6 ms·

Yeah good luck setting up a startup now. If other countries follow Russia's suit, we'll soon end up having to somehow determine where a user is from (what if th

• Majestic121 11y ago
  The easiness of setting up a startup should not be held in higher regard than people's right to privacy.
  • axx 11y ago
    While this is true, it's interesting to see what kind of effect this will have on the market. I also didn't talk about startups, i mean small business in general. This could be a reason not to launch your business in europe, if the cost of "deployment" is to high. Sure, someone else will fill that hole for you, but that's less money in your bank account. :)
    • estefan 11y ago
      Exactly. There's a bit of "pulling up the ladder" here. The guys who got in when the Internet was still the wild west got established without all this overhead. There will be an enormous burden on new businesses satisfying these laws - previously we've got away with privacy policies but could still code the same. If we need to maintain N servers for N countries customers could be from, that's a massive operational overhead that is bound to do nothing other than stifle innovation. Now, I'm all for privacy, but if each country starts fragmenting the internet on country boundaries - to the level of physical servers and data storage locations, bringing a new idea to market is going to much much harder. This is different to, e.g. different tax regulations, etc, because you can still benefit from centralised computation while processing orders for different localities. And while today this might be just about Europe, it sets a trend. Before it was just Russia and China. How long before all countries want to see the code a la the Chinese? So the NSA has screwed things up for all of us now who are trying to start businesses. If my costs go from: developer -> developer + global devops team + legal, etc., that's a massive burden that will affect the "bedroom/garage" startups.
      • jarek 11y ago
        From my experience, majority of "bedroom/garage" startups self-limit geographically - whether it's expecting a phone number or a bank account in a given country, or assuming everyone has a U.S. state and zipcode (90210). Data regulation is hardly the deal-breaker when their own dataschemes don't support internationalization.
        • estefan 11y ago
          I guess it all comes down to how you're meant to determine where someone's data should be stored. Is it by their nationality? What if your app gains popularity outside your launch country? Are you suddenly on the hook for not having sharded your data geographically? Plenty of popular apps don't require anything like bank account/post code, etc. that could be assumed to prove which country someone is from.
          • Arnt 11y ago
            If your app gains popularity in Italy, you have to care about Italy. That means supporting the Italian language always, it means supporting the odd Italian phone numbers if your app happens to deal with phone numbers, and it means complying with Italian law. Now, if your app does not become popular in Italy, you just have five users there, do you still have to comply? No you don't, because de minimis non curat lex.
            • estefan 11y ago
              What about the English speaking world or the Spanish speaking world?
              • Arnt 11y ago
                Yes, what about them?
              • jarek 11y ago
                What kind of services or small businesses do you have in mind that a) have offices in different data jurisdictions and b) do not require any localization for these jurisdictions?
  • Menge 11y ago
    I'm as much for generating friction as anyone else. But I wouldn't pretend that keeping data in any country in NATO isn't akin to giving it to five eyes. Basically the EU is creating a PR stunt that in theory could force them to enact some minimum veneer of standards and that PR stunt is going to have higher short term costs for the small private sector players than the large ones. It is entirely possible the stunt will instead pay off for the other EU governments and against the privacy of their population by getting them invited further into the club.
    • Oletros 11y ago
      A ruling from the higher court of the EU is a PR stunt?
      • Menge 11y ago
        Germany thought the antennas on their land were just for astronomy?
        • Oletros 11y ago
          What has to do some antennas in Germany with a ruling from the ECJ of a case referred by the Irish High Court about Facebook? Are you saying that the ECJ ruled without looking at the case merits?
          • Menge 11y ago
            I'm saying that no material facts have changed or were unknown by the governments before the safe haven and that I am skeptical that the case would have been heard at all without public revelation and interest. I am also very skeptical that private data in Germany was or is any safer from the problems with the safe haven as far as data intentionally illegally shared with institutions in the US, not due purely to issues on the ground when defending the data in good faith.
