9 ms·

Archiving your website in the Wayback Machine

50 points by l1am0 8y ago

Aardwolf 8y ago
A blog only displays public content on a page right? How can that be affected?
- mikejb 8y ago
  By adding a shit-ton of tracking and analytic code from 3rd parties that provide some convenience. Blog owners are worried because it's not always clear what happens through the imported 3rd-party code, and now they have to start caring about that.
  - pmlnr 8y ago
    There's Matomo[^1] and ancient tools like awstats[^2] which are self-hosted and can be configured to be completely GDPR friendly. I thought the "need" for silly amount of analytics died with 3rd party website visitor counters back in the days. [^1]: https://matomo.org/ https://matomo.org/ [^2]: http://www.awstats.org/ http://www.awstats.org/
  - yellowapple 8y ago
    They should've been caring about that from the start. If GDPR is what it takes to get bloggers to think twice about embedding Like buttons and analytics/trackers up the wazoo, then I for one welcome our new European overlords.
- deleted 8y ago
  [deleted]
- detaro 8y ago
  Facebook like-buttons. Google Analytics. Comments function that stores user data. Server logs. Can all be documented appropriately or adjusted to not collect unneccessary data, but it is some amount of work. It's kind of embarrassing that the author ran a platform for privacy-friendly stuff though and didn't have some of that down before, especially since in Germany a lot of this is not new ideas with GDPR. A static archive would also have been very easy to self-host in a privacy-friendly way, but using archive.org is interesting (not sure if a good idea, but interesting)
  - Festro 8y ago
    Facebook have changed their privacy policy and ask for consent to track via external sites through things like the 'like' button. Google Analytics is largely anonymised and deletes data after a set time now, including any custom user data that you may set up yourself. You have a legitimate reason to track people interacting with your web property. Also, if a site is a personal project, not a business, it doesn't even come under GDPR as there's a household use exemption. (Not sure how a household use interacts with things like FB but let's assume non-third-party processing of data is exempt - e.g. comments with named user labels on a personal blog) This feels like a whole lot of fuss over a very shallow reading of one of the most carefully thought-out pieces of privacy legislation the world has seen. It's got flaws but these aren't them.
tjoff 8y ago
"So I searched trough my websites: Remove Facebook Like Button, Remove analytics, Add privacy statement, Add cookie opt-in/out …. the list goes on." This is exactly why GDPR is so essential. Not a single thought about why allowing tracking or the trade offs for others gain had occurred before GDPR. For a blog GDPR is a non-issue. Though I'm deeply disappointed in how many large sites have interpreted "opt in" as spending 5 minutes vigorously unchecking boxes with ambiguous meaning, hopefully that will bite them hard. This isn't rocket science. Yes, if you go out of your way trying to game your users privacy as much as possible then things will get hairy. That's a feature and the whole point.
- eatitraw 8y ago
  Have you actually tried to read and understand GDPR before getting to this level self-righteousness? A blog writer wants an easy way of tracking popularity of their posts. Clearly I need a protection from this. The internet is worse off after GDPR.
  - detaro 8y ago
    And they can have easy ways of tracking popularity. You can use Google Analytics and similar products in compliant ways, and the tools for that have existed for ages (at least in the case of GA).
    - eatitraw 8y ago
      Except that if you add "login with" button then you are suddenly start processing personal data (even if you only store social media ids).
      - Festro 8y ago
        But you don't just store social media ids. You seem to misunderstand that you're entering into a partnership with a third party. They become a data processor on your behalf. They process a whole lot more, and you have access to a lot of that data. Fortunately, the social media platform includes the privacy policy and consent process in their onboarding of users, so you don't need to worry about it for the purposes of social login.
uhnuhnuhn 8y ago
I've just about had it with these GDPR shitposts on HN. The website the author talks about (datenschutzhelden.de meaning "data protection heroes") was apparently a platform to share tools and best practices for online privacy. Now it turns out the same guy running that website thinks it's too much hassle to remove Facebook integration and offer a cookie opt-out. That's truly next level hypocrisy.
- arendtio 8y ago
  Exactly what I thought. Yes, respecting all the legal parameters can be time consuming when you are building something new features (especially in corporate environments), but actually I think laws like the GDPR are quite important in our modern day life and as a EU citizen I am thankful we got it.
- oytis 8y ago
  I can't get into Simon's head, but I've got a feeling that GDPR contradicts the basic maxim of hacker culture that my computer belongs to me. The website seems to teach how those who care enough can protect their privacy by getting control over one's own computer, not imposing requirements on the others'.
  - pluma 8y ago
