IP Geolocation Is Twenty-Five Years Old

https://www.sanjayparekh.com/ip-geolocation-is-25-years-old/

by sanjayparekh • 2 years ago

88 66 2 years ago

sanjayparekh.com

wara23arish• 2 years ago

Very cool read! I wasn’t working during your time, but I recently have been working on maxmind db datasets.

How different was it to what was offered in the past?

I used to think this data was sourced from ISPs and could not be deduced from how you mentioned in your post

sanjayparekh16• 2 years ago

This is a great question. So when I came up with IP location back in 1999, there was nothing for location-based targeting. Any advertising that happened would be because a user shared a location (ZIP code, etc.) and then got cookie'd and that information was brokered between sites. This obviously doesn't work for more secure uses (content control, fraud detection, etc.), so some of these uses were made possible once we launched. The shift to streaming content would never have happened without a secure way to accurately know a user's location.

The other part of your question, I think, deserves its own blog post. One of my tenants was to NEVER be reliant on someone else's willingness to give us data or access. So, everything was designed with the idea that we would have to gather first-hand data and knowledge. If an ISP gave us data, that would be great and make things easier. But being beholden to ISPs would mean we would be hosed if the sands shifted. This is why I am still flabbergasted when people build their entire company based on someone else's platform, API, etc., and then are upset when those platforms change their models. If you build the foundation of your company on someone else's land, be prepared to lose the house.

qingcharles2• 2 years ago

I was doing legit music downloads and streams for the major labels in late 1999/early 2000 and I was using some sort of paid IP database to determine which of the 34 countries we covered the user was connecting from, so I could pay the right royalties.

Was the market really that small for IP geolocation 25 years ago? I don't remember it being a problem to source the data...

below43• 2 years ago

"That comment of "crushing us" was infuriating. We decided to go it alone, and the results show this was the right decision."

Very satisfying to read!

sanjayparekh16• 2 years ago

It was very satisfying to live through and now reflect back on. :-)

hnfong2• 2 years ago

It's extremely {whatever}-centric to assume that IP location in any way implies anything about one's preferred language. There are multi-lingual countries. There are cultural minorities. People travel. (Not to mention VPNs becoming more popular these days.)

So I always found it infuriating that web sites would try to guess my language from geoip when my browser already sends Accept-Language headers. They spend resources doing this stuff, think they're doing their users a service, give themselves a pat on the back, and then unnecessarily screws up the UX for a significant portion of the users.

I have no idea why companies keep doing this.

sanjayparekh16• 2 years ago

See my comment about this on another response.

junto• 2 years ago

For the last 25 years I’ve hated this invention because it has been continually conflated to make the assumption that my preferred language is based on the country I currently find myself.

Every major global tech company has made this mistake and nearly all of them deliberately override my Accept-Language request header and ignore it.

Did you know that over 8 million people worldwide are native speakers of Catalan, whilst only 4 million people speak Norwegian? Guess which speakers are continually ignored.

When I travel to France, should websites push me to use the website in French, even though I don’t speak it? No.

Incorrect understanding of the problem and badly misused over time. I’d vote to have the IP2Location databases killed off and buried for good.

sanjayparekh16• 2 years ago

You're confusing the tech/innovation with the uses. I agree with you that not respecting, or rather assuming, a user's preferences is a bad UX mistake. That said the tech is also used for content control without which streaming of shows and films would be impossible to contractually happen. It is used to protect your bank account. It is used in a myriad of ways that are much less visible than just picking a language or showing targeted advertising.

hnfong2• 2 years ago

I understand your article was about the tech.

But you did mention the motivation of geoip for detecting location for selecting a language, and given that's what people still do these days despite Accept-Language headers being available for most clients, I think it's worth a call out.

ndriscoll• 2 years ago

Obviously it would not be contractually impossible to allow streaming. The contracts would just not require IP based fencing/allow for global distribution, or e.g. use the billing account's jurisdiction, which is a more reasonable solution anyway.

mrd3v0• 2 years ago

None of the ways you mentioned are the most optimal, or do I say, even valid ways to achieve a certain social goal.

Content control geo fencing is only recent, and streaming was there and will continue to be there long after IP geofencing stops being a practice. In fact, I believe if the technology wasn't around, streaming would have been accessible to more people.

