29 ms·

I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here

• Barrin92 8y ago
  Tired of the eternal startup excuse to justify bad behaviour when it comes to protection of consumer privacy. If it is impossible for some startups to respect strong privacy practices maybe we simply don't need those startups. This 'startupism' is almost an ideology. No mechanical engineer would complain about safety regulation just because it means that they cannot start a business in their garage. In other industries, strong safety standards and regards for customer privacy is simply the norm, not an annoyance.
  • manigandham 8y ago
    Also tired of people thinking that a company not wanting a rule means they were intending to do the exact the opposite of that rule, especially given said rule is incredibly vague and designed to be applied "on principle". Fortunately for all of us, safety regulation is actually very specific in requirements.
    • mintplant 8y ago
      Upthread we have the claim that "most early-stage startups use the... best practice of 'delete=1'," pretending to delete user data while actually retaining it. So, the exact opposite of the rule.
      • manigandham 8y ago
        Yes, and many things will remain that way with GDPR because of necessity (ie: old invoices and transactions will continue to have your details). Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them. But do let me know when GDPR actually does anything to deal with ISPs, credit unions, medical companies, and plenty of other institutions that have breaches all the time and have endured roughly $0 in penalties.
        • lathiat 8y ago
          > Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them. lol
          • manigandham 8y ago
            So you work for a big company like Canonical. Glad to know you guys always get it right: http://www.wired.co.uk/article/canonical-warns-2m-users-of-personal-data-breach http://www.wired.co.uk/article/canonical-warns-2m-users-of-p... https://arstechnica.com/information-technology/2013/07/hack-exposes-e-mail-addresses-password-data-for-2-million-ubuntu-forum-users/ https://arstechnica.com/information-technology/2013/07/hack-...
• admax88q 8y ago
  > Most early-stage startup use the best practice of “delete=1” Honestly that's a bad best practice if the data your collecting is sensitive, which PII is.
  • ars 8y ago
    It's not so easy. Someone buys a book. Transaction is recorded, and now we know total book sales. Someone says "delete me and my purchases", so you do, and oops - total book sales are now wrong. There's ways around it, obviously. But they are not easy. Much easier to just mark as deleted. Another example: Threaded conversation - someone deletes their post, and oops all the replies are now orphaned.
    • 4ndrewl 8y ago
      More GDPR strawmen. If a user requests deletion, assign anyYassociated entities (eg purchases, conversations etc) to an anonymous user. Or, keep the original user record and just blank all of the fields. You've had two years to think about these problems.
      • inferiorhuman 8y ago
        > It’s only a strawman if you assume that everybody knows the right way to do everything. There was nobody around when I did my start up to tell me how to do all of this stuff. lol Edit: Love (and expected) the downvotes. Where's that innovative entrepreneurial spirit? Part of creating a business is figuring out how to do things that won't get you sued into oblivion.
        • pjscott 8y ago
          > Part of creating a business is figuring out how to do things that won't get you sued into oblivion. The harder that gets, the fewer businesses there will be. If you look at businesses that managed to exist, sure, you'll see stories of how they used their "innovative entrepreneurial spirit" to triumph over every obstacle. Hurrah! What you won't see are the companies that just barely weren't able to exist, the ones that didn't quite make it through every hoop -- and it is this unseen cost that should keep every regulator up at night.
• FridgeSeal 8y ago
  > Most early-stage startup use the best practice of “delete=1” Who are you people who can’t/won’t actually delete something from your db’s?
  • spookthesunset 8y ago
    What if the contents of that DB get pre-rendered to disk or memory for caching (eg: prerendering a bunch of HTML)? Do you blow those away? Which ones? What if it turns out to be a substantial number of cache records you need to blow away? Whats gonna be the performance impact of that? I agree with the OP. People who assume this shit is easy haven't really thought about the problem much at all. There is a lot of data stored out there in ways that wasn't really designed to be mutable.
    • Thiez 8y ago
      You have 30 days to comply, so if you regenerate those cached pages regularly (e.g. once every 3 weeks) you're fine.
  • bmelton 8y ago
    DBs, memcaches, tape backups, offsite storage, log files, etc. Past that, deleting things from databases is sometimes hard. If, for example, I delete userX, and userX was the founder of a number of forums, or chat rooms, or groups, or facebook pages that are linked to userX? Do those groups and forums and things count as 'belonging' to userX? If userX happened to be the guy who created /r/news, do we delete that subreddit, and all of the content therein? What if userX was a paying member? Do you delete all his old invoices? How do you make sure that doing so still allows you to balance your books? There are indeed real world scenarios wherein just deleting a user and cascading that delete throughout the system breaks things. In some cases, it might be better to replace userX's personal details with 'AnonymousUserX', but then that might leave behind content they've generated, which you then have to replace with "DELETED CONTENT" or some other stub, which causes complications.
    • jeremyt 8y ago
• mc32 8y ago
  Even if you delete it from disk and remove from memory, you may be required to remove it from offline backups too like tapes and other media.
  • 4ndrewl 8y ago
    Not true.
    • mc32 8y ago
      Has that interpretation changed? I recall reading that in some circumstances it could. Or was that misinformation?
      • Silhouette 8y ago
        No-one actually knows. What constitutes erasure and how to deal with all the edge cases around backups, archives, unstructured data and so on is one of the big ambiguities under GDPR, and one of the areas most in need of (but mostly lacking) actionable guidance from official sources.
        • pkaye 8y ago
          I'm surprised with the law being around for 2 years nobody has received the official guidance needed.
          • Silhouette 8y ago
            The law might have been around for 2 years, but in practice many smaller organisations didn't find out about it until a few months ago. Much of the official guidance is more recent even than that. And much of that guidance doesn't really help anyway, because it is often almost as vague and/or incomplete as the original regulations themselves. Questions about numerous everyday issues that will affect literally millions of businesses across the EU are still lacking useful answers.
    • 8y ago
• coderdude 8y ago
  > I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. You're not wrong at all. It first started dawning on me around 5 years ago. Almost no one knows what they're talking about. It's like watching hackers in a major motion picture. Except it's "hackers" on a major news site.
• viraptor 8y ago
  > the requirement that you can permanently delete all of your information. Most early-stage startup use the best practice of “delete=1”. What's your system for dealing with COPPA then? You're required to have a way for permanently removing data of children.
  • guelo 8y ago
    COPA was struck down by the courts last decade.
