Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the UK's online safety bill threatens Matrix

matrix.org

Post reply on HN
Print view View original

131–140 of 165 posts

Re: How the UK's online safety bill threatens Matrix

#131

Post by danShumway »

kjakm wrote: post #72
hyperman1 wrote: post #64

Earlier quoted context omitted.

I was also curious, so I found this: https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-... The core: ... transfers of personal data to the U.S.- were not lawful. So the problem is that an US company cannot be GDPR compliant, because that conflicts with US law. Which sucks for mailchimp but makes sense.

A US company can be compliant. They just have to host EU user data in the EU.

Wait, is that really the standard? Wouldn't that imply that virtually any service doing business with EU customers would need to be either a multinational business or based in the EU? And just buying server hosting in the EU won't actually change that much about data access; if I'm a purely American business and I buy hosting in the EU, I think I'm still subject to US data requests. None of that goes away as far as I know, so I don't see how a hosting restriction would even help unless I literally move my business to the EU.

I thought that I understood GDPR at least reasonably well: be specific about what data you collect, don't collect unneeded data, allow deletion of data, and a couple other minor caveats. But if I sell software in multiple countries, and part of my account process is collecting an email address or other PII, is that not GDPR compliant unless I set up offices in the EU?

That can't possibly be what the law actually says; nobody except the biggest US companies would be able to do any business online with EU customers if that was the case. What am I missing?

Re: How the UK's online safety bill threatens Matrix

#132

Post by throwaway210222 »

kjakm wrote: post #72
hyperman1 wrote: post #64

Earlier quoted context omitted.

I was also curious, so I found this: https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-... The core: ... transfers of personal data to the U.S.- were not lawful. So the problem is that an US company cannot be GDPR compliant, because that conflicts with US law. Which sucks for mailchimp but makes sense.

A US company can be compliant. They just have to host EU user data in the EU.

> A US company can be compliant. They just have to host EU user data in the EU.

Actually since the 2018 Cloud Act, no US company can be ever be GDPR compliant.

Here is a possible sequence of events:

1. the US has secret courts (FISA, 1978)

2. and these courts can insist on access to EU hosted data (CLOUD Act, 2018)

3. its illegal for a US corp to indicate whether such access has been demanded

4. so a FALSE 'no' must be the answer to an EU data subject asking about access to his/her data

5. which is a breach of the GDPR.

Everyone knows this. They just ignore it. The EU ties itself in knots (Schrems II) trying to justify all of this.

Re: How the UK's online safety bill threatens Matrix

#133

Post by Arathorn »

tekknik wrote: post #125
Arathorn wrote: post #40

Earlier quoted context omitted.

But at least GDPR /is/ tractable to implement at small scale. Whereas for the OSB: if you run a smallish but popular chat/blog/forum/etc service, there literally isn’t a solution for moderation which isn’t fiendishly expensive, privacy invasive, or both. The legislation has clearly been dreamt up by folks saying “ah ha! if we threaten the Facebook UK executive mangement team with jailtime unless they do better at fil…

> The legislation has clearly been dreamt up by folks saying “ah ha! if we threaten the Facebook UK executive mangement team with jailtime unless they do better at filtering self-harm/CSAM/terrorism/etc then they will obviously get their house in order!”. Whereas in practice they crush their own UK-based startups instead. So frustrating. Isn’t that exactly what the GDPR did? I know I pulled my apps for fear of fines…

GDPR really isn’t that complicated for most purposes - it boils down to: tell your users what data you store; let them delete their data if they want; let them export their data if they want. Which is not exactly unreasonable - the only scary thing was being obligated to do it by law with threats of fines if you didn’t. It wasn’t that hard to put together, particularly if you’re a normal centralised website or app that they were aiming at.

Whereas the OSB is: “if you run a service which lets users distribute ‘harmful’ content, then you’ll get pulled up in court. Plus it’s up to you to figure out what ‘harmful’ is; you’ll know it when you see it.”. Which sounds like the opening premise of a Black Mirror episode.

Re: How the UK's online safety bill threatens Matrix

#134

Post by iso1631 »

frockington1 wrote: post #55
Permit wrote: post #6

Earlier quoted context omitted.

> I don't send cookies or keep personal data, so why do I need to worry about them? Can you share your website/service?

Commenting to follow up later. I'm really interested in the use case. The only thing I can think of would be a website similar to mid-2000s youtube to mp3 converters.

Alas they are all behind ssl authentication so you wouldn't be able to access them, but the stuff I currently have open includes a switch port mapper (every 20 minutes all my switches are scanned and reports generated on what's plugged in where), a firewall config interpretor (a list of current port forwards is generated), and a logging server showing me what

But if you want an example of a fully featured public site which doesn't need cookies

https://news.ycombinator.com/

Load that in lynx, which asks for every cookie, and none are set.

Now sure, if you choose to log in, then functionally you need to accept the login cookie, but that cookie isn't spammed out to you.

Under GDPR, a website doesn't need to ask for permission to have necessary cookies which enable core functionality such as security, network management, and accessibility.

