Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for side-projects? Blocking all EU traffic with Nginx in 3 simple steps

medium.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: GDPR for side-projects? Blocking all EU traffic with Nginx in 3 simple steps

#21

Post by matthewmacleod »

orand wrote: post #19
matthewmacleod wrote: post #12

Earlier quoted context omitted.

“I don’t have time to label and expire all the food I prepare on top of serving meals to customers” “I don’t have time to do all those structural calculations on top of all the properties I have to build” “I don’t have time for all this silly human safety testing on top of all the drugs I have to develop” Your statement is equivalent to the above. If you are unwilling to meet a relatively straightforward level or pri…

Nice ridiculous examples. Now for some ridiculous examples on the other end of the spectrum: "If you refuse to document every ingredient and possible allergic reaction when inviting friends over for dinner, then I'm really glad if you don't have any friends." "If you don't create structural and safety calculations for your kids' tree fort, then I'm really glad when your kids fall out." The point is, people need to be…

Why are those examples ridiculous? They are all, like the GDPR, examples of regulation that says “demonstrate a basic level of care and attention when performing activities which may cause damage to users or customers”.

GDPR provisions are not onerous, are easy to follow, and are what we should expect every company handling personal data to already be doing.

Re: GDPR for side-projects? Blocking all EU traffic with Nginx in 3 simple steps

#22

Post by orand »

matthewmacleod wrote: post #21
orand wrote: post #19

Earlier quoted context omitted.

Nice ridiculous examples. Now for some ridiculous examples on the other end of the spectrum: "If you refuse to document every ingredient and possible allergic reaction when inviting friends over for dinner, then I'm really glad if you don't have any friends." "If you don't create structural and safety calculations for your kids' tree fort, then I'm really glad when your kids fall out." The point is, people need to be…

Why are those examples ridiculous? They are all, like the GDPR, examples of regulation that says “demonstrate a basic level of care and attention when performing activities which may cause damage to users or customers”. GDPR provisions are not onerous, are easy to follow, and are what we should expect every company handling personal data to already be doing.

The original parent examples were side projects that make no money. So while it seems reasonable to expect this of companies, GDPR also applies to nonprofits, charities, things you create just for your friends, some random thing you put on the internet when you're 15 years old and have no clue about GDPR, etc.

Re: GDPR for side-projects? Blocking all EU traffic with Nginx in 3 simple steps

#24

Post by icedchai »

inetsee wrote: post #9
olliej wrote: post #5

If you have a side project that siphons personal information from people for no reason, then maybe the gdpr isn’t the problem...

My reading of the GDPR says that the MINIMUM fine is 20,000,000 Euros, which I think would be a pretty big problem for an individual working on a side project. I also think the 403 error page explaining that the GDPR is the reason the visitor can't access the page is a nice touch.

It's only a problem if you are fined, and actually pay it. The odds of an individual, unknown, low traffic side project facing these problems are effectively zero. Go play the lottery.

Re: GDPR for side-projects? Blocking all EU traffic with Nginx in 3 simple steps

#25

Post by cpburns2009 »

While this sounds like an overreaction, I question the breadth of this method (unrelated to the reliability of IP address origin).

> This tells nginx to assign the $allow_visit variable a 0 for any users the GeoIP database specifies as coming from the “EU” continent.

Europe is the continent. The EU does not encompass all European countries. Doesn't this needlessly block non-EU European countries?

Re: GDPR for side-projects? Blocking all EU traffic with Nginx in 3 simple steps

#26

Post by ummjackson »

cpburns2009 wrote: post #25

While this sounds like an overreaction, I question the breadth of this method (unrelated to the reliability of IP address origin). > This tells nginx to assign the $allow_visit variable a 0 for any users the GeoIP database specifies as coming from the “EU” continent. Europe is the continent. The EU does not encompass all European countries. Doesn't this needlessly block non-EU European countries?

Good point, it likely does. Alternatively, you could set up the rules using country and list out the 28 that make up the EU.

Re: GDPR for side-projects? Blocking all EU traffic with Nginx in 3 simple steps

#27

Post by andonisus »

huebnerob wrote: post #18
itake wrote: post #8

Earlier quoted context omitted.

I don't have time to build user exporting, user deletion, user notifications, amongst other required features on top of the already big backlog of fearures to do. I use third party tools to help worth logging and error tracking. Its just not worth my time to support gdpr on a website that makes no money.

Yes, but my understanding is that you don't need to automate these features, so you would just do it all manually until your scale starts to make building tools worth it.

Maybe they don't want to spend time doing it manually...?

Re: GDPR for side-projects? Blocking all EU traffic with Nginx in 3 simple steps

#28

Post by Sohcahtoa82 »

inetsee wrote: post #9
olliej wrote: post #5

If you have a side project that siphons personal information from people for no reason, then maybe the gdpr isn’t the problem...

My reading of the GDPR says that the MINIMUM fine is 20,000,000 Euros, which I think would be a pretty big problem for an individual working on a side project. I also think the 403 error page explaining that the GDPR is the reason the visitor can't access the page is a nice touch.

https://gdpr-info.eu/art-83-gdpr/

The wording says fines "up to 20,000,000 Euros"

"up to" usually implies a minimum, not a maximum.

Re: GDPR for side-projects? Blocking all EU traffic with Nginx in 3 simple steps

#29

Post by dragonwriter »

Sohcahtoa82 wrote: post #28
inetsee wrote: post #9

Earlier quoted context omitted.

My reading of the GDPR says that the MINIMUM fine is 20,000,000 Euros, which I think would be a pretty big problem for an individual working on a side project. I also think the 403 error page explaining that the GDPR is the reason the visitor can't access the page is a nice touch.

https://gdpr-info.eu/art-83-gdpr/ The wording says fines "up to 20,000,000 Euros" "up to" usually implies a minimum, not a maximum.

> "up to" usually implies a minimum, not a maximum.

“Up to” literally means a maximum.

Re: GDPR for side-projects? Blocking all EU traffic with Nginx in 3 simple steps

#30

Post by lovich »

cft wrote: post #17
matthewmacleod wrote: post #14

Earlier quoted context omitted.

The front page has had daily articles from mis-informed US tech startups collectively shitting themselves about GDPR for weeks.

How many former US startups such as Google or eBay do you use in the UK? And how many former UK startups does an average US user use? There gotta be a reason for this disparity. And the reason is regulatory capture in the EU.

Man, I think that's the first time I've seen someone compare the EU to the US unfavorably on regulatory capture. They both have it, but the US has basically perfected it. Just look at the FCC and it's current chair
Post reply on HN