    • hideo 8y ago
      I think GP meant COPPA, not COPA https://people.apache.org/~jim/NewArchitect/docs/new1013636173/1.htm https://people.apache.org/~jim/NewArchitect/docs/new10136361...
  • amarkov 8y ago
    COPPA only applies to sites that are directed towards children or have "actual knowledge" that they're collecting data from children. It's legally sufficient to ask for birthdays and refuse signups from anyone under 13.
    • viraptor 8y ago
      When you learn that someone lied and they are under 13yo, the rule applies again.
      • amarkov 8y ago
        I'm not aware of any rule or case which supports this claim.
        • viraptor 8y ago
          It doesn't have to be a specific rule. You learn that the age declaration was invalid so the "§312.10 Data retention and deletion requirements" applies unless you have a verifiable parent consent.
• gerdesj 8y ago
  I'm a Brit. I am the MD of a small IT company. I have two partners and 20 employees. We started in 2000. We turn over about £1.5Mpa. We sell our services to people and organisations. Our backups are now smaller these days (thanks to GDPR). I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR. There is no way on earth that the EU as a whole has looked on your company/project or whatever and decided to screw you. Have a look at the first few paras of this: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... after it says "Whereas". Does the language look a little familiar? Do the sentiments look strangely familiar in some way? GDPR is not about destroying people's livelihoods. It is about protecting basic, fundamental rights that say 30 years ago we never knew needed to exist. After all the knee jerk reactions have calmed down a bit, you may find that you personally have benefited in some way from EU regs. If you find that, then I suggest you fight tooth and nail for similar to be enacted at home. I'll be the first to thank you for that.
  • datamingle 8y ago
    How do you handle developer computers with possible client data on them, even semi-anonymized? Or when communicating issues on the live server, you might transfer client information to other stake holders to debug issue. Are you tracking that communication. Where does the communication data reside, perhaps on a server outside of the EU? There is a lot of complications that arise if you think about the second order/third order consequences of the law.
    • gerdesj 8y ago
      I have keyed in and deleted so many efforts at an answer to your question that I have given up and find myself merely asking: "Have you actually read the regs?" http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... My reading of them finds no second/third order anything. The regs are surprisingly clear. I forgot to mention that unless you are trying to abuse EU citizens in some way then you have no problems. A useful side effect of the internet is that deciding whether someone is an EU citizen or not is tricky. That means that most companies have decided to treat all citizens in nearly the same way: For you as a private individual, a foreign power now provides you (indirectly) with way more "rights" than you might have had in the past on the internet. Have a read of the regs, please. The first few paras are a bit "we the people" but then, that is what is required. Then go through the articles. Read them as a person first and then consider them as a company or whatever you do later.
• yzmtf2008 8y ago
  The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before. If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all. To your example, you could easily not switch to a CASCADE, but instead set delete=1 and rewrite every sensitive field with a special value. Doesn’t even require a DB migration. If your attitude to properly handling sensitive information is “it’s too complicated and costly, so we’ll just not handle it and YOLO”, perhaps GDPR is a good reflecting moment for you. [edit:typo, edit:clarification]
  • mbob88 8y ago
    >properly handling sensitive information But the thing is that GDPR affects all PII not just sensitive one so your random small useless app/blog/game/forum that has some personally identifiable but harmless and unimportant data stored is now under the same restrictions like your email or FB data.
    • lox 8y ago
      Like, say, a personality quiz on Facebook?
      • deleted 8y ago
        [deleted]
    • pilsetnieks 8y ago
      > your random small useless app/blog/game/forum that has some personally identifiable but harmless and unimportant data Unimportant like your email address and your one password you're reusing everywhere? Yes, they should know better but that's neither here nor there.
  • txsh 8y ago
    “Move fast and *break things.” Although, GDPR seems to be throwing on the brakes.
• ACow_Adonis 8y ago
  Clearly you have a different definition of entrepreneurs/technical people than I do. Those seems like impositions on people who implement bad practice or work in fields that have morally questionable practices regarding people's data and identification. Many people I know don't engage or work in such industries because of the moral implications of doing so and what people are doing with data. Its not about "just ask your lawyers" or "just call HR". Its about "well don't do dodgy/disrespectful stuff with customer data". And if everyone is doing it or its regarded as "best practice" (as the old joke goes, best practice is just orwellian-speak for average), then that seems like MORE of an arguement why GDPR type activities and policies are required.
  • jeremyt 8y ago
    Again, I was in my early 20s and fresh out of college. I had no idea what I was doing. It’s not that I was trying to cut ethical corners or do things poorly, I just didn’t know what the right way to do things was. Computer science education is often very theoretical and high level and not at all practical . I’ll be the first person to say that I was not the most experienced and or talented programmer in the world, but do we want to prevent such people from starting companies? And secondly, not all PII is the same. We stored names and addresses and phone numbers and websites. Not exactly medical histories or DNA profiles.
    • ryanwaggoner 8y ago
      I think that to the hardcore GDPR fans that you're arguing with, this is like asking if we should let someone who is interested in structural engineering go build a skyscraper and figure it out as they go. Or someone who is interested in medicine start doing brain surgery on people. They don't really agree that all PII is not the same. To them, storing their IP address without permission is a horrific violation of their human rights. It strikes me personally as illogical and paranoid to the point of hysteria. However, that's just me, and at the end of the day, I think there's a cultural divide here as to what constitutes privacy, who owns what data, and what power we should trust the government with.
    • gkya 8y ago
• bcheung 8y ago
  Funny thing is there are also mandatory data retention regulations that say data MUST be maintained for a certain period of time by law. It's getting worse, but it's generally been the case that it's impossible for an individual to bootstrap a company and be 100% compliant with every law and tax regulation. You would never have any time to actually provide a product and service customers. You just do the best you can and as you get bigger you become more complaint.
  • Kim_Bruning 8y ago
    GDPR just says that if you are keeping data, you have to have a good reason for it. If you have to retain certain data for eg tax purposes, then that sounds like a good reason to me.
    • strken 8y ago
      It has 99 articles arranged over 11 chapters. It does not "just [say] that if you are keeping data, you have to have a good reason for it".
      • Kim_Bruning 8y ago
        Ok, sure. How do you interpret Article 6, section 1. Especially subsection f) ? https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
    • manigandham 8y ago
      That's so reductionist as to be useless. What is a "good" reason? Are you a judge that will be presiding over these cases? Things like that are massive holes for litigation and the cause of all these compliance issues in the first place.
