Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Will Hit Dev Teams Harder Than GDPR

tonic.ai

Post reply on HN
Print view View original

101–110 of 179 posts

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#101

Post by sroussey »

msla wrote: post #79
thaumaturgy wrote: post #74

Earlier quoted context omitted.

There's been a lot of FUD surrounding the logging of IP addresses for network diagnostic and abuse purposes as a violation of GDPR (and now CCPA), but I'm not aware of any cases where that alone was sufficient to cripple a business. Until I hear otherwise, I'm going to gamble that for now that's not the kind of reckless mishandling of personal information that regulators are trying to crack down on.

> Until I hear otherwise, I'm going to gamble that for now that's not the kind of reckless mishandling of personal information that regulators are trying to crack down on. And you're probably right until they do otherwise. The problem with badly-drafted laws is that they can be used to attack people who are annoying but who haven't done anything wrong... except for technically violating a law which is "supposed to" m…

GDPR gives regulators a lot of leeway on how to crack down on things.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#102

Post by sheeper »

ghayes wrote: post #58
jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Could you salt and perform a one-way hash on the IP address and store that? It would alleviate a large amount of leakage issues while still giving you uniqueness counts.

It's not possible to one-way hash a 32-bit IP address. A hash of a 32-bit value can always be reversed because the search space is so small.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#103

Post by sroussey »

fooey wrote: post #26
baroffoos wrote: post #20

Earlier quoted context omitted.

I have seen it done in a small company to check if a query will run too slow in production. Take a copy of the biggest database. Run query, see what happens, delete copy.

It's probably more often that the query is just run against production in the first place. Making a copy is probably more effort than most developers out in the wild are going to make.

Not true. If you were to throw up a slow locking query in production, you could take down the site. Restoring a backup should be fast.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#104

Post by lodi »

sheeper wrote: post #102
ghayes wrote: post #58

Earlier quoted context omitted.

Could you salt and perform a one-way hash on the IP address and store that? It would alleviate a large amount of leakage issues while still giving you uniqueness counts.

It's not possible to one-way hash a 32-bit IP address. A hash of a 32-bit value can always be reversed because the search space is so small.

Who cares if it’s trivially hackable; we’re talking about a legal checkbox that you have to tick.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#105

Post by IanCal »

ehnto wrote: post #88
jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Yeah it is odd. You decided to hit my server, I should be able to record the occurance. How am I suppposed to deflect DoS attacts if I can't maintain a list of nefarious IPs. I know that's a fairly low tech attack, but they still happen constantly. Is Fail2Ban no longer compliant? I wouldn't be surprised if some policies pertaining to record keeping in some sectors contradict that requirement as well.

Not sure about this law but that sounds completely fine under GDPR. You need to keep your log files secure and not longer than necessary for what youre doing though.

https://termsfeed.com/blog/gdpr-recitals/#Recital_49_8211_En...

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#106

Post by mattnewton »

sroussey wrote: post #101
msla wrote: post #79

Earlier quoted context omitted.

> Until I hear otherwise, I'm going to gamble that for now that's not the kind of reckless mishandling of personal information that regulators are trying to crack down on. And you're probably right until they do otherwise. The problem with badly-drafted laws is that they can be used to attack people who are annoying but who haven't done anything wrong... except for technically violating a law which is "supposed to" m…

GDPR gives regulators a lot of leeway on how to crack down on things.

And that’s problematic for someone trying to understand if their business operations are legal.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#107

Post by sheeper »

jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Another note... Per 1798.140(c)(1)(B), CCPA applies to a business that receives PII of =>50k consumers for the business’ commercial purposes. Which might not apply to access logs kept purely for diagnostic purposes.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#108

Post by chias »

afpx wrote: post #100

When using personal data is outlawed, only the outlaws will use personal data. What about all of the state actors (and 'hackers') who are cracking corporations for data and building a massive database on everyone?

> When using personal data is outlawed, only the outlaws will use personal data.

This argument only works if you feel the thing being outlawed is good (it is most commonly used in the context of privacy). To your statement I would respond the same way as I would respond to "When shooting people is outlawed, only the outlaws will shoot people": sounds good to me!

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#109

Post by sheeper »

lodi wrote: post #104
sheeper wrote: post #102

Earlier quoted context omitted.

It's not possible to one-way hash a 32-bit IP address. A hash of a 32-bit value can always be reversed because the search space is so small.

Who cares if it’s trivially hackable; we’re talking about a legal checkbox that you have to tick.

A reversable hash "could reasonably be linked" with the plaintext. You can't get around the law on technicalities. Judges are not computers.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#110

Post by spydum »

mattnewton wrote: post #106
sroussey wrote: post #101

Earlier quoted context omitted.

GDPR gives regulators a lot of leeway on how to crack down on things.

And that’s problematic for someone trying to understand if their business operations are legal.

Courts are not run by robots, judges are generally smart people. I agree - I think most people overthink the whole IP == PII nonsense. I think it’s more likely that IP + other factors, and your USE (or misuse) is where things become more gray.
Post reply on HN