Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

581–590 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#581

Post by ATsch »

alwaysdoit wrote: post #552
hk__2 wrote: post #519

Earlier quoted context omitted.

> Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. Erase the name and address fields from the user in the database. You don’t have to delete any line, and that person doesn’t have any personal info in your database anymore. Problem solved.

Two days later the customer files a chargeback with their credit card company and the credit card company wants you to provide documentation for the transaction.

Then you have a legal obligation to keep the data, which counts as one of the valid reasons for keeping it, AFAICT.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#582

Post by bcheung »

anfogoat wrote: post #516
viraptor wrote: post #466

Earlier quoted context omitted.

So which parts of the GDPR do you actually disagree with in case of this XMPP service? Mostly you need to tell people what you collect, allow removing accounts and history, and tell them if you're sending the data to third-parties. If you're running a private service you most likely already fulfill those requirements. Where's the annoyance?

In the specific case of XMPP, wouldn't I need to have an agreement with every other admin who federates their XMPP server and work out what exactly our roles are as defined by GDPR? XMPP still has active development community around it so this will no doubt get much easier with time, but that's just XMPP.

Maybe not: You need to have a "Legal Basis" and only 1 of them is the "subject has given consent" one.

There's another:

"The processing is NECESSARY FOR THE PERFORMANCE OF A CONTRACT to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;"

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#583

Post by bobcostas55 »

gerdesj wrote: post #506
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your…

It's curious how these "basic, fundamental" rights only apply to select industries, while others are free to completely ignore them (art. 85). What kind of basic, fundamental right is that?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#584

Post by Kim_Bruning »

bcheung wrote: post #555
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Funny thing is there are also mandatory data retention regulations that say data MUST be maintained for a certain period of time by law. It's getting worse, but it's generally been the case that it's impossible for an individual to bootstrap a company and be 100% compliant with every law and tax regulation. You would never have any time to actually provide a product and service customers. You just do the best you can…

GDPR just says that if you are keeping data, you have to have a good reason for it.

If you have to retain certain data for eg tax purposes, then that sounds like a good reason to me.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#585

Post by jv22222 »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Thank you for saying this, another thing that is ridiculously difficult is to delete specific user from all your backups. This is made even worse if you have multi region backups and cold back ups.

Even a one-year-old start up could have literally thousands of database dumps in different places if they followed best practice of triple redundant daily dumps.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#586

Post by manigandham »

mintplant wrote: post #577
manigandham wrote: post #554

Earlier quoted context omitted.

Also tired of people thinking that a company not wanting a rule means they were intending to do the exact the opposite of that rule, especially given said rule is incredibly vague and designed to be applied "on principle". Fortunately for all of us, safety regulation is actually very specific in requirements.

Upthread we have the claim that "most early-stage startups use the... best practice of 'delete=1'," pretending to delete user data while actually retaining it. So, the exact opposite of the rule.

Yes, and many things will remain that way with GDPR because of necessity (ie: old invoices and transactions will continue to have your details). Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

But do let me know when GDPR actually does anything to deal with ISPs, credit unions, medical companies, and plenty of other institutions that have breaches all the time and have endured roughly $0 in penalties.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#587

Post by JoshMnem »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

The transition period will be difficult for some people, but I think that GDPR will probably be good for the world in the long-term. New companies will start building their systems correctly from the beginning, and, ideally, the law won't be too heavily enforced on small companies during the transition period. The next generation of programming tutorials will show people how to build things in privacy-conscious ways.

I don't think that blocking Europe with Cloudflare is a good idea. How is blocking Europe going to fix the problem of already having European data in your databases?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#588

Post by Silhouette »

jeremyt wrote: post #565
Silhouette wrote: post #559

Earlier quoted context omitted.

Someone says "delete me and my purchases", so you do In many cases, that will be your mistake. The right to erasure is not absolute, and if you need to keep those records for a good reason -- for example, as evidence to support tax returns or defend chargebacks -- then you are entitled to refuse to delete them and to continue processing them for the necessary purposes. Otherwise mortgages would suddenly become a very…

Great, so now we get to spend money on lawyers and time in the courts to decide what information falls under “OK to keep for a good reason”

I couldn't agree more. The rules about erasure are full of holes like this. So are the rules about legitimate interests. And those represent, respectively, probably the most significant new subject right and probably the most common lawful basis for processing that isn't strictly necessary for some sort of legal compliance.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#589

Post by doesnt_know »

Plenty of other countries have similar, or even stronger consumer privacy protection laws. It's not too much of a stretch to imagine the US eventually becoming the outlier to the point they have a sort of self imposed "great firewall".

The rest of the world will continue on without them, especially as the ~middle class~ population explodes in countries where there previously wasn't one.

The US is really only the "center of the Internet" for primarily English speaking countries, as the others have regional variants of popular US based services. There is no real reason why things wouldn't just split out to Europe and Oceania even more.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#590

Post by strken »

yzmtf2008 wrote: post #512
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every website using social media buttons and GA.js, I don't think it matters in the slightest.

It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop.

There's so much smugness about the GDPR being a "good reflecting moment", etc. which makes me think that people who support the GDPR believe that there's no way detractors could disagree with it in good faith or for good reasons.

Post reply on HN