6 ms·

While Monal is privacy focused, it is also free, open source and run by a single person — me. I simply do not have the resources or the time to jump through the

While Monal is privacy focused, it is also free, open source and run by a single person — me. I simply do not have the resources or the time to jump through the regulatory hoops required by the EU. As a new and small construction company we simply don't have the resources to comply with all the building codes and the related paperwork. I just can't afford to meet all food safety requirements, I just want to provide free meals for homeless people in my spare time. I just built this car from scratch for myself and now they tell me I can not drive it on public roads just because I don't have the time and money to meet the required standards?

noobiemcfoob 8y ago
Your point is clear, but this is internet software all having to comply with the same regulations regardless of actual industry. I'm having to close my small construction company because the FDA passed harsher food safety requirements.
- jacquesm 8y ago
  No, you don't have to close at all. You just need to comply with the law, just like everybody else. You also need to file your taxes, keep the books in order, ensure that you do not pollute the environment, in some cases you need to be licensed in order to be able to practice your trade and so on. Why would this particular regulation suddenly cause you to close your business unless you were doing something really shady?
  - tathougies 8y ago
    Perhaps it costs money to do so, and the company does not have enough working capital + lines of credit to make the payments necessary? I feel like your statement here is basically "you are a business, therefore it is impossible for you to run out of money", which -- superficially -- seems very naive.
    - jacquesm 8y ago
      At that level it doesn't have to cost anything other than your time. And if it's not a business it is a hobby and those cost time (and usually also money). The GDPR is not going to cause any but the weakest businesses to close shop, in fact if the GDPR causes a business to close (which I highly doubt other than people voluntarily throwing in the towel because they can't be bothered) then I am not sure if I'm going to shed tears over that because it likely means that that business was so weak already that other things besides GDPR compliance were suffering as well (such as security).
      - tathougies 8y ago
        The comment I responded to cited environmental regulation. These are oftentimes costly to implement. All regulation costs money to implement. Even if each regulation by itself is cheap, these things add up -- it's death by a thousand cuts.
        jacquesm 8y ago
        > These are oftentimes costly to implement. Yes, but then again: if you don't implement them society as a whole will end up holding the bag. Polluter pays is a very good principle. > All regulation costs money to implement. Yes. But that's called the cost of doing business. And most software based businesses have insane margins anyway because of their ability to scale. > Even if each regulation by itself is cheap, these things add up -- it's death by a thousand cuts. That's one way of looking at it. Another way of looking at it is that it levels the playing field between those that ride roughshot over their users rights and those that try to be nice.
        tathougies 8y ago
        I'm not sure what it is you are arguing about. I am in 100% agreement that regulation is necessary for a functioning society. However, the natural result of introducing new regulation is that some businesses will choose to leave the market. This is the cost of doing business. If a society can bear the loss of the business from the market, then things are good. That's about all there is to it. > Another way of looking at it is that it levels the playing field between those that ride roughshot over their users rights and those that try to be nice. Neither of those viewpoints are in opposition. You can both believe that more regulation kills some businesses through a 'death by a thousand cuts' and that these regulations level the playing field.
  - deleted 8y ago
    [deleted]
  - deleted 8y ago
    [deleted]
- danbruc 8y ago
  If you abstract away the industry specific details of my examples, you are not supposed to physically endanger, harm or kill people regardless of the actual industry. So I would say it is exactly the same but instead of physical harm we are talking about harming peoples' privacy. Maybe one could argue that there is something to be gained by differentiating the rules based on the industry but, at least to me, it is not obvious that the result would be better and not just more complex. Also there are already rules and laws for specific industries and how they have to handle personal information, think for example medical or financial data.
- davidgould 8y ago
  > I'm having to close my small construction company because the FDA passed harsher food safety requirements. Is your creative reuse scheme for sawdust and broken drywall bits no longer allowed?
fcbrooklyn 8y ago
Your first two examples are cute, but your third has the unfortunate side effect of undercutting your argument. A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights). There's a crazy subculture around building bikes that would never in a million years pass muster as production vehicles. (let's drop a chevy small block into a harley).
- bkor 8y ago
  > A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US Such a car cannot be driven on the road within The Netherlands without it being validated as safe (plus some other inspections). For US, same seems to apply. Per https://www.dmv.org/car-registration.php https://www.dmv.org/car-registration.php it mentions: "Pass a vehicle safety inspection.". So again you need to deal with paperwork and read what those safety regulations are.
  - fcbrooklyn 8y ago
    Yeah, for "specially constructed vehicles" that safety inspection is extremely minimal. For a production vehicle, the requirements are much more extreme, and cost millions to comply with.
  - nathanaldensr 8y ago
    Some rules are decided by state. For example, Idaho has no vehicle inspection process, just registration (i.e., paying a fee and getting a license plate and license plate sticker). FWIW, dmv.org is not an official government site.
  - kevin_thibedeau 8y ago
    Dmv.org is not associated with any government body. Its advice should be taken with a grain of salt as such matters are not uniform across the US. Moreover their state specific info is often a paraphrased summary that only represents best practices and not the full scope of the applicable law.
- 8y ago
rwcarlsen 8y ago
No need to be snarky - you do have a good point that can stand on its own. However the issue is not black and white. And just because you think the GDPR is a step forward, some people disagree. Even the Monal guy might agree with you - he just doesn't think it is worth it. And why wouldn't we expect strictly enforced food safety regulations to prevent meals being shared? It might be worth it, but it doesn't mean there won't be collateral damage.
- danbruc 8y ago
  My comment is not intended to be snarky. I am aware that it sounds otherwise and I thought about adding a few more sentences to counter that, but there is just not much I have to add, it would just make the comment longer. So I decided to keep it short even if it might sound a bit snarky hoping that everybody is able to infer that I wanted to say that this is not some unique burden thrown at software developers but that we were some kind of exception not having to deal with that much regulation as other industries.