Any amateur "carder" (what credit card thieves call themselves) knows that IP geolocation is in fact good for them, because they can easily load up a proxy or VPN, making this arbitrary, problematic (read: tracking) factor in their favour to steal money and commit identity fraud. There are easily accessible programs online that provide ZIP code accurate IP proxies.

I can go on and on about how terrible IP Geolocation is for almost everyone.

geraldhh6• 2 years ago

whilst only 4 million people speak Norwegian? Guess which speakers are continually ignored.

yaml says "NO"

brianhama• 2 years ago

I used your product when building my start-up. Fascinating to hear the back story!

sanjayparekh16• 2 years ago

Whoa! That is awesome. I get chills whenever people tell me they've actually used something I've built. Hoping I get the chance to write more about the stories from my time building Digital Envoy. Congrats on your startup too - I hope it is/was wildly successful!

incolumitas• 2 years ago

And IP geolocation is still very relevant as of today.

You can derive an enormous amount of geolocation data by looking at WHOIS data: https://ipapi.is/geolocation.html

geraldhh6• 2 years ago

lol k

ggm2• 2 years ago

https://www.ripe.net/publications/docs/ripe-181/

October 1994. which is 28 years ago. Contains the inetnum: object as follows

  The information in the old inetnum object
  inetnum: 192.87.45.0
  netname: RIPE-NCC
  descr: RIPE Network Coordination Centre
  descr: Amsterdam, Netherlands
  country: NL

So.. I hesitate to be snitty, what exactly about IP geolocation did you invent given that by 1994 we already had a formalism to represent IP economy in the records?

toast02• 2 years ago

I had the same kind of thought, but I think the 'invention' is really figuring out an application of ip geolocation, and a market for that application.

IMHO, it wasn't hard to figure out roughly where servers or peers were in the real world based on their IP address and network routes to them, but it was non obvious why someone would want to pay for a service...

ggm2• 2 years ago

"I worked out how to monetize it"

is very different to

"I invented it"

Fischgericht3• 2 years ago

If you read the patent it's clear it's not even that. He filed a patent for an idea, where you would build a database based on geo information provided by the user.

And even before the existence of data privacy laws, this simply would not have worked.

Instead companies like Maxmind implemented the much better idea of sourcing location data from Whois databases and ISPs server-side.

That's what everybody understands when you use the term "IP Geolocation".

convolvatron• 2 years ago

we did some early geolocation work at CAIDA/stanford a little later, around 1996

https://graphics.stanford.edu/videos/mbone/

sanjayparekh16• 2 years ago

CAIDA had some awesome stuff back in those days. There was also an outfit that generated poster maps of the Internet backbones too. I wish I had bought one back then because I don't know of anyone making things like this anymore. Our data was used by a number of companies to create visualizations too. One even appeared on a 60 Minutes story (I think it was that show).

ACow_Adonis• 2 years ago

I can accept that he invented it in the same sense that I invented recursion. I called it the "ouroboros" function and was really quite pleased with myself for thinking of the pattern.

Now, the fact that I called it by an ancient reference should probably have been the first clue that I didn't get there first, and sure enough later I found out that actually no, it's a very old idea in computer programming.

For the record, I can place back reliably to about 2001 the first time I was introduced to someone showing me an actual free application of searching/displaying ip lookups and laying it out on a visual map because it was about the only thing of value I took away from my first year information systems course, and although I can't remember the name of the application or program used, i've never heard of the blog writers company or his competitor: free software that did it must have already been available and mature for doing it and was being passed around during that time because it was already freely available by the time lowly old me turned up.

And given that the theory of doing so probably worked out long before that I think "invented" might be a liiiiiiiitle bit of a stretch...

sanjayparekh16• 2 years ago

All I can say is when I first met Vint Cerf, he was pretty enthusiastic about the invention. But maybe he didn't really understand the Internet either. You can see the fireside chat I had with him here (to be clear, we weren't sitting next to a fire either): https://vimeo.com/124048978

yosito3• 2 years ago

25 years old and still constantly misused by tech companies to assume my language preferences while traveling even though my browser explicitly communicates my language and locale preferences. Spotify and Google are particularly notorious offenders.

kristopolous2• 2 years ago

Wrote about that 7 years ago over here https://kristopolous.medium.com/stop-guessing-languages-base...