    Your computer belongs to you. My data belongs to me. I can give you my data and you can keep that data if you tell me what you are going to keep it for and how you are going to use it and when I agree with all of that, but you don't get to abuse it for anything else and I can revoke that permission at any moment and you have to comply. It's not "imposing requirements", it's called "respecting consent". The more I hear arguments like this the more it reinforces my impression that "hacker culture" isn't really about experimenting with technology but more about self-entitled rich kids abusing other people and shared property for their own fun and profit (like young Zuckerberg marveling at being trusted with access to people's private information without understanding the implied mutual understanding his users assumed to be self-evident). I feel like the GDPR is the Code of Conduct of privacy laws: it codifies a modicum of respect that should need not explicit mentioning but seems to have been entirely lost on entire generations of (aspiring) Silicon Valley hacker types and thus catches them by surprise when it really should be the least you can do. At the very least you are now aware that when you're violating your users' privacy (if only by handing off their data to random BigCo's you have no formal contract with) you're breaking the law just as clearly as those cool '80s kids were breaking the law when they whistled into phones to cheat their way to free phone calls.
yoz-y 8y ago
A few years back I have removed all like buttons, Disqus comments and analytics from my blog. Even though I have hosted the images myself and generated links. It took me maybe an hour and that is because I was browsing reddit or something at the same time. Now I do not need to do anything about GDPR.
- pluma 8y ago
  Keep in mind you still need a privacy policy, even if it just says "we store anonymised access logs which we delete after X months and that's all" (paraphrased). EDIT: Not sure why the downvotes. Prove me wrong if you disagree. Every lawyer I've heard after the GDPR echoes the sentiment that even simple sites that don't do anything fancy should have at least a minimal privacy policy. There are certain requirements a site could theoretically meet to be entirely exempt, but if you have a public-facing website in 2018 you're probably not, even if it's a "digital business card". Besides, the point is that a privacy policy that explicit tells a visitor that you're really not doing much at all with their data is a positive signal whereas a missing privacy policy is more likely to indicate that a) you don't care about your users' rights, b) you have no idea what you're doing or c) you don't want to tell your users what you're doing with their data.
  - yoz-y 8y ago
    AFAIK the fact whether IP addresses and user agents are considered personal information is still up to debate. Nevertheless it is not much work to add that so I probably will. I've already done that kind of policy to my app: "I keep nothing because I don't collect anything"
    - pluma 8y ago
      IP addresses combined with time stamps are personal information if there's only one person using that IP address at that moment in time. If you don't want to personally verify that the IP address was used by more than one person at the given time, you should consider it personal information. What is apparently unintuitive to some people (especially programmers) about the GDPR definition of "personal information" is that it's not a clear cut list but highly contextual: if it can be used to unambiguously identify a single individual by someone, then to that someone it is personal information and they need to treat it as such. Absurd example: if someone called "John Smith" writes their name on a piece of paper and you find it ten years later, it's probably not personal information as you have no way to determine who that name refers to or even whether it refers to anyone at all. Absurd counter-example: any given number can be personal information when used to identify specific individuals in the real world (e.g. numeric user IDs), so slipping your coworker a piece of paper with the number "12345" on it can be personal information if both of you know who it refers to (or can look it up).
NVRM 8y ago
The tooling is ridiculous, while we can do this with some barebone bookmarklets. Save url to archive: javascript:void(window.open('https://web.archive.org/save/'+location.href)); https://web.archive.org/save/'+location.href)); Search the archive for url: javascript:void(window.open('https://web.archive.org/web/*/'+location.href)); https://web.archive.org/web/*/'+location.href)); xD
- NVRM 8y ago
  Peoples downvoting doesn't even known how to make a for loop...
JacobAldridge 8y ago
Of course, if you're going to offload hosting, GDPR concerns, or just your own backup peace of mind to the Internet Wayback Machine, don't forget to say thank you - https://archive.org/donate/ https://archive.org/donate/
pmlnr 8y ago
I'd argue that running a webserver on a VPS/Raspberry/etc, with no logs, serving a static site or a wget mirrored version of that site is better - you still own the site, but if you don't store any information of your visitors at all, in any form, there's no way GDPR will bite you.
skbly7 8y ago
There is already quite a good plugin available by Berkman, Harvard University related to what author's idea seem to be. It works with Drupal as well as Wordpress upon which I worked as my GSoC project (nginx/httpd modules as well). http://amberlink.org http://amberlink.org It use Archive and local copies as backend, while had ideas to support IPFS among others. What Amber does? Amber is an open source tool for websites to provide their visitors persistent routes to information. It automatically preserves a snapshot of every page linked to on a website, giving visitors a fallback option if links become inaccessible. If one of the pages linked to on this website were to ever go down, Amber can provide visitors with access to an alternate version. This safeguards the promise of the URL: that information placed online can remain there, even amidst network or endpoint disruptions.