dageshi 8y ago
He is meeting the required standards... by not having an EU users. In doing that he's as equally compliant as any company who has jumped through the various GDPR hoops.
- jacquesm 8y ago
  And has made his business that much less viable, and opened himself up to competition from a company with a comparable product that does comply with the law. And maybe one day the USA will pass some privacy legislation...
  - dageshi 8y ago
    I'm not actually sure he is running this as a business? It seems open source? He even suggests people download and build their own? So all he's done is save himself the time and effort of dealing with the GDPR and cost himself nothing.
    - jacquesm 8y ago
      The fact that it is open source does not mean it isn't a business. And yes, he has saved himself the time and the effort of dealing with the GDPR, has also managed to position himself as someone who pays lipservice to privacy but who does not care to actually be compliant with privacy legislation when it matters. I wouldn't want my data in his hands after that anyway (not that that would ever happen because I don't have a smartphone in the first place).
      - enedil 8y ago
        From my POV, he definitely positioned himself as someone that doesn't give a damn about user privacy
        orangecat 8y ago
        That's ridiculous, and the same non-logic as "anyone who declines to let the police search their home without a warrant is trying to hide something illegal". In both cases there is no upside and a chance of a large downside, even when you're completely innocent.
zerostar07 8y ago
the laws you refer to preexisted. Did they tear down all the houses that don't comply with contemporary building standards? I dont think so. GDPR is enforced retroactively on everything since the beginning of the internet.
- kuschku 8y ago
  > Did they tear down all the houses that don't comply with contemporary building standards? No, they fined everyone that owns homes commercially that did not upgrade the homes to comply. And then fined them again. And again, until they complied.
  - fiter 8y ago
    For what it's worth, this is not generally done in the US.
  - zerostar07 8y ago
    Where did that happen? There were earthquakes recently in Italy that tore down super-dangerous but not illegal houses. In fact the construction sector is a very bad example here, because old buildings are usually covered by separate regulations , thats not true for software.
    - kuschku 8y ago
      In Germany for example with the new environmental regulations. Everyone selling their house, renting it out, etc had to comply.
- bkor 8y ago
  > GDPR is enforced retroactively on everything since the beginning of the internet. That is not allowed. GDPR is only enforced for things which do not comply after in goes into effect. Further, it's not specific to the internet.
  - zerostar07 8y ago
paulddraper 8y ago
Building codes vary vastly in quality. Some prevent loss of life. Some are pointless or even harmful to society. HN complains constantly about insufficiently dense housing....a situation caused by none other than building codes. When possible, build in places with good codes, not bad ones.
dominotw 8y ago
Why not compare it with heart surgery while you are at it.
emidln 8y ago
I made this software program that listens on a port on my computer, located in Springfield, IL, USA. I allow other people to connect to this program over the internet, which terminates at a connection I pay Comcast to provide me. I log their IP addresses (on my server that I own which resides in the United States) because I'm curious where my users are coming from. Someone from Europe is claiming that I owe them some of "their" data (which they seem to think is stored on my storage that they never bothered renting from me) or I might have to pay 20 million euros. I tell those users and their government, neither of whom I owe anything, to kindly piss off and then ban all ip addresses from the EU. To put it another way, I go to Central Park and start to juggle. I don't charge people, I just juggle because I like to juggle. Some people watch; others simply ignore me. I write observations about a couple of the people who watched me perform in my journal. One of those guys was from France. He later looks me up in a phone book and calls me to demand I give him any observations I wrote in my journal. I tell this fellow to piss off. A few months later I get a letter saying I need to pay 20 million euros because I wouldn't give away my personal observations stemming from something I did publicly and for free.
- danbruc 8y ago
  You have to respect the privacy of people in the same way you have to respect their lives. You can not harm or kill random people, you can not do arbitrary things with information about them.
  - ryanwaggoner 8y ago
    It’s alarming that you don’t realize how insane this argument is. Now murder and keeping notes about someone you see in public are the same? You’re headed towards thought-crime with this; it’s basically murder to continue to hold an opinion of someone that they disapprove of, because “privacy”. Ridiculous.
    - danbruc 8y ago
      Of course they are not the same but they share a common principle, i.e. you can not do arbitrary things involving other people. And nobody is talking about your opinions, you are free to think whatever you want, just as you are free to harm yourself or even commit suicide. But if your »thinking« involves information about other people, there are limits just as there are limits if you go from killing you to killing others. If something is ridiculous, then the way you twisted what I said.
deleted 8y ago
[deleted]
closeparen 8y ago
If you see nothing wrong with moving websites into the category of buildings, aircraft, medical devices, etc... what are you doing on HN? The entire ethos of this community is free and casual, sometimes entrepreneurial experimentation with networked software. It may be necessary to end that for the greater good, but that’s not something to take lightly. US law has surprising respect for the hacker ethos, so that even in highly regulated activities, there is a much less rigorous licensing regime for small-scale practitioners. . Experimental aircraft certificates, private pilot licensing, amateur radio licensing, etc. You can build yourself a car, cook food for a party, etc. without being subject to the laws about those activities under corporate mass manufacture.
emilfihlman 8y ago
This is not even remotely in the same realm.
phyzome 8y ago
In many jurisdictions in the US, you can give away free home-cooked meals to homeless people without the requirement for a certified kitchen. Some of my friends fought for the right to do so in Connecticut with Food Not Bombs, in fact.
PurpleBoxDragon 8y ago
I built a small shed in my backyard. I didn't follow any building codes. I cooked a meal at home, I didn't follow any food safety standards. I build a gokart from scratch and ride it around my own property. Should any of these be banned? Now if I tell my friend, 'Hey, you can store stuff in my shed/grab a plate of food/take the gokart for a spin', should any of it be banned?
- e_proxus 8y ago
  I think you'll find recording a video of your neighbors from your home without their permission will be seen as quite different from your other examples by most people.

