Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

541–550 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#541

Post by taysic »

thisone wrote: post #494
badminton1 wrote: post #473

Earlier quoted context omitted.

GDPR is simply a response to abusive behavior. May not be the best response, but it was about time. Then, it is surprising to me that Americans are against a national id card, but are not OK with a privacy protection law.

I believe it's because, in general, Americans distrust government and trust corporations

It's not about trusting corporations, but rather trusting in the benefit of the free market which offers more choices than a government which generally limits choices. A well intentioned government but still with too many unintended consequences

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#542

Post by jeremyt »

viraptor wrote: post #501
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

> the requirement that you can permanently delete all of your information. Most early-stage startup use the best practice of “delete=1”. What's your system for dealing with COPPA then? You're required to have a way for permanently removing data of children.

Honestly? During the first year of our start up, I didn’t have time to understand all of that stuff so I just put a checkmark on the sign up that users were over the age of 13, and moved on.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#543

Post by jeremyt »

4ndrewl wrote: post #517
ars wrote: post #497

Earlier quoted context omitted.

It's not so easy. Someone buys a book. Transaction is recorded, and now we know total book sales. Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted. Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.

More GDPR strawmen. If a user requests deletion, assign anyYassociated entities (eg purchases, conversations etc) to an anonymous user. Or, keep the original user record and just blank all of the fields. You've had two years to think about these problems.

It’s only a strawman if you assume that everybody knows the right way to do everything. There was nobody around when I did my start up to tell me how to do all of this stuff.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#544

Post by codexon »

yzmtf2008 wrote: post #512
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#545

Post by daveFNbuck »

contravariant wrote: post #530
daveFNbuck wrote: post #525

Earlier quoted context omitted.

You don't necessarily have to delete stuff from cold storage right away. You just need to have a process to remove deleted PII when you retrieve/rewrite your backups.

This might be a bit of a weird question, but how do you remember which information needs to be deleted when you're at the point where you need to use backups?

You need backups of which information needs to be deleted. Or you can just store PII separately from the rest of your data so most of your backups don't need to be modified.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#546

Post by jeremyt »

ACow_Adonis wrote: post #514
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Clearly you have a different definition of entrepreneurs/technical people than I do. Those seems like impositions on people who implement bad practice or work in fields that have morally questionable practices regarding people's data and identification. Many people I know don't engage or work in such industries because of the moral implications of doing so and what people are doing with data. Its not about "just ask…

Again, I was in my early 20s and fresh out of college. I had no idea what I was doing.

It’s not that I was trying to cut ethical corners or do things poorly, I just didn’t know what the right way to do things was. Computer science education is often very theoretical and high level and not at all practical .

I’ll be the first person to say that I was not the most experienced and or talented programmer in the world, but do we want to prevent such people from starting companies?

And secondly, not all PII is the same. We stored names and addresses and phone numbers and websites. Not exactly medical histories or DNA profiles.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#547

Post by genericone »

jedberg wrote: post #534

But this wouldn't even work, because it applies to all EU citizens, regardless of geography.

This is a great point actually... the GDPR law specifically applies to holders of EU passports. If your website clearly disallows EU citizens, ie: a popup stating "You are not authorized to access this website if you are, or plan to become within the next 2 years, an EU citizen", are you being compliant with GDPR? Or is there simply no way to be GDPR compliant if you store any personally identifiable data?

I won't get into intentions, but it seems like the law is so broad that it just allows any EU government to selectively enforce the law and collect fines from any company they choose...

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#548

Post by jeremyt »

bmelton wrote: post #515
FridgeSeal wrote: post #493

Earlier quoted context omitted.

> Most early-stage startup use the best practice of “delete=1” Who are you people who can’t/won’t actually delete something from your db’s?

DBs, memcaches, tape backups, offsite storage, log files, etc. Past that, deleting things from databases is sometimes hard. If, for example, I delete userX, and userX was the founder of a number of forums, or chat rooms, or groups, or facebook pages that are linked to userX? Do those groups and forums and things count as 'belonging' to userX? If userX happened to be the guy who created /r/news, do we delete that subr…

Absolutely. It just isn’t easy.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#549

Post by inferiorhuman »

4ndrewl wrote: post #517
ars wrote: post #497

Earlier quoted context omitted.

It's not so easy. Someone buys a book. Transaction is recorded, and now we know total book sales. Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted. Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.

More GDPR strawmen. If a user requests deletion, assign anyYassociated entities (eg purchases, conversations etc) to an anonymous user. Or, keep the original user record and just blank all of the fields. You've had two years to think about these problems.

> It’s only a strawman if you assume that everybody knows the right way to do everything. There was nobody around when I did my start up to tell me how to do all of this stuff.

lol

Edit: Love (and expected) the downvotes. Where's that innovative entrepreneurial spirit? Part of creating a business is figuring out how to do things that won't get you sued into oblivion.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#550

Post by Barrin92 »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Tired of the eternal startup excuse to justify bad behaviour when it comes to protection of consumer privacy.

If it is impossible for some startups to respect strong privacy practices maybe we simply don't need those startups.

This 'startupism' is almost an ideology. No mechanical engineer would complain about safety regulation just because it means that they cannot start a business in their garage. In other industries, strong safety standards and regards for customer privacy is simply the norm, not an annoyance.

Post reply on HN