Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

561–570 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#561

Post by ComputerGuru »

4ndrewl wrote: post #524
ACow_Adonis wrote: post #514

Earlier quoted context omitted.

Clearly you have a different definition of entrepreneurs/technical people than I do. Those seems like impositions on people who implement bad practice or work in fields that have morally questionable practices regarding people's data and identification. Many people I know don't engage or work in such industries because of the moral implications of doing so and what people are doing with data. Its not about "just ask…

+1 to this. GDPR is just the personal data equivalent of the "don't be a dick" principle.

Except it's now codified law, with real punishments based off the ambiguous "don't be a dick" directive. There are serious ambiguities here, and unfortunately no one knows how they'll be handled.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#562

Post by alexbecker »

yzmtf2008 wrote: post #551
codexon wrote: post #544

Earlier quoted context omitted.

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

I encourage you to read my comment again, and point out where I mentioned merely setting a delete flag. Any reader worth their salt will point out that it’s not what I suggested at all.

I believe the confusion is around your statement "mark every sensitive field". I think you mean "overwrite every sensitive field", but that definitely took a re-reading to infer, and I'm still not 100% sure.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#563

Post by dbpatterson »

codexon wrote: post #556
yzmtf2008 wrote: post #551

Earlier quoted context omitted.

I encourage you to read my comment again, and point out where I mentioned merely setting a delete flag. Any reader worth their salt will point out that it’s not what I suggested at all.

"you could easily not switch to a CASCADE, but instead set delete=1 and mark every sensitive field with a special value"

you ignored "and mark every sensitive field with a special value", which is the key part. As long as all sensitive data has been essentially zero'd out (for some value of zero), all is fine.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#564

Post by elorant »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

It's no big deal because not everyone in here is in B2C marketplace. I have SaaS services aimed at businesses. I don't give a damn about GDPR. It mostly doesn't affect me. On the other hand as a EU citizen I wholeheartedly welcome it. Sure, it's a draconian law and given time it will get polished but let's just face reality. Online advertising and whatnot has gotten out of hand. You visit any given site and it loads two dozen trackers. Facebook tracks you even if you don't have a profile on them. Google collects shitloads of personal information and none knows what they're doing with it exactly.

Back in the days we used to say that the Internet self-regulates. Well guess what, that's not happening anymore. Companies like FB or Google are actually breaking the web as we know it because they exploit our trust. If GDPR means that their business model will break then so be it. I have huge appreciation for Google, and none for FB, but enough is enough. And they're just the low hanging fruits. There are countless other companies out there working in unethical ways. If anyone's business model is to invade user's privacy then fuck off and die. That's not entrepreneurship, that's greed and a total disregard for human rights.

And by the way, we're not just professionals. We're also users.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#565

Post by jeremyt »

Silhouette wrote: post #559
ars wrote: post #497

Earlier quoted context omitted.

It's not so easy. Someone buys a book. Transaction is recorded, and now we know total book sales. Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted. Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.

Someone says "delete me and my purchases", so you do In many cases, that will be your mistake. The right to erasure is not absolute, and if you need to keep those records for a good reason -- for example, as evidence to support tax returns or defend chargebacks -- then you are entitled to refuse to delete them and to continue processing them for the necessary purposes. Otherwise mortgages would suddenly become a very…

Great, so now we get to spend money on lawyers and time in the courts to decide what information falls under “OK to keep for a good reason”

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#566

Post by curun1r »

4ndrewl wrote: post #524
ACow_Adonis wrote: post #514

Earlier quoted context omitted.

Clearly you have a different definition of entrepreneurs/technical people than I do. Those seems like impositions on people who implement bad practice or work in fields that have morally questionable practices regarding people's data and identification. Many people I know don't engage or work in such industries because of the moral implications of doing so and what people are doing with data. Its not about "just ask…

+1 to this. GDPR is just the personal data equivalent of the "don't be a dick" principle.

It's that, plus a whole lot of unreasonable demands. Just take the requirement to have an EU representative[0]...even a 1-person US startup that processes data now needs to hire someone in the EU and designate a qualified DPO, which they'll likely need to hire as well. That's way more than not being a dick, it's a huge jobs program that will cost companies millions. One estimate I saw indicated that they expected there would be a need for more than 30,000 DPOs in the EU (and it's that low because a single person can act as a DPO for more than one company).

There's a lot in the GDPR that I like, but having just been through a massive compliance effort, there's a lot in there that overreaches and is just there to leech money out of the companies that make an effort to comply.

[0] https://gdpr-info.eu/art-27-gdpr/

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#567

Post by spookthesunset »

nelsntk wrote: post #504
manfredo wrote: post #454

Earlier quoted context omitted.

If a kid makes a meme generator site where you can create a profile and organize your dank memes, then now they have to have a data protection officer, build a system to purge user data, and build a system to get user consent, etc. I can easily see small websites just ignoring GDPR and hoping they fly under the radar. Or, using something like this Cloudflare configuration to block all EU users until they reach a size…

>they have to have a data protection officer Themselves > build a system to purge user data SELECT * from users, memes, usermemes where userid = #####

What about all the comments on those memes? Do those go too? What about the people who hot-linked to those memes? Do you just nuke the images and break all the content people linked to?

You sign up for a website and upload and share a bunch of memes.... honestly... the shit isn't really your data anymore. It is the publics. You shared it and yanking it back is kind of a dick move.

It really isn't as "simple" as a DELETE statement that some people argue it is.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#568

Post by yzmtf2008 »

alexbecker wrote: post #562
yzmtf2008 wrote: post #551

Earlier quoted context omitted.

I encourage you to read my comment again, and point out where I mentioned merely setting a delete flag. Any reader worth their salt will point out that it’s not what I suggested at all.

I believe the confusion is around your statement "mark every sensitive field". I think you mean " overwrite every sensitive field", but that definitely took a re-reading to infer, and I'm still not 100% sure.

Thanks, the processs reminded me of the “redaction” process, so I used mark. That’s definitely on me. Clarified.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#569

Post by joejerryronnie »

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

Many people view The EU's recent actions (GDPR, Vestager's crusade, etc) as a blatant attempt to weaken the dominant US tech sector so that Europe can try to compete.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#570

Post by pkaye »

Silhouette wrote: post #553
mc32 wrote: post #509

Earlier quoted context omitted.

Has that interpretation changed? I recall reading that in some circumstances it could. Or was that misinformation?

No-one actually knows. What constitutes erasure and how to deal with all the edge cases around backups, archives, unstructured data and so on is one of the big ambiguities under GDPR, and one of the areas most in need of (but mostly lacking) actionable guidance from official sources.

I'm surprised with the law being around for 2 years nobody has received the official guidance needed.
Post reply on HN