noobiemcfoob 8y ago

Your point is clear, but this is internet software all having to comply with the same regulations regardless of actual industry. I'm having to close my small construction company because the FDA passed harsher food safety requirements.

jacquesm 8y ago
No, you don't have to close at all. You just need to comply with the law, just like everybody else. You also need to file your taxes, keep the books in order, ensure that you do not pollute the environment, in some cases you need to be licensed in order to be able to practice your trade and so on. Why would this particular regulation suddenly cause you to close your business unless you were doing something really shady?
- tathougies 8y ago
  Perhaps it costs money to do so, and the company does not have enough working capital + lines of credit to make the payments necessary? I feel like your statement here is basically "you are a business, therefore it is impossible for you to run out of money", which -- superficially -- seems very naive.
  - jacquesm 8y ago
    At that level it doesn't have to cost anything other than your time. And if it's not a business it is a hobby and those cost time (and usually also money). The GDPR is not going to cause any but the weakest businesses to close shop, in fact if the GDPR causes a business to close (which I highly doubt other than people voluntarily throwing in the towel because they can't be bothered) then I am not sure if I'm going to shed tears over that because it likely means that that business was so weak already that other things besides GDPR compliance were suffering as well (such as security).
    - tathougies 8y ago
      The comment I responded to cited environmental regulation. These are oftentimes costly to implement. All regulation costs money to implement. Even if each regulation by itself is cheap, these things add up -- it's death by a thousand cuts.
      - jacquesm 8y ago
        > These are oftentimes costly to implement. Yes, but then again: if you don't implement them society as a whole will end up holding the bag. Polluter pays is a very good principle. > All regulation costs money to implement. Yes. But that's called the cost of doing business. And most software based businesses have insane margins anyway because of their ability to scale. > Even if each regulation by itself is cheap, these things add up -- it's death by a thousand cuts. That's one way of looking at it. Another way of looking at it is that it levels the playing field between those that ride roughshot over their users rights and those that try to be nice.
        tathougies 8y ago
        I'm not sure what it is you are arguing about. I am in 100% agreement that regulation is necessary for a functioning society. However, the natural result of introducing new regulation is that some businesses will choose to leave the market. This is the cost of doing business. If a society can bear the loss of the business from the market, then things are good. That's about all there is to it. > Another way of looking at it is that it levels the playing field between those that ride roughshot over their users rights and those that try to be nice. Neither of those viewpoints are in opposition. You can both believe that more regulation kills some businesses through a 'death by a thousand cuts' and that these regulations level the playing field.
- deleted 8y ago
  [deleted]
- deleted 8y ago
  [deleted]
danbruc 8y ago
If you abstract away the industry specific details of my examples, you are not supposed to physically endanger, harm or kill people regardless of the actual industry. So I would say it is exactly the same but instead of physical harm we are talking about harming peoples' privacy. Maybe one could argue that there is something to be gained by differentiating the rules based on the industry but, at least to me, it is not obvious that the result would be better and not just more complex. Also there are already rules and laws for specific industries and how they have to handle personal information, think for example medical or financial data.
davidgould 8y ago
> I'm having to close my small construction company because the FDA passed harsher food safety requirements. Is your creative reuse scheme for sawdust and broken drywall bits no longer allowed?