    • fnordfnordfnord 11y ago
      >But I wouldn't pretend that keeping data in any country in NATO isn't akin to giving it to five eyes. Collecting data which is routed internationally is a well documented method that NSA et al have used to skirt domestic law and grab/share the data. If you already live in country "C", and by statute your data must never leave country "C", then your data are more protected than if it had been sent outside the legal jurisdiction of country "C"'s courts.
  • MichaelGG 11y ago
    Don't conflate people's privacy and random laws that say they are about privacy. With prevalent encryption on-the-wire, fibre tapping is less useful. So the way people get their privacy leaked is via hacking or other compromises. Saving to disks in a person's country of origin is probably rather far down on threats to their privacy. (Yeah, I know, if you host it all on disks in the US, then the FBI can come steal those disks. But that's less a risk than a hacking group dumping your DB on pastebin.) And a compromise to the company will compromise the data no matter where the disk are. If countries were really concerned, they'd mandate strong security for personal info. Not like PCI where technical details are spec'd, but somehow offload it so that companies must make reasonable steps. Then have enforcement to fine companies that misbehave. Perhaps make it something where companies will want to get insurance. That way, a startup, instead of grabbing everything, they'll ask themselves: "Hey, do we really wanna capture this info?" Just like PCI shot a lot of plans to store card numbers and CVV, a strong law could make companies think twice and plan around handling private info. Location of storage devices might end up on the list of requirements, somewhere. Like once you store info on more than X people, you're required to address how you handle differing jurisdictions or something.
    • icebraining 11y ago
      The two are not incompatible; EU countries are already fining companies that leak private data, and talking about increasing those fines (the EP suggests a max of 5% of global revenue or €100M, whichever is higher). EDIT: fixed wording
  • MichaelGG 11y ago
    Don't conflate people's privacy and random laws that say they are about privacy. With prevalent encryption on-the-wire, fibre tapping is less useful. So the way people get their privacy leaked is via hacking or other compromises. Saving to disks in a person's country of origin is probably rather far down on threats to their privacy. (Yeah, I know, if you host it all on disks in the US, then the FBI can come steal those disks. But that's less a risk than a hacking group dumping your DB on pastebin.) And a compromise to the company will compromise the data no matter where the disk are. If countries were really concerned, they'd mandate strong security for personal info. Not like PCI where technical details are spec'd, but somehow offload it so that companies must make reasonable steps. Then have enforcement to fine companies that misbehave. Perhaps make it something where companies will want to get insurance. That way, a startup, instead of grabbing everything, they'll ask themselves: "Hey, do we really wanna capture this info?" Just like PCI shot a lot of plans to store card numbers and CVV, a strong law could make companies think twice and plan around handling private info. Location of storage devices might end up on the list of requirements, somewhere. Like once you store info on more than X people, you're required to address how you handle differing jurisdictions or something.
• thibaut_barrere 11y ago
  I don't know why you are downvoted. This is going to become a real concern indeed: should I have one deployment per country of sale, ultimately, etc? This is getting tricky.
  • bpodgursky 11y ago
    Because hacker news isn't dominated by people who actually create things anymore... certainly not startups. At this point, upvotes and downvotes are mostly driven by a reddit-esque crowd with political grudges.
    • icebraining 11y ago
      If your impediment to creating things is having to setup an extra server in each continent, you're not very good at it anyway. As an employee of a small software startup, but also as a citizen, I welcome this move.
      • deleted 11y ago
        [deleted]
  • Oletros 11y ago
    He is being downvoted because he weights more the easiness of a business than the citizen's privacy.
    • thibaut_barrere 11y ago
      Ah - I didn't read like "it's a bit of pain" (easy or not) but rather like the extra friction brought by this issue is going to stop many people from starting businesses, at all. (for some context, I'm a French SaaS bootstrapper; I am as careful with my customers data as I can be, and found that starting a SaaS has been a major pain already - VAT rules, finding a SafeHarbor provider which doesn't suck at security, too etc).
