Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

891–900 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#891

Post by lou1306 »

auganov wrote: post #881
gkya wrote: post #774

Earlier quoted context omitted.

The business culture defined in this post is really freaky, to say the least. You can't point me to one other industry where you can start selling shit w/o "knowing what you're doing". Or if you can't sell your things you lure people in with free stuff and sneakily fuck them up w/o no laws to work around which protect them. Simply and brutally put: if you are incompetent and/or malevolent in your business practices a…

This culture has driven innovation of the last 2 decades. You can't point me to one other industry which enjoyed as much success. Of course, Europe couldn't care less - they never had a real startup industry in the first place.

> This culture has driven innovation of the last 2 decades.

So what? Communism turned feudal Russia into a world superpower in less than 2 decades. Do the ends justify the means?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#892

Post by CaptainZapp »

codexon wrote: post #544
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

Merely setting a delete flag is not compliant with the GDPR, that's why a cascading delete is necessary. Any programmer worth their salt knows mass random deletes and updates are extremely inefficient.

I read a lot about cascading deletes, which I interpret as holding personally identifiable data redundantly.

I can see two reasons why this would be a problem:

You have a really shitty un-normalized database design. Granted that you may have to denormalize specific columns for performance reasons. But why that would be the case with, for example names, phone numbers or sexual preferences, totally escapes me.

Or, you're referring to actual cascading deletes, meaning that you need to get rid of child relations, based on deletion of the parent relation. If this poses a problem then I'd argue that you're guilty of a shitty database implementation, arguably with criminally bad definition of your primary / foreign key pairs.

I really don't see a problem here, unless the database schema is implemented in a totally incompetent manner.

Edit: Clarity

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#893

Post by tomrod »

ThJ wrote: post #53

I keep seeing these posts on how to block European users to avoid the GDPR. As a citizen of Europe, seeing these posts consistently making it to the front page is disappointing. It would seem that Silicon Valley perceives the GDPR as more of a hindrance than an opportunity to offer users better privacy. Nothing has been learned.

Innovation costs money. GDPR threatens part of their model, but the tradeoff is calculated.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#894

Post by mike-cardwell »

ars wrote: post #497
admax88q wrote: post #484

Earlier quoted context omitted.

> Most early-stage startup use the best practice of “delete=1” Honestly that's a bad best practice if the data your collecting is sensitive, which PII is.

It's not so easy. Someone buys a book. Transaction is recorded, and now we know total book sales. Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted. Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.

Continue to set deleted=1, but also now just set name="DELETED" and email="DELETED@DELETED" at the same time?

You don't need to actually delete the row, just overwrite the information which you no longer have consent to store...

This is obvious isn't it?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#895

Post by baby »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

> Most early-stage startups use the (in 2008, when I did mine) best practice of “delete=1”. Changing your whole database over to permanent cascade delete is only easy if you’re a very experienced programmer or who knows what he’s doing.

HAHAHAHAHAHAHAHAHAHAHAHAHAHAAHA

How did you get upvoted so much

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#896

Post by tchock23 »

nelsntk wrote: post #504
manfredo wrote: post #454

Earlier quoted context omitted.

If a kid makes a meme generator site where you can create a profile and organize your dank memes, then now they have to have a data protection officer, build a system to purge user data, and build a system to get user consent, etc. I can easily see small websites just ignoring GDPR and hoping they fly under the radar. Or, using something like this Cloudflare configuration to block all EU users until they reach a size…

>they have to have a data protection officer Themselves > build a system to purge user data SELECT * from users, memes, usermemes where userid = #####

You’re not allowed to have the DPO be yourself due to potential conflicts of interest.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#897

Post by baby »

auganov wrote: post #881
gkya wrote: post #774

Earlier quoted context omitted.

The business culture defined in this post is really freaky, to say the least. You can't point me to one other industry where you can start selling shit w/o "knowing what you're doing". Or if you can't sell your things you lure people in with free stuff and sneakily fuck them up w/o no laws to work around which protect them. Simply and brutally put: if you are incompetent and/or malevolent in your business practices a…

This culture has driven innovation of the last 2 decades. You can't point me to one other industry which enjoyed as much success. Of course, Europe couldn't care less - they never had a real startup industry in the first place.

driving innovation while having the biggest number of homeless people in the streets and no health care.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#898

Post by matwood »

closeparen wrote: post #862
gerdesj wrote: post #598

Earlier quoted context omitted.

I have keyed in and deleted so many efforts at an answer to your question that I have given up and find myself merely asking: "Have you actually read the regs?" http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... My reading of them finds no second/third order anything. The regs are surprisingly clear. I forgot to mention that unless you are trying to abuse EU citizens in some way then you have no problems…

>I forgot to mention that unless you are trying to abuse EU citizens in some way then you have no problems. Half of commenters are making this assertion; the other half are asserting it's a damn good thing that small companies will be eviscerated for insufficient seriousness, whether or not they are doing anything abusive. Some of you are necessarily wrong.

I could argue that not protecting my data constitutes abuse.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#899

Post by wlll »

ww520 wrote: post #683
yzmtf2008 wrote: post #512

Earlier quoted context omitted.

The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but inst…

And going through all the backups to overwrite the data? Backups that would have been written to CD or tapes?

Yep, you have one month.

If you are storing backups for longer than this then perhaps you have to ask yourself why.

For instance, the last company I worked for deliberately didn't keep database backups past 30 days and had that policy for some years prior to GDPR. The idea being that it would be expected by a user that when they hit "delete" on something in the web app it would actually be deleted.

(Additionally there is a whole minefield of crap that could happen if you got subpoenaed and had to due process on months or years worth of backup data, but this wasn't the primary driver of the policy)

This is a pretty good read on the matter:

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#900

Post by auganov »

lou1306 wrote: post #891
auganov wrote: post #881

Earlier quoted context omitted.

This culture has driven innovation of the last 2 decades. You can't point me to one other industry which enjoyed as much success. Of course, Europe couldn't care less - they never had a real startup industry in the first place.

> This culture has driven innovation of the last 2 decades. So what? Communism turned feudal Russia into a world superpower in less than 2 decades. Do the ends justify the means?

Not making a moral argument. @gkya's comment paints a picture where entrepreneurs unhappy with GDPR are perhaps just a small contingent of incompetent amateurs who shouldn't be doing business in the first place.

While I, in agreement with OC/OP, see it as a threat to the entire industry.

Post reply on HN