Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR for lazy people: Block all European users with Cloudflare Workers

apility.io

Post reply on HN
Print view View original

961–970 of 1001 posts

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#961

Post by zeta0134 »

hennsen wrote: post #880
beojan wrote: post #865

Earlier quoted context omitted.

Because if your business model is based on selling user data, it doesn't matter if you're a small startup, it absolutely is meant to target you. If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly.

How does for example a small yoga studio’s email list fit in your examples? Or even just it’s website? Without cookies and login even - the IP adress in the log files alone is considered potential personal data that basically puts people in the need of consulting a lawyer about how to safely deal with that. And makes you a potential target to being sued and getting a lot of hassle. Even found nit guilty in the end, n…

I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't.

Now compliance is largely handled by the tool makers, and the Yoga studio can focus on their business case and any custom coded extensions to ensure they remain compliant. (For popular stuff like Apache, compliant configurations are probably already available or will be shortly, once we all figure out if we are allowed to keep logging IP addresses by default.)

I'm not sure I understand the email jab; obviously you can store data, you just must obtain consent first, and must allow the data to be deleted on request. That's an opt-in mailing list with an unsubscribe feature that actually works and properly deletes the relevant data. Why should that be difficult for a small business to do right?

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#962

Post by tlogan »

auganov wrote: post #881
gkya wrote: post #774

Earlier quoted context omitted.

The business culture defined in this post is really freaky, to say the least. You can't point me to one other industry where you can start selling shit w/o "knowing what you're doing". Or if you can't sell your things you lure people in with free stuff and sneakily fuck them up w/o no laws to work around which protect them. Simply and brutally put: if you are incompetent and/or malevolent in your business practices a…

This culture has driven innovation of the last 2 decades. You can't point me to one other industry which enjoyed as much success. Of course, Europe couldn't care less - they never had a real startup industry in the first place.

I actually think it is exactly the opposite: the culture like this was killing the innovation. That is reason biggest companies are ads companies: Facebook, Google, Twitter, etc.

And that is the reason companies like Oracle and other will still make big $$ - why? Because you cannot "break things and sell ads" and do "delete=1" when you are developing RDMBS.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#963

Post by beojan »

rhapsodic wrote: post #936
beojan wrote: post #865

Earlier quoted context omitted.

Because if your business model is based on selling user data, it doesn't matter if you're a small startup, it absolutely is meant to target you. If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly.

>If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly. Or, alternatively, just don't do business where it would put you under the jurisdiction of the GDPR. That's what a lot of companies are doing, and there seems to be a lot of resentment over it.

There isn't a law banning the use of Electron instead of learning how to build desktop applications properly, and there's a lot of resentment over people doing that too.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#964

Post by rajacombinator »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

HN is a good reflection of Silicon Valley actually. Mostly people working for big companies who loves to read about and criticize startups but don’t have the guts to attempt one themselves.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#965

Post by YtvwlD »

mcguire wrote: post #812
hekfu wrote: post #613

Earlier quoted context omitted.

> This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every web…

I have a blog. No ads. No revenue. 1. I have been using Google analytics for their entertainment value. I assume that's verboten now. 2. I assume the IP addresses in my logs are PII. Should I shut off logging?

1. No, but you shouldn't need to store PII. Simply disable cookie usage and enable IP address anonymization in Google Analytics.

2. You can simply exclude IP addresses from logging.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#966

Post by blablabla123 »

jeremyt wrote: post #479

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. Let’s just take one feature: the requirement that you can permanently delete all of your information. Most early-…

> I’ve been reading hacker news for about a decade, and

> it’s getting to the point where I don’t think there are

> many entrepreneurs and/or technical people on here

> anymore.

Not sure, I tried my luck with co-founding 2 companies but I work now as an employee. I notice that the number of Stars on popular Github projects is rising every year, leading me to the conclusion there is an ever growing number of technical people. More over I realize it becomes easier every year to deal with more complexity.

That said, it becomes more feasible to handle more business logic - or compliance logic if you will.

I know that especially Lean Startup proponents say one should start with low tech solutions. Also I attended an accelerator program and was surprised that most startups there were not tackling exactly super complex things. In fact one Startup worked with some kind of modified Wordpress or so - which has GDPR logic already included.

So yeah, things become more technical and complex but I think it's for the good. Also when handling other people's data I guess there should be some responsibility. For the 2 companies I co-founded data-export would have been trivial to implement as the Web Apps were AJAX powered, I would have had just to provide a link to the user. In case of Startup #1 users were anyway only there to train for some test, so it would have been no problem to delete the user records. Probably delete cascade would have been fine as I worked with backups. Deleting data from backups would have been fine as well, they take up only precious space and use up bandwidth. Startup #2 was more about producing content that was not from users.