      • realusername 8y ago
        Every law will be interpreted according to its spirit, it won't be used like a hammer on anything... It's like HN suddenly discovers how a legal system works..
• elorant 8y ago
  It's no big deal because not everyone in here is in B2C marketplace. I have SaaS services aimed at businesses. I don't give a damn about GDPR. It mostly doesn't affect me. On the other hand as a EU citizen I wholeheartedly welcome it. Sure, it's a draconian law and given time it will get polished but let's just face reality. Online advertising and whatnot has gotten out of hand. You visit any given site and it loads two dozen trackers. Facebook tracks you even if you don't have a profile on them. Google collects shitloads of personal information and none knows what they're doing with it exactly. Back in the days we used to say that the Internet self-regulates. Well guess what, that's not happening anymore. Companies like FB or Google are actually breaking the web as we know it because they exploit our trust. If GDPR means that their business model will break then so be it. I have huge appreciation for Google, and none for FB, but enough is enough. And they're just the low hanging fruits. There are countless other companies out there working in unethical ways. If anyone's business model is to invade user's privacy then fuck off and die. That's not entrepreneurship, that's greed and a total disregard for human rights. And by the way, we're not just professionals. We're also users.
  • gschier 8y ago
    If you store emails or people's names, you need to care. It has nothing to do with the type of business you are.
• dansanuf 8y ago
  Not to mention all the backups of said databases. Imagine sitautions where you’ve got tape backups stored in vaults or places like AWS Glacier. It’s the stuff of ops nightmares.
  • pilsetnieks 8y ago
    Imagine situations where people actually read the regulation and its commentaries. You don't have to delete specific records from every one of your backups; in case of a deletion request, you have to be able to replay that if you restore the backup. Also, have some kind of policy in place for how exactly you're handling your backups and how long you're storing them.
• jv22222 8y ago
  Thank you for saying this, another thing that is ridiculously difficult is to delete specific user from all your backups. This is made even worse if you have multi region backups and cold back ups. Even a one-year-old start up could have literally thousands of database dumps in different places if they followed best practice of triple redundant daily dumps.
  • martimarkov 8y ago
    They also had 2 years to come up with a way to fix all of that and if they haven’t I don’t think it’s ok for them to be holding that information in the first place. GDPR does give a window for you to remove the data. They could delete the information from the backups over a period of time.
  • basilgohar 8y ago
    It sounds to me like this reflects more on the startup's sloppy practices than anything else. Prevalence of this bad practice shouldn't be an excuse for it.
    • hawkice 8y ago
      Regular database backups are a bad practice?
      • gsich 8y ago
        No, read again.
      • gkya 8y ago
        Keeping a backup from a year ago when three backups from yesterday are available, is.
        • hawkice 8y ago
          I mean, I see the general wisdom of what you're saying, but I think older backups are still good practice. I've seen it take almost a week for a data corruption issue to be noticed. Not crazy to think it'd take even longer, sometimes.
• JoshMnem 8y ago
  The transition period will be difficult for some people, but I think that GDPR will probably be good for the world in the long-term. New companies will start building their systems correctly from the beginning, and, ideally, the law won't be too heavily enforced on small companies during the transition period. The next generation of programming tutorials will show people how to build things in privacy-conscious ways. I don't think that blocking Europe with Cloudflare is a good idea. How is blocking Europe going to fix the problem of already having European data in your databases?
  • sunir 8y ago
    Maybe. It is more likely the United States will create the opposite regime. Since all major Internet software firms are American or Chinese it is also possible that the EU May sideline itself.
    • JoshMnem 8y ago
      I think it's more likely that other countries will adopt similar data protection rules (and they should).
      • BRAlNlAC 8y ago
        Why do you think that likely? I don't think it is at all likely, the CIA et. al. like facebook too much.
• deleted 8y ago
  [deleted]
• Spooky23 8y ago
  I get where you’re coming from, but maybe the bar has to be raised. Computing has gotten more capable and software frameworks are exponentially more powerful than they were even 20 years ago when the internet started going bananas. The barrier to entry is so low that anyone with a credit card can setup complex IT environments quickly and collect valuable and sensitive information with no consequence to the principals.
• drb91 8y ago
  What is the fear about startups? If you look at the ones you actually use reliably for a decade, very few would have been stymied by GDPR. To add on to this, for every successful startups there seem to be many mostly replaceable ones. If anything, a reduction in the rate of new startups would indicate that perhaps the market is growing MORE rational, which corroborates the recognition of risk of PII that the GDPR manifests.
  • beauzero 8y ago
    ...or I can just not sell to Europe. Solved.
  • pjscott 8y ago
    For some reason when I read your comment I had a vision of the Reddit founders in the very early days, waking up in the middle of the night to restart the server when it had crashed. Their sanity was very nearly wrecked because they didn't know about the existence of daemon supervisor tools yet. God help them if they'd had to deal with GDPR while still sleep-deprived. Early-stage startups do not, in general, have their shit together. A straw may not break a camel's back, but a camel embryo would have a harder time with it.
• zerostar07 8y ago
  HN has been overrun by MBAs a long time ago
  • lomnakkus 8y ago
    I'm not sure whether you're agreeing or disagreeing with your parent comment, but I'm just tacking this on there because it feels right: I think HN has just hit peak stupidity. The amount of paranoia, misreading, misunderstanding, etc. about the GDPR is just insane (or intentional shilling, but let's not go all tin-foil-hatty prematurely). Nobody who's doing anything even remotely above-board is panicking or anything of the sort. If you weren't already mostly complying with the GDPR (paperwork notwithstanding) your security practices and/or business practices were sloppy and/or dishonest and/or exploitative to begin with. EDIT/Addendum: People who are not in the know are (somewhat understandably) a little bit nervous about "interpretation" and such, but there's a reason there's a "sliding scale" of potential penalties. Regulators don't tend to go for people/companies who are actually trying to do the right thing. They go for the people/companies who are the most egregious violators. (I hope I don't have to explain the reasoning behind this, but do ask if you're confused.)