Re: How the UK's online safety bill threatens Matrix

#135

Post by TheManInThePub »

pessimizer wrote: post #59
viktorcode wrote: post #5

Sad to see UK becoming one of the apologists of internet censorship, closing the gap to the levels of authoritarian countries. Once you have censorship facility in place, the area of its application will only grow. The term "illegal information" is also widely used in Russia for the same purpose.

The UK has never not been eager to censor to a sometimes comical extent. Just look at the "Video Nasty" moral panic, or the hilarious dubbing of Northern Irish people on television. https://en.wikipedia.org/wiki/Video_nasty https://en.wikipedia.org/wiki/1988%E2%80%931994_British_broa...

The censorship you refer to happend 30-40 years ago under Thatcher [1]. Sense prevailed and these were promptly overturned.

I'm not sure what mentioning such old events brings to the conversation, any more than a discussion of modern US censorship would benefit from discussing the Satanic Panic under Reagan.

Perhaps you would care to elaborate?

[1] Many quipd that the reason she was cremated was that a burial grave would have needed a ballroom to be built above it.

Re: How the UK's online safety bill threatens Matrix

#136

Post by TheManInThePub »

Mediterraneo10 wrote: post #7
iso1631 wrote: post #4

Earlier quoted context omitted.

Interesting. I don't send cookies or keep personal data, so why do I need to worry about them? The only time I've got into issues was with an american firm using an american law (dmca) to attack me (a non-american) and my hosting company (a non-american hosting company)

Common CMSs send cookies by default. Even if you are one of those tech-inclined people using a static site generator for your own website, this is not the case for millions and millions of other websites.

*sigh*

Here we go again.

The GDPR has no problem AT ALL with cookies. Use as many as you like with no need for popups. However, if you are using cookies to track or personally identify me, then you need to ask my permission to do so. And so you should.

The amount of misinformation (some of it wilful) circulating about the GDPR on HN (a technical forum!) is shocking. If you consider yourself a professional developer then I strongly suggest you read a GDPR primer. There is no excuse not to. Following the GDPR will simply make your code safer when handling personal data.

Re: How the UK's online safety bill threatens Matrix

#137

Post by iso1631 »

maxrev17 wrote: post #84
nfoz wrote: post #9

Earlier quoted context omitted.

Then let's replace those CMS's. [edited with less anger]

Replace them? You need cookies for a tonne of reasons. It's really difficult to justify replacing half the web because some people abuse it. That's like replacing cars with walking because some people drink drive.

What reasons do you need the types of cookies you need to ask permission for under the GDPR?

Re: How the UK's online safety bill threatens Matrix

#138

Post by nprateem »

It's clear to me that this bill is incompatible with end-to-end encrypted chat apps. It's a convenient, backdoor way of allowing the security services to read all our messages again without the government needing to ban encryption itself. I suspect this is the real motivation, especially since it was originally proposed by May.

Re: How the UK's online safety bill threatens Matrix

#139

Post by nprateem »

buro9 wrote: post #74

This appears to be the thing that will finally take my sites offline. I'm an individual who runs 300 forums. I do this because I believe that forums organised around an interest bring people together and help address loneliness. Further I believe that if you do that, you also help minimise the impact of depression and things like the suicide rate for middle aged men. The forums are things like this: https://www.lfgss…

OFCOM will recommend thresholds in terms of the number of users a service needs to have for the legislation to apply to it. Hopefully they'll set the threshold at Twitter scale, so unless you've got 100k/millions of users you'll probably be OK.

Re: How the UK's online safety bill threatens Matrix

#140

Post by KingOfCoders »

Arathorn wrote: post #133
tekknik wrote: post #125

Earlier quoted context omitted.

> The legislation has clearly been dreamt up by folks saying “ah ha! if we threaten the Facebook UK executive mangement team with jailtime unless they do better at filtering self-harm/CSAM/terrorism/etc then they will obviously get their house in order!”. Whereas in practice they crush their own UK-based startups instead. So frustrating. Isn’t that exactly what the GDPR did? I know I pulled my apps for fear of fines…

GDPR really isn’t that complicated for most purposes - it boils down to: tell your users what data you store; let them delete their data if they want; let them export their data if they want. Which is not exactly unreasonable - the only scary thing was being obligated to do it by law with threats of fines if you didn’t. It wasn’t that hard to put together, particularly if you’re a normal centralised website or app th…

I would agree in principle, in Germany/EU there is this ongoing discussion about making a carrier ("forum") responsible - which will lead to upload-filter SaaS, the way PWC does audits. Still you can fail for accounting after an PWC audit (too many public examples), but most companies that don't actively try to break the law feel kind of safe with a PWC audit. I would assume it's the same when you let an upload-filter company audit your content (but increases cost, just like PWC).

With GDPR on the other hand you can't use any US company with your customer PI data in the US and US companies hosting in the EU is a gray zone [1].

It is a challenge to find equivalent companies in the EU, e.g. good luck finding a equivalent competitor to Unbounce or Webflow. It works for MailChimp (e.g. Sendinblue) and ZenDesk, but not for some other dependencies you might have.

[1] https://en.wikipedia.org/wiki/CLOUD_Act rejections by companies need to be tested in court

Post reply on HN