rework their architecture to support this kind of preemptive censorship.

Yet this would actually be a better solution for everyone (except the pirates).

10 minutes seems like a reasonable response time that would allow a chance for human review. No football fan wants to have their viewing interrupted because they used a dodgy pirate site to watch it. Currently, pirates can simply use a VPN to get around the IP-level block while the huge collateral damage affects legitimate Cloudflare users.

Plenty of companies proactively take action against shady users, even if not 100% required under law. Youtube has content id, social media companies have "community guidelines", and ISPs have AUPs.

Looks like same old regulatory capture.

https://xcancel.com/eastdakota/status/2009654937303896492

Everyone looks bad in this conflict.

When the match starts, Movistar (a big ISP, but also a TV platform that streams legally football matches) sues itself in the following terms: "we, Movistar TV, demand that Movistar ISP blocks the following IPs that are being used to stream our matches illegally", on a special and urgent procedure. The judge tells Movistar-ISP to block the IP, which they do in seconds. Now replace Movistar with the biggest ISPs in Spain, and you have more than 80% of the country with Internet capped for hours (except if you know how to use some kind of tunneling)

As the pirates share the IP with so many sites, because the IP is actually a Cloudflare proxy, a big chunk of the internet goes down. Users complains, and Movistar ask Cloudflare to block the real IP and spare the rest. Cloudflare says that they cannot legally do that as no judge actually told them to.

Our Spanish judges are historically inept when talking about copyright, internet, file sharing and similar stuff. Some of them might be more updated, but there has been cases that they ordered some publications to surrender their lithographic plates, because a cover has to be retired as late as 2007 (https://www.elmundo.es/elmundo/2007/07/20/espana/1184937587....). So I don't think they understand much more about what is an IP other than "a IP is a number assigned to a computer". And Movistar is quite happy with that.

https://www.shadertoy.com/view/lscczl

Performing security verification

This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot. Incompatible browser extension or network configuration

  The real fix on your end until Spain sorts this out: set up a pull-through registry cache (e.g. registry:2 with proxy.remoteurl) on a VPS outside Spain, and point your Docker daemon's mirror config at it. Your
  GitLab runner pulls from the cache, the cache pulls from Docker Hub via a non-blocked IP. Also insulates you from Docker Hub rate limits.

  But yeah, the fact that a court order about football streaming can break docker pull for an entire country is genuinely absurd.

AFAIK, they're not doing "blanket IP blocking", they're intercepting requests based on DNS and IP, and try to serve their own certificates and their own content. Obviously, in most cases it fails, as the certificate doesn't match the site, so the browser rejects it, but as far as I can see and tell, there is no "blanket IP blocks", more like "DNS and IP interception".

The difference doesn't really matter in practice, sucks regardless, but I thought I'd clarify for the ones who are not experiencing these blocks themselves at least.

India has consistently been at the top of the number of Internet blackouts anywhere in the world for years (Access Now keeps track of this through its KeepItOn project). These tend to be brief and localized, triggered by something as mundane as an exam or protest or local incident. It’s such a routine occurrence here that there’s even a reflexive response: mobile data works differently from other connectivity types, so go with that, try new DNS settings, rely on Telegram instead of WhatsApp when the latter fails you, and always have a list of mirrors.

What’s fascinating about this case is that it’s identical except for who is pressing the button LaLiga, a privately owned entity, in place of the government.

Someone needs to write a heist movie set in Spain where a key part of the plan is they steal something while La Liga is blocking some key security route.

I'd like to suggest some steps that might/should be followed, which I will not pursue personally but in my defense - I do not live in Spain and not affected.

1) (first! low-effort) Somebody should create any space on the internet, where such anecdotes might shared and probably people with common goals of fixing internet access in Spain will meet. E.g. telegram group, discord channel, subreddit...

