30 ms·

How the UK's online safety bill threatens Matrix

362 points by daenney 5y ago

deleted 5y ago
[deleted]
Permit 5y ago
> Forcing a “duty of care” responsibility on organisations which operate online will not only drown small and medium sized companies in administrative tasks and costs, it will further accentuate the existing monopolies by Big Tech. I often wonder about this. I mean, just the other day there was an article[1] here about sending GDPR requests to a health non-profit in order to sequence your genes for free. The costs of each individual piece of legislation are small, but internet legislation only ever trends in the direction of "more of it". As more small costs are added (GDPR, cookie notifications, right to be forgotten, removal of Safe Harbor etc.) these costs will start to play a factor in who can run a web service and who cannot. [1] https://news.ycombinator.com/item?id=27146975 https://news.ycombinator.com/item?id=27146975
- iso1631 5y ago
  Interesting. I don't send cookies or keep personal data, so why do I need to worry about them? The only time I've got into issues was with an american firm using an american law (dmca) to attack me (a non-american) and my hosting company (a non-american hosting company)
  - Permit 5y ago
    > I don't send cookies or keep personal data, so why do I need to worry about them? Can you share your website/service?
    - frockington1 5y ago
      Commenting to follow up later. I'm really interested in the use case. The only thing I can think of would be a website similar to mid-2000s youtube to mp3 converters.
      - iso1631 5y ago
        Alas they are all behind ssl authentication so you wouldn't be able to access them, but the stuff I currently have open includes a switch port mapper (every 20 minutes all my switches are scanned and reports generated on what's plugged in where), a firewall config interpretor (a list of current port forwards is generated), and a logging server showing me what But if you want an example of a fully featured public site which doesn't need cookies https://news.ycombinator.com/ https://news.ycombinator.com/ Load that in lynx, which asks for every cookie, and none are set. Now sure, if you choose to log in, then functionally you need to accept the login cookie, but that cookie isn't spammed out to you. Under GDPR, a website doesn't need to ask for permission to have necessary cookies which enable core functionality such as security, network management, and accessibility.
        Permit 5y ago
        > Under GDPR, a website doesn't need to ask for permission to have necessary cookies which enable core functionality such as security, network management, and accessibility. I am not convinced this is true. See: https://law.stackexchange.com/a/32157 https://law.stackexchange.com/a/32157 Also note that HN is likely in violation of this since there is no "Remember Me" checkbox when logging in. There is no indication that logins will be persistent.
  - Mediterraneo10 5y ago
    Common CMSs send cookies by default. Even if you are one of those tech-inclined people using a static site generator for your own website, this is not the case for millions and millions of other websites.
    - nfoz 5y ago
      Then let's replace those CMS's. [edited with less anger]
      - maxrev17 5y ago
        Replace them? You need cookies for a tonne of reasons. It's really difficult to justify replacing half the web because some people abuse it. That's like replacing cars with walking because some people drink drive.
        deleted 5y ago
        [deleted]
        iso1631 5y ago
        What reasons do you need the types of cookies you need to ask permission for under the GDPR?
    - TheManInThePub 5y ago
      *sigh* Here we go again. The GDPR has no problem AT ALL with cookies. Use as many as you like with no need for popups. However, if you are using cookies to track or personally identify me, then you need to ask my permission to do so. And so you should. The amount of misinformation (some of it wilful) circulating about the GDPR on HN (a technical forum!) is shocking. If you consider yourself a professional developer then I strongly suggest you read a GDPR primer. There is no excuse not to. Following the GDPR will simply make your code safer when handling personal data.
- ryukafalz 5y ago
  Cookie notifications? You have to be actively tracking your users for those to even be relevant. You could literally do less work and avoid the need for them altogether.
- daenney 5y ago
  GDPR, or CCPA, isn't all that costly as long as you stop thinking of user data as something for you to harvest, mine, resell and profit from. If you instead treat user data like a security liability, system designs and trade-offs will flow from there. They'll help ensure you design systems that minimise collection and anonymise things early, remove data promptly when no longer needed, and make it easy to audit what data you do hold which in turns makes supporting GDPR requests easy. The largest cost of GDPR is making that shift for existing companies. If GDPR ends up killing a few companies because of that, I personally don't mind. And if a startup doesn't end up seeing the light of day because it's not possible for them to operate under the conditions that GDPR imposes, then from my point of view the GDPR is doing what I'd like it to do.
  - anshorei 5y ago
    It's possible for you to be in violation of GDPR without "thinking of user data as something for you to harvest, mine, resell and profit from". If it's "killing a few companies" and "a startup doesn't end up seeing the light" then "GDPR is doing what I'd like it to do." That's a pretty shitty opinion to hold. What did those companies and startups do wrong? I'm as tired of stupid startups as the next person, but I won't cheer for their failure unless they actually do something wrong.
    - 3np 5y ago
      How about adding third-party analytics integrations that compromise your visitors, tracks them around the web, and fail to protect that data properly as the analytics company gets acquired by another entity? Stop saving PII for profit/exploitation reasons and you're in the clear.
    - account42 5y ago
      > What did those companies and startups do wrong? Well for one, they ignored users and the authorities asking them to stop their illegal data collection. No company is getting "killed" or even fined at all when they are not actively refusing to get compliant.
viktorcode 5y ago
Sad to see UK becoming one of the apologists of internet censorship, closing the gap to the levels of authoritarian countries. Once you have censorship facility in place, the area of its application will only grow. The term "illegal information" is also widely used in Russia for the same purpose.
- t-writescode 5y ago
