Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

31–40 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#31

Post by kentonv »

logronoide wrote: post #14
jotaen wrote: post #8

I think the most important part about the post is at the very end: > Please don’t take us seriously > This is an example of all the things you can do with Cloudflare Workes and our API. If you like it, please spread the word! But hey, don’t take us seriously. We just wanted to take the drama out from all the GDPR madness out there. Anyway: just for academic interest I’m curious how much this increases the overall req…

You can see the average latency here: https://status.apility.io But Cloudflare has servers very close to our endpoints around the world, so I guess We are working hard to reduce the amount of time to establish the connection. It's about 80% of the time of the request.

If you make sure that the response is cacheable, then Cloudflare will cache it at the edge and so only the first check for any particular IP will be slow.

What makes a response cacheable is a little complicated. There's cache headers, but also some heuristics involved. However, you can override all of that from a Worker by passing an explicit cache TTL to fetch():

    fetch(url, {cf: {cacheTtl: 86400}})
This will force Cloudflare to cache the response at the edge for one day regardless of anything else. (Note: The documentation currently claims this option is available to enterprise customers only, but as of this week, it actually works for everyone. Docs to be updated soon.)

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#32

Post by disconnected »

matte_black wrote: post #28
logronoide wrote: post #21

I'm the author of the post. My most stupid post is in HN! crazy! I just wanted to be sarcastic and make some laughs about people blocking all traffic from Europe, which is crazy! It's a Friday afternoon blog post to show how cool my product is with Cloudflare Workers and having fun at the same time!

It's no laughing matter for some companies. EU citizens have turned into pests overnight. There are businesses who don't make much money from the EU to justify compliance with the regulations.

> EU citizens have turned into pests overnight.

More than USA citizens with dubious DMCA takedown requests?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#34

Post by nrdgrl »

sp332 wrote: post #13
LinuxBender wrote: post #11

How does CloudFlare know if someone is a citizen of the EU and traveling abroad? In haproxy, I redirect a few accept-language headers, but even this has its faults.

You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/refo...

GDPR applies to all EU citizens. It doesn't matter if the citizen is accessing the web site from the eu or another country. Blocking people in the EU doesn't block all eu citizens from accessing your product/service.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#36

Post by Kalium »

LyndsySimon wrote: post #18
sp332 wrote: post #13

Earlier quoted context omitted.

You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/refo...

It actually isn't clear that it doesn't, as best I can tell. I don't have the text in question in front of me, but one of the questions I've asked and haven't gotten a solid answer on is - who is covered by GDPR? Is it only EU citizens residing in the EU, or EU citizens generally? If it's the latter, then someone with both US and German citizenship could be covered even if they've never been to the EU.

GDPR is written in terms of rights people in the EU have against companies operating in the EU.

Which is to say your hypothetical dual citizen would have zero rights under GDPR in their dealings with purely US entities.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#37

Post by frockington »

disconnected wrote: post #32
matte_black wrote: post #28

Earlier quoted context omitted.

It's no laughing matter for some companies. EU citizens have turned into pests overnight. There are businesses who don't make much money from the EU to justify compliance with the regulations.

> EU citizens have turned into pests overnight. More than USA citizens with dubious DMCA takedown requests?

Yes, much bigger pests

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#38

Post by outside1234 »

LyndsySimon wrote: post #18
sp332 wrote: post #13

Earlier quoted context omitted.

You're the third person to ask this and I'd like to ask you: is this idea coming from a specific source? The law, like any other EU law, obviously does not apply outside the EU. It applies to companies that do business in the EU (even if they are based outside), but it can't apply to companies that don't do business there. https://ec.europa.eu/info/law/law-topic/data-protection/refo...

It actually isn't clear that it doesn't, as best I can tell. I don't have the text in question in front of me, but one of the questions I've asked and haven't gotten a solid answer on is - who is covered by GDPR? Is it only EU citizens residing in the EU, or EU citizens generally? If it's the latter, then someone with both US and German citizenship could be covered even if they've never been to the EU.

This is a very dangerous interpretation. Let me tell you why: this opens the door for someone, let's say China, to say that their laws apply to Chinese nationals outside of China. You know, censorship and the rest.

While GDPR is a good idea, its legal impact can only be for business conducted within EU boundaries, or we are going to open up a Pandora's Box like this.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#39

Post by colek42 »

repsilat wrote: post #26
merinowool wrote: post #6

How this checks if a user is European when using US VPN or being on holidays outside EU?

I suppose you have to use your TOS for that. (In fact, a banner that tells European users that they aren't allowed to use your site is probably the easiest way to insulate yourself -- if you collect their data because they used your service illegally, I'm not sure you can be blamed.)

Violating TOS is not illegal...

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#40

Post by Kalium »

jacquesm wrote: post #30
matte_black wrote: post #28

Earlier quoted context omitted.

It's no laughing matter for some companies. EU citizens have turned into pests overnight. There are businesses who don't make much money from the EU to justify compliance with the regulations.

> EU citizens have turned into pests overnight. That's an excellent attitude to take towards your users.

Let's try another formulation.

Valuable, dear, beloved users for which the business has boundless sympathy, empathy, and compassion are now awkwardly the source of compliance concerns for which the costs outstrip the reasonably expected revenues enabled by compliance. While compassion is unlimited, it is possible the budgets and time may not be.

Better?

Post reply on HN