4 ms·

If you want to toss some static HTML into a host, go for it. If you want to record statistics on how many page hits you had, go for it. If you want to add Jav

If you want to toss some static HTML into a host, go for it. If you want to record statistics on how many page hits you had, go for it. If you want to add JavaScript for interactions and making it look prettier, go for it. But if you want to contribute to a privacy-violating network that tracks individual users, then that goes far beyond wanting "just to put up a website somewhere".

true_religion 5y ago
Well, you can totally contribute to a privacy violating network … so long as the data is located and processed in France. They are only tryin to keep their monopoly on government oversight which is reasonable for a governing body (our citizens = our control).
- viro 5y ago
  That's why this whole thing is nothing but protectionism.
- pgeorgi 5y ago
  > so long as the data is located and processed in France. ... you also have to ask for permission first. The main difference is that for a data processor in France it seems possible to get all the right contracts in place, while a US based data processor is incapable of doing that thanks to FISA and similar US initiatives.
- Nextgrid 5y ago
  > you can totally contribute to a privacy violating network … so long as the data is located and processed in France. While that's not the issue being discussed here, you should by default only collect & process the minimum amount of data needed for the product/service to function. Analytics aren't part of that and would need to be opt-in.
shadowgovt 5y ago
At this point, tossing some static text up with default apache configs runs afoul of GDPR opt-out and data-scrubbing requirements, IIUC.
- MereInterest 5y ago
  I'd be interested to hear exactly what default configuration violates GDPR, as that wasn't something I'd heard before. However, even if that is the case, that would imply that the defaults should be changed. Imagine that you run a workplace where floor space is relatively expensive. To avoid increasing the floor space, you determine exactly how wide each hallway must be, exactly how much space is required, and build everything to that specification. Your hiring decisions take the weight of an applicant into account, so that nobody will be too large for those hallways. Then a law comes along saying that your coal mine is dangerous, and your use of child labor is unethical. "But look at the cost!", you cry, "I can't afford to enlarge every tunnel to accommodate full-grown adults!" But there was no reason the tunnels couldn't have been built larger in the first place. There was no reason why the web and the internet could not have chosen to respect privacy by default, and thereby avoid the current costs of changing their software and business models. If it is true that the default apache configurations violate privacy standards, just as any configuration of Google Analytics violates privacy standards, then that is a sign of just how much the regulation is needed.
  - shadowgovt 5y ago
    > I'd be interested to hear exactly what default configuration violates GDPR https://law.stackexchange.com/questions/42438/do-default-apache-logs-violate-the-gdpr https://law.stackexchange.com/questions/42438/do-default-apa... It would appear public IP addresses are PII. Apache (and most web servers) log those by default. A case can be made, on a site-by-site basis, that those are necessary for providing the functionality of the site. But that's a hard case to make if the logs are never actually read, and then if they're collected for that purpose, timely deletion is important (and unless your host also configures log rotation and disposal, timely deletion isn't happening). I'm pretty sure all of this has to be declared in a privacy declaration anyway, even if they are collected for site operations purposes and deleted in a timely fashion. With all these constraints, probably safer to run in a privacy-configured Docker in one of the big Cloud hosts than to stand up one's own apache install.

true_religion 5y ago

Well, you can totally contribute to a privacy violating network … so long as the data is located and processed in France. They are only tryin to keep their monopoly on government oversight which is reasonable for a governing body (our citizens = our control).

viro 5y ago
That's why this whole thing is nothing but protectionism.
pgeorgi 5y ago
> so long as the data is located and processed in France. ... you also have to ask for permission first. The main difference is that for a data processor in France it seems possible to get all the right contracts in place, while a US based data processor is incapable of doing that thanks to FISA and similar US initiatives.
Nextgrid 5y ago
> you can totally contribute to a privacy violating network … so long as the data is located and processed in France. While that's not the issue being discussed here, you should by default only collect & process the minimum amount of data needed for the product/service to function. Analytics aren't part of that and would need to be opt-in.

shadowgovt 5y ago

At this point, tossing some static text up with default apache configs runs afoul of GDPR opt-out and data-scrubbing requirements, IIUC.

MereInterest 5y ago
I'd be interested to hear exactly what default configuration violates GDPR, as that wasn't something I'd heard before. However, even if that is the case, that would imply that the defaults should be changed. Imagine that you run a workplace where floor space is relatively expensive. To avoid increasing the floor space, you determine exactly how wide each hallway must be, exactly how much space is required, and build everything to that specification. Your hiring decisions take the weight of an applicant into account, so that nobody will be too large for those hallways. Then a law comes along saying that your coal mine is dangerous, and your use of child labor is unethical. "But look at the cost!", you cry, "I can't afford to enlarge every tunnel to accommodate full-grown adults!" But there was no reason the tunnels couldn't have been built larger in the first place. There was no reason why the web and the internet could not have chosen to respect privacy by default, and thereby avoid the current costs of changing their software and business models. If it is true that the default apache configurations violate privacy standards, just as any configuration of Google Analytics violates privacy standards, then that is a sign of just how much the regulation is needed.
- shadowgovt 5y ago
  > I'd be interested to hear exactly what default configuration violates GDPR https://law.stackexchange.com/questions/42438/do-default-apache-logs-violate-the-gdpr https://law.stackexchange.com/questions/42438/do-default-apa... It would appear public IP addresses are PII. Apache (and most web servers) log those by default. A case can be made, on a site-by-site basis, that those are necessary for providing the functionality of the site. But that's a hard case to make if the logs are never actually read, and then if they're collected for that purpose, timely deletion is important (and unless your host also configures log rotation and disposal, timely deletion isn't happening). I'm pretty sure all of this has to be declared in a privacy declaration anyway, even if they are collected for site operations purposes and deleted in a timely fashion. With all these constraints, probably safer to run in a privacy-configured Docker in one of the big Cloud hosts than to stand up one's own apache install.