Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

611–620 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#611

Post by omeid2 »

FridgeSeal wrote: post #493
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

> Most early-stage startup use the best practice of “delete=1” Who are you people who can’t/won’t actually delete something from your db’s?

I only know of two group of people, either incompetent or just plain dishonest.

Because they either argue that it is hard to design a database that allows deleting or anonymization, or it is that they're in the business of selling data and won't delete anything and rather lie to their user and customers.

I would be interested to know if there is any other argument for this.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#612

Post by lathiat »

manigandham wrote: post #586
mintplant wrote: post #577

Earlier quoted context omitted.

Upthread we have the claim that "most early-stage startups use the... best practice of 'delete=1'," pretending to delete user data while actually retaining it. So, the exact opposite of the rule.

Yes, and many things will remain that way with GDPR because of necessity (ie: old invoices and transactions will continue to have your details). Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them. But do let me know when GDPR actually does anything to deal with ISPs, credit unions, medical companies, and plenty of other institutions that have breac…

> Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

lol

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#613

Post by hekfu »

strken wrote: post #590
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every websi…

> This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every website using social media buttons and GA.js, I don't think it matters in the slightest.

> It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop.

If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights

> There's so much smugness about the GDPR being a "good reflecting moment", etc. which makes me think that people who support the GDPR believe that there's no way detractors could disagree with it in good faith or for good reasons.

I think it's mainly a difference in viewpoint: this is my data for me. Not yours. GDPR makes it easier for me to enforce that. From my perspective I don't care about you violating my rights "in good faith", just like most people don't cares if you trespass on my property and steal something "in good faith".

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#614

Post by seanmcdirmid »

gerdesj wrote: post #506
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your…

> There is no way on earth that the EU as a whole has looked on your company/project or whatever and decided to screw you.

The rules are enforced via third-party litigation. So its not the "EU", but some lawyer looking for a nice payday that you have to worry about.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#615

Post by sebleon »

gerdesj wrote: post #598
datamingle wrote: post #574

Earlier quoted context omitted.

How do you handle developer computers with possible client data on them, even semi-anonymized? Or when communicating issues on the live server, you might transfer client information to other stake holders to debug issue. Are you tracking that communication. Where does the communication data reside, perhaps on a server outside of the EU? There is a lot of complications that arise if you think about the second order/th…

I have keyed in and deleted so many efforts at an answer to your question that I have given up and find myself merely asking: "Have you actually read the regs?" http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... My reading of them finds no second/third order anything. The regs are surprisingly clear. I forgot to mention that unless you are trying to abuse EU citizens in some way then you have no problems…

> surprisingly clear

This is an 88 page document with extremely dry language. Just confirming your assertion will be time consuming. No wonder many American services would rather shut out EU users than comply.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#616

Post by drtillberg »

dan-0 wrote: post #521
4ndrewl wrote: post #505

Earlier quoted context omitted.

Not true.

> Not true. ... unless you plan to use the backups. Then you have to have another service that tracks entities to delete when a backup it's restored... and back that up separately.

If you back up a list of things to delete is that GDPR compliant? Ponder.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#617

Post by Spooky23 »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I get where you’re coming from, but maybe the bar has to be raised. Computing has gotten more capable and software frameworks are exponentially more powerful than they were even 20 years ago when the internet started going bananas.

The barrier to entry is so low that anyone with a credit card can setup complex IT environments quickly and collect valuable and sensitive information with no consequence to the principals.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#618

Post by yzmtf2008 »

codexon wrote: post #593
dboat wrote: post #558

Earlier quoted context omitted.

To your post specifically, I think a cascade of "zero outs" or the like to blank out a user's data would be sufficient is it not? It could happen at most once for each user account so it shouldn't be ruinously inefficient unless a system was already on the verge of collapse. But on the topic in general, could someone explain to me what the real world consequences are likely to be for a small business not based in the…

That would make it compliant but there will still be efficiency problems. Databases such as Cassandra are made so that updating doesn't actually delete the old data until some time later so frequent updates will degrade performance and storage. Other databases that allow for immediate overwriting the data will cause fragmentation and thus performance decline and wasted storage until you compact (basically recreating…

I mean, come on.

1. GDPR gives you 40 days to respond. You don’t have to run VACUUM everyday.

2. The entire point of my post was acknowledging that there are costs to being GDPR compliant, and why it’s responsible to have that cost.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#619

Post by drb91 »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

What is the fear about startups? If you look at the ones you actually use reliably for a decade, very few would have been stymied by GDPR. To add on to this, for every successful startups there seem to be many mostly replaceable ones.

If anything, a reduction in the rate of new startups would indicate that perhaps the market is growing MORE rational, which corroborates the recognition of risk of PII that the GDPR manifests.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#620

Post by strken »

hekfu wrote: post #613
strken wrote: post #590

Earlier quoted context omitted.

This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every websi…

> This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every web…

If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights

The problem is not the work that the GDPR requires, the problem is the work I'll have to put into understanding the GDPR.

I think it's mainly a difference in viewpoint: this is my data for me. Not yours.

This is the part that I don't understand. If I own a shop, and you come in and buy something, you have absolutely no right to demand that I forget your face and your purchase. In the real world, it's not your data, it's my memory. If I go home and write in my diary that today hekfu bought lots of broccoli, you don't have the right to come to me in five years and demand that I remove all mention of you from my diary at my own cost.

I don't understand the concept of data ownership, because it does not align with how I understand the real world to work.

Post reply on HN