3 ms·

> Did it turn a profit? No, sadly not, but running at a loss was fine as my day job covered the bills. It seems the root of the issue would be financing the ch

by hrktb 9y ago

> Did it turn a profit? No, sadly not, but running at a loss was fine as my day job covered the bills. It seems the root of the issue would be financing the changes. In a way, looking further into the regulations to clear how to deal with ambiguous parts or even straight hire a lawyer to look at the details would be a simple move if the expense could be justified. Could it be summed up as “unexpected but mandatory changes kill unprofitable business” ?

darawk 9y ago
It could if you also added "and prevent possibly profitable businesses from ever being started".
- mdpopescu 9y ago
  Yes. Starting a business is already a huge mental effort, I've done it once when I was 19 and never since, even though it's pretty much expected of me (programmer after 40). Adding "you might have to pay 20 million euros" to the list of risks is... indescribable.
strken 9y ago
It's not like he ever intended to turn it into the next Facebook, though, is it? It's like your grandmother's unprofitable home-made scone business shutting down because she doesn't have a certified kitchen.
- estel 9y ago
  If her scone business started accepting payments by card then I think it should be held to the similar standards as larger businesses when it comes to securing card details. Which is kind of what GDPR wants to do for personal data: if you want to collect it from me, there are a minimum set of standards that you need to adhere to because it’s my data.
  - jimktrains2 9y ago
    The pci DSS is well speced and reasonable.
    - hrktb 9y ago
      GDPR is not that big of a deal for companies/groups who’ve been paying attention to these issues from day one. In particular if you already went though PCI DSS, it’s only a few additional things here and there.
      - jimktrains2 9y ago
        "few". Handling customers individually in terms of logs and database backups, for instance, is not a small undertaking. Deleting all traces of a customer is neigh impossible; I bet even "compliant" places don't do it right. The pci DSS has nothing in it like the gdpr; I'm not even sure why you would compare them.and it makes me think you know nothing about either.
        hrktb 9y ago
        It depends how you do it. For me dealing with PCI DSS compliance was mainly to get rid of unwanted traces in the logs and anything permanent (backed up), and separating services dealing with sensible information. While doing these changes, there will usualy be a rethinking of how user data is handled at its core. For instance I worked in the past on dissociating user account with it’s profile and private info, so we could get rid of personal info and only keep behaviors. With GDPR you get similar leeway for keeping most of your data as long as you get rid of identifying info in a reasonable manner. If I’m not mistaken backups are also safe up to a point, but I don’t have the details at hand. My main point was that if someone had the occasion to think thoroughly about user data policy and cleaning unwanted traces at leadt once in the past, GDPR was a lot easier than one might think at first.
deleted 9y ago
[deleted]

by hrktb 9y ago

darawk 9y ago

It could if you also added "and prevent possibly profitable businesses from ever being started".

mdpopescu 9y ago
Yes. Starting a business is already a huge mental effort, I've done it once when I was 19 and never since, even though it's pretty much expected of me (programmer after 40). Adding "you might have to pay 20 million euros" to the list of risks is... indescribable.

strken 9y ago

It's not like he ever intended to turn it into the next Facebook, though, is it? It's like your grandmother's unprofitable home-made scone business shutting down because she doesn't have a certified kitchen.

estel 9y ago
If her scone business started accepting payments by card then I think it should be held to the similar standards as larger businesses when it comes to securing card details. Which is kind of what GDPR wants to do for personal data: if you want to collect it from me, there are a minimum set of standards that you need to adhere to because it’s my data.
- jimktrains2 9y ago
  The pci DSS is well speced and reasonable.
  - hrktb 9y ago
    GDPR is not that big of a deal for companies/groups who’ve been paying attention to these issues from day one. In particular if you already went though PCI DSS, it’s only a few additional things here and there.
    - jimktrains2 9y ago
      "few". Handling customers individually in terms of logs and database backups, for instance, is not a small undertaking. Deleting all traces of a customer is neigh impossible; I bet even "compliant" places don't do it right. The pci DSS has nothing in it like the gdpr; I'm not even sure why you would compare them.and it makes me think you know nothing about either.
      - hrktb 9y ago
        It depends how you do it. For me dealing with PCI DSS compliance was mainly to get rid of unwanted traces in the logs and anything permanent (backed up), and separating services dealing with sensible information. While doing these changes, there will usualy be a rethinking of how user data is handled at its core. For instance I worked in the past on dissociating user account with it’s profile and private info, so we could get rid of personal info and only keep behaviors. With GDPR you get similar leeway for keeping most of your data as long as you get rid of identifying info in a reasonable manner. If I’m not mistaken backups are also safe up to a point, but I don’t have the details at hand. My main point was that if someone had the occasion to think thoroughly about user data policy and cleaning unwanted traces at leadt once in the past, GDPR was a lot easier than one might think at first.

deleted 9y ago

[deleted]