Larrikin• 2 years ago

I usually mentally filter any links that I see that are on medium, and actively block them from search results.

Old articles like yours can be read to the end, but with a banner blocking a third of the page, and nearly 100% of new articles I've come across in the past year get a nice paywall right at the entire reason I clicked on the article. All the new articles that aren't blocked are worthless content I wish I hadn't clicked on.

paulddraper2• 2 years ago

MDN doesn't like it

Browsers set required values for this header according to their active user interface language. Users rarely change it, and such changes are not recommended because they may lead to fingerprinting.
The content of Accept-Language is often out of a user's control (when traveling, for instance). A user may also want to visit a page in a language different from the user interface language.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac...

:shrug:

hsbauauvhabzb• 2 years ago

There are a million metrics that can be used for fingerprinting, the notion of avoiding language detection because fingerprinting seems a bit weak - it’s pretty hard to fingerprint me if I’m not willing to fumble your site to configure my language, and I assume for non English speakers hard locking browser resolution to 1920x1080 to prevent resolution fingerprinting would presumably be a more usable limitation.

Edit: and ‘a user might not be the owner of the computer and therefore the accept language might be wrong‘ sounds like a UI problem that a ‘file -> set language’ workflow would solve.

yosito3• 2 years ago

Accept-Language is far more under my control while traveling than my IP address. Especially for services that actively block VPNs.

bun_terminator• 2 years ago

God yes. It's still an uphill battle trying to convince my PC that I indeed want to have english-everything, although my PC is in europe. And boy do some websites go through hoops to be "clever"

Dalewyn3• 2 years ago

I can kind of see why this is all the case: IP geolocating can be assumed to be generally useful, locale settings expressed by the browser and/or operating system could have been explicitly set or just left as what they came out of the box and thus unreliable.

That said: There's a reason I am going to google.com and not google.co.jp, fucking thanks fucking good day fucking fuck.

geraldhh6• 2 years ago

I indeed want to have english-everything

english + metric || gtfo

lloeki• 2 years ago

boy do some websites go through hoops to be "clever"

1. I'm in (east of) France geo

2. My system is set to en_GB

Yet some websites insist in putting me in Germany. Sometimes it even changes between requests (web pages), some are extra nutty and I even get mixed content within the same page.

For the love of all that is holy, please stop being clever. UAs have had Accept-Language headers ever since RFC3282. Use that hint.

Fischgericht3• 2 years ago

No, IP Geolocation is not Twenty-Five Years old, you did not invent it, and you do not have a patent for it.

Let's see what your patent is about:

A method, computer program product and electronic device are provided for providing hyper-local geo-targeting based on validated, user-supplied geographic information, wherein the user's anonymity may be maintained. In particular, user-supplied geographic information may be collected in association with a truncated IP address. Once collected, the user-supplied information may be validated using geographic data previously derived from one or more complete IP addresses corresponding to the received truncated IP address. The derived geographic data may have been derived using a system that maps the routing infrastructure of the Internet in order to determine where endpoints on the Internet are located. The validated, user-supplied geographic information, which may be more specific than the derived geographic data, may then be used to provide more granular and accurate geo-targeting, all the while maintaining the privacy of the individual users.

User-supplied geographic info. Aha.

First claim:

1. A method comprising:

receiving, by a computer over a network, a truncated internet protocol (IP) address associated with a user device related to a specific user;

receiving, by the computer, user-supplied geographic information associated with the truncated IP address, the user-supplied geographic information not being linked to the specific user;

retrieving, by the computer from a database, geographic data derived from one or more complete IP addresses corresponding to the truncated IP address;

validating, by the computer, the user-supplied geographic information based at least in part on the geographic data, the validating comprising determining if the user-supplied geographic information is the same or equivalent to the derived geographic data associated with at least one of the one or more complete IP addresses corresponding to the truncated IP address, wherein in response to the user-supplied geographic information being validated, the user-supplied geographic information permits providing geo-targeted information.

I may not be perfect at reading patent legalize, but this "Invention" does not make any sense to me. So someone is providing his geo location, to then receive his geo location? Yay.

I've been using geo location for over 25 years now. And I have never heard about your company. And pretty much everybody uses Maxmind for 22 years now. Because they have an actual product, a website, pricing, and a free offering that's deployed on hundreds of thousands of servers.

