Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things to know about the GDPR, Mozilla and Firefox

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 103 posts

Re: Things to know about the GDPR, Mozilla and Firefox

#71

Post by jhall1468 »

pluma wrote: post #68
jhall1468 wrote: post #5

Earlier quoted context omitted.

And a ton of non-EU companies don't, but are doing so for future purposes. Despite territorial scope, a company without any form of business in the EU, they can't entorce this against non-EU businesses.

FWIW while you're right, that's awfully shortsighted unless you're a mom & pop shop with no intent of ever expanding beyond your backyard. A lot of devs hanging out on HN are working for companies that have at least some B2B aspect. Being GDPR non-compliant means these companies will have to avoid you too, because even if they're themselves not affected by GDPR they may have customers who are and need the compliance…

The US is an enormous market. You could easily be a multi-billion dollar company without having a single presence in the EU. Hell you don't even have to stay in the US market, since Asia is a thing.

Calling it a "backyard" is disingenuous. Most companies are going to follow this because they have global aspirations, but that doesn't mean it's impossible... or even all that hard.

Re: Things to know about the GDPR, Mozilla and Firefox

#72

Post by trumped »

tbranyen wrote: post #51
athenot wrote: post #41

Earlier quoted context omitted.

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

This is a terrible use case for cookies. Any browser reset or change, new computer, your phone, etc, and you need to redo the whole experience every time. I'd rather login and customize once. Cookies get sent with most requests as headers so you're unnecessarily bogging down requests with data unrelated to the session.

You could backup your cookies and share them across devices? ... I don't think "bogging down" requests is a very big issue nowadays...

Re: Things to know about the GDPR, Mozilla and Firefox

#73

Post by grey_earthling »

paublyrne wrote: post #43
gregknicholson wrote: post #39

Earlier quoted context omitted.

If Google is collecting the data, not Mozilla, who's violating?

After completing our mandatory and very boring GDPR training at work, I can tell you that it's Mozilla :)

OK. Can you tl;dr for me why that is?

Is it because I've asked Mozilla to show me a web page, and the data collection happens as an automatic result of that?

Re: Things to know about the GDPR, Mozilla and Firefox

#74

Post by chimeracoder »

ryanwaggoner wrote: post #57
krageon wrote: post #12

Earlier quoted context omitted.

You are wrong. This is a misconception that has thankfully died down a bit over the past week or so, but apparently it is still a bit alive. There are accords in place between (for example) the US and the EU, which allows the EU to hand out fines overseas. The reverse is also true (the US can and does litigate in the EU).

Bullshit. Please tell me how the EU has any possible way to enforce this law in the courts against some small business in the US that has no EU presence but many EU customers. There is zero chance that US courts are going to let this small business be fined by the EU for violating an EU only law. Their absolute best option would be to attack global platforms that small businesses rely on to get the platforms to enfor…

> Their absolute best option would be to attack global platforms that small businesses rely on to get the platforms to enforce compliance or blacklist those small companies. This is especially potent for Visa and MasterCard. I doubt that will ultimately work though.

Actually, that part is the most plausible way that companies outside the EU with no EU presence could be forced to to comply the the GDPR.

Re: Things to know about the GDPR, Mozilla and Firefox

#75

Post by solarkraft »

ReidZB wrote: post #60
athenot wrote: post #41

Earlier quoted context omitted.

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

"User-interface customization" cookies are actually explicitly exempt from EU consent requirements: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm I believe they should not be affected by GDPR either, since they're not actually identifying a person.

Yet you could use them to do that once there is a significantly high amount of customised settings ...

Re: Things to know about the GDPR, Mozilla and Firefox

#76

Post by gkya »

tbranyen wrote: post #51
athenot wrote: post #41

Earlier quoted context omitted.

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

This is a terrible use case for cookies. Any browser reset or change, new computer, your phone, etc, and you need to redo the whole experience every time. I'd rather login and customize once. Cookies get sent with most requests as headers so you're unnecessarily bogging down requests with data unrelated to the session.

I don't think a gzipped header with some hundreds of bytes of JSON (or BSON) for preferences is that much bigger than one with a session id string in a cookie.

Re: Things to know about the GDPR, Mozilla and Firefox

#77

Post by ryanwaggoner »

chimeracoder wrote: post #74
ryanwaggoner wrote: post #57

Earlier quoted context omitted.

Bullshit. Please tell me how the EU has any possible way to enforce this law in the courts against some small business in the US that has no EU presence but many EU customers. There is zero chance that US courts are going to let this small business be fined by the EU for violating an EU only law. Their absolute best option would be to attack global platforms that small businesses rely on to get the platforms to enfor…

> Their absolute best option would be to attack global platforms that small businesses rely on to get the platforms to enforce compliance or blacklist those small companies. This is especially potent for Visa and MasterCard. I doubt that will ultimately work though. Actually, that part is the most plausible way that companies outside the EU with no EU presence could be forced to to comply the the GDPR.

Agreed that it’s most plausible, but still not very. I don’t think the US is going to stand for letting the EU squeeze these companies to enforce their laws on every small business with a website in the US.

Re: Things to know about the GDPR, Mozilla and Firefox

#78

Post by gkya »

pixellab wrote: post #64
tbranyen wrote: post #51

Earlier quoted context omitted.

This is a terrible use case for cookies. Any browser reset or change, new computer, your phone, etc, and you need to redo the whole experience every time. I'd rather login and customize once. Cookies get sent with most requests as headers so you're unnecessarily bogging down requests with data unrelated to the session.

100% exactly. Cookies are device and moment specific. Whereas a user account can easily save and transport the saved experience/setting anywhere the user wants to access them.

Firefox (and Chrom{e,ium} AFAIK) can sync up your cookies, among other things.

Re: Things to know about the GDPR, Mozilla and Firefox

#79

Post by zerostar07 »

JohnTHaller wrote: post #44
billysielu wrote: post #19

OK great, can we have First Party Isolation enabled by default now? Y'know, for privacy. Browsers should be protecting users by default.

Just have the browser present the user with the choice on install. ( ) Enable third party cookies. This may allow third party websites to track you across the internet. ( ) Disable third party cookies. This may break some functionality on some websites. It's no more confusing to end users than the endless sets of checkboxes websites have to use for GDRP or the pointless click OK to accept cookies notices.

Yup thats how it should be. Technical solutions are always superior to regulations.

Re: Things to know about the GDPR, Mozilla and Firefox

#80

Post by throwaway974 »

I have a profitable, bootstrapped SaaS business. It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required to login so that I can send password reset and other such communication.

I've been talking to a very well known giant corporation for months. The VP and director love my product and want to start using it right away for their department. But their legal team is scared shitless with 4% fines in GDPR. They are putting some draconian clauses, (various ISO certifications and such) in the contract that I, as a small company, cannot comply. That's their interpretation of GDPR. It doesn't matter whether it's right or wrong.

The VP and Director are really nice people and I've developed very good rapport with them. But I'm afraid their patience will run out soon and they'll go back to using spreadsheets. A lose-lose situation.

This is the side-effect of GDPR.

I'm all up for GDPR. I have uBlock, have blackholed all Facebook domains, etc. But don't assume that GDPR doesn't affect normal business transactions. Anyone who says, "Oh, how hard could it be?" has no idea what they are talking about.

Post reply on HN