4 ms·

> If you fine Facebook, you have to fine the small companies too, and even individual developers developing OSS, since the law should apply to everyone equally.

> If you fine Facebook, you have to fine the small companies too, and even individual developers developing OSS, since the law should apply to everyone equally. I would agree regarding small companies, but I wouldn't put oss developers in the same boat, fining the entity that provides a service makes more sense. It doesn't matter if that service relies on OSS or not. It's the company providing the service to the consumer who is responsible to vet the final product. A OSS developer has no idea if her/his code is going to be used by a gaming app or by NASA for mission critical stuff and shouldn't be made responsible if a bug in the oss project caused a rocket failure. Similarly a construction company providing wood (and that company isn't making any false claims about the level of quality): it should not be the company's fault if someone decides to use that wood for a bridge where concrete is needed. The bridge builder is responsible of picking a good material.

saagarjha 8y ago
Plus OSS software is often provided with not liability or warranty, which should protect developers from legislation.
- jimktrains2 8y ago
  So is most commercial software and tos iirc.
bacon_waffle 8y ago
> It's the company providing the service to the consumer who is responsible to vet the final product. I agree with your post, but I tend to think of facebook's users as providing the product (their attention). If the consumer is a company buying advertising, then where's facebook's motivation to be careful with a user's "private" data?
- WA 8y ago
  Sorry, but you’re overthinking this. Facebooks product is not advertising. It’s a platform that brings users and advertisers together. Just because it’s free for some or most users of the platform doesn’t mean that only paying people (advertisers) need to be protected. Under GDPR, it actually doesn’t matter if you charge money for your product or not. If you process personal data, you’re responsible for it. This also applies to private people with no commercial interest who start to gather data from strangers (in exchange for some service or whatever). Edit: The motivation should’ve been there from the beginning, if only for ethical reasons. Now the motivation is probably enforced by hefty fines.
  - jachee 8y ago
    Answer this: If facebook's product is not advertising, then how do they make money?
    - WA 8y ago
      Answer this: if Facebook was only a product for advertisers, whom would they show the ads? Facebook‘s product is a platform. It can’t exist without users, and it can’t exist without advertisers (presumably). Since both end users and advertisers are part of the product, the data of all of them needs to be protected. It doesn’t matter who the paying party is.
      - mcny 8y ago
        If we fine Facebook.com for bugs, do we also fine Mastodon.social? Gitlab.com? Movim.SE? I have a test instance of hasura running on heroku so... if there are bugs in hasura, will you fine me? If you say I can avoid penalities by saying my services are "as is", what stops Facebook from doing the same thing?
        WA 8y ago
        Where do you draw the line between bug, neglect and outright malpractice? Obviously, it’s still not clear for many people: All services that process personal data became more regulated through GDPR. And yes, if any service loses its customers data, there will be a fine. The fine depends on many factors. And yes, even Mastodon.social or Gitlab.com (the service, not the OSS). The advantage of these platforms is that they actually don’t process that much personal data. Behind any service is a legal entity that asks people for their data, to provide a service. These legal entities are subject to the same laws. However, since the GDPR apparently determines fines on a case-by-case basis, they might give a low or no fine at all, if the service is non-commercial and had no intention to collect user data for commercial purposes. But the law still applies. If you put a web service online that handles personal data, you must make sure to keep that data safe. It doesn’t matter if your service is free or not. Turn this around: just because you as a user signed up for a non-commercial free service like Mastodon.social (the service, not the OSS you can host yourself), you wouldn’t want the admins of Mastodon.social to mess around with your data, no?

saagarjha 8y ago

Plus OSS software is often provided with not liability or warranty, which should protect developers from legislation.

jimktrains2 8y ago
So is most commercial software and tos iirc.

bacon_waffle 8y ago

> It's the company providing the service to the consumer who is responsible to vet the final product. I agree with your post, but I tend to think of facebook's users as providing the product (their attention). If the consumer is a company buying advertising, then where's facebook's motivation to be careful with a user's "private" data?

WA 8y ago
Sorry, but you’re overthinking this. Facebooks product is not advertising. It’s a platform that brings users and advertisers together. Just because it’s free for some or most users of the platform doesn’t mean that only paying people (advertisers) need to be protected. Under GDPR, it actually doesn’t matter if you charge money for your product or not. If you process personal data, you’re responsible for it. This also applies to private people with no commercial interest who start to gather data from strangers (in exchange for some service or whatever). Edit: The motivation should’ve been there from the beginning, if only for ethical reasons. Now the motivation is probably enforced by hefty fines.
- jachee 8y ago
  Answer this: If facebook's product is not advertising, then how do they make money?
  - WA 8y ago
    Answer this: if Facebook was only a product for advertisers, whom would they show the ads? Facebook‘s product is a platform. It can’t exist without users, and it can’t exist without advertisers (presumably). Since both end users and advertisers are part of the product, the data of all of them needs to be protected. It doesn’t matter who the paying party is.
    - mcny 8y ago
      If we fine Facebook.com for bugs, do we also fine Mastodon.social? Gitlab.com? Movim.SE? I have a test instance of hasura running on heroku so... if there are bugs in hasura, will you fine me? If you say I can avoid penalities by saying my services are "as is", what stops Facebook from doing the same thing?
      - WA 8y ago
        Where do you draw the line between bug, neglect and outright malpractice? Obviously, it’s still not clear for many people: All services that process personal data became more regulated through GDPR. And yes, if any service loses its customers data, there will be a fine. The fine depends on many factors. And yes, even Mastodon.social or Gitlab.com (the service, not the OSS). The advantage of these platforms is that they actually don’t process that much personal data. Behind any service is a legal entity that asks people for their data, to provide a service. These legal entities are subject to the same laws. However, since the GDPR apparently determines fines on a case-by-case basis, they might give a low or no fine at all, if the service is non-commercial and had no intention to collect user data for commercial purposes. But the law still applies. If you put a web service online that handles personal data, you must make sure to keep that data safe. It doesn’t matter if your service is free or not. Turn this around: just because you as a user signed up for a non-commercial free service like Mastodon.social (the service, not the OSS you can host yourself), you wouldn’t want the admins of Mastodon.social to mess around with your data, no?