  The cameras tracking everything everywhere in UK would say that it's long been an authoritarian country. Authoritarianism is a sliding scale. From what I can gather, lots of humans that have any political pull at all tend to be authoritarian (against the kinds of people they don't like, of course).
  - cyrksoft 5y ago
    Most cameras in the UK (I think around 95% even) are private. Not sure why you think the UK is an authoritarian regime. Check any ranking and it is one of the freest countries out there (Heritage Ranking, for example: https://www.heritage.org/index/ranking https://www.heritage.org/index/ranking)
    - ipaddr 5y ago
      He is referring to the camera network in London.
      - cyrksoft 5y ago
        The government's camera network in London is very small, only 23708 cameras (15516 of which are from Transport of London across the tube network)[0]. It's a fairly small network for an authoritarian government. [0]https://www.cctv.co.uk/how-many-cctv-cameras-are-there-in-london/#:~:text=Research%20by%20CCTV.co.uk,world%2C%20and%20for%20good%20reason https://www.cctv.co.uk/how-many-cctv-cameras-are-there-in-lo....
        5y ago
______- 5y ago
I wish there was some sort of island or safe haven country setup by cryptographers so they could safely work on crypto without legal issues or crypto being seen as a munition and a threat to government. We could call it `01` and have it in a non fourteen-eyes jurisdiction preferably as an independent nation. We could export code containing cryptographic algorithms to countries that need it for privacy and safety reasons. Cryptography actually is needed for safety more than it is used by undesirable people to commit crimes!
- teclordphrack2 5y ago
  We can't have communist countries in latan america because of the good ole u s of a. You think you are going to get some slight utopia that helps people b/c of their ideals? Never going to happen... sadly.
  - LeftTriangle 5y ago
    You can’t have communist countries in “Latan” America because their industrial base and population expertise is even worse than the USSR. Not to defend the CIA’s actions, but Venezuela was never going to work out.
    - FranchuFranchu 5y ago
      I don't think he was talking about Venezuela.
      - LeftTriangle 5y ago
        It’s a synecdoche.
  - deleted 5y ago
    [deleted]
- newacct583 5y ago
  > Cryptography actually is needed for safety more than it is used by undesirable people to commit crimes! This is actually more because criminals on balance tend to be too dumb to hide their traces than because of any demographic truth. There are a lot of criminals. Focusing on "crypto" is, I think, a forest for the trees argument. Look instead at anonymity for evidence of where this kind of thing goes. Put up any reasonably anonymous forum where people can interact without their identities being reveals (which often includes, but doesn't always require, some kind of crypto protocol). Within a year it will be filled with criminals. Minor criminals like drug dealers. Worse things like market manipulation and fraudsters. Weapons sales. Black market rings. Revolutionaries of all sorts and sizes. Child porn. Mail order brides and other trafficking trades. Seriously, run a Tor exit node for a while and see where this goes. Your neighbors in your imagined "safe haven country for cryptographers" aren't going to be who you think they are.
Mindwipe 5y ago
The Bill is arguably the biggest threat to global online freedoms that exists. I'm surprised it has not been covered more here. It is amazingly badly written and will have huge negative consequences.
- HeckFeck 5y ago
  > Amazingly badly written You know they want ambiguity. It means MPs can dismiss objectors as irrational slippery slope proponents. Then when it's appended to the statute books it only takes a few judgements to 'clarify' the law. It's all downhill for freedom. The intention is clear. Voting is useless. The press have been silent to the point of compliance. It only takes a well placed messaging campaign and an unvigilant, ignorant public. At least we still have beer to see us through the long haul. See you at the pub.
  - lostlogin 5y ago
    > See you at the pub This is a disturbing good summary of UK politics at the moment.
hwbehrens 5y ago
While I agree with their position overall, particularly with the ambiguity of "harmfulness", I think this is not the right tack to take here: > fails to acknowledge how actually harmful it would be for certain groups of the population to have their real life identity associated with their online identity No nanny-state-style government is going to buy this argument for a moment, because it requires a certain level of distrust of authority that certainly won't be present in the authorities themselves. Even among the population at large, there are undeniable trends in many countries towards authoritarianism on both the left and the right that are ignored or embraced by a majority (or a large minority) of their respective bases of support. Combined with prevailing trends against web-based anonymity and concerns over "fake news" and other amplification mechanisms for information warfare, I suspect we will see a further bifurcation into regulated, KYC-style services and unregulated, anonymous communities. Even here on HN, posters and commenters are regularly chastised for failing to adequately disclose their identities when they have a vested interest in the topic under discussion. Rather, the privacy angle which has been so conveniently mooted by Apple lately is (in my opinion) more palatable to the general public. By giving more responsibility to the service providers, the government is also implicitly giving them more power as well (as censors, if nothing else). But in practice, most people have personally observed that when more power/information is provided to private companies, it leads to a slippery slope of monetization, advertising, and lock-in. An appeal to this sense of unfairness and power imbalance with companies seems more "sellable" to me than convincing people their governments have nefarious/censorious motives. As a supporting argument, consider the general global consensus on gun control -- if people were willing to believe that their governments were ready to turn on them (in terms of physical oppression) at any moment, there would be more global concern about the physical power disparity between police/military and the civilian populace. Currently (with some exceptions, e.g. the U.S.), the global consensus is that people are much more willing to trust their police/military with weaponry than their fellow citizens, based on the implicit notion that the likelihood of experiencing harm from the latter is disproportionately more likely than the former. In contrast, as partially evidenced by the relative growth of Signal as a response to the changes in WhatsApp and the public support for app-tracking changes in iOS, people are demonstrably concerned about privacy in the commercial space. Thus, I theorize that an appeal to privacy would be more effective: "Under the proposed changes, we would have the ability to do ____, which would exploit your personal, private information for profit. If we can do it, that means ____, ____, and ____ can do it too. Do you want your government giving even more power to private companies to profit off you?"