    • zerostar07 8y ago
      > paperwork notwithstanding thats the main point for me. Some of GDPR is good: right to delete in a reasonable fashion is great. Right to not be personally identified is awesome, but that's much easier to do in the ISP level. Adtech creates problems - that should mean you have to regulate adtech. But GDPR is more about documentation, bureaucracy and Vista-style popups than about how to protect data. You need a lawyer just to put ads on your site. It's a draconian law designed by a single-issue Green leftist, which relegated IP addresses to the status of some kind of fatally dangerous information. It breaks the web from a "web" to a series of tubes with doors in between. The severity of the law is out of proportion with the average internet user's concern about privacy: time and again people have shown they just don't value it as much as the law suggests. After a few days, when the cheerleading has stopped people are going to be faced with some unpleasant realities: small business switching to facebook (because otherwise their website would contain more legalese than content) and ecommerce turning more towards the large marketplaces. In this sense, Facebook, Google and ebay/amazon become one-stop shops for GDPR-compliant solutions. The reason: GDPR removes options but offers no alternatives.
• VeronicaJJ123 8y ago
  You are right. Not to mention this gives a huge advantage to big players like Facebook and Google. They can screw small guys by pointing out violations. EU member countries should consider getting out of this bureaucracy.
• wavegeek 8y ago
  > My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup. A senior executive at a large bank once told me "that's the idea!". Specifically, complex and onerous regulation makes it a lot harder for upstarts and, while costly for large established players, they can bear it.
• pilsetnieks 8y ago
  > We couldn’t afford a lawyer, and the amount of time for me (the only programmer) to go through and read all the regulations and make all the requisite changes in the product I would estimate might take on the order of a month or two, which if timed poorly would’ve killed our company. I say again: at an early stage startup with one programmer, you cannot have that one programmer spending two months on compliance. "We couldn't afford a lawyer and the amount of time for me (the only chef) to go through and read all the regulations and make all the requisite changes in the kitchen I would estimate might take on the order of a month or two, which if timed poorly would’ve killed our restaurant. I say again: at an early stage restaurant with one chef, you cannot have that one chef spending two months on compliance." Would you eat in a place like that?
  • fleitz 8y ago
    Definitely. I’ve eaten at restaurants with out power floating on the river serving fresh crocs, ate right beside the meal. Best donut I ever ate was done up in a metal bowl sitting on a cinder block with a hole chipped into it for the tiger torch. It’s not rocket science to make a meal without killing people.
  • blhack 8y ago
    Yes, in fact I think I have eaten at literally hundreds of places like that all over the world. Also: your equivalency is ridiculous. I have had a "food manager's card", which means that I am certified to oversee an entire restaurant of chefs and cooks who all presumably have their own "food handler's card". The certification took about an hour. Food handler's cards take even less time, and you'll be shocked to know that many people working in restaurants don't actually have them.
  • tomatotomato37 8y ago
    Yes. Shove perishables in a refrigerator/freezer, cook any meat thoughly, slap an allergy poster somewhere, and then allocate 30 minutes a night to cleaning and you're 95% of the way there In contrast there's so much FUD surrounding this bill that you'll end up having to hire a lawyer to figure out how to clear up your EULA without accidentally leaving a loophole for the predatory lawyers on the American side that are partly the reason those EULAs are such a impenetrable wall in the first place
• JohnTHaller 8y ago
  I'm kind of surprised by the number of people surprised that companies are thinking this way: If GDRComplianceCost > EUVisitorProfitMargin Then BlockEUVisitors
• ryandrake 8y ago
  There are literally hundreds of laws, some very large, that tech startups must comply with from day 1. Yet somehow we still have startups and small companies, and the world goes on, round and round. Why no complaints about these other big laws? None of them get the vitriol hurled at them quite like GDPR. I suspect this is because having to comply with big laws is not really the issue. The real issue is that GDPR hits Silicon Valley right in the soft spot where it hurts: Callous and unrestrained collection of user data. Everyone is complaining "I don't want to have to comply with big laws!" but what they are really thinking is "I don't want to get busted for the crazy amount of data we suck up (or want to suck up) and store!"
  • ahje 8y ago
    >There are literally hundreds of laws, some very large, that tech startups must comply with from day 1. > The real issue is that GDPR hits Silicon Valley right in the soft spot where it hurts: Callous and unrestrained collection of user data. I've kept myself to lurking in those threads, simply because there's been so much FUD about this for the last few months. This, however, is spot on and it needs to be pointed out. If people think GDPR is bad, then they should have a look at what it takes for a small startup that want to sell chicken eggs for breeding purposes, especially if you buy/sell across the EU borders. The requirements are quite insane compared to GDPR. :)
• baryphonic 8y ago
  I've been wondering the same thing. Maybe the true hacker spirit is dead. I just want to roll my eyes when I see comments to the effect of, "Oh, it's so simple, just read the 80+ pages! The language is clear and straightforward, we promise! Also, you should have separated duties, full CI/CD that sanitizes any possible user data from leaving its hermetically sealed tier, and delete data early and often. If you don't, you'll be fined several tens of MegaEuros." The risk-reward ratio there is just insurmountably high for a small one- or two-person team. I'm sure there are actually good parts of GDPR, and, hell, for all I know, the whole thing is the overarching achievement of Western civilization. But, unfortunately, reading 80 pages of dry foreign legalese when I'm not a lawyer is somewhere between a waste of time and a very bad idea (e.g. I think the regs are simple, make a mistake, then have huge legal liability). I will sadly be blocking the EU from any services I work on going forward until the point where I'm successful enough that I can actually have my lawyer look over everything.
  • sequoia 8y ago
    "The hacker spirit" was NEVER about harvesting user data so you could sell it to advertisers. Bite your tongue.
    • closeparen 8y ago
      Yes, and? No one claims that it is. It is, however, about iterating quickly on networked software in the absence of heavy bureaucratic process. Process that is now necessary to ensure auditable, provable compliance with the letter of the law, even for activities that are already complaint with its spirit. One can argue this is necessary for society, but it's certainly a crackdown on the hacker spirit. Fun fact: GDPR has not one word to say about advertising in particular. Ad targeting may still be legal in some cases! Meanwhile all networked software is illegal by default unless its operator can prove that it stays within the defined GDPR exceptions.
      • cbfoo 8y ago
        Not about creating broken networking software or broken software in general. Have you been in Usenet in a networking group around 2000. Good luck with these fake opinions. Just because some startup incubator is great at grabbing words from the hacker culture ("ycombinator", "hacker" "news"), does not mean they get to redefine the meaning. They are just greedy, greedy for money and words they can appropriate.