50 points by l1am0 8y ago

Aardwolf 8y ago

A blog only displays public content on a page right? How can that be affected?

mikejb 8y ago
By adding a shit-ton of tracking and analytic code from 3rd parties that provide some convenience. Blog owners are worried because it's not always clear what happens through the imported 3rd-party code, and now they have to start caring about that.
- pmlnr 8y ago
  There's Matomo[^1] and ancient tools like awstats[^2] which are self-hosted and can be configured to be completely GDPR friendly. I thought the "need" for silly amount of analytics died with 3rd party website visitor counters back in the days. [^1]: https://matomo.org/ https://matomo.org/ [^2]: http://www.awstats.org/ http://www.awstats.org/
- yellowapple 8y ago
  They should've been caring about that from the start. If GDPR is what it takes to get bloggers to think twice about embedding Like buttons and analytics/trackers up the wazoo, then I for one welcome our new European overlords.
deleted 8y ago
[deleted]
detaro 8y ago
Facebook like-buttons. Google Analytics. Comments function that stores user data. Server logs. Can all be documented appropriately or adjusted to not collect unneccessary data, but it is some amount of work. It's kind of embarrassing that the author ran a platform for privacy-friendly stuff though and didn't have some of that down before, especially since in Germany a lot of this is not new ideas with GDPR. A static archive would also have been very easy to self-host in a privacy-friendly way, but using archive.org is interesting (not sure if a good idea, but interesting)
- Festro 8y ago
  Facebook have changed their privacy policy and ask for consent to track via external sites through things like the 'like' button. Google Analytics is largely anonymised and deletes data after a set time now, including any custom user data that you may set up yourself. You have a legitimate reason to track people interacting with your web property. Also, if a site is a personal project, not a business, it doesn't even come under GDPR as there's a household use exemption. (Not sure how a household use interacts with things like FB but let's assume non-third-party processing of data is exempt - e.g. comments with named user labels on a personal blog) This feels like a whole lot of fuss over a very shallow reading of one of the most carefully thought-out pieces of privacy legislation the world has seen. It's got flaws but these aren't them.

tjoff 8y ago

"So I searched trough my websites: Remove Facebook Like Button, Remove analytics, Add privacy statement, Add cookie opt-in/out …. the list goes on." This is exactly why GDPR is so essential. Not a single thought about why allowing tracking or the trade offs for others gain had occurred before GDPR. For a blog GDPR is a non-issue. Though I'm deeply disappointed in how many large sites have interpreted "opt in" as spending 5 minutes vigorously unchecking boxes with ambiguous meaning, hopefully that will bite them hard. This isn't rocket science. Yes, if you go out of your way trying to game your users privacy as much as possible then things will get hairy. That's a feature and the whole point.

eatitraw 8y ago
Have you actually tried to read and understand GDPR before getting to this level self-righteousness? A blog writer wants an easy way of tracking popularity of their posts. Clearly I need a protection from this. The internet is worse off after GDPR.
- detaro 8y ago
  And they can have easy ways of tracking popularity. You can use Google Analytics and similar products in compliant ways, and the tools for that have existed for ages (at least in the case of GA).
  - eatitraw 8y ago
    Except that if you add "login with" button then you are suddenly start processing personal data (even if you only store social media ids).
    - Festro 8y ago
      But you don't just store social media ids. You seem to misunderstand that you're entering into a partnership with a third party. They become a data processor on your behalf. They process a whole lot more, and you have access to a lot of that data. Fortunately, the social media platform includes the privacy policy and consent process in their onboarding of users, so you don't need to worry about it for the purposes of social login.

uhnuhnuhn 8y ago

I've just about had it with these GDPR shitposts on HN. The website the author talks about (datenschutzhelden.de meaning "data protection heroes") was apparently a platform to share tools and best practices for online privacy. Now it turns out the same guy running that website thinks it's too much hassle to remove Facebook integration and offer a cookie opt-out. That's truly next level hypocrisy.