sauntheninja 5y ago
cc
Arathorn 5y ago
One of the most frustrating things about this legislation is that it's set up so that the only outfits with the resources to do the requested censorship would be a GAFAM. Which is utterly perverse, as on one hand the UK govt is despairing about the extent to which the UK is dependent on Big Tech social media and the control they exert on society... whilst simultaneously pushing through legislation which effectively ensures that GAFAM are the only people who can operate! The Matrix approach to addressing abuse is https://matrix.org/blog/2020/10/19/combating-abuse-in-matrix-without-backdoors https://matrix.org/blog/2020/10/19/combating-abuse-in-matrix... (and we're in the middle of building out the first implementation of the decentralised reputation proposal right now) - but it is not pleasant to think that if a judge considered that approach inadequate, the directors of UK entities providing Matrix hosting (e.g. Element, running matrix.org on behalf of The Matrix.org Foundation) would be eligible for jail time \o/ Needless to say, we're doing our best to explain to the UK Govt that their Bill is throwing out the baby along with bathwater...
- deleted 5y ago
  [deleted]
- KingOfCoders 5y ago
  It's the same with GDPR. When I worked for a large enterprise, we had a legal/compliance team of dozens of people and a huge outsourced legal budget. When I worked in the startup of my wife, it was me implementing GDPR compliance.
  - Arathorn 5y ago
    But at least GDPR /is/ tractable to implement at small scale. Whereas for the OSB: if you run a smallish but popular chat/blog/forum/etc service, there literally isn’t a solution for moderation which isn’t fiendishly expensive, privacy invasive, or both. The legislation has clearly been dreamt up by folks saying “ah ha! if we threaten the Facebook UK executive mangement team with jailtime unless they do better at filtering self-harm/CSAM/terrorism/etc then they will obviously get their house in order!”. Whereas in practice they crush their own UK-based startups instead. So frustrating.
varispeed 5y ago
We have a little forum with a niche community. Few months ago we have closed the registration, because of spam and also because we had people posting questionable stuff and then reporting it to the hosting provider. There is not much money from ads, it barely covers the servers. Moderators do not always have time to react quickly to something stupid. Probably many other communities will be forced to close with either having to move to Facebook or other privacy hostile platforms. Then there is EU terreg - we have some members from the EU, so we would have to boot them out or create a legal entity in the EU to process content removal requests as I understand, in a year or so. There is no money for that. Sad times for the internet...
- ronsor 5y ago
  > we would have to boot them out or create a legal entity in the EU to process content removal requests as I understand, in a year or so. Have you considered just ignoring them? Provided you're not an (international) business, you can likely afford to ignore foreign governments, and if they want to block you, that's up to them.
jeena 5y ago
I'm so happy that there are people out there who care about this things and have the time to invest fighting the fight. I would like to be with you there but right now my life doesn't allow the time but I'm totally with you there but only can help by throwing some money on the problem. But a very big thank you to everyone involved!
world_peace42 5y ago
"when we force technology companies to make calls about what is right or wrong - or what is “likely to have adverse psychological or physical impacts” on children - we end up in a dangerous place of centralising and regulating relative morals" I told myself to laugh when I read this line. As it stands now, a small group of Facebook and Google executives determine what peasants are allowed to think and see on a daily basis based on their "relative morals". Not that politicians are any better, but at least some people did vote for them, and that counts for something. Let's be real here, anyone with time on their hands should click on foundation, and go check each of their grant histories. I am not even going to agree or disagree with the legislation, but I'm going to bet the money trail will explain this letter.
- deleted 5y ago
  [deleted]
einpoklum 5y ago
> Whilst we sympathise with the [UK] government’s desire to show action in this space and to do something about children’s safety (everyone’s safety really) I don't sympathize with it. A government which supports and arms near-genocidal attacks and blockades in Yemen and in Palestine - is not a legitimate actor where it comes to safety and harm prevention online. Or at the very least - where its involvement may have effect on non-UK-citizens.
jsdevtom 5y ago
The current UK politicians are so mind numbingly naive in so many ways.
- brokenmachine 5y ago
  That's what they want you to think. It's not naivete.
HeckFeck 5y ago
> Whilst we sympathise with the government’s desire to show action in this space and to do something about children’s safety (everyone’s safety really), we cannot possibly agree with the methods. Respectfully, stop sympathising with authoritarians who want to take away your freedom. They are not good people. Good people aren't nosey. Good people don't deprive others of liberty. Neither do they class a whole group (Internet users and entrepreneurs) as responsible for the actions of a minority. Guilt by association and collective punishment are antithetical to any lover of freedom and life. Their reasons of 'child safety' and 'online harms' (whatever on earth that means) are simply pretexts. They don't give a shit about children's safety. This bill will do nothing, nothing to improve the safety of children. The perpetrators will simply go after children in other ways. They won't change. If you, Mr. MP, care about children then ask why are they drawn to bad online content? What's going wrong with families and upbringing? Start with questions that might actually address the problem rather than implicate everyone who uses the Internet! The trajectory is to increase their power and control over your life. Again, they are NOT good people. They know EXACTLY what they are doing. They love dominating you. It's understandable why some imagine the government as simply well-meaning but misguided, for it makes our helpless subjection easier to accept. But we won't stop getting the boot from the state until we start calling their actions out as morally reprehensible.