• phyzome 8y ago
  Before GDPR: You had to decide whether you could take the time to do right by your users w.r.t. privacy, because your competitor certainly wasn't. After GDPR: Everyone's required to do it, so at least you don't have to worry about your competitors. That's what this is about: Self-regulation failed. Here's the externally imposed regulation. Be thankful it's as well-written and aligned with our interests as it is!
• rorykoehler 8y ago
  While i agree with your last 2 paragraphs i don't agree with the rest. I have a small team (2 fulltime devs and a designer) and we have no problem achieving GDPR compliance.
  • mdpopescu 8y ago
    SaaS idea: I am a EU citizen and I will test that for every company that sends me a link to their website, by creating an account and then complaining to the Romanian authority that the site doesn't comply with the law. Sarcasm... maybe :)
• fantad 8y ago
  Many industries are already like this. Certainly anything that touches securities laws or payments. Or safety regulations, or government customers. It was once possible to start a bank (Goldman Sachs origins buying receivables), a hedge fund, PayPal, etc etc without heavy compliance costs and infrastructure. Then things change. Though GDPR has a longer history, the US election showed that data-collecting people-connecting internet companies can do even more systematic damage and e.g. permit more foreign election manipulation than any one financial institution. They might not crash an economy but they can crash a democracy. So really the regulation is somewhat deserved and levels the playing field with other industries that have the potential to damage society. Personally I wish two people could start an internet company or a bank or an exchange or an investment fund without deep pockets for compliance and legal. But it’s no more. Mourn it and think about the next sector that is open for growth.
• inopinatus 8y ago
  I'm running a small startup and finding GDPR compliance is small beans compared to the tax code and employment law, both of which we have no trouble complying with.
• gkya 8y ago
  The business culture defined in this post is really freaky, to say the least. You can't point me to one other industry where you can start selling shit w/o "knowing what you're doing". Or if you can't sell your things you lure people in with free stuff and sneakily fuck them up w/o no laws to work around which protect them. Simply and brutally put: if you are incompetent and/or malevolent in your business practices and for that reason your business faces existencial threat from a piece of regulation that codifies the ideal setting for the industry, your business better dies ASAP. I want that just like you can't have a random person design cars, architect buildings or teach our kids, similarly a random person cannot code up a commercial/government web site where they were "learning as I went along"; and an enterprise that can't afford to consult a lawyer can not get their hands on people's private data that they'd rather not change throughout their lives. Entrepreneurs to the hell, the amount of irresponsibility some people posting here want conceded to them is mind-boggling. I really hope that the upcoming decade will bring some sanity to this wild-west of an industry where who don't know what they are fucking doing can't just go out and handle stuff that they should not be allowed to even observe with a telescope from miles and miles away.
  • auganov 8y ago
    This culture has driven innovation of the last 2 decades. You can't point me to one other industry which enjoyed as much success. Of course, Europe couldn't care less - they never had a real startup industry in the first place.
    • lou1306 8y ago
      > This culture has driven innovation of the last 2 decades. So what? Communism turned feudal Russia into a world superpower in less than 2 decades. Do the ends justify the means?
      • auganov 8y ago
        Not making a moral argument. @gkya's comment paints a picture where entrepreneurs unhappy with GDPR are perhaps just a small contingent of incompetent amateurs who shouldn't be doing business in the first place. While I, in agreement with OC/OP, see it as a threat to the entire industry.
• sequoia 8y ago
  I disagree strongly. "...cascade delete is only easy if you’re a very experienced programmer or who knows what he’s [sic] doing." No it's not. Nothing could be easier than foreign key constraints & cascade deletes in a relational database. It's literally "built in." If you're a garage-startup, you're unlikely to be slapped with fines under GDPR. Let's be honest- if you're a garage startup you're lucky to be noticed by anyone, much less European regulators. The argument expressed here is sleight of hand: complaining about the supposed impact on "the little guy" when the regulations themselves are designed to target Facebook & Google (among others) specifically. The regulations are not that complex, they just require a new standard of respect for users, one that we should have always had as an industry. The fact that we had to wait for regulators to force this on us is our shame, no one else's.
  • balfirevic 8y ago
    > If you're a garage-startup, you're unlikely to be slapped with fines under GDPR. Let's be honest- if you're a garage startup you're lucky to be noticed by anyone, much less European regulators. You might be noticed by your competitor, who reports you to the regulator. > The argument expressed here is sleight of hand: complaining about the supposed impact on "the little guy" when the regulations themselves are designed to target Facebook & Google (among others) specifically. No, that is not how they are designed. They might have been motivated by the behavior of Facebook and Google (or not, who knows actually) but they have been designed to target the big and little guys equally. Many GDPR proponents here in comments espouse that as a good thing.
    • philjohn 8y ago
      And if you're flagged to the regulator, what do you think is going to happen? They'll contact you and let you know there's a problem, and you need to fix it - that's it. If you continually flout the regulations after being warned then sanctions will be escalated. Half the world is running around saying "I'm going to be fined 20 million euros!" and it's just fear-mongering.
• MikkoFinell 8y ago
  I'm so so sorry that my right to privacy is inconvenient for you.
• ianamartin 8y ago
  So . . . what we have here is a law that assumes that if you are a good enough engineer to create software that makes money, you are a good enough engineer to comply with the law, given two years' notice. I don't have a problem with that. If the law has a side-effect of people who suck at understanding and organizing and managing data responsibly not starting companies and making money off of data, I'm also okay with that. Maybe the days of two guys starting a company in a garage learning how to handle other people's information before they start a company dependent on it is just beginning. I'm also okay with that. You don't have a right to be incompetent. You don't have a right to be clueless when it comes to databases and information. You especially don't have a right to take advantage of other people who don't understand exactly what it means when they agree to a ToS page. The reason there are so many comments to the effect that this is a non-issue is that it's just not hard to comply unless the business you're running is doing something shady. There is nothing technically difficult about complying with GDPR. If it's hard for you and everyone in your company, I don't know what to say. Hire someone who doesn't suck at this. This is only difficult from a business point of view. Not a technical one.
• Naomarik 8y ago
  As the solo developer/cofounder of a two man business I have absolutely no time to worry about these things. Only a few days ago I've googled GDPR to get a facile understanding of what it is. If at some point I create something that is large enough to matter, I can worry about it then and will have the resources to do so. Until then I'll continue working on software as if it does not exist. It's hard enough to build a profitable product that is valuable to people, don't need to think about any laws handicapping my creativity and design decisions.
