Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

681–690 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#681

Post by _delirium »

JoshMnem wrote: post #637
Spooky23 wrote: post #628

Earlier quoted context omitted.

Is it? Visit Germany sometime. Drive through the countryside. Most parts of the US look like a hollowed out shell by comparison.

> Drive through the countryside. Most parts of the US look like a hollowed out shell by comparison. In what way do you mean? Wind power?

Basic housing is the thing that stands out most for me. I'm originally an American, and now live in a rural area in Europe. Rural parts of the more affluent Western European countries aren't advanced per se, but they're, I dunno, reasonably modern. Decent housing and decent internet access. The U.S. countryside is just incredibly backward in this weirdly visible way by comparison. Entire swaths of countryside, especially in the southern US, but not exclusively there, are full of a mix of trailer parks on the one hand, and questionably habitable shacks with missing wallboards and plastic-tarp roof patches on the other (parts of Louisiana are seriously shocking). And good luck getting broadband.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#682

Post by abiox »

takeitto wrote: post #417
guelo wrote: post #375

Earlier quoted context omitted.

> ban on EU IPs is both draconic and ineffective It doesn't matter it's ineffective. The block means they're complying with GDPR's requirement that they not target Europeans.

But they still process European user data if they do not block my IP. So they are not complying at all with GDPR's main requirement, just a poorly singled-out subclause.

you're saying that blocking eu ip is insufficient. so you can, at leisure, forcibly subject anyone to attack by gdpr, against their will, by circumventing their access controls.

the only way for all businesses around the world to avoid abuse and subjugation to eu regulators, who they cannot influence, is to not exist at all?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#683

Post by ww520 »

yzmtf2008 wrote: post #512
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

And going through all the backups to overwrite the data? Backups that would have been written to CD or tapes?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#684

Post by stale2002 »

Barrin92 wrote: post #550
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Tired of the eternal startup excuse to justify bad behaviour when it comes to protection of consumer privacy. If it is impossible for some startups to respect strong privacy practices maybe we simply don't need those startups. This 'startupism' is almost an ideology. No mechanical engineer would complain about safety regulation just because it means that they cannot start a business in their garage. In other industri…

Hey, man, that's totally fine that you don't want those services.

Which is why those services are responding by blocking all EU customers.

Seems like a win win for everyone. Businesses don't have to deal with ounerous laws, and EU citizens don't get to use those services.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#685

Post by pilsetnieks »

jv22222 wrote: post #585
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Thank you for saying this, another thing that is ridiculously difficult is to delete specific user from all your backups. This is made even worse if you have multi region backups and cold back ups. Even a one-year-old start up could have literally thousands of database dumps in different places if they followed best practice of triple redundant daily dumps.

They'd also be spending a shitload for storing those dumps.

If information is backed up (in a way that it cannot be easily accessible and queried directly from the backup,) and the backups are stored securely, and there is a mechanism/policy (it doesn't have to be a purely technical measure) to replay the deletion in case if the backup is restored, you're going to be fine.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#686

Post by pilsetnieks »

dansanuf wrote: post #580
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Not to mention all the backups of said databases. Imagine sitautions where you’ve got tape backups stored in vaults or places like AWS Glacier. It’s the stuff of ops nightmares.

Imagine situations where people actually read the regulation and its commentaries.

You don't have to delete specific records from every one of your backups; in case of a deletion request, you have to be able to replay that if you restore the backup. Also, have some kind of policy in place for how exactly you're handling your backups and how long you're storing them.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#687

Post by themacguffinman »

viraptor wrote: post #451
tquinn wrote: post #244

Earlier quoted context omitted.

I feel the EU regulators could stand to learn something. If EU citizens are small portion of your users, and your tasked with parsing this document http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... just blocking them doesn't seem like that bad of an idea, especially with the fines involved. I think the things that bother me is: 1) A College student working on a side project with no revenue are treated t…

I don't get the complaints about how hard GDPR is and having to understand it all. If you're based in the US, have you read the actual DMCA document? CFAA? California S.B. 1386? TWEA? ADA? Or at least any interpretations of them and validated that you comply? If not, then worrying about GDPR which is mostly not enforceable in the US sounds disingenuous.

Who are you arguing with that thinks DMCA was a great idea but GDPR isn't?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#688

Post by rsuelzer »

omeid2 wrote: post #611
FridgeSeal wrote: post #493

Earlier quoted context omitted.

> Most early-stage startup use the best practice of “delete=1” Who are you people who can’t/won’t actually delete something from your db’s?

I only know of two group of people, either incompetent or just plain dishonest. Because they either argue that it is hard to design a database that allows deleting or anonymization, or it is that they're in the business of selling data and won't delete anything and rather lie to their user and customers. I would be interested to know if there is any other argument for this.

The problem is dealing with software and databases that weren't designed for deleting and anonymization. I do not envy all the developers who are going to have to rewrite crappy legacy code to be compliant.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#689

Post by pilsetnieks »

anfogoat wrote: post #446

My biggest _annoyance_ with GDPR and its advocates is the constant touting of "giving users control over their data" when in reality it is hindering voluntary actions that by their nature require some of "my data". If I want to service a small group of people with, say, an XMPP network, and those users are willing and eager to just go with it without any of this bs with terms and three-letter EU dictated roles, then…

> network, and those users are willing and eager to just go with it without any of this bs

How can you declare they're willing and eager, if you don't have their consent, and they're not informed about your actions?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#690

Post by ww520 »

mc32 wrote: post #496
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Even if you delete it from disk and remove from memory, you may be required to remove it from offline backups too like tapes and other media.

And remove it from the off site backup, like AWS, which helpfully makes copies of the backup data, and you have to remove it from all of them.
Post reply on HN