fcbrooklyn 8y ago

Your first two examples are cute, but your third has the unfortunate side effect of undercutting your argument. A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights). There's a crazy subculture around building bikes that would never in a million years pass muster as production vehicles. (let's drop a chevy small block into a harley).

bkor 8y ago
> A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US Such a car cannot be driven on the road within The Netherlands without it being validated as safe (plus some other inspections). For US, same seems to apply. Per https://www.dmv.org/car-registration.php https://www.dmv.org/car-registration.php it mentions: "Pass a vehicle safety inspection.". So again you need to deal with paperwork and read what those safety regulations are.
- fcbrooklyn 8y ago
  Yeah, for "specially constructed vehicles" that safety inspection is extremely minimal. For a production vehicle, the requirements are much more extreme, and cost millions to comply with.
- nathanaldensr 8y ago
  Some rules are decided by state. For example, Idaho has no vehicle inspection process, just registration (i.e., paying a fee and getting a license plate and license plate sticker). FWIW, dmv.org is not an official government site.
- kevin_thibedeau 8y ago
  Dmv.org is not associated with any government body. Its advice should be taken with a grain of salt as such matters are not uniform across the US. Moreover their state specific info is often a paraphrased summary that only represents best practices and not the full scope of the applicable law.
8y ago

rwcarlsen 8y ago

No need to be snarky - you do have a good point that can stand on its own. However the issue is not black and white. And just because you think the GDPR is a step forward, some people disagree. Even the Monal guy might agree with you - he just doesn't think it is worth it. And why wouldn't we expect strictly enforced food safety regulations to prevent meals being shared? It might be worth it, but it doesn't mean there won't be collateral damage.

danbruc 8y ago
My comment is not intended to be snarky. I am aware that it sounds otherwise and I thought about adding a few more sentences to counter that, but there is just not much I have to add, it would just make the comment longer. So I decided to keep it short even if it might sound a bit snarky hoping that everybody is able to infer that I wanted to say that this is not some unique burden thrown at software developers but that we were some kind of exception not having to deal with that much regulation as other industries.

dageshi 8y ago

He is meeting the required standards... by not having an EU users. In doing that he's as equally compliant as any company who has jumped through the various GDPR hoops.

jacquesm 8y ago
And has made his business that much less viable, and opened himself up to competition from a company with a comparable product that does comply with the law. And maybe one day the USA will pass some privacy legislation...
- dageshi 8y ago
  I'm not actually sure he is running this as a business? It seems open source? He even suggests people download and build their own? So all he's done is save himself the time and effort of dealing with the GDPR and cost himself nothing.
  - jacquesm 8y ago
    The fact that it is open source does not mean it isn't a business. And yes, he has saved himself the time and the effort of dealing with the GDPR, has also managed to position himself as someone who pays lipservice to privacy but who does not care to actually be compliant with privacy legislation when it matters. I wouldn't want my data in his hands after that anyway (not that that would ever happen because I don't have a smartphone in the first place).
    - enedil 8y ago
      From my POV, he definitely positioned himself as someone that doesn't give a damn about user privacy
      - orangecat 8y ago
        That's ridiculous, and the same non-logic as "anyone who declines to let the police search their home without a warrant is trying to hide something illegal". In both cases there is no upside and a chance of a large downside, even when you're completely innocent.