  • ianamartin 8y ago
    Welp, have fun with SESTA/FOSTA when you aren't busy having fun with GDPR. I really hope you get noticed by some regulator somewhere. You're not a special snowflake. Your design decisions and creativity don't make you special. You're not an artist, and if you were that wouldn't matter either. If you don't have time to worry about whether your business is legal, I hope your business fails, gets fined, or you and your cofounder go to jail.
• jmcs 8y ago
  The european union provides a FAQ for the GDPR so you don't need a lawyer if you have a small business: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... The "best practice" you mention was already illegal if you have European users, the right to be forgotten was already a consequence of existing laws and directives (just ask Google). As for startups the GDPR already takes company size into account, so unless their business is literally being a private NSA/Stasi/etc. they don't have much burocracy to deal with (https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/do-rules-apply-smes_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...)
• davedx 8y ago
  Technical person here! I was tech lead at an energy company in the Netherlands. We had a compliance dept (mostly 1 person) I worked closely with before GDPR was on the radar as the energy sector here is fairly well regulated. It’s true that compliance can sometimes be scary and requirements are not always clear. Big company ending fines probably keep some people awake at night. The point is regulators don’t generally want to end your company, they want to see (proof of) reasonable efforts towards full compliance. Compliance does take time and effort and can be technically challenging. It can be a constant overhead on regular technical / development efforts. But it also isn’t rocket science. It would help people to not overreact (also, there has been lots of time to prepare for it).
  • jeremyt 8y ago
    Bullshit. Sometimes regulators want to shut down your company. Bureaucrats are not immune from politics.
• kadenshep 8y ago
  >The number of people who are saying it’s no big deal to comply with this huge law It's not if you're actually thinking about what you should be doing with user data from an ethical perspective. Our company has had zero problems complying with GDPR. >My biggest fear is that all of these complex bureaucratic laws Allow me to be extremely blunt here. If you think these laws are complex and if you have to resort to meaningless U.S. connotations of bureaucracy, you shouldn't be handling user data.
• nextlevelwizard 8y ago
  >I was not a great programmer >amount of time for me (the only programmer) well theres your problem. in any other industry you have to have professionals and competent people only in tech can you gobbel together something you can charge for by browsing StackOverflow. it is time that your clowning gets checked and you need to take things seriously. and if deleting data from your database causes "business logic problems" then you are obviously doing shady shit with users data and I am glad this is causing you pain.
• JBSay 8y ago
  Funny how the very people who rail about corporations and Too Big To Fail are the same ones asking for regulations which raise the barrier of entry for small startups and protect large ones from competition.
• TomK32 8y ago
  You have delete as a boolean? My standard (well, Mongoid::Paranoia) is a timestamp and after a reasonable time to cover accidental deletions (like facebook does) a worker job can do the actual deletion.
  • inopinatus 8y ago
    DHH has a video about how this is implemented in Basecamp. https://www.youtube.com/watch?v=AoxoPfilKqE https://www.youtube.com/watch?v=AoxoPfilKqE
    • TomK32 8y ago
      Oh, did the series move to a different channel, I missed that announcement. I only watched upto #5, thanks for reminding me :)
• czardoz 8y ago
  I think businesses should just charge EU customers more for their products, in order to make up for the compliance costs of GDPR. That should make most people happy.
  • hitechnomad 8y ago
    Great! That opens the door for other startups that ARE responsible with people's personal data.
• erkkie 8y ago
  The world is not coming to an end, the sky is not falling. Nothing has to be automatic as far as the deletion requests go. It's fine for you to go through the db manually and grant a specific request within 30 days. If you're big enough to get enough requests to not be able to handle the load, you can afford a couple of days of dev work. It's mind boggling the amount of people who's interpretation of GDPR is overzealous (to the max) based on third party interpretations. Get to the source of it and you might find it's not that bad. You're only in trouble if your business model actually relies on doing things to the data your users would not want you to do (which could be argued is for the better good).
• perlgeek 8y ago
  > Most early-stage startups use the (in 2008, when I did mine) best practice of “delete=1”. Changing your whole database over to permanent cascade delete is only easy if you’re a very experienced programmer or who knows what he’s doing. If you can't handle cascading deletes, continue to set delete=1 and overwrite the other columns with random data / empty strings / whatever. Less risky than implementing cascading deletes, but still effectively gets rid of PII.
• DanBC 8y ago
  > the requirement that you can permanently delete all of your information. Can you point to the bit of GDPR that says I can have all my data permanently deleted?
• coldtea 8y ago
  >I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and/or technical people on here anymore. The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling. You want it to sound like the second phrase is the observation that proves the first, but in my eyes the two sentences are contradicting. You can very well be technical and/or entrepreneur and think it's "no big deal to comply with this huge law". Because, in fact, one of the defining characteristics of being an entrepreneur is taking risk, including the risk to not comply 100% with all BS laws. And one of the defining characteristics of hackers and programmers is thinking they can solve a problem (and often underestimating how long it would take). So your GDPR-related observation would in fact prove the opposite of what you're stating: that there are plenty of entrepreneurs and technical people on HN. Now, if you wanted to say: "there are no conservative, risk adverse entrepreneurs, and by-the -book corporate software engineers in HN anymore", then yes, that would be something that your GDPR related observation would support. P.S Note that I'm not making an argument either way. There might be many or few entrepreneurs and technical people on HN. I'm just saying that if the latter is the case, it's not at all supported by your observation re: GDPR.
• Havoc 8y ago
  The fact that it is such a big problem for so many companies just demonstrates how badly things have been handled thus far. I'm sitting through tons of GDPR meetings & there are quite a few conclusions amounting to "maybe we shouldn't have stored the data that way".