- pharmakom 5y ago
  Indeed. We know exactly how much the UK conservatives care about child safety by their decisions around funding for child protection, schooling, health and so on. The child protection argument is a smoke screen.
  - BLKNSLVR 5y ago
    Ex-fucking-actly right. Various legislation around internet-related activities cleaning to be to "protect children" only shifts government resources and funding away from the departments that actually do something real and tangible to protect children. Child protection where I'm from only has the resources to attend to reports in which the child is in immediate, life-threatening danger. If a politician is talking about protecting children and it doesn't include increased funding for the actual child protection agencies and education of the bottom end of society, then they're actually working against protecting children. It's gross politics and should be called out.
buro9 5y ago
This appears to be the thing that will finally take my sites offline. I'm an individual who runs 300 forums. I do this because I believe that forums organised around an interest bring people together and help address loneliness. Further I believe that if you do that, you also help minimise the impact of depression and things like the suicide rate for middle aged men. The forums are things like this: https://www.lfgss.com/ https://www.lfgss.com/ Cycling related. So that people come together, build friendships, and take those friendships into the real world through the interest - to go on a cycle ride. I can't really see how I could comply with this bill at a low cost (the forums all run a deficit that I cover), and even if I did the paperwork side of things there are risks created that come with large and scary penalties for me... too large for me to consider bearing them. There is no exemption I fit in... I run forums, and these are defined by the bill as being a regulated service.
- 3np 5y ago
  I think you should contact the press. Maybe The Guardian? You seem like the kind of person that could help bring light and counterweight to this
- 908B64B197 5y ago
  Transfer them to the United States and simply ban European members?
  - viccuad 5y ago
    or better, transfer them to Europe and simply ban UK.
    - throwaway3699 5y ago
      There is a good chance a significant portion of those forums have UK members. You can't just hollow out a community like that and expect it to survive.
      - brokenmachine 5y ago
sys_64738 5y ago
Is the Matrix based in the UK? I guess I don't follow why this UK specific law matters to anybody outside that country. I mean, if the Matrix is in the EU then is a UK law really relevant? If your website is not based in the UK then it's not your problem unless I'm missing something. Even if the reach of the UK was beyond its shores then the fallback is to simply ban that country's IP addresses. Sucks to be from that country but blame your government for draconian legislation.
- Arathorn 5y ago
  Yes, the Matrix.org Foundation is a UK non-profit. It leans heavily on Element, the company which set up by the original Matrix team to fund Matrix, which is a UK for-profit. So if the UK govt starts incarcerating the team who created Matrix because they provide Matrix hosting, this is bad news for Matrix.
  - sys_64738 5y ago
    Yes that totally is terrible for them then. Hope this all falls apart for Boris.
- throwaway3699 5y ago
  What the US, UK, EU, Australia, Canada, etc... do have implications for the whole world. These countries all communicate and align on surveillance policy.
stjohnswarts 5y ago
I guess they'll just have to try and block it. The matrix devs aren't going to give in to government nonsense. Too bad they want to make 1984 a real thing.
Veedrac 5y ago
I realize this is about the least popular opinion you can express on HN, but I really strongly dislike the lack of engagement with the issue here. Online abuse, of all varieties, including sexual abuse, including of children, is not a boogieman. It is not marginal. It is not so rare as to be a rounding error. It is not enough for you, personally, to not want to partake in it. A person is not bad, or evil, or morally compromised, for recognizing or wanting to mitigate this problem. Semi-centralized control over data is not the end of the world. Most people are rightly fine with companies storing their data. The ability to enforce laws in publically shared online spaces is not an unthinkable compromise. Not all data needs to be end-to-end encrypted and immune to outside influence. Defaults matter. Purely offline methods of intervention and investigation are difficult to apply. I understand there are significant difficulties here. I moved to DuckDuckGo for my default search engine as a response to the mess Google made wrt. COVID. I am extremely worried about how disinformation countermeasures have and will continue to be misapplied. I realize that governments are not generally trustworthy. I agree that overregulation is extremely harmful. I just wish people would take both sides of the issue equally seriously.
- imtringued 5y ago
  In that case we should stop the online safety bill entirely because it will only end up with more child abuse in the end!
brokenmachine 5y ago
The positive part of this bill is that children will be free from risk after it passes, because actual risks to children have moved from the physical world to online now. /s, if it wasn't obvious. Don't we have laws that protect children already?
nprateem 5y ago
It's clear to me that this bill is incompatible with end-to-end encrypted chat apps. It's a convenient, backdoor way of allowing the security services to read all our messages again without the government needing to ban encryption itself. I suspect this is the real motivation, especially since it was originally proposed by May.
DanBC 5y ago
No-one is mentioning that this bill will compel platforms to host content they do not want. https://www.gov.uk/government/news/landmark-laws-to-keep-children-safe-stop-racial-hate-and-protect-democracy-online-published https://www.gov.uk/government/news/landmark-laws-to-keep-chi... > All in-scope companies will need to consider and put in place safeguards for freedom of expression when fulfilling their duties. These safeguards will be set out by Ofcom in codes of practice but, for example, might include having human moderators take decisions in complex cases where context is important. > People using their services will need to have access to effective routes of appeal for content removed without good reason and companies must reinstate that content if it has been removed unfairly. Users will also be able to appeal to Ofcom and these complaints will form an essential part of Ofcom’s horizon-scanning, research and enforcement activity.
xtat 5y ago
> These are, quite frankly, steps towards an authoritarian dystopia. Says it all.

