151–160 of 179 posts
Earlier quoted context omitted.
It's not possible to one-way hash a 32-bit IP address. A hash of a 32-bit value can always be reversed because the search space is so small.
Who cares if it’s trivially hackable; we’re talking about a legal checkbox that you have to tick.
Earlier quoted context omitted.
Courts are not run by robots, judges are generally smart people. I agree - I think most people overthink the whole IP == PII nonsense. I think it’s more likely that IP + other factors, and your USE (or misuse) is where things become more gray.
I think the whole point of the rule of law (versus rule of authority) is to remove some of the massive ambiguity about enforcement and make the courts a bit more “robotic” and regular. You don’t want a situation where it’s luck of the draw on a judge, or where the ambiguity allows selective enforcement against people one judge or prosecutor particularly dislikes.
Earlier quoted context omitted.
I find it somewhat sad that programming is basically a guild where arcane language is used to gatekeep what should be a much more straightforward exercise.
Hahaha, actually at some point in the future, I suspect 25 years or so, our programming guild will likely have taken over and replace the legal guild.
Earlier quoted context omitted.
I dislike how the minute someone mentions a legal hack, the responses are "oh, are you a lawyer?" Why not consider this reply on its merits?
"Legal hacks" are rarely, if ever, as clever as their proponents think. Scepticism is natural and warranted. Judges aren't complete morons and will take a dim view of "hacks". There could be loopholes somewhere but you'd need a lawyer to spot them.
Earlier quoted context omitted.
The amount of information that can be found using your ip address https://clearbit.com/attributes (refer only the reveal api)
I just signed up for the trial and Reveal turns up nothing on my home IP address.
Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.
Yeah it is odd. You decided to hit my server, I should be able to record the occurance. How am I suppposed to deflect DoS attacts if I can't maintain a list of nefarious IPs. I know that's a fairly low tech attack, but they still happen constantly. Is Fail2Ban no longer compliant? I wouldn't be surprised if some policies pertaining to record keeping in some sectors contradict that requirement as well.
So are we going to have websites blacklisting CA IPs and answering back with some vague "this content is not available in your region?"
It's now GDPR + CCPA, so you are cutting off EU and California. Probably, more to come.
For example, seems like LA Times does not block EU anymore.
Earlier quoted context omitted.
Who cares if it’s trivially hackable; we’re talking about a legal checkbox that you have to tick.
A reversable hash "could reasonably be linked" with the plaintext. You can't get around the law on technicalities. Judges are not computers.
Simply out of curiosity, what do you mean by that?
All my life experience and knowledge tells me it's exactly how you get around the law, unless court has its own agenda or strong bias.
Earlier quoted context omitted.
Do they specifically mention rental cars in the code of law, when they say that the driver can't drive over the speed limit?
"Process PII" is incredibly vague. You could define that in a hilarious amount of ways with the amount of complexity we introduce to our software products, especially with code we don't even write ourselves that widens your security surface. This is especially true if you use a service that allows others to inject code into your code base. If NPM has a security failure that leads to a breach at a company, who is at f…
You could define in a hilarious amount of ways in which your chef can pee in the broth you ordered in a local diner. But it generally doesn't happen, does it?
Earlier quoted context omitted.
I’d hope not. From the company’s perspective, there’s never any guarantee at all that an IP is going to be 1:1 to a real identity. IPs will be dynamically reassigned to new consumers constantly, and there are many situations where you’ll have many (some times very many) users sitting behind the same IP. The only situation I’ve come across where some level of PII has been retrieved from an IP are services that will be…
From a company’s perspective a person uses only a handful of IPs most of the time: home and work. Combine that with cross-site tracking and phone companies selling your info...