• delinka 8y ago
  I'm in the US and I can't agree with this sentiment. 1) Don't collect more information than is necessary to provide service. Why do you need to care about someone's physical address? "Shipping physical product" is a good answer. Why do you need to maintain historical usage data? "Providing user the ability to view their own usage history" seem acceptable. If any of your answers involve "Just in case", "because marketing said so", or "I don't know", then your plan smells. If you think you need to make money selling my data, think again: maybe you should be charging me enough to cover your costs and make a profit; or if you already are doing that and you still want to sell my data, the you should just stop being greedy. 2) Allow the user to fix incorrect data. I mean, you wrote it to a database at one point in time, you can issue UPDATEs to allow the user to edit information. 3) Remove data when it's no longer needed (e.g. when it's out of date, or when a user says "I'm outta here") If you can't be arsed to figure out how to properly delete data from your database, or hire someone who knows how, then I suggest you're not really dedicated to the business of creating software of value to customers. 4) Provide all of a user's data to that user. It's right there in your systems, and your software is accessing it to make decisions, provide service, etc. How hard can it be to put it all into some CSV files to download? You don't have to copy the users rows from your MySQL tables into a SQLite database that the user can download. Some files with basic explanation of content will suffice. Yep, it raises the bar on what's "bare minimum" to get your company going. But keep in mind this is more 'line of business' than all the other requirements foisted on you by the law: things like corporate structure, taxes, occupancy permits, etc. VC firms pair your technical ability with another founder who, presumably, has more of a business bent. That person should understand how to set your business up and how it's regulated - and if not, know where to find answers. You sound to me like all the GOP whiners about how "regulations hurt business" who fail to see that lack of regulations hurts consumers.
• madez 8y ago
  I think it's mind boggling how you equate startup with abusing user data without users consent. Is that really the only way you think someone can make a business and earn money?
• baby 8y ago
  > Most early-stage startups use the (in 2008, when I did mine) best practice of “delete=1”. Changing your whole database over to permanent cascade delete is only easy if you’re a very experienced programmer or who knows what he’s doing. HAHAHAHAHAHAHAHAHAHAHAHAHAHAAHA How did you get upvoted so much
  • matwood 8y ago
    I assume it is your tone getting you down voted, but the message is true. If a cascading delete is too hard for someone building the tech at a startup, it's no wonder emails and passwords are leaked every single day.
  • dang 8y ago
    Please don't do this here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
• jcadam 8y ago
  Yep. Doing a one person startup (in the US) I absolutely do not have time (or money) to mess around trying to figure out GPDR compliance. I'm not selling data to anyone, and I'm not collecting anything beyond an email address during sign-ups at this point, in any case. If a user decides they want to store PII or other sensitive data on my system, I can't stop them, but I'm not going to go combing through their data in order to sell it either. Most likely I'm just going to have to avoid doing business with Europe for the time being. A quick read of some of the provisions of GPDR immediately brought to mind this passage from Atlas Shrugged: > “Did you really think we want those laws observed?" said Dr. Ferris. "We want them to be broken. You'd better get it straight that it's not a bunch of boy scouts you're up against... We're after power and we mean it... There's no way to rule innocent men. The only power any government has is the power to crack down on criminals. Well, when there aren't enough criminals one makes them. One declares so many things to be a crime that it becomes impossible for men to live without breaking laws. Who wants a nation of law-abiding citizens? What's there in that for anyone? But just pass the kind of laws that can neither be observed nor enforced or objectively interpreted – and you create a nation of law-breakers – and then you cash in on guilt. Now that's the system, Mr. Reardon, that's the game, and once you understand it, you'll be much easier to deal with.”
  • Moter8 8y ago
    Sounds like you wouldn't have to change anything then. Make extra personal data stuff opt-in, rest should be the same as usual.
    • coreyoconnor 8y ago
      Incorrect: Even a single person company described above will still need to handle GPDR requests. The operational requirements is not 0 even for a company retaining no unnecessary records.
• geocar 8y ago
  > Let’s just take one feature: the requirement that you can permanently delete all of your information. Let's take that feature because it's mentioned often, but it doesn't exist. Read Article 17* carefully yourself. It doesn't say "permanent". It never even says the word "delete". Elementary, My Dear Watson. * https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ > at an early stage startup with one programmer, you cannot have that one programmer spending two months on compliance. And then here's the other straw man. An early stage startup in the US with one programmer has more to worry about from US regulation than European regulation. Nonetheless, if you want to trade with Europe then reading the ICO guidance on the GDPR for your business should take a couple of hours. > My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup. There are so many things I care about more than whether you can create a startup with wilful disregard for people's rights. Did you even notice that Equifax* lost control of personal data on pretty much every single American? Your name, date of birth, your SSN. Equifax did this because they are actually incentivised to make their systems as insecure as they can get away with. The only thing you're right about is that real security has real costs, but you're not convincing me that they're not needed. * https://www.sec.gov/Archives/edgar/data/33185/000119312518154706/d583804dex991.htm https://www.sec.gov/Archives/edgar/data/33185/00011931251815...
• hiergiltdiestfu 8y ago
  First off, the GDPR just harmonizes existing data protection laws, and increases the associated penalties to give those laws teeth. If you need to do something fundamentally new today, you probably broke these laws yesterday already. Stop whining because you feel forced to comply now, just due to the fines having been increased. That's a basic risk of entrepeneurship. Next, something like the deletion right has to submit to other laws that mandate data retention, like having to keep sales and bookings records for 10 years due to tax laws. If you do a cascading deletion in your data set, you're probably breaking these, so flagging records as deleted, or moving them to an archive to comply with these other laws still is perfectly find. So this is just another regulation a startup has to think about. It's way easier than, i.e., tax laws, so please. Just stop panicking -.-
• deleted 8y ago
  [deleted]
• ghego1 8y ago
  I started coding in 2012 as a funder with 0 experience in programming. From day one I avoided "delete=1". I implemented real data deletion from the very start and it has never been an issue. If someone like me (self thought from 0) could do it, I can't see any reason why this should ever be a problem. The GDPR does not pose any particular problem to start-ups, if you take the time to read it (no lawyer needed for that). Sure, as long as your business model does not rely on exploiting personal data.
• eveningcoffee 8y ago
  >* Most early-stage startups use the (in 2008, when I did mine) best practice of “delete=1”. Changing your whole database over to permanent cascade delete is only easy if you’re a very experienced programmer or who knows what he’s doing.* You do not have to do cascade delete. Just invalidate the data that identifies the user (this includes also transaction dates). Well, maybe it is possible to cross reference a person based on the transaction volume?
• tripzilch 8y ago
  > Do you have any idea how much it would cost to have “your lawyers” go through the GDPR, tell you what you need to do, and deal with all of the edge cases and gray areas? $20k or $30k doesn’t seem too high. The worst thing is those who can afford the $300k lawyers to get away with doing whatever to my privacy.