362 points by daenney 5y ago

deleted 5y ago

[deleted]

> Forcing a “duty of care” responsibility on organisations which operate online will not only drown small and medium sized companies in administrative tasks and costs, it will further accentuate the existing monopolies by Big Tech. I often wonder about this. I mean, just the other day there was an article[1] here about sending GDPR requests to a health non-profit in order to sequence your genes for free. The costs of each individual piece of legislation are small, but internet legislation only ever trends in the direction of "more of it". As more small costs are added (GDPR, cookie notifications, right to be forgotten, removal of Safe Harbor etc.) these costs will start to play a factor in who can run a web service and who cannot. [1] https://news.ycombinator.com/item?id=27146975 https://news.ycombinator.com/item?id=27146975

iso1631 5y ago
Interesting. I don't send cookies or keep personal data, so why do I need to worry about them? The only time I've got into issues was with an american firm using an american law (dmca) to attack me (a non-american) and my hosting company (a non-american hosting company)
- Permit 5y ago
  > I don't send cookies or keep personal data, so why do I need to worry about them? Can you share your website/service?
  - frockington1 5y ago
    Commenting to follow up later. I'm really interested in the use case. The only thing I can think of would be a website similar to mid-2000s youtube to mp3 converters.
    - iso1631 5y ago
      Alas they are all behind ssl authentication so you wouldn't be able to access them, but the stuff I currently have open includes a switch port mapper (every 20 minutes all my switches are scanned and reports generated on what's plugged in where), a firewall config interpretor (a list of current port forwards is generated), and a logging server showing me what But if you want an example of a fully featured public site which doesn't need cookies https://news.ycombinator.com/ https://news.ycombinator.com/ Load that in lynx, which asks for every cookie, and none are set. Now sure, if you choose to log in, then functionally you need to accept the login cookie, but that cookie isn't spammed out to you. Under GDPR, a website doesn't need to ask for permission to have necessary cookies which enable core functionality such as security, network management, and accessibility.
      - Permit 5y ago
        > Under GDPR, a website doesn't need to ask for permission to have necessary cookies which enable core functionality such as security, network management, and accessibility. I am not convinced this is true. See: https://law.stackexchange.com/a/32157 https://law.stackexchange.com/a/32157 Also note that HN is likely in violation of this since there is no "Remember Me" checkbox when logging in. There is no indication that logins will be persistent.
- Mediterraneo10 5y ago
  Common CMSs send cookies by default. Even if you are one of those tech-inclined people using a static site generator for your own website, this is not the case for millions and millions of other websites.
  - nfoz 5y ago
    Then let's replace those CMS's. [edited with less anger]
    - maxrev17 5y ago
      Replace them? You need cookies for a tonne of reasons. It's really difficult to justify replacing half the web because some people abuse it. That's like replacing cars with walking because some people drink drive.
      - deleted 5y ago
        [deleted]
      - iso1631 5y ago
        What reasons do you need the types of cookies you need to ask permission for under the GDPR?
  - TheManInThePub 5y ago
    *sigh* Here we go again. The GDPR has no problem AT ALL with cookies. Use as many as you like with no need for popups. However, if you are using cookies to track or personally identify me, then you need to ask my permission to do so. And so you should. The amount of misinformation (some of it wilful) circulating about the GDPR on HN (a technical forum!) is shocking. If you consider yourself a professional developer then I strongly suggest you read a GDPR primer. There is no excuse not to. Following the GDPR will simply make your code safer when handling personal data.
ryukafalz 5y ago
Cookie notifications? You have to be actively tracking your users for those to even be relevant. You could literally do less work and avoid the need for them altogether.
daenney 5y ago
GDPR, or CCPA, isn't all that costly as long as you stop thinking of user data as something for you to harvest, mine, resell and profit from. If you instead treat user data like a security liability, system designs and trade-offs will flow from there. They'll help ensure you design systems that minimise collection and anonymise things early, remove data promptly when no longer needed, and make it easy to audit what data you do hold which in turns makes supporting GDPR requests easy. The largest cost of GDPR is making that shift for existing companies. If GDPR ends up killing a few companies because of that, I personally don't mind. And if a startup doesn't end up seeing the light of day because it's not possible for them to operate under the conditions that GDPR imposes, then from my point of view the GDPR is doing what I'd like it to do.
- anshorei 5y ago
  It's possible for you to be in violation of GDPR without "thinking of user data as something for you to harvest, mine, resell and profit from". If it's "killing a few companies" and "a startup doesn't end up seeing the light" then "GDPR is doing what I'd like it to do." That's a pretty shitty opinion to hold. What did those companies and startups do wrong? I'm as tired of stupid startups as the next person, but I won't cheer for their failure unless they actually do something wrong.
  - 3np 5y ago
    How about adding third-party analytics integrations that compromise your visitors, tracks them around the web, and fail to protect that data properly as the analytics company gets acquired by another entity? Stop saving PII for profit/exploitation reasons and you're in the clear.
  - account42 5y ago
    > What did those companies and startups do wrong? Well for one, they ignored users and the authorities asking them to stop their illegal data collection. No company is getting "killed" or even fined at all when they are not actively refusing to get compliant.

viktorcode 5y ago

Sad to see UK becoming one of the apologists of internet censorship, closing the gap to the levels of authoritarian countries. Once you have censorship facility in place, the area of its application will only grow. The term "illegal information" is also widely used in Russia for the same purpose.

