Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How GDPR Will Change The Way You Develop

smashingmagazine.com

Post reply on HN
Print view View original

341–350 of 710 posts

Re: How GDPR Will Change The Way You Develop

#341

Post by chopin »

Romanulus wrote: post #306
calcifer wrote: post #266

Earlier quoted context omitted.

> The problem is you are required to prove that you follow the rules Yes, because the "just don't do creepy shit" approach to privacy didn't go so well. If the carrot doesn't work, the stick comes out.

Isn't this, like, the cornerstone of bad reasoning; acting/enforcing on a few one-offs?

Just switch on developer mode in the browser and watch the network activity while visiting an arbitrary site. I don't think it's a few one-offs. The few sites who don't do malicious tracking (thanks HN) are one-offs.

Re: How GDPR Will Change The Way You Develop

#342

Post by freeone3000 »

floatrock wrote: post #291
sbov wrote: post #177

Earlier quoted context omitted.

The comparison is disingenuous. The internet makes anything you build automatically global. You're blasting software engineers for not knowing worldwide regulations. How many New York lawyers know the regulations of France? How many local UK construction companies know the building codes of Japan? None. Knowing all regulations in the world for any given industry would be a full time job. The people you seem to be imp…

> How many New York lawyers know the regulations of France? New York lawyers who do business in France do. If you're accepting ~dollars~ euros to place French ads on your pages targeting French customers, seems reasonable to know the relevant French regulations.

It's a bit more strict than that. If I have customers in France, this affects me, no matter how many, no matter if it's one dude in Florida who happens to also be French. The reach is absurd.

Re: How GDPR Will Change The Way You Develop

#343

Post by jefe_ »

I imagine most of it will boil down to this:

Follow OWASP, encrypt in motion and at rest, use key-manager appliance, implement access logging and store separate from systems, backups of data, define lifetime of data, physical controls to data storage facilities, access controls in system, manage multi-tenancy as the situation requires, sensible password policies / multi-factor authentication, background checks on employees, train staff on security, perform regular scans, restrict ports, intrusion detection system, penetration testing, have plans for business continuity and disaster recovery and practice implementing them, be aware when third party libraries are being used and have a policy for applying software/os patches.

Re: How GDPR Will Change The Way You Develop

#344

Post by freeone3000 »

madez wrote: post #331
damontal wrote: post #300

Earlier quoted context omitted.

>and they request later to be forgotten and you don't How do you prove you have forgotten someone?

You attest so legally binding. The legal system does not function on mathematical proofs. If it turns out you did not speak the truth, you can be fined, and maybe even jailed. That's how it works. Also, we are not talking about forgetting someone personally, but deleting their data. I assume that's clear.

So if you're willing to indefinitely lie, you just get out? This seems inefficient.

Re: How GDPR Will Change The Way You Develop

#345

Post by eadmund »

jacquesm wrote: post #183
Sevii wrote: post #164

Earlier quoted context omitted.

Explicitly banning Eurozone citizens from using the service is the easiest solution I have thought of.

The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition.

Some people may find that a valuable trade-off, because the alternative would be to permit their customers to demand that they rewrite their logs at any time. I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand).

Re: How GDPR Will Change The Way You Develop

#346

Post by chopin »

sbov wrote: post #177
mfoy_ wrote: post #81

Earlier quoted context omitted.

No. Professionals in engineering or the trades have to know the regulations that govern their industry and abide by them. What many SVers call "innovation", other industries would call "reckless". How embarrassing for us! EDIT: In terms of regulation, we're practically chiropractors.

The comparison is disingenuous. The internet makes anything you build automatically global. You're blasting software engineers for not knowing worldwide regulations. How many New York lawyers know the regulations of France? How many local UK construction companies know the building codes of Japan? None. Knowing all regulations in the world for any given industry would be a full time job. The people you seem to be imp…

Don't slurp up data worldwide, then. If you don't do that, you're fine. If you do business you'd better know the law of your target audience, isn't it?

