Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

551–560 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#551

Post by yzmtf2008 »

codexon wrote: post #544
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

I encourage you to read my comment again, and point out where I mentioned merely setting a delete flag. Any reader worth their salt will point out that it’s not what I suggested at all.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#552

Post by alwaysdoit »

hk__2 wrote: post #519
ars wrote: post #497

Earlier quoted context omitted.

It's not so easy. Someone buys a book. Transaction is recorded, and now we know total book sales. Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted. Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.

> Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. Erase the name and address fields from the user in the database. You don’t have to delete any line, and that person doesn’t have any personal info in your database anymore. Problem solved.

Two days later the customer files a chargeback with their credit card company and the credit card company wants you to provide documentation for the transaction.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#553

Post by Silhouette »

mc32 wrote: post #509
4ndrewl wrote: post #505

Earlier quoted context omitted.

Not true.

Has that interpretation changed? I recall reading that in some circumstances it could. Or was that misinformation?

No-one actually knows. What constitutes erasure and how to deal with all the edge cases around backups, archives, unstructured data and so on is one of the big ambiguities under GDPR, and one of the areas most in need of (but mostly lacking) actionable guidance from official sources.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#554

Post by manigandham »

Barrin92 wrote: post #550
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Tired of the eternal startup excuse to justify bad behaviour when it comes to protection of consumer privacy. If it is impossible for some startups to respect strong privacy practices maybe we simply don't need those startups. This 'startupism' is almost an ideology. No mechanical engineer would complain about safety regulation just because it means that they cannot start a business in their garage. In other industri…

Also tired of people thinking that a company not wanting a rule means they were intending to do the exact the opposite of that rule, especially given said rule is incredibly vague and designed to be applied "on principle".

Fortunately for all of us, safety regulation is actually very specific in requirements.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#555

Post by bcheung »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Funny thing is there are also mandatory data retention regulations that say data MUST be maintained for a certain period of time by law.

It's getting worse, but it's generally been the case that it's impossible for an individual to bootstrap a company and be 100% compliant with every law and tax regulation. You would never have any time to actually provide a product and service customers. You just do the best you can and as you get bigger you become more complaint.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#556

Post by codexon »

yzmtf2008 wrote: post #551
codexon wrote: post #544

Earlier quoted context omitted.

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

I encourage you to read my comment again, and point out where I mentioned merely setting a delete flag. Any reader worth their salt will point out that it’s not what I suggested at all.

"you could easily not switch to a CASCADE, but instead set delete=1 and mark every sensitive field with a special value"

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#557

Post by spookthesunset »

FridgeSeal wrote: post #493
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

> Most early-stage startup use the best practice of “delete=1” Who are you people who can’t/won’t actually delete something from your db’s?

What if the contents of that DB get pre-rendered to disk or memory for caching (eg: prerendering a bunch of HTML)? Do you blow those away? Which ones? What if it turns out to be a substantial number of cache records you need to blow away? Whats gonna be the performance impact of that?

I agree with the OP. People who assume this shit is easy haven't really thought about the problem much at all. There is a lot of data stored out there in ways that wasn't really designed to be mutable.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#558

Post by dboat »

codexon wrote: post #544
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

To your post specifically, I think a cascade of "zero outs" or the like to blank out a user's data would be sufficient is it not? It could happen at most once for each user account so it shouldn't be ruinously inefficient unless a system was already on the verge of collapse.

But on the topic in general, could someone explain to me what the real world consequences are likely to be for a small business not based in the EU, of not complying? If I've never cared where my users were as long as their payments cleared (oh, is that where they get you? the payment processor?), and I'm selling handcrafted bobbins online in Canada without letting people delete their email address, what is likely to happen if someone complains to EU authorities?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#559

Post by Silhouette »

ars wrote: post #497
admax88q wrote: post #484

Earlier quoted context omitted.

> Most early-stage startup use the best practice of “delete=1” Honestly that's a bad best practice if the data your collecting is sensitive, which PII is.

It's not so easy. Someone buys a book. Transaction is recorded, and now we know total book sales. Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted. Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.

Someone says "delete me and my purchases", so you do

In many cases, that will be your mistake. The right to erasure is not absolute, and if you need to keep those records for a good reason -- for example, as evidence to support tax returns or defend chargebacks -- then you are entitled to refuse to delete them and to continue processing them for the necessary purposes. Otherwise mortgages would suddenly become a very fast way to send lenders under, since everyone could just demand they delete all identifiable records of who owes them money...

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#560

Post by yzmtf2008 »

codexon wrote: post #544
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

HN won’t let me go deeper, so here it goes:

> "you could easily not switch to a CASCADE, but instead set delete=1 and mark every sensitive field with a special value"

Emphasize on the part after “and”

Post reply on HN