7 ms·

Good. if you do not value my privacy, I dont want you to do business here. another product will replace your own. And in all likeness an EU one, meaning less eu

• ryanwaggoner 8y ago
  if you do not value my privacy False equivalence. You can do nothing untoward with user data and still not be compliant.
  • jimmaswell 8y ago
    Exactly. The most basic/outrageous example: anyone in the EU who installs Apache and leaves it in its default configuration which logs all page visits indefinitely is now a criminal. Spin up a DO/Linode/etc. instance and apt-get install apache2? You're now theoretically liable for a 20 million Euro fine.
    • openIce 8y ago
      This is the most retarded comment I have read today. Literally everything you say is false
      • jimmaswell 8y ago
        Are you disputing that GDPR disallows you from retaining visitor IPs, especially without explicit consent?
        • DanBC 8y ago
          Consent is one basis for gathering personal information. It's only one, there are five others. Consent isn't always needed. The fine for this would not be €20m either.
        • ascorbic 8y ago
          Yes. It's fine to retain IP addresses for a reasonable amount of time if you have a good reason to keep them, such as security. Just rotate them as usual, and don't keep them longer than you need.
      • Sargos 8y ago
        You might want to actually read the GDPR. IP addresses are PII.
      • dang 8y ago
        We ban accounts that post like this. Please post civilly and substantively, or not at all. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    • ryanwaggoner 8y ago
      Oh, it's much worse than that :) Do the same, but from any country in the world, and make sure your welcome page has multiple languages, including some EU ones. Now you're specifically targeting EU users and you're liable for up to $20 million euros. The response from GDPR fans is that: a) regulators would never levy such a fine, or b) they can't enforce it, or even c) that of course you should be fined because you're a filthy scammer who is stealing people's data and violating their human rights! But all that misses the point: in what universe is it reasonable to even make such a claim to begin with? And why should I have to trust that the regulators will be more reasonable than the law requires, or that they won't be able to enforce what they'd like to do? And why should I have to comply because you sent me your info voluntarily?? Is there something that makes the internet different here? If someone in the EU puts some personal info in an envelope and mails it to me and I never get around to opening it and it just sits on a stack with other junk mail, am I now violating their human rights by keeping the info they voluntarily sent to me?
      • jimmaswell 8y ago
        > If someone in the EU puts some personal info in an envelope and mails it to me and I never get around to opening it and it just sits on a stack with other junk mail, am I now violating their human rights by keeping the info they voluntarily sent to me? Everyone I've tried to make this point to has ultimately said something to the effect of "yes, you're violating their rights by not throwing out the letter." It's baffling.
    • malka 8y ago
      Your point is that apache default config is horrendous regarding log keeping policy ? I agree.
      • jimmaswell 8y ago
        Nobody would have said this a year ago. How are people getting so swept up in this privacy zeitgeist that they think web admins keeping logs is horrendous?
        • Spivak 8y ago
          At my company doing this would be in complete violation of our data retention policy (not GPDR related). Where are companies running production services without handling logging of sensitive information? Regulation or not that kind of data is a huge liability for our legal department.
      • ryanwaggoner 8y ago
        I know! Just imagine...your (likely dynamic) IP address exists in forgotten log files all over the web. The horror! One of the most annoying things about the GDPR fandom is the black and white nature it seems to inevitably take. If your log files store IP addresses, you're clearly evil and shady and are violating human rights, just as bad as if you're recording people's conversations at home with the intent to deprive them of insurance or publish their sexual histories or whatever. What possible "horrendous" harm is there from apache's default config storing IP addresses? Can you give me an actual harm that has befallen someone as a result of this that isn't some freak one-in-a-billion example?
        • malka 8y ago
          you can log ip adresses. keeping them forever is bad. It means that any future government, no matter how evil it is, could query your log and know precisely what I am doing on the internet right now. I might not want that.
  • majewsky 8y ago
    How so?
• zmmmmm 8y ago
  > another product will replace your own That's optimistic ... but there is no reason to believe in many niche areas that another equally good product will do that. It is very plausible that in fact what will happen is that EU customers will be significantly delayed in accessing valuable services and products. And in many cases the web sites provide those would be making no meaningful intrusion on privacy in the first place.