Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

741–750 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#741

Post by sfifs »

pilsetnieks wrote: post #656
seanmcdirmid wrote: post #614

Earlier quoted context omitted.

> There is no way on earth that the EU as a whole has looked on your company/project or whatever and decided to screw you. The rules are enforced via third-party litigation. So its not the "EU", but some lawyer looking for a nice payday that you have to worry about.

While the GDPR allows for third party litigation, the violations are expected to be handled though relevant data protection authorities, and direct litigation is a last recourse if all else fails. If you haven't tried and failed to resolve your GDPR complaint through the relevant authorities, you'll be laughed out of the court, if you try to bring a GDPR case to it. Edit: any replies instead of just downvotes? Yes, i…

I'll try to answer. The law doesn't actually say that you can sue only after complaint resolution through authorities have failed. That is merely expected practice and assumptions. Potentially facing a frivolous lawsuit in Europe is high risk for a business which small businesses may not want to take. If that's the intent, it should be codified in law.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#742

Post by lomnakkus »

zerostar07 wrote: post #726
lomnakkus wrote: post #701

Earlier quoted context omitted.

I'm not sure whether you're agreeing or disagreeing with your parent comment, but I'm just tacking this on there because it feels right: I think HN has just hit peak stupidity. The amount of paranoia, misreading, misunderstanding, etc. about the GDPR is just insane (or intentional shilling, but let's not go all tin-foil-hatty prematurely). Nobody who's doing anything even remotely above-board is panicking or anything…

> paperwork notwithstanding thats the main point for me. Some of GDPR is good: right to delete in a reasonable fashion is great. Right to not be personally identified is awesome, but that's much easier to do in the ISP level. Adtech creates problems - that should mean you have to regulate adtech. But GDPR is more about documentation, bureaucracy and Vista-style popups than about how to protect data. You need a lawyer…

This is paperwork you should already have in some form if you're actually following (and I hate this phrase) "best practices" for customer data and trying to explain to your employees how to handle a (suspected) security breach, etc.

IMO, it's good to actually at least try (as a company) to come with some sort of consistent set of guidelines as to how a security breach should be handled. And a company-wide policy on how company laptops should be treated (disk encryption, etc.).

It's just that nobody actually bothered to actually do these things because the potential penalties were absolutely trivial.

I know of at least one company which chose to just pay the regulator in their country a monthly fine instead of fixing the problem because it was cheaper than paying developers to fix the issue.

How is that not broken?

(I should say that I have problems in which this was "released", so to speak, since there hasn't been time for any establishment of practice based on the intent of the law, etc. It should definitely have been a gradual rollout, but that's not really relevant now that it has been "released".)

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#743

Post by cygned »

codexon wrote: post #544
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

The thing is, affected persons can not only request a data deletion, but also the pausing of data processing. In that case, you are not allowed to delete them but they must not be used any longer, which is essentially a soft delete. So to be compliant, you’d have to implement both a soft and a hard delete.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#744

Post by pjscott »

freedomben wrote: post #144
disconnected wrote: post #32

Earlier quoted context omitted.

> EU citizens have turned into pests overnight. More than USA citizens with dubious DMCA takedown requests?

This strikes me as the typical political response when you are backing a terrible candidate and somebody points out something terrible they do/did. Rather than defend your candidate you respond by attacking theirs. My kids do this all the time when I catch them doing something wrong, "well #{brother} was doing #{badthing}!" Both seem wrong, can we agree on that? DMCA is a disgusting weapon, as is a lot that the US ha…

It's been around long enough to have a short name in a dead language:

https://en.wikipedia.org/wiki/Tu_quoque

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#746

Post by mark_l_watson »

gerdesj wrote: post #506
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your…

Thanks for posting that, makes me feel much better about the spirit of the GPDR.

I decided to remove any use of cookies from all of my sites() a week ago. For my business (writer, and sometimes consultant) that makes sense for me but I understand that most businesses need some access to customer data so they have a motivation to properly handle personal data.

() except my blog is on blogger - still trying to deal with that - I will probably go back to using Jekyll.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#747

Post by yzmtf2008 »

Hermel wrote: post #730
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

> If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. Are you aware that setting “delete=1” is essentially what file systems do when deleting a file? What file system do you suggest companies to use when they want to comply with GDPR?

I’m well aware of that, but are you aware of any SQLi that can output a deleted file? There’s a big difference between the two things you’re trying to equalize.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#748

Post by takeitto »

ng12 wrote: post #635
Barrin92 wrote: post #623

Earlier quoted context omitted.

I'm not onboard with the idea that Silicon Valley holds a monopoly on technical innovation. Getting people to click on ads on smartphones doesn't capture the entire scope of technology. Europe's economy is roughly as large as that of the United States. Many world-leading companies from the car industry, to chemicals, to biotech reside in Europe. The US holds one dominating advantage in one subset of technology. Consu…

That's exactly my point. The EU is built for entrenched institutions. There is no entrepreneurial spirit -- and that's why there's N-number of self driving car companies in the US and zero(?) in the EU, for example.

The EU had self-driving cars in the 1980s (Ernst Dickmanns & Mercedes, demo: https://www.youtube.com/watch?v=I39sxwYKlEE ). The most expensive robot car project was in Europe (https://en.wikipedia.org/wiki/Eureka_Prometheus_Project).

I do agree that the EU has less of an entrepreneurial spirit. Some cultural elements, but also practical: It is difficult to scale an app, since there are such large language and culture barriers between EU member states. There is a decades long brain-drain of highly technical (AI) people. Finally, it is very hard to compete with US companies, as they skirt the rules, winning all network effects with huge VC infusions.

I always suspected some of that was accomplished with military and intelligence support: The American economy and intelligence apparatus stands to benefit a lot with the entire world using Google and Facebook. The other side of this coin is that the pro-privacy anti-surveillance movement may also be supported by foreign intelligence agencies in an attempt to hurt US economic and military interests. https://en.wikipedia.org/wiki/Lernout_%26_Hauspie#History was close to establishing an AI-type Silicon Valley in Belgium in the early 2000's, but was unsuccessful.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#750

Post by curun1r »

MockObject wrote: post #716
curun1r wrote: post #566

Earlier quoted context omitted.

It's that, plus a whole lot of unreasonable demands. Just take the requirement to have an EU representative[0]...even a 1-person US startup that processes data now needs to hire someone in the EU and designate a qualified DPO, which they'll likely need to hire as well. That's way more than not being a dick, it's a huge jobs program that will cost companies millions. One estimate I saw indicated that they expected the…

Dumb question, but how is the EU going to come over here to the US and file charges against me?

They won't, but they'll levy fines that will be in effect should you ever want to expand into Europe. And they might be able to prevent you from doing business with any company that has an EU presence. If you're making a profit off of EU citizens, there are ways to target that revenue.

Look at the ways that the US targeted online poker sites. None of them are in the US and subject to US law. But lots of banks are, and US lawmakers made it illegal for those banks to transfer money into or out of the poker sites and that basically worked.

Post reply on HN