2) probably create wiki with related research: legal framework and possible actions etc

3) Raise public awareness. Create a resource/website with schedule of past and future "semi-blackouts", simple explanation of possible effects a layman may notice etc

4) Explore legal actions that might be taken. How this issue might be forced to be discussed by politicians? For instance I know that Portugal has official mechanism to put forward petitions, that will be discussed in parliament if get enough votes [1]

Space of possible demands in such petitions is vast. For instance:

- Make LaLiga compensate partly price of internet access

- Force LaLiga to include education notice in the beginning and the of translation with title like "Start of reduced internet connectivity" / "End of reduced internet connectivity"

[1] https://participacao.parlamento.pt/initiatives/

https://hayahora.futbol

My game's server is blocked in Spain whenever there's a football match on: https://news.ycombinator.com/item?id=45358433

Spain’s LaLiga has blocked access to freedom.gov: https://news.ycombinator.com/item?id=47114235

Cloudflare’s authoritative DNS uses EDNS Client Subnet (ECS) to return different IP pools based on where the query originates. Spanish resolvers get IPs from a range that La Liga blocks. If your recursive resolver is physically outside Spain (or you use DoH/DoT to tunnel to one), Cloudflare returns a different, unblocked pool.

AdGuard DNS works well for this.

Sometimes it works, sometimes it does not, but doing nothing is never an option if you disagree with what they're doing. To think that doing nothing is better than something, that's incredibly naive.

You're right, it possibly has the same effect. How could we figure out what's the actual answer in practice?

This is also not new behaviour - Theo posted a YouTube about it nearly a year ago[1].

[1]: https://www.youtube.com/watch?v=1-geGEYEw7g

For everyone else, small and big, this is the weekly reminder to not use Cloudflare for user-facing access to anything.

Cloudflare is one of the few companies who can handle that for relatively cheap, Docker could not just "run their own" and have it even be compareable.

Then you origin needs to be publicly accessible and you lose the DDOS protection that a CDN gives you.

> All the other ones.

They're just as susceptible to outages as Cloudflare is.

Docker must be handling absolute massive amounts of traffic on their (free) docker hub, Cloudflare is one of the only companies in the world willing to handle that is able to handle that cheaply. It’s no secret that Docker is struggling financially. So surely you’re not blaming Docker as well for using Cloudflare?

There are alternatives and any search engine can lead you to them

(The trial was initiated by LaLiga and Telefonica...).

"Telefonica" is the (exclusive) distributor for the rights of streaming the matches, and is only (of course?) the main consumer (and business) Telco in Spain: they are in a game they cannot lose. This is such an abuse and no government (this, past, whichever) has done anything about it.

The last domestic TV deal they signed recently was worth $6B for 5 seasons or so, which is what you are proposing they buy.

In enterprise value terms that $1B/year growing 6 %YoY is worth a lot more than $5B.

In contrast Cloudflare has a $2.5B revenue albeit growing much faster but also has much smaller earnings or free cash flow, I.e. money they are not spending to make their current revenue.

They make about $25m a year in profit. Cloudflair actually looses a small amount of money on 2.5x the revenue. However, Cloudflairs market cap is about 100x that of RM's and that's because they have a growing business, in a growing industry and can easily become profitable when needed. That's probably not possible for RM and their very pricey lineup of players.

Real Madrid owns the Bernabeu a valuable piece of real estate in the heart of Madrid and many other assets the Real Madrid brand is very monetizable .

Sports team have been consistently growing businesses in every major sport in both Europe and US. Comparing a sports team and SaaS company is hardly going to be apples to apples with different asset , revenue, brand and monopoly and strategic profiles.

——

The risk to the league due to piracy is the value of the television deal. The buyer paying $1B/yr (DAZN) is the reason for this enforcement.

If Cloudflare wants to buy this problem away that is what they need — The $1B deal growing 5-6% YoY and get into the streaming business .

Prime alone is expected to spend $4B on live sports rights this year. It is very expensive space with everyone from Apple to Google and Netflix to sovereign funds going deeper every year .

The streaming revenues otherwise aren’t expected to be massively grow so this is the content play that is least risk - compared to investing in say 4-5 blockbuster movies or tv series this is far more predictable and consistent revenue stream.

[0]: https://news.ycombinator.com/item?id=47750927

Something that confused me for a while was the path "docker.io" used for pulling containers. There is not actually a container registry at "docker.io" - rather docker and podman are hard coded to convert it to either "registry-1.docker.io" or "index.docker.io".

I use a little script[0] to automate that when deploying some personal projects, but really it could be as simple as `docker save`/`scp`/`docker load` (especially for a one-off situation or when the images are small).

[0]: https://github.com/mkantor/docker-pushmi-pullyu