Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

461–470 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#461

Post by ajuc »

tquinn wrote: post #244
ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

I feel the EU regulators could stand to learn something. If EU citizens are small portion of your users, and your tasked with parsing this document http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... just blocking them doesn't seem like that bad of an idea, especially with the fines involved. I think the things that bother me is: 1) A College student working on a side project with no revenue are treated t…

1. when you open a restaurant nobody cares you're a collage student. You have to have all the checks and permits to serve people food. It's not because somebody hates small businesses, it's because the right not to be poisoned is more important than the right to do business hassle-free. Why should internet be different?

2. Fuck your souvereignty. Seriously. USA has no problem violating secrecy of correspondency worldwide, and argues in length for years whether wiretapping its citizens is OK, because everybody agrees wiretapping others is perfectly fine. USA forces poor half of the world to follow ridiculous copyright law, including software patents and art becoming public domain after a century or more. There's no good will earned there, so don't expect a free pass cause of your feelings. Want to serve customers from other countries - have to obey the law there.

3. they probably could. Still - I'm sure there will be "GDPR as a service" soon. Maybe some libraries, frameworks and standards how to handle personal data will finally be created? This should have been done decades ago.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#462

Post by pbhjpbhj »

acatton wrote: post #218
manigandham wrote: post #161

Earlier quoted context omitted.

It's not about privacy, its about poorly written regulation that leaves too much vagueness because its based on principles rather than hard rules. Good intentions are not enough, there must be clear paths to implementation and verification. Perhaps that should've been fixed instead of wondering why so many companies don't really want to deal with it. It will also do just about nothing in regards to the major companie…

As a French guy, these type of comments make me smile. The GDPR is basically just the implementation of the French law "Informatique et Liberté" into the European Level. (You can read on HN many Germans saying that it's actually the implementation of the Datenschutzgesetzt. The truth is: these two laws are extremely similar.) This law has been in application since 1978 [1]. And in 2018, we have adtech companies like…

>There's is a lot of implicit contracts (you filled up our sign up form? Well, then you chose to give us your data. ...) //

AIUI that's one of the main changes, that explicit consent is now needed to retain data and specific details of how it will be secured, who it might be passed to, must be given. Also that if the service being offered doesn't need the data, that the company offering the service can't insist on having it.

It is a big thing for micro-businesses and SMEs in the UK - despite having data protection laws already - it does change the complexion of how one handles PII and the embedded assumptions. We're talking about businesses many of whom have paper bookings diaries - the diary apparently needs to now be secured, whilst it's always sat on the counter before; that's a costly structural/workflow change (unlock the diary for every phone call!).

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#464

Post by myhf »

anfogoat wrote: post #446

My biggest _annoyance_ with GDPR and its advocates is the constant touting of "giving users control over their data" when in reality it is hindering voluntary actions that by their nature require some of "my data". If I want to service a small group of people with, say, an XMPP network, and those users are willing and eager to just go with it without any of this bs with terms and three-letter EU dictated roles, then…

If I want to service a small group of people with, say, a nuclear power plant, and those people are willing and eager to just go with it without any bs or roles, then it should be possible. When you make it prohibitive to handle hazardous materials, then you've done something wrong.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#465

Post by zmmmmm »

takeitto wrote: post #390
zmmmmm wrote: post #344

Earlier quoted context omitted.

I can't think of any web server that doesn't log ip addresses by default, and I think it's been established that satisfies the GDPR threshold test for personal data. So while what you say is true, I think you're being a little bit deceptive when you say 'As long as you're just "responding to HTTP requests"' because all practical and established means of doing that violate the GDPR by default.

If you log for security purposes that is a "legitimate interest" which would allow you to keep doing that, provided: - You make a note that this data is being logged. - You state for how long this is logged (6 months is reasonable), and justify that time frame. - You state who else has access to these logs. - You state what steps you have taken to try to minimize unauthorized access to these logs. - In a register (th…

You already described far more work than I'm willing to do for the small web site I happen to host. If there's a simple geoblocking switch I'd much rather flip the switch and block Europe than continuously worry that I didn't dot every 'i' and cross every 't' to make some obscure European regulator happy.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#466

Post by viraptor »

anfogoat wrote: post #446

My biggest _annoyance_ with GDPR and its advocates is the constant touting of "giving users control over their data" when in reality it is hindering voluntary actions that by their nature require some of "my data". If I want to service a small group of people with, say, an XMPP network, and those users are willing and eager to just go with it without any of this bs with terms and three-letter EU dictated roles, then…

So which parts of the GDPR do you actually disagree with in case of this XMPP service? Mostly you need to tell people what you collect, allow removing accounts and history, and tell them if you're sending the data to third-parties. If you're running a private service you most likely already fulfill those requirements. Where's the annoyance?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#468

Post by ajuc »

spullara wrote: post #452
takeda wrote: post #429

Earlier quoted context omitted.

> A College student working on a side project with no revenue are treated the same as some massive multi-national. Am I reading this wrong? If the college student creates just a simple page, he/she is already complaint with GDPR. If the student starts collecting personal information, then they need to know what's allowed or not. There are already things that are not legal to do, GDPR just adds private information int…

Web servers are non-compliant out of the box because they all by default log and store IP addresses of visitors.

So the defaults will be changed.

It's called software cause it can be changed easily.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#469

Post by Kalium »

shabble wrote: post #382
Kalium wrote: post #198

Earlier quoted context omitted.

> Nothing has been learned. I don't know about you, but I have learned a great deal! I've mostly learned that Eurocrats can't actually write useful regulation. Blah blah blah human rights blah blah reasonable measures. Next chapter. Blah blah envisage blah blah reasonable measures. Blah blah blah inter-government communications protocols blah blah codes of conduct. What's a reasonable measure? How do I know if I'm co…

Can you think of any good technical regulations that do lay out requirements & obligations in a useful manner without being massively outdated, trivially bypassable, or some sort of hugely onerous 'one size swamps all'? I mostly agree that the lack of concrete measures makes it horrible from a compliance view, but I'm not sure you can have both things, especially in a relatively immature area of law.

US environmental regulations tend to spell out technical requirements, particularly around emissions.

I would have been happier if they'd done something around setting up an administrative body that authors and updated regs.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#470

Post by shados »

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

Dealing with laws is hard. Dealing with laws that aren't even from your country is very hard.

When you're in "move fast and break things" mode, getting stuff working for SOME users is better than having a complete solution for all users that come much later. It's not even just about ignoring Europeans. A lot of these products and software solutions start "only available in California", or hell, only in SF. That's even true for some stuff from big companies like Amazon.

Then as you grow, you can start tackling more barriers and regulations from other countries. I mean, there's plenty of companies that won't ship to my address because they don't do business with the US. Or when I lived in Quebec, I could not participate to a lot of contests because it wasn't worth it for these entities to deal with Quebec's gambling laws. That's ok.

Even if you agree with the general idea of GDPR, even if you want to implement the tightest privacy rules you can't in your software, there's more to it than that. I've watched lawyers duke it out over some of the details. My employer takes GDPR very seriously and we've done everything in our power to comply, not just with the letter, but also with the spirit of the law. But we're big, we have money, and we're actively trying to grow internationally. 10+ years ago when the company was barely afloat? I'm not sure they would have been able to deal with the fine prints even if they wanted to.

There's more to GDPR than sending a silly email and adding a "Delete all the things!" button.

Post reply on HN