t-writescode 5y ago
The cameras tracking everything everywhere in UK would say that it's long been an authoritarian country. Authoritarianism is a sliding scale. From what I can gather, lots of humans that have any political pull at all tend to be authoritarian (against the kinds of people they don't like, of course).
- cyrksoft 5y ago
  Most cameras in the UK (I think around 95% even) are private. Not sure why you think the UK is an authoritarian regime. Check any ranking and it is one of the freest countries out there (Heritage Ranking, for example: https://www.heritage.org/index/ranking https://www.heritage.org/index/ranking)
  - ipaddr 5y ago
    He is referring to the camera network in London.
    - cyrksoft 5y ago
      The government's camera network in London is very small, only 23708 cameras (15516 of which are from Transport of London across the tube network)[0]. It's a fairly small network for an authoritarian government. [0]https://www.cctv.co.uk/how-many-cctv-cameras-are-there-in-london/#:~:text=Research%20by%20CCTV.co.uk,world%2C%20and%20for%20good%20reason https://www.cctv.co.uk/how-many-cctv-cameras-are-there-in-lo....
      - 5y ago

______- 5y ago

I wish there was some sort of island or safe haven country setup by cryptographers so they could safely work on crypto without legal issues or crypto being seen as a munition and a threat to government. We could call it `01` and have it in a non fourteen-eyes jurisdiction preferably as an independent nation. We could export code containing cryptographic algorithms to countries that need it for privacy and safety reasons. Cryptography actually is needed for safety more than it is used by undesirable people to commit crimes!

teclordphrack2 5y ago
We can't have communist countries in latan america because of the good ole u s of a. You think you are going to get some slight utopia that helps people b/c of their ideals? Never going to happen... sadly.
- LeftTriangle 5y ago
  You can’t have communist countries in “Latan” America because their industrial base and population expertise is even worse than the USSR. Not to defend the CIA’s actions, but Venezuela was never going to work out.
  - FranchuFranchu 5y ago
    I don't think he was talking about Venezuela.
    - LeftTriangle 5y ago
      It’s a synecdoche.
- deleted 5y ago
  [deleted]
newacct583 5y ago
> Cryptography actually is needed for safety more than it is used by undesirable people to commit crimes! This is actually more because criminals on balance tend to be too dumb to hide their traces than because of any demographic truth. There are a lot of criminals. Focusing on "crypto" is, I think, a forest for the trees argument. Look instead at anonymity for evidence of where this kind of thing goes. Put up any reasonably anonymous forum where people can interact without their identities being reveals (which often includes, but doesn't always require, some kind of crypto protocol). Within a year it will be filled with criminals. Minor criminals like drug dealers. Worse things like market manipulation and fraudsters. Weapons sales. Black market rings. Revolutionaries of all sorts and sizes. Child porn. Mail order brides and other trafficking trades. Seriously, run a Tor exit node for a while and see where this goes. Your neighbors in your imagined "safe haven country for cryptographers" aren't going to be who you think they are.

Mindwipe 5y ago

The Bill is arguably the biggest threat to global online freedoms that exists. I'm surprised it has not been covered more here. It is amazingly badly written and will have huge negative consequences.

HeckFeck 5y ago
> Amazingly badly written You know they want ambiguity. It means MPs can dismiss objectors as irrational slippery slope proponents. Then when it's appended to the statute books it only takes a few judgements to 'clarify' the law. It's all downhill for freedom. The intention is clear. Voting is useless. The press have been silent to the point of compliance. It only takes a well placed messaging campaign and an unvigilant, ignorant public. At least we still have beer to see us through the long haul. See you at the pub.
- lostlogin 5y ago
  > See you at the pub This is a disturbing good summary of UK politics at the moment.

hwbehrens 5y ago

While I agree with their position overall, particularly with the ambiguity of "harmfulness", I think this is not the right tack to take here: > fails to acknowledge how actually harmful it would be for certain groups of the population to have their real life identity associated with their online identity No nanny-state-style government is going to buy this argument for a moment, because it requires a certain level of distrust of authority that certainly won't be present in the authorities themselves. Even among the population at large, there are undeniable trends in many countries towards authoritarianism on both the left and the right that are ignored or embraced by a majority (or a large minority) of their respective bases of support. Combined with prevailing trends against web-based anonymity and concerns over "fake news" and other amplification mechanisms for information warfare, I suspect we will see a further bifurcation into regulated, KYC-style services and unregulated, anonymous communities. Even here on HN, posters and commenters are regularly chastised for failing to adequately disclose their identities when they have a vested interest in the topic under discussion. Rather, the privacy angle which has been so conveniently mooted by Apple lately is (in my opinion) more palatable to the general public. By giving more responsibility to the service providers, the government is also implicitly giving them more power as well (as censors, if nothing else). But in practice, most people have personally observed that when more power/information is provided to private companies, it leads to a slippery slope of monetization, advertising, and lock-in. An appeal to this sense of unfairness and power imbalance with companies seems more "sellable" to me than convincing people their governments have nefarious/censorious motives. As a supporting argument, consider the general global consensus on gun control -- if people were willing to believe that their governments were ready to turn on them (in terms of physical oppression) at any moment, there would be more global concern about the physical power disparity between police/military and the civilian populace. Currently (with some exceptions, e.g. the U.S.), the global consensus is that people are much more willing to trust their police/military with weaponry than their fellow citizens, based on the implicit notion that the likelihood of experiencing harm from the latter is disproportionately more likely than the former. In contrast, as partially evidenced by the relative growth of Signal as a response to the changes in WhatsApp and the public support for app-tracking changes in iOS, people are demonstrably concerned about privacy in the commercial space. Thus, I theorize that an appeal to privacy would be more effective: "Under the proposed changes, we would have the ability to do ____, which would exploit your personal, private information for profit. If we can do it, that means ____, ____, and ____ can do it too. Do you want your government giving even more power to private companies to profit off you?"

