4 ms·

> because they insist on violating their readers' privacy rights and that would be illegal in the EU. Bad assumption. Maybe an unpopular fact, but many sites s

> because they insist on violating their readers' privacy rights and that would be illegal in the EU. Bad assumption. Maybe an unpopular fact, but many sites simply block EU access to avoid potential legal pitfalls of navigating foreign laws. Getting the site compliant would require review from legal teams and work from (likely contracted) web developers, which is almost certainly not in the budget for a side site like this. Not every website is backed by a corporation with on-staff web developers and corporate counsel to double-check everything. Their audience is primarily a local one, so allocating the budget to do this and maintain it isn’t worth it.

gorgoiler 5y ago
It’s a form of purity spiral where the consensus on acceptable behaviour becomes narrower and narrower as peope try to out-compete each other on who is the most virtuous, or in this case who is the most careful about nonexistent GDPR risks.
- PragmaticPulp 5y ago
  > or in this case who is the most careful about nonexistent GDPR risks. Parent comment is convinced the site is doing something that would be illegal. You are convinced that the site’s GDPR risk is non-existence. It’s amazing how many people sitting on the sidelines can be so confident about GDPR while having entirely opposite opinions. But my point stands: This stuff is complicated and requires sign-off from the lawyers in any large institution. If you don’t have a reason or budget to go through that process, you don’t do it. It’s not virtue signaling or anything silly like that. It’s basic corporate legal protections.
  - gorgoiler 5y ago
    With respect, your assertion that these 451s serve a useful purpose does not match up with my experience of seeing them in the wild. In fact this is the first one I’ve seen that isn’t being done as a protest.
bubblethink 5y ago
This is a completely backwards way of looking at it. If you don't have the budget, create a static website and throw it behind github pages or s3 or whatever. An entire university with a school of computer science cannot figure out some standard way of doing this ?
- tapoxi 5y ago
  This publication is independent and not run by the school.
  - bubblethink 5y ago
    Right, but surely they have resources at the school if they need technical assistance. It's a university. Just find any CS major and they'll tell you how to set up a website.
    - Benlights 5y ago
      It's not the technical assistance needed it's the legal review. Go get that from a CS major.
      - wizzwizz4 5y ago
        You don't need a legal review. • A static site without JavaScript; • with all images / external resources hosted on the same domain; • where the logs are default configuration, don't leave the server (except as GoAccess reports), and are deleted / anonymised eventually; is GDPR-compliant. Sure, there are other ways to be compliant, but this works, and is basically the default way of setting up a website. It's not hard to check whether this is how your website works.
        dogleash 5y ago
        When you put together that simple bulletpoint approach you still leveraged baselevel knowledge about the GDPR that would be ridiculous to assume of a CS major.
inglor_cz 5y ago
Within the EU itself, GDPR is rarely enforced. A paper tiger of sorts. Its main meaning is to scare some people straight, but the resources for actual enforcement of its provisions are rather limited. For example, I still receive a lot of commercial spam that advertises in-EU businesses.
- blululu 5y ago
  Maybe but no lawyer is going to say it’s probably fine to break the law since enforcement is lax, and the engineering team isn’t going to say we can stand by all the random code this we pulled from npm. The obvious thing to do here is blocking readers from 7 time zones away which up until today went unnoticed.
  - inglor_cz 5y ago
    "which up until today went unnoticed" GDPR-related 451 is quite widespread in my experience, but that is what VPNs are for :-)
- bmn__ 5y ago
  > rarely enforced. A paper tiger https://news.ycombinator.com/item?id=28140406 https://news.ycombinator.com/item?id=28140406

gorgoiler 5y ago

It’s a form of purity spiral where the consensus on acceptable behaviour becomes narrower and narrower as peope try to out-compete each other on who is the most virtuous, or in this case who is the most careful about nonexistent GDPR risks.

PragmaticPulp 5y ago
> or in this case who is the most careful about nonexistent GDPR risks. Parent comment is convinced the site is doing something that would be illegal. You are convinced that the site’s GDPR risk is non-existence. It’s amazing how many people sitting on the sidelines can be so confident about GDPR while having entirely opposite opinions. But my point stands: This stuff is complicated and requires sign-off from the lawyers in any large institution. If you don’t have a reason or budget to go through that process, you don’t do it. It’s not virtue signaling or anything silly like that. It’s basic corporate legal protections.
- gorgoiler 5y ago
  With respect, your assertion that these 451s serve a useful purpose does not match up with my experience of seeing them in the wild. In fact this is the first one I’ve seen that isn’t being done as a protest.

bubblethink 5y ago

This is a completely backwards way of looking at it. If you don't have the budget, create a static website and throw it behind github pages or s3 or whatever. An entire university with a school of computer science cannot figure out some standard way of doing this ?

tapoxi 5y ago
This publication is independent and not run by the school.
- bubblethink 5y ago
  Right, but surely they have resources at the school if they need technical assistance. It's a university. Just find any CS major and they'll tell you how to set up a website.
  - Benlights 5y ago
    It's not the technical assistance needed it's the legal review. Go get that from a CS major.
    - wizzwizz4 5y ago
      You don't need a legal review. • A static site without JavaScript; • with all images / external resources hosted on the same domain; • where the logs are default configuration, don't leave the server (except as GoAccess reports), and are deleted / anonymised eventually; is GDPR-compliant. Sure, there are other ways to be compliant, but this works, and is basically the default way of setting up a website. It's not hard to check whether this is how your website works.
      - dogleash 5y ago
        When you put together that simple bulletpoint approach you still leveraged baselevel knowledge about the GDPR that would be ridiculous to assume of a CS major.

inglor_cz 5y ago

Within the EU itself, GDPR is rarely enforced. A paper tiger of sorts. Its main meaning is to scare some people straight, but the resources for actual enforcement of its provisions are rather limited. For example, I still receive a lot of commercial spam that advertises in-EU businesses.

blululu 5y ago
Maybe but no lawyer is going to say it’s probably fine to break the law since enforcement is lax, and the engineering team isn’t going to say we can stand by all the random code this we pulled from npm. The obvious thing to do here is blocking readers from 7 time zones away which up until today went unnoticed.
- inglor_cz 5y ago
  "which up until today went unnoticed" GDPR-related 451 is quite widespread in my experience, but that is what VPNs are for :-)
bmn__ 5y ago
> rarely enforced. A paper tiger https://news.ycombinator.com/item?id=28140406 https://news.ycombinator.com/item?id=28140406