arendtio 8y ago
Exactly what I thought. Yes, respecting all the legal parameters can be time consuming when you are building something new features (especially in corporate environments), but actually I think laws like the GDPR are quite important in our modern day life and as a EU citizen I am thankful we got it.
oytis 8y ago
I can't get into Simon's head, but I've got a feeling that GDPR contradicts the basic maxim of hacker culture that my computer belongs to me. The website seems to teach how those who care enough can protect their privacy by getting control over one's own computer, not imposing requirements on the others'.
- pluma 8y ago
  Your computer belongs to you. My data belongs to me. I can give you my data and you can keep that data if you tell me what you are going to keep it for and how you are going to use it and when I agree with all of that, but you don't get to abuse it for anything else and I can revoke that permission at any moment and you have to comply. It's not "imposing requirements", it's called "respecting consent". The more I hear arguments like this the more it reinforces my impression that "hacker culture" isn't really about experimenting with technology but more about self-entitled rich kids abusing other people and shared property for their own fun and profit (like young Zuckerberg marveling at being trusted with access to people's private information without understanding the implied mutual understanding his users assumed to be self-evident). I feel like the GDPR is the Code of Conduct of privacy laws: it codifies a modicum of respect that should need not explicit mentioning but seems to have been entirely lost on entire generations of (aspiring) Silicon Valley hacker types and thus catches them by surprise when it really should be the least you can do. At the very least you are now aware that when you're violating your users' privacy (if only by handing off their data to random BigCo's you have no formal contract with) you're breaking the law just as clearly as those cool '80s kids were breaking the law when they whistled into phones to cheat their way to free phone calls.

yoz-y 8y ago

A few years back I have removed all like buttons, Disqus comments and analytics from my blog. Even though I have hosted the images myself and generated links. It took me maybe an hour and that is because I was browsing reddit or something at the same time. Now I do not need to do anything about GDPR.

pluma 8y ago
Keep in mind you still need a privacy policy, even if it just says "we store anonymised access logs which we delete after X months and that's all" (paraphrased). EDIT: Not sure why the downvotes. Prove me wrong if you disagree. Every lawyer I've heard after the GDPR echoes the sentiment that even simple sites that don't do anything fancy should have at least a minimal privacy policy. There are certain requirements a site could theoretically meet to be entirely exempt, but if you have a public-facing website in 2018 you're probably not, even if it's a "digital business card". Besides, the point is that a privacy policy that explicit tells a visitor that you're really not doing much at all with their data is a positive signal whereas a missing privacy policy is more likely to indicate that a) you don't care about your users' rights, b) you have no idea what you're doing or c) you don't want to tell your users what you're doing with their data.
- yoz-y 8y ago
  AFAIK the fact whether IP addresses and user agents are considered personal information is still up to debate. Nevertheless it is not much work to add that so I probably will. I've already done that kind of policy to my app: "I keep nothing because I don't collect anything"
  - pluma 8y ago
    IP addresses combined with time stamps are personal information if there's only one person using that IP address at that moment in time. If you don't want to personally verify that the IP address was used by more than one person at the given time, you should consider it personal information. What is apparently unintuitive to some people (especially programmers) about the GDPR definition of "personal information" is that it's not a clear cut list but highly contextual: if it can be used to unambiguously identify a single individual by someone, then to that someone it is personal information and they need to treat it as such. Absurd example: if someone called "John Smith" writes their name on a piece of paper and you find it ten years later, it's probably not personal information as you have no way to determine who that name refers to or even whether it refers to anyone at all. Absurd counter-example: any given number can be personal information when used to identify specific individuals in the real world (e.g. numeric user IDs), so slipping your coworker a piece of paper with the number "12345" on it can be personal information if both of you know who it refers to (or can look it up).

NVRM 8y ago

The tooling is ridiculous, while we can do this with some barebone bookmarklets. Save url to archive: javascript:void(window.open('https://web.archive.org/save/'+location.href)); https://web.archive.org/save/'+location.href)); Search the archive for url: javascript:void(window.open('https://web.archive.org/web/*/'+location.href)); https://web.archive.org/web/*/'+location.href)); xD

NVRM 8y ago
Peoples downvoting doesn't even known how to make a for loop...

JacobAldridge 8y ago

Of course, if you're going to offload hosting, GDPR concerns, or just your own backup peace of mind to the Internet Wayback Machine, don't forget to say thank you - https://archive.org/donate/ https://archive.org/donate/

pmlnr 8y ago

I'd argue that running a webserver on a VPS/Raspberry/etc, with no logs, serving a static site or a wget mirrored version of that site is better - you still own the site, but if you don't store any information of your visitors at all, in any form, there's no way GDPR will bite you.

skbly7 8y ago

There is already quite a good plugin available by Berkman, Harvard University related to what author's idea seem to be. It works with Drupal as well as Wordpress upon which I worked as my GSoC project (nginx/httpd modules as well). http://amberlink.org http://amberlink.org It use Archive and local copies as backend, while had ideas to support IPFS among others. What Amber does? Amber is an open source tool for websites to provide their visitors persistent routes to information. It automatically preserves a snapshot of every page linked to on a website, giving visitors a fallback option if links become inaccessible. If one of the pages linked to on this website were to ever go down, Amber can provide visitors with access to an alternate version. This safeguards the promise of the URL: that information placed online can remain there, even amidst network or endpoint disruptions.