sauntheninja 5y ago

Arathorn 5y ago

One of the most frustrating things about this legislation is that it's set up so that the only outfits with the resources to do the requested censorship would be a GAFAM. Which is utterly perverse, as on one hand the UK govt is despairing about the extent to which the UK is dependent on Big Tech social media and the control they exert on society... whilst simultaneously pushing through legislation which effectively ensures that GAFAM are the only people who can operate! The Matrix approach to addressing abuse is https://matrix.org/blog/2020/10/19/combating-abuse-in-matrix-without-backdoors https://matrix.org/blog/2020/10/19/combating-abuse-in-matrix... (and we're in the middle of building out the first implementation of the decentralised reputation proposal right now) - but it is not pleasant to think that if a judge considered that approach inadequate, the directors of UK entities providing Matrix hosting (e.g. Element, running matrix.org on behalf of The Matrix.org Foundation) would be eligible for jail time \o/ Needless to say, we're doing our best to explain to the UK Govt that their Bill is throwing out the baby along with bathwater...

deleted 5y ago
[deleted]
KingOfCoders 5y ago
It's the same with GDPR. When I worked for a large enterprise, we had a legal/compliance team of dozens of people and a huge outsourced legal budget. When I worked in the startup of my wife, it was me implementing GDPR compliance.
- Arathorn 5y ago
  But at least GDPR /is/ tractable to implement at small scale. Whereas for the OSB: if you run a smallish but popular chat/blog/forum/etc service, there literally isn’t a solution for moderation which isn’t fiendishly expensive, privacy invasive, or both. The legislation has clearly been dreamt up by folks saying “ah ha! if we threaten the Facebook UK executive mangement team with jailtime unless they do better at filtering self-harm/CSAM/terrorism/etc then they will obviously get their house in order!”. Whereas in practice they crush their own UK-based startups instead. So frustrating.

varispeed 5y ago

We have a little forum with a niche community. Few months ago we have closed the registration, because of spam and also because we had people posting questionable stuff and then reporting it to the hosting provider. There is not much money from ads, it barely covers the servers. Moderators do not always have time to react quickly to something stupid. Probably many other communities will be forced to close with either having to move to Facebook or other privacy hostile platforms. Then there is EU terreg - we have some members from the EU, so we would have to boot them out or create a legal entity in the EU to process content removal requests as I understand, in a year or so. There is no money for that. Sad times for the internet...

ronsor 5y ago
> we would have to boot them out or create a legal entity in the EU to process content removal requests as I understand, in a year or so. Have you considered just ignoring them? Provided you're not an (international) business, you can likely afford to ignore foreign governments, and if they want to block you, that's up to them.

jeena 5y ago

I'm so happy that there are people out there who care about this things and have the time to invest fighting the fight. I would like to be with you there but right now my life doesn't allow the time but I'm totally with you there but only can help by throwing some money on the problem. But a very big thank you to everyone involved!

world_peace42 5y ago

"when we force technology companies to make calls about what is right or wrong - or what is “likely to have adverse psychological or physical impacts” on children - we end up in a dangerous place of centralising and regulating relative morals" I told myself to laugh when I read this line. As it stands now, a small group of Facebook and Google executives determine what peasants are allowed to think and see on a daily basis based on their "relative morals". Not that politicians are any better, but at least some people did vote for them, and that counts for something. Let's be real here, anyone with time on their hands should click on foundation, and go check each of their grant histories. I am not even going to agree or disagree with the legislation, but I'm going to bet the money trail will explain this letter.

deleted 5y ago
[deleted]

einpoklum 5y ago

> Whilst we sympathise with the [UK] government’s desire to show action in this space and to do something about children’s safety (everyone’s safety really) I don't sympathize with it. A government which supports and arms near-genocidal attacks and blockades in Yemen and in Palestine - is not a legitimate actor where it comes to safety and harm prevention online. Or at the very least - where its involvement may have effect on non-UK-citizens.

jsdevtom 5y ago

The current UK politicians are so mind numbingly naive in so many ways.

brokenmachine 5y ago
That's what they want you to think. It's not naivete.

HeckFeck 5y ago

> Whilst we sympathise with the government’s desire to show action in this space and to do something about children’s safety (everyone’s safety really), we cannot possibly agree with the methods. Respectfully, stop sympathising with authoritarians who want to take away your freedom. They are not good people. Good people aren't nosey. Good people don't deprive others of liberty. Neither do they class a whole group (Internet users and entrepreneurs) as responsible for the actions of a minority. Guilt by association and collective punishment are antithetical to any lover of freedom and life. Their reasons of 'child safety' and 'online harms' (whatever on earth that means) are simply pretexts. They don't give a shit about children's safety. This bill will do nothing, nothing to improve the safety of children. The perpetrators will simply go after children in other ways. They won't change. If you, Mr. MP, care about children then ask why are they drawn to bad online content? What's going wrong with families and upbringing? Start with questions that might actually address the problem rather than implicate everyone who uses the Internet! The trajectory is to increase their power and control over your life. Again, they are NOT good people. They know EXACTLY what they are doing. They love dominating you. It's understandable why some imagine the government as simply well-meaning but misguided, for it makes our helpless subjection easier to accept. But we won't stop getting the boot from the state until we start calling their actions out as morally reprehensible.

