Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

751–760 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#751

Post by wxnx »

I think some people are missing a real opportunity here. It seems GDPR is here to stay.

A simple, straightforward guide to GDPR compliance for small-medium size websites who otherwise would have difficulty complying, including FOS well-executed software extensions that make it even easier:

* Backup compliance

* Database deletion performance improvements

* Legal explanations à la tldrlegal [1]

Haven't done general population-facing web dev for a while, but it seems fairly straightforward. How to monetize it, if at all, I'm not entirely sure. Maybe charge a reasonable fee for short consultations which consist of essentially running down a checklist?

[1] https://tldrlegal.com

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#752

Post by baryphonic »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I've been wondering the same thing. Maybe the true hacker spirit is dead.

I just want to roll my eyes when I see comments to the effect of, "Oh, it's so simple, just read the 80+ pages! The language is clear and straightforward, we promise! Also, you should have separated duties, full CI/CD that sanitizes any possible user data from leaving its hermetically sealed tier, and delete data early and often. If you don't, you'll be fined several tens of MegaEuros." The risk-reward ratio there is just insurmountably high for a small one- or two-person team.

I'm sure there are actually good parts of GDPR, and, hell, for all I know, the whole thing is the overarching achievement of Western civilization. But, unfortunately, reading 80 pages of dry foreign legalese when I'm not a lawyer is somewhere between a waste of time and a very bad idea (e.g. I think the regs are simple, make a mistake, then have huge legal liability). I will sadly be blocking the EU from any services I work on going forward until the point where I'm successful enough that I can actually have my lawyer look over everything.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#753

Post by pjscott »

lsmarigo wrote: post #250

To offer a non-dev perspective on Hn, it feels like tech companies are really trying to annoy us users with GDPR updates in an effort to nurture opposition to similar proposed regulations in the future. I hope it doesn't work. I love GDPR, getting rid of the WHOIS database stuff alone is enough to make me a huge fan. The option to delete my data is also amazing.

You've got the incentive structure backwards! GDPR actually favors companies big enough to do something like that. They have the resources to comply without it affecting them much. Complying with vague, complicated laws is something they're used to, and they have legions of lawyers on payroll. For them it's no big deal. The ones who'll have the biggest problems are the little companies, the ones that are secretly just three extremely busy guys and a handful of EC2 instances.

Regulations usually favor big businesses at the expense of their competitors, and the GDPR is no exception.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#754

Post by spullara »

oneplane wrote: post #460
spullara wrote: post #452

Earlier quoted context omitted.

Web servers are non-compliant out of the box because they all by default log and store IP addresses of visitors.

There is nothing non-compliant about that. You seem to misunderstand essential vs. data hoarding for advertisement purposes. If you were to keep that data forever, sell it to third parties or profile users based on that logging data, not tell them about it, then yeah, you'd be violating the GDPR. For normal operation system logging is pretty much a requirement for essential operation. That includes most properties of…

Without it documented why I am collecting it, how I use it and how I store and delete it, it is non-compliant that I am collecting it at all. I think that you are assuming that they know it is being collected and that they are supposed to use it for something. They don't. It is not essential at all to the operation of the service if you don't actively monitor it. Saying it could potentially be used for some kind of security function seems like a CYA if you aren't actually doing that.

Do you disagree with this TLDR of the regulation?

https://www.smartsurvey.co.uk/articles/gdpr-compliant-with-d...

Without a bunch of work that hasn't been done I seriously doubt that they can give Right to Access, Right to be Forgotten, Data Portability, Privacy of Design and it does clearly state it is Personal Data.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#755

Post by kccqzy »

gerdesj wrote: post #506
jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your…

> Have a look at the first few paras of this: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX.... after it says "Whereas". Does the language look a little familiar? Do the sentiments look strangely familiar in some way?

The thing after "Whereas" is just a preamble stating the intentions, not the actual legal text. In this case, I scrolled down no fewer than 31 pages, thinking to myself "The whereas section can't be that long" until I finally found the real start of the legal text "HAVE ADOPTED THIS REGULATION" on page 32 of 88.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#756

Post by phyzome »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

Before GDPR: You had to decide whether you could take the time to do right by your users w.r.t. privacy, because your competitor certainly wasn't.

After GDPR: Everyone's required to do it, so at least you don't have to worry about your competitors.

That's what this is about: Self-regulation failed. Here's the externally imposed regulation. Be thankful it's as well-written and aligned with our interests as it is!

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#757

Post by colejohnson66 »

johnbellone wrote: post #536
contravariant wrote: post #530

Earlier quoted context omitted.

This might be a bit of a weird question, but how do you remember which information needs to be deleted when you're at the point where you need to use backups?

You would keep a list of unique identifiers (opaque) that were deleted and filter data out prior to rewriting/restoring it. It’s cumbersome but not impossible.

So I need to keep a list of people to delete from my backups when I restore them? Is keeping that list even GDPR compliant?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#758

Post by phyzome »

codazoda wrote: post #579

I run a simple personal blog. I make a meager $200 a year or so from targetted ads on that blog. I have Adsense and Analytics collecting what they collect. My stats have IP's, countries, browsers, OS's, list of pages a visitor looked at, etc. I look through the info on occassion to decide which random rambling I wrote that I should improve or update on the site. This is a hobby but it has expenses and income so it's…

Yes, I believe Google is still working on this. Looks like their drop-in thing won't be ready for a couple months:

https://support.google.com/adsense/answer/9031649?hl=en

You can just turn off ads for a while and then turn them on again when Google has gotten their shit sorted out, or leave them on because honestly you're very unlikely to come to the attention of the regulators -- especially since they're not yet fully staffed and funded for this. :-)

Blocking EU users doesn't actually protect you, and will just piss people off -- not to mention look shady, and thereby increase the chances of you coming to the attention of regulators!

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#760

Post by phyzome »

logronoide wrote: post #21

I'm the author of the post. My most stupid post is in HN! crazy! I just wanted to be sarcastic and make some laughs about people blocking all traffic from Europe, which is crazy! It's a Friday afternoon blog post to show how cool my product is with Cloudflare Workers and having fun at the same time!

Unfortunately, I think people are taking it seriously. -.-
Post reply on HN