Also I want to note that in times where TDD is something even known to barely technical people, delete cascade is safe and a no-brainer.

Anyhow, the most challenging thing looking back would be all those 3rd party tools. To name some: Google Analytics, Mixpanel, managed DB/Redis/etc. I was never a fan of any of those tools and in times of Docker, we can run our software on whichever computers seem most suitable.

> My biggest fear is that all of these complex

> bureaucratic laws are just raising the bar for doing a

> startup. Maybe the days of two people doing a startup

> in someone’s garage should be in the past? If so, that

> makes me kind of sad.

GDPR isn't really complex, it's more like a collection of vague rules and recommendations. Basically most of them are like keep only the data you need, offer export and deletion following best practices.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#967

Post by smooc »

I don’t see a lot of comments looking at the practical side of things. I am implementing GDPR and here are some suggestions:

1. Collect only what is necessary for providing your service 2. Make clear what you store and for what reason 3. Ask consent and give the opportunity to retract this consent as easily

Deletion:

1. PII means information that makes a person identifiable. This is the type of information that you need to remove 2. So if you are storing PII information for the use of profiling you will need to disconnect the profile from the PII information. E.g. you could use user table where you would overwrite the PII information with generic information. You can still use the now stale profile withou PII information (for example in statistics, aggregations etc), but you cannot tie it to a single person anymore. Ie. You should not be able to reconnect the person to profile you have stored. 3. As technical possibilities evolve you need to improve the disconnection over time.

There are legitimate business reasons to store some PII information. E.g. for security reasons, other laws etc. So IP addresses don’t need to be deleted from your web logs, but if not given consent you cannot use them for ads, sell them etc.

The required clarity that GDPR will bring to your data is actually going to benefit you. Your data scientists will love it, because the tooling that helps with Gdpr also helps with discoverability, data quality etc.

Enjoy GdPR, there is a lot of business opportunity in it.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#968

Post by gkya »

SuperNinKenDo wrote: post #938
baby wrote: post #897

Earlier quoted context omitted.

driving innovation while having the biggest number of homeless people in the streets and no health care.

Not even close[0] There is healthcare in America[1] [0] https://en.wikipedia.org/wiki/List_of_countries_by_homeless_... [1] Doesn't actually need a source

I don't think the commenter meant healthcare as in hospitals and medicine being available; AFAIK the US has nothing like what most other countries has where it is facilitated for most or all citizens to access health care at minimum or no costs.

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#969

Post by gkya »

auganov wrote: post #881
gkya wrote: post #774

Earlier quoted context omitted.

The business culture defined in this post is really freaky, to say the least. You can't point me to one other industry where you can start selling shit w/o "knowing what you're doing". Or if you can't sell your things you lure people in with free stuff and sneakily fuck them up w/o no laws to work around which protect them. Simply and brutally put: if you are incompetent and/or malevolent in your business practices a…

This culture has driven innovation of the last 2 decades. You can't point me to one other industry which enjoyed as much success. Of course, Europe couldn't care less - they never had a real startup industry in the first place.

This culture has been riding a wave of innovation, a wave driven by big chip companies (e.g. Intel, NVidia, Arm), big SaaS companies (e.g. Amazon, Microsoft, Google), big content / ads companies (e.g. Facebook, Google), big hardware companies (e.g. Apple, Samsung, recently Google and Microsoft) and big software companies (e.g. Apple, Microsoft, Google). From that big farm of company-flowers which live for only a couple days, founded on the most fragile of practices, only a handful actually produce some service that has any interaction with the general public, and these businesses' most innovative thing was to app-ify a thing that we used to do day to day (which I do not look down upon, but it's no "innovation"). Examples are Uber (however controversial), AirBnB, Etsy, etc., if we exclude those who feed themselves exclusively on users' private data (Facebook, partially Google, Twitter, etc., but these are not businesses whose customers are the general public, their customers are the ad publishers).

Re: GDPR for lazy people: Block all European users with Cloudflare Workers

#970

Post by zenhack »

mcguire wrote: post #812
hekfu wrote: post #613

Earlier quoted context omitted.

> This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every web…

I have a blog. No ads. No revenue. 1. I have been using Google analytics for their entertainment value. I assume that's verboten now. 2. I assume the IP addresses in my logs are PII. Should I shut off logging?

(standard IANAL disclaimers)

1. yeah, probably.

2. There's a comment elsewhere in the thread to this effect, but short-term logging for the usual purposes of managing stability/security of a system almost certainly qualifies as legitimate interest. Don't keep the logs indefinitely, but I figure nginx's defaults with a week's retention period is quite reasonable.

The relevant authorities also have a track record of giving people warnings and time to fix things, so especially for something so trivial, I'd basically just make a good faith effort and not stress about it.

Post reply on HN