pharmakom 5y ago
Indeed. We know exactly how much the UK conservatives care about child safety by their decisions around funding for child protection, schooling, health and so on. The child protection argument is a smoke screen.
- BLKNSLVR 5y ago
  Ex-fucking-actly right. Various legislation around internet-related activities cleaning to be to "protect children" only shifts government resources and funding away from the departments that actually do something real and tangible to protect children. Child protection where I'm from only has the resources to attend to reports in which the child is in immediate, life-threatening danger. If a politician is talking about protecting children and it doesn't include increased funding for the actual child protection agencies and education of the bottom end of society, then they're actually working against protecting children. It's gross politics and should be called out.

buro9 5y ago

This appears to be the thing that will finally take my sites offline. I'm an individual who runs 300 forums. I do this because I believe that forums organised around an interest bring people together and help address loneliness. Further I believe that if you do that, you also help minimise the impact of depression and things like the suicide rate for middle aged men. The forums are things like this: https://www.lfgss.com/ https://www.lfgss.com/ Cycling related. So that people come together, build friendships, and take those friendships into the real world through the interest - to go on a cycle ride. I can't really see how I could comply with this bill at a low cost (the forums all run a deficit that I cover), and even if I did the paperwork side of things there are risks created that come with large and scary penalties for me... too large for me to consider bearing them. There is no exemption I fit in... I run forums, and these are defined by the bill as being a regulated service.

3np 5y ago
I think you should contact the press. Maybe The Guardian? You seem like the kind of person that could help bring light and counterweight to this
908B64B197 5y ago
Transfer them to the United States and simply ban European members?
- viccuad 5y ago
  or better, transfer them to Europe and simply ban UK.
  - throwaway3699 5y ago
    There is a good chance a significant portion of those forums have UK members. You can't just hollow out a community like that and expect it to survive.
    - brokenmachine 5y ago

sys_64738 5y ago

Is the Matrix based in the UK? I guess I don't follow why this UK specific law matters to anybody outside that country. I mean, if the Matrix is in the EU then is a UK law really relevant? If your website is not based in the UK then it's not your problem unless I'm missing something. Even if the reach of the UK was beyond its shores then the fallback is to simply ban that country's IP addresses. Sucks to be from that country but blame your government for draconian legislation.

Arathorn 5y ago
Yes, the Matrix.org Foundation is a UK non-profit. It leans heavily on Element, the company which set up by the original Matrix team to fund Matrix, which is a UK for-profit. So if the UK govt starts incarcerating the team who created Matrix because they provide Matrix hosting, this is bad news for Matrix.
- sys_64738 5y ago
  Yes that totally is terrible for them then. Hope this all falls apart for Boris.
throwaway3699 5y ago
What the US, UK, EU, Australia, Canada, etc... do have implications for the whole world. These countries all communicate and align on surveillance policy.

stjohnswarts 5y ago

I guess they'll just have to try and block it. The matrix devs aren't going to give in to government nonsense. Too bad they want to make 1984 a real thing.

Veedrac 5y ago

I realize this is about the least popular opinion you can express on HN, but I really strongly dislike the lack of engagement with the issue here. Online abuse, of all varieties, including sexual abuse, including of children, is not a boogieman. It is not marginal. It is not so rare as to be a rounding error. It is not enough for you, personally, to not want to partake in it. A person is not bad, or evil, or morally compromised, for recognizing or wanting to mitigate this problem. Semi-centralized control over data is not the end of the world. Most people are rightly fine with companies storing their data. The ability to enforce laws in publically shared online spaces is not an unthinkable compromise. Not all data needs to be end-to-end encrypted and immune to outside influence. Defaults matter. Purely offline methods of intervention and investigation are difficult to apply. I understand there are significant difficulties here. I moved to DuckDuckGo for my default search engine as a response to the mess Google made wrt. COVID. I am extremely worried about how disinformation countermeasures have and will continue to be misapplied. I realize that governments are not generally trustworthy. I agree that overregulation is extremely harmful. I just wish people would take both sides of the issue equally seriously.

imtringued 5y ago
In that case we should stop the online safety bill entirely because it will only end up with more child abuse in the end!

brokenmachine 5y ago

The positive part of this bill is that children will be free from risk after it passes, because actual risks to children have moved from the physical world to online now. /s, if it wasn't obvious. Don't we have laws that protect children already?

nprateem 5y ago

It's clear to me that this bill is incompatible with end-to-end encrypted chat apps. It's a convenient, backdoor way of allowing the security services to read all our messages again without the government needing to ban encryption itself. I suspect this is the real motivation, especially since it was originally proposed by May.

DanBC 5y ago

No-one is mentioning that this bill will compel platforms to host content they do not want. https://www.gov.uk/government/news/landmark-laws-to-keep-children-safe-stop-racial-hate-and-protect-democracy-online-published https://www.gov.uk/government/news/landmark-laws-to-keep-chi... > All in-scope companies will need to consider and put in place safeguards for freedom of expression when fulfilling their duties. These safeguards will be set out by Ofcom in codes of practice but, for example, might include having human moderators take decisions in complex cases where context is important. > People using their services will need to have access to effective routes of appeal for content removed without good reason and companies must reinstate that content if it has been removed unfairly. Users will also be able to appeal to Ofcom and these complaints will form an essential part of Ofcom’s horizon-scanning, research and enforcement activity.

xtat 5y ago

> These are, quite frankly, steps towards an authoritarian dystopia. Says it all.