5 ms·

You cannot run any internet service without collecting personal information. IP addresses are personal data per GDPR, and by serving TCP connections you are col

You cannot run any internet service without collecting personal information. IP addresses are personal data per GDPR, and by serving TCP connections you are collecting IP addresses of your clients. In the case of DNS, your DNS query is also likely personal data in some cases, and it definitely is personal data when linked to a timestamp and an IP address. There is a huge distinction to be made in collecting vs. storing. The 8888 privacy policy also calls out that some personal information is stored, for how long, and for what purpose. But most people who claim that they're not collecting personal information are just not being accurate in their privacy statements. Disclaimer: googler, opinion is my own and not my employer's.

capableweb 6y ago
> You cannot run any internet service without collecting personal information What the hell are you talking about?! Of course you can, why wouldn't you be able to? You think the internet and the web started out with having everyone automatically collecting everyones personal information? > Disclaimer: googler Aha, yeaaaah, now it makes sense that you don't think it's possible to do anything else but to collect personal data. While the opinion is your own, it's pretty obvious what its been influenced by.
- LocalH 6y ago
  You didn't read the sentence after your first quote, apparently. They went on to mention how IP address is considered personal information under most modern data protection law. You took the opportunity to make a personal attack on the poster based on their place of employment.
  - capableweb 6y ago
    Why would I have to continue reading the comment when the first and most basic argument they make is factually incorrect? "You cannot run any internet service without collecting personal information" is not true, you can absolutely run services on the internet that collects and/or stores 0 personal data. That they don't know how to, is besides the point, but that doesn't make it impossible, it just means they don't know how to.
- iso1210 6y ago
  Default setup for apache has been to log IP addresses, useragents, and requests, in the access log for decades. Now you can probably keep this for typical security purposes for a week or so, and even aggregated page hits, without permission so you're not entirely wrong Running netflow probably counts as collecting PII, but the main idea is 1) Why are you collecting it. Clearly storing connection details in a firewall is acceptable. 2) Why are you keeping it. Storing IP logs for security purposes is fine for example. 3) How are you keeping it secure and ensuring you only keep it for the shortest amount of time you need.
  - capableweb 6y ago
    > Default setup for apache has been to log IP addresses, useragents, and requests, in the access log for decades. Yeah, and the defaults for mongodb is to let anyone edit the database, at least it used to be so. Doesn't mean you should run it like that. You can, as soon as you receive a request, hash the IP address and store the hash instead of storing the cleartext IP. If there is no way of reversing the hash (which there shouldn't, wouldn't be much of a hash then), you're not storing any IP anymore, and it's not personal data. Strikes me as very weird someone who supposed to be high-level developer or employee at one of the biggest companies in the world don't know how not build applications that stores personal information. But since that company is Google, it hardly surprises anyone.
    - iso1210 6y ago
      Not much point in hashing a (v4) IP, there's 4 billion of them, trivial to undo (you won't be able to change the salt) There's nothing wrong with storing individual IPs temporarily for security and functionality purposes, but you're still collecting them - if nothing else they'll show up in your netflow sessions and your netstat output
      - capableweb 6y ago
        > Not much point in hashing a (v4) IP, there's 4 billion of them, trivial to undo (you won't be able to change the salt) I didn't know! Here is my IP as a sha256, please reverse it and show me you actually know what you're talking about: 20adfe5288d85b6279dc65eff126828c0b20b896cb853caef9de0d6251e46169

capableweb 6y ago

> You cannot run any internet service without collecting personal information What the hell are you talking about?! Of course you can, why wouldn't you be able to? You think the internet and the web started out with having everyone automatically collecting everyones personal information? > Disclaimer: googler Aha, yeaaaah, now it makes sense that you don't think it's possible to do anything else but to collect personal data. While the opinion is your own, it's pretty obvious what its been influenced by.

LocalH 6y ago
You didn't read the sentence after your first quote, apparently. They went on to mention how IP address is considered personal information under most modern data protection law. You took the opportunity to make a personal attack on the poster based on their place of employment.
- capableweb 6y ago
  Why would I have to continue reading the comment when the first and most basic argument they make is factually incorrect? "You cannot run any internet service without collecting personal information" is not true, you can absolutely run services on the internet that collects and/or stores 0 personal data. That they don't know how to, is besides the point, but that doesn't make it impossible, it just means they don't know how to.
iso1210 6y ago
Default setup for apache has been to log IP addresses, useragents, and requests, in the access log for decades. Now you can probably keep this for typical security purposes for a week or so, and even aggregated page hits, without permission so you're not entirely wrong Running netflow probably counts as collecting PII, but the main idea is 1) Why are you collecting it. Clearly storing connection details in a firewall is acceptable. 2) Why are you keeping it. Storing IP logs for security purposes is fine for example. 3) How are you keeping it secure and ensuring you only keep it for the shortest amount of time you need.
- capableweb 6y ago
  > Default setup for apache has been to log IP addresses, useragents, and requests, in the access log for decades. Yeah, and the defaults for mongodb is to let anyone edit the database, at least it used to be so. Doesn't mean you should run it like that. You can, as soon as you receive a request, hash the IP address and store the hash instead of storing the cleartext IP. If there is no way of reversing the hash (which there shouldn't, wouldn't be much of a hash then), you're not storing any IP anymore, and it's not personal data. Strikes me as very weird someone who supposed to be high-level developer or employee at one of the biggest companies in the world don't know how not build applications that stores personal information. But since that company is Google, it hardly surprises anyone.
  - iso1210 6y ago
    Not much point in hashing a (v4) IP, there's 4 billion of them, trivial to undo (you won't be able to change the salt) There's nothing wrong with storing individual IPs temporarily for security and functionality purposes, but you're still collecting them - if nothing else they'll show up in your netflow sessions and your netstat output
    - capableweb 6y ago
      > Not much point in hashing a (v4) IP, there's 4 billion of them, trivial to undo (you won't be able to change the salt) I didn't know! Here is my IP as a sha256, please reverse it and show me you actually know what you're talking about: 20adfe5288d85b6279dc65eff126828c0b20b896cb853caef9de0d6251e46169