Your company website on the other hand makes me want to puke. No way to actually see any IP Geolocation services. No products, no pricing. Just BLABLABLA WHY WE ARE SO GREAT.

So, guess what: No, nobody stole your idea. Nobody every heard about you or your idea, and nobody cared.

Maybe instead of posting this here actually invent something that is of use, and then come back here?

Yes, these have been rude words. But did you REALLY come here to get praise on this whiny narcissistic blog post of yours? Next time, please have this discussion in front of your bathroom mirror instead.

sanjayparekh16• 2 years ago

Maybe it wasn't clear, but I left my operating role at the company in 2005 and we exited the company (it was acquired) in 2007. I don't think I ever said anyone stole my idea - because they never did. Others were in the same space (Maxmind included) but came up way after us - and we never pursued anyone in court for patent infringement. Why? Because we always wanted to win in the marketplace and not in the courtroom.

Also, you probably don't know what data goes into Maxmind but that's okay. It doesn't matter to me since I exited a long time ago and have no dog in the fight anymore. But just because you don't know Digital Envoy doesn't mean you aren't using (and paying for) their data. ;-)

Fischgericht3• 2 years ago

I am very sure I am not paying for that data, and no-one else is.

The patent is absolutely trivial and would be thrown out in 5 minutes on the first objection. It does not even specify an implementation. Yes, patent language makes it sound important, but basically your "invention" can be summarized in one sentence. That's not an invention.

It's all bullshit. The company website now reads "50 patents on this!". It's a single patent, and yes, in the EU every copy of a patent is registered for each country and therefore you get 50 patent numbers.

Sorry to hurt your feelings, but as you are still insisting to be an inventor. You are not. You may be a great marketer if someone really paid you for this, but that's all.

(I also have "50" patents. But I would not brag about it, and my invention at least consists of a complex idea and 15 pages describing the implementation.)

And finally: The idea is illegal in the EU, where an IP is regarded as personal data, and you would need a written approval by every single user. And I have seen GDPR cookie popups, but never a sanjay popup.

Please just stop trying to impress tech people with a trivial sales person idea. You are abusing the patent system as a troll, and exactly this makes everyone in the industry hate it.

Amfy• 2 years ago

Source of so many problems

sanjayparekh16• 2 years ago

Agreed. But also the source of so many new possibilities. Like most things, the bad comes with the good.

unethical_ban2• 2 years ago

And what a privacy nightmare, particularly with IPv6. When I see a map of my home IPv4, it's within a mile or two. With IPv6, it's on my block.

But at least the companies I consult can block Chinese IP addresses from their public web presence. Chinese security will never think to stand up a server in the US or Europe.

(Yes, I know it can help block noisy log generation).

sanjayparekh16• 2 years ago

If you're getting targeted to your block with IPv6, your ISP is likely giving away your data. VPNs are your friend.

geraldhh6• 2 years ago

ime geoip is at best able to identify the country, but yours are both scarily accurate, which isp?

unethical_ban2• 2 years ago

ATT.

8organicbits• 2 years ago

The site owners contended that they could not know where an Internet user was geographically located. Clearly, I had proven the opposite.

I've spent a lot of time working with the Maxmind and other paid datasets for IP geolocation. One thing you'll quickly notice is that they disagree with each other, sometimes giving answers on different continents.

There's challenges here. IP addresses are dynamically assigned. They are bought and sold to different companies regularly.

That's not even getting into problems like VPNs, or remote browser sessions. The details and context are lacking here, but I disagree that you can be certain where a user is located using those tools and its harmful to believe you can.

imp0cat2• 2 years ago

What's with the `?ref=sanjayparekh.com` query parameter? It's present on every link, is that some new tracking standard?

sanjayparekh16• 2 years ago

Huh. Good question. Must be something Ghost added because I didn't do that manually. I'll have to take a look.

geraldhh6• 2 years ago

browsers started to limit referrer info a few years ago, this might be a workaround.

imp0cat2• 2 years ago

Yeah it looks like that, but is this an official standard that's defined somewhere. I am not sure what to search for.

Sporktacular• 2 years ago

Looks like people just aren't buying it. The self-aggrandisement and the unjustified certainty of the 25 years ago claim. Modesty in line with the achievement will be received much better.

IP Geolocation Is Twenty-Five Years Old

Related Stories