Re: How GDPR Will Change The Way You Develop

#347

Post by skosch »

mfoy_ wrote: post #268
_o_ wrote: post #214

I really don't think (and I am developer, I will need to comply) that anything in GDPR is hard to understand. Treat data from others in same way as you would treat (and you are treating) yours. You are not selling your personal details to 3rd parties, you are not keeping painfull pictures of yourself climbing to garbage bin and doing diving completely drunk, you are not storing them into pastebin or unsecured databas…

Software development needs some sort of Iron Ring ( https://en.wikipedia.org/wiki/Iron_Ring ) to remind us to be humble.

It's a nice symbol, but not nearly enough emphasis is being put on these values (and how to defend them, in work day practice) as part of the curriculum.

Undergrad engineering culture elevates the ring into a mythical embodiment of the deliverance that is graduating. Then, naturally, the moment you have it on your pinky, it's a status symbol – you're 23 now, old enough to act real casual about it, but man, shit feels like you're 13 and just emptied a can of Axe spray on yourself. The noble humility is very shortlived, in my experience.

Somehow those in medicine seem to be doing a bit better, with their Hippocratic oath. Maybe it's a maturity thing. But yeah, I think actually teaching these kinds of practical ethics more would have a bigger effect.

Re: How GDPR Will Change The Way You Develop

#348

Post by cortesoft »

wglb wrote: post #188
chimeracoder wrote: post #103

Earlier quoted context omitted.

> No. Professionals in engineering or the trades have to know the regulations that govern their industry and abide by them. Eh, not substantially or consistently more than in software. It's possible to cherry-pick examples where engineers in other fields are more aware of relevant regulations, but overall, it's roughly comparable. I'm generally very critical of the move-fast-and-break-things mentality, but engineers…

American engineer building a bridge or tunnel in EU is certainly going to know EU regulations. An EE designing circuits for EU needs to know about lead-free solder requirements. On the other side, Mies van der Rohe needed to work with a US-certified architect to build the Seagrams. Having been in the software industry for a while, it is often discouraging to see how both explicitly and often inadvertently move-fast-a…

Right, but the point is that you KNOW the country your bridge or tunnel is going to be used in, because you build it there. If I build a web app and deploy it on a server in California, it can immediately be used by people in almost any country in the world.

Is it my responsibility to follow the censorship rules from China on my webapp in California? Is it my responsibility to know all the regulations on web apps from Sri Lanka?

Building software with care and professionalism is unrelated to understanding all the rules in place all around the world.

Re: How GDPR Will Change The Way You Develop

#349

Post by eadmund »

robin_reala wrote: post #54
sb8244 wrote: post #45

Earlier quoted context omitted.

I'm not sure. I think this is a very absolutist and probably naive way to look at it, frankly. For a simple example, let's say you use an immutable data store. What do you do if a customer wants every info about them redacted, but you did something like store their IP, name, or email. All common things. Now you must build mutability into your store and all assumptions that used to be made can be removed. This is just…

You encrypt the data before it’s stored with a unique key, then destroy the key when the user requests it. Doesn’t help for pre-GDPR data but that’s the way you should be building going forwards.

> You encrypt the data before it’s stored with a unique key, then destroy the key when the user requests it.

That makes selects & joins on the data quite a bit more complex. Per-record & per-subject keys are … tricky.

Re: How GDPR Will Change The Way You Develop

#350

Post by freeone3000 »

wuliwong wrote: post #263
wglb wrote: post #178

Earlier quoted context omitted.

Consider the case of an EU citizen traveling in the US transaction in USD. This person is covered. Even if they are in the US.

This is exactly what I was coming to HN to query about. Without some agreement with the US federal government, I don't believe they would have any mechanism of enforcement that would affect your business in the U.S. I imagine they could do something like block your site from EU ip addresses but nothing like coming after you or your company for damages.

This sort of argument is like saying you can commit murder then flee to Algeria, and the US will have no mechanism of enforcement. It's true, but heaven help you if they figure some mechanism out.
Post reply on HN