      • 11y ago
• scrollaway 11y ago
  European privacy laws are very consumer-friendly and usually very reasonable. US companies should look at those laws as a guidebook on how to get your customer's privacy right in the US as well. You build houses - think of it like fire safety rules. "What do you mean I have to keep track of all the fire safety rules for the country I build the houses in? Can't I just keep track of a set of rules of my choosing instead?" -- well, no, for one and even if you could, that'd be a bad idea. Almost universally, there's good reasons behind specific rules in the fire code. (And in the rarer cases the rules really are broken, that's a problem with the law, but not one that can't be fixed). Unfortunately, most companies don't give a rat about their customers' privacy (we care deeply about it we swear). What really should happen instead is that US customers demand laws like the ones we have in Europe.
  • JohnTHaller 11y ago
    Some EU laws may be intended to be consumer-friendly, but the intended outcomes don't necessarily line up. Case in point, the cookie law absurdity.
    • vidarh 11y ago
      In the end we ended up with a requirement to ensure more and more prominent information. Do you think it's bad that more consumers are aware of the potential privacy impact of their actions?
      • JohnTHaller 11y ago
        Basically every website in the world except basic static sites use cookies. So the EU wants every website in the world to have a warning message about the dangers of cookies. That will show up every single time you visit every single website. Unless you accept the cookie that allows the site to see the fact that you saw a warning about cookies. So, websites have to use cookies to display a warning about cookies and if you don't accept the cookie, you get a warning about it on every single subsequent visit. It screams laws written by politicians for special interest groups none of whom have the first clue about technology or how it works. You could just have the web browser show an alert when a site wants to set a cookie and the user can click that alert or always allow it. Which is what we used to have in every web browser. Until users got sick of seeing the stupid warning because every single website uses cookies. And they got blind to the warning and paid no attention to it. Which made any other warning a browser shows more likely to just be clicked through. So browsers removed the warning because we all realized it was stupid and pointless and ineffective and served no purpose any longer. But politicians with no idea how the technology works and no understanding of the fact that we already went through all this decide that everyone should see the dumb, stupid, ineffective warning on every single website and have it show up every single time for the people who understand how to manage their cookies and only show up once for the people who have no idea how to use their cookies. Just brilliant. It serves no purpose and everyone just clicks it away just like any other popup ad.
• weland 11y ago
  > Yeah good luck setting up a startup now. If other countries follow Russia's suit, we'll soon end up having to somehow determine where a user is from (what if they're roaming, etc.?) so we can shard the datastore across multiple geographic locations. Or just host everything in Europe. Or lobby Congress to stop shitting all over privacy so that the US can be considered a safe harbour again.
  • MichaelGG 11y ago
    Hosting in Europe wouldn't fix the issue that Russian law wants to have Russian persons' info stored in Russia. It could very easily end up with several countries requiring this, and needing to store data differently depending on user's selected country. And think about it: is there a really huge increase to privacy? What exact attack scenarios does this defeat, and how likely are such scenarios compared to run-of-the-mill privacy breaches (lax security)?
    • socksy 11y ago
      It's obviously about regulatory requirements rather than a random hacker. If I host my data in the US, then I am subject to the whims of the US government, and as such they have jurisdiction over European data (which of course, is not protected in any way in the US, even by the meagre data protection laws that the US affords its own citizens).
      • dgoldstein0 11y ago
        The problem is there are some judges in the US who disagree. So ultimately it might not even matter where your data is stored: http://www.theguardian.com/technology/2014/apr/29/us-court-microsoft-personal-data-emails-irish-server http://www.theguardian.com/technology/2014/apr/29/us-court-m...
    • lagadu 11y ago
      > And think about it: is there a really huge increase to privacy? What exact attack scenarios does this defeat, and how likely are such scenarios compared to run-of-the-mill privacy breaches (lax security)? Those are two entirely different scenarios. There's no reason both couldn't (and shouldn't) be handled in parallel. For example starting next year companies within the EU are held liable for data loss, with up to IIRC 3% of their global revenue. That policy handles the lax security concerns; no reason to not tackle other problems, like the one described on this thread.
• deskamess 11y ago
  Or you could work on starting a startup that helps to 'store stuff in their geographic region' as a service. And let all the other startups leverage your service.