• ahallock 8y ago
  Regulations absolutely raise the bar for new companies and give an unfair advantage to established companies who can afford the legal costs and additional staff. If I were a strategist for a large corporation, I would push for regulations that would hurt smaller competition. Startups that specialize in easing the pain of compliance do help. I recently had to implement tax collection in an app and a third-party API saved me a lot of work. However, it was still a drain on resources and took over a month to implement and test. I don't know a lot about GDPR, but the requirement to permanently delete all your information is absurd, especially if you need that information for a legal context. What if a customer sues you years later and you've deleted all their information? I don't get it.
• DeepYogurt 8y ago
  I’ve been reading web news for over a decade, and it’s getting to the point where I don’t think there are many hackers and/or privacy sensitive people on here anymore. The number of people who are saying it’s no big deal to ignore privacy rights that should be law, especially for sensitive information, is mind boggling.
• pedalpete 8y ago
  As a start-up, you do what you need to do, and probably skirt the laws in some areas (I do anyway). We can't get to full compliance, and in the timeframe with the workload we're working with, we didn't send out a message to all of our users asking them to reconfirm that we can email them. That's just a hassle I don't think is worthwhile at this stage. So, we're risking it. Are we going to get a $4m fine for this. No, did we every implement the cookie law, which because we are an embed would create a brutal UI and result in some of our customers having multiple "accept cookie" messages on a single page? No, we said screw it, it's a stupid law. If we listened to every stupid law on the books, nobody would have any fun. BUT, in my opinion, we work within the objective of the law. The law is about protecting users private data. That is a good thing. Due to GPDR, we are taking extra steps to protect user data, and making it easier for users to delete their data. We have had to create Data Processing Agreements for our customers. Take a look at the law, see what you can implement, understand why the EU has implemented the law as they have, and get as close to legal as you can. Every start-up is making trade-offs, just because this is a big-bad LAW, does that mean it should get all the attention and that your customers should suffer while you implement. Weigh the odds and get to work. If this kills a start-up, I suspect it is the start-up gave up or needed to act shady. This is definitely doable for a one-man start-up with no lawyer. Just like Terms of Use, take a look at what others are doing, and then copy what works for you and your busy.
• eksemplar 8y ago
  This is mostly false. The GDPR doesn’t fine small companies that aren’t making a lot of money. The fines also don’t apply fully to startups until they are a certain age, depending on country. The GDOR doesn’t require you to delete user data that you need. That would be insane, you could obtain a loan and ask to have the record of it deleted if it did. The GDPR does require you to inform people that you keep their data, and it requires you to tell your national how you plan to keep the data safe. You’re not required to have GDPR legal representation in one man - small companies or startups. The GDPR is only really a problem if your business model evolves around selling privacy data. I won’t lose any sleep over it being harder to make a new Facebook and I’m looking forward to see what new business models spring up. I work in the Danish public sector by the way. I have around 500 systems that need to comply, some of these systems run on mainframes and have bits of software that are older than me. I’m not worried, especially not when we haven’t seen a single case in the courts. Until that happens the GDPR is really just a piece of paper because nobody knows exactly how it’ll be interpreted by the legal system.
• rajacombinator 8y ago
  HN is a good reflection of Silicon Valley actually. Mostly people working for big companies who loves to read about and criticize startups but don’t have the guts to attempt one themselves.
• blablabla123 8y ago
  > I’ve been reading hacker news for about a decade, and > it’s getting to the point where I don’t think there are > many entrepreneurs and/or technical people on here > anymore. Not sure, I tried my luck with co-founding 2 companies but I work now as an employee. I notice that the number of Stars on popular Github projects is rising every year, leading me to the conclusion there is an ever growing number of technical people. More over I realize it becomes easier every year to deal with more complexity. That said, it becomes more feasible to handle more business logic - or compliance logic if you will. I know that especially Lean Startup proponents say one should start with low tech solutions. Also I attended an accelerator program and was surprised that most startups there were not tackling exactly super complex things. In fact one Startup worked with some kind of modified Wordpress or so - which has GDPR logic already included. So yeah, things become more technical and complex but I think it's for the good. Also when handling other people's data I guess there should be some responsibility. For the 2 companies I co-founded data-export would have been trivial to implement as the Web Apps were AJAX powered, I would have had just to provide a link to the user. In case of Startup #1 users were anyway only there to train for some test, so it would have been no problem to delete the user records. Probably delete cascade would have been fine as I worked with backups. Deleting data from backups would have been fine as well, they take up only precious space and use up bandwidth. Startup #2 was more about producing content that was not from users. Also I want to note that in times where TDD is something even known to barely technical people, delete cascade is safe and a no-brainer. Anyhow, the most challenging thing looking back would be all those 3rd party tools. To name some: Google Analytics, Mixpanel, managed DB/Redis/etc. I was never a fan of any of those tools and in times of Docker, we can run our software on whichever computers seem most suitable. > My biggest fear is that all of these complex > bureaucratic laws are just raising the bar for doing a > startup. Maybe the days of two people doing a startup > in someone’s garage should be in the past? If so, that > makes me kind of sad. GDPR isn't really complex, it's more like a collection of vague rules and recommendations. Basically most of them are like keep only the data you need, offer export and deletion following best practices.
• supergirl 8y ago
  who says it must be possible or easy to run a 1 man company that handles user data? I rather not have my data handled by a company who can’t handle GDPR
• whatev3r 8y ago
  If you don't have the ability to delete a user from your database, you got issues. Getting a banking permit requires an awful lot of money and you have to go though a lot of bureaucracy to get it, do you also have a problem with that? What if a startup leaked your private data, like Equifax did? would you still feel the same way about this? If the industry would have been able to self regulate, big bad government wouldn't have dropped the hammer on them.
• mgleason_3 8y ago
  “...it’s no big deal to comply with this huge law” Sorry but this comment has been driving me crazy. The GBDR about 100 pages? Obamacare is 20,000. This law may be a lot of things. It may have a huge impact. It may require companies to do things hugely differently. It may require a huge amount of work for some. It could do a huge amount of good or bad. But, it is NOT a huge law.
• krageon 8y ago
  So because the sentiment here is that it's no big deal, which you yourself say "is only easy if you’re a very experienced programmer or who knows what he’s doing" somehow the audience is less technical here. Perhaps the sentiment is that it's no big deal precisely because the audience knows how to solve this problem.