zerostar07 8y ago

the laws you refer to preexisted. Did they tear down all the houses that don't comply with contemporary building standards? I dont think so. GDPR is enforced retroactively on everything since the beginning of the internet.

kuschku 8y ago
> Did they tear down all the houses that don't comply with contemporary building standards? No, they fined everyone that owns homes commercially that did not upgrade the homes to comply. And then fined them again. And again, until they complied.
- fiter 8y ago
  For what it's worth, this is not generally done in the US.
- zerostar07 8y ago
  Where did that happen? There were earthquakes recently in Italy that tore down super-dangerous but not illegal houses. In fact the construction sector is a very bad example here, because old buildings are usually covered by separate regulations , thats not true for software.
  - kuschku 8y ago
    In Germany for example with the new environmental regulations. Everyone selling their house, renting it out, etc had to comply.
bkor 8y ago
> GDPR is enforced retroactively on everything since the beginning of the internet. That is not allowed. GDPR is only enforced for things which do not comply after in goes into effect. Further, it's not specific to the internet.
- zerostar07 8y ago

paulddraper 8y ago

Building codes vary vastly in quality. Some prevent loss of life. Some are pointless or even harmful to society. HN complains constantly about insufficiently dense housing....a situation caused by none other than building codes. When possible, build in places with good codes, not bad ones.

dominotw 8y ago

Why not compare it with heart surgery while you are at it.

emidln 8y ago

I made this software program that listens on a port on my computer, located in Springfield, IL, USA. I allow other people to connect to this program over the internet, which terminates at a connection I pay Comcast to provide me. I log their IP addresses (on my server that I own which resides in the United States) because I'm curious where my users are coming from. Someone from Europe is claiming that I owe them some of "their" data (which they seem to think is stored on my storage that they never bothered renting from me) or I might have to pay 20 million euros. I tell those users and their government, neither of whom I owe anything, to kindly piss off and then ban all ip addresses from the EU. To put it another way, I go to Central Park and start to juggle. I don't charge people, I just juggle because I like to juggle. Some people watch; others simply ignore me. I write observations about a couple of the people who watched me perform in my journal. One of those guys was from France. He later looks me up in a phone book and calls me to demand I give him any observations I wrote in my journal. I tell this fellow to piss off. A few months later I get a letter saying I need to pay 20 million euros because I wouldn't give away my personal observations stemming from something I did publicly and for free.

danbruc 8y ago
You have to respect the privacy of people in the same way you have to respect their lives. You can not harm or kill random people, you can not do arbitrary things with information about them.
- ryanwaggoner 8y ago
  It’s alarming that you don’t realize how insane this argument is. Now murder and keeping notes about someone you see in public are the same? You’re headed towards thought-crime with this; it’s basically murder to continue to hold an opinion of someone that they disapprove of, because “privacy”. Ridiculous.
  - danbruc 8y ago
    Of course they are not the same but they share a common principle, i.e. you can not do arbitrary things involving other people. And nobody is talking about your opinions, you are free to think whatever you want, just as you are free to harm yourself or even commit suicide. But if your »thinking« involves information about other people, there are limits just as there are limits if you go from killing you to killing others. If something is ridiculous, then the way you twisted what I said.

deleted 8y ago

[deleted]

closeparen 8y ago

If you see nothing wrong with moving websites into the category of buildings, aircraft, medical devices, etc... what are you doing on HN? The entire ethos of this community is free and casual, sometimes entrepreneurial experimentation with networked software. It may be necessary to end that for the greater good, but that’s not something to take lightly. US law has surprising respect for the hacker ethos, so that even in highly regulated activities, there is a much less rigorous licensing regime for small-scale practitioners. . Experimental aircraft certificates, private pilot licensing, amateur radio licensing, etc. You can build yourself a car, cook food for a party, etc. without being subject to the laws about those activities under corporate mass manufacture.

emilfihlman 8y ago

This is not even remotely in the same realm.

phyzome 8y ago

In many jurisdictions in the US, you can give away free home-cooked meals to homeless people without the requirement for a certified kitchen. Some of my friends fought for the right to do so in Connecticut with Food Not Bombs, in fact.

PurpleBoxDragon 8y ago

I built a small shed in my backyard. I didn't follow any building codes. I cooked a meal at home, I didn't follow any food safety standards. I build a gokart from scratch and ride it around my own property. Should any of these be banned? Now if I tell my friend, 'Hey, you can store stuff in my shed/grab a plate of food/take the gokart for a spin', should any of it be banned?

e_proxus 8y ago
I think you'll find recording a video of your neighbors from your home without their permission will be seen as quite different from your other examples by most people.