14 ms·

On the contrary, it only forces those providers to have a European presence. We're not fragmenting the internet by looking after our own interests. This wouldn

On the contrary, it only forces those providers to have a European presence. We're not fragmenting the internet by looking after our own interests. This wouldn't be an issue if Americans viewed rights (and in this case privacy rights) as belonging to human being as opposed to Americans citizens. The US's policy is what led to this: > Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield

gxs 5y ago
This is a great response to OPs comment. At the end of the day we should be doing what is good for the People and somehow its always assumed that they will/should be the ones impacted when policies like these are enacted. But Europe has leverage here - I don't think Amazon would want to miss out on a giant market base out of some moral principle and there are probably other levers to be pulled here to encourage that. Anyway, not adding much to your comment other than kudos.
VikingCoder 5y ago
You are absolutely fragmenting the internet. We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare. EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may believe that's a good thing, and that's a rational discussion we can have. But don't lie to yourself, or to me, that this doesn't fragment the internet.
- 0des 5y ago
  désolé!
  - benreesman 5y ago
    Je suis un homme occupé, et te faire passer pour une risée peut prendre du temps, mais tout le monde a besoin d'un passe-temps.
- anothernewdude 5y ago
  So pass the cost of doing business in France on to the french.
- richardfey 5y ago
  The fragmentation is acceptable since the alternative for non-US citizens is to be treated as "free game"?
  - nickpp 5y ago
- malermeister 5y ago
  The solution to this is to get your government to get its shit together on privacy. This is just a defensive act by the Europeans and to blame it on them is victim blaming.
- mping 5y ago
  This completely misses the point, the laws shouldn't be written to accommodate businesses, its the other way around. If fragmenting is a consequence of better privacy laws, so be it.
  - nickpp 5y ago
    Businesses exists for consumers. Fragmenting hurts people - European users - in the first place. I see very little advantages from these privacy laws but I use and appreciate US businesses every day.
    - aksss 5y ago
      What, you don't appreciate a pop-up on every web page telling you that cookies are going to be used? XD
      - lillecarl 5y ago
        The cookie banners are a byproduct of companies still wanting to abuse your data, when was the last time you saw a cookie pop-up on HN? Logged in or not.
        VikingCoder 5y ago
        If only there were some way that European citizens could have told their browsers to not accept Cookies, then maybe we all wouldn't have to click on those banners all the damn time.
        Dylan16807 5y ago
        But I do want most non-tracking cookies. Still, the "please let us track" popups can be fixed by policy or law, and I hope they are.
    - Nullabillity 5y ago
      So if those businesses utterly refuse to serve consumers then they have no business existing?
- rightbyte 5y ago
  > would take weeks of vacation with zero support for us Heh. Somethings tells me a devops engineer in France has way better work-life balance.
  - VikingCoder 5y ago
    You'd think a _team_ of them could provide 8/5 (8 hours a day, 5 days a week) service...
- __MatrixMan__ 5y ago
  The internet was designed to be resilient in the face of nuclear war. If it can't handle governments that actually protect their citizens from predation by multinational corporations, then we should rethink some things about the direction that we've taken with it.
  - gjs278 5y ago
  - VikingCoder 5y ago
    Sure, so, let's say that France decides that HN info is PII. So then Hacker News has to launch servers in France. And then French HN users are in an island, and only see other French HN users' posts and comments. And, to be clear, you think that's a good thing?
    - kyletns 5y ago
      Do you think it would be difficult to allow the different HN servers to federate their content across regions?
      - VikingCoder 5y ago
        In what way is a French resident protected if their data is stored on a server in France but can be federated to other countries?
      - jonas21 5y ago
        Would it be impossible? No. But would it be, say, 5x the amount of effort to build and maintain a federated system with no data stored across boundaries? Probably.
      - esyir 5y ago
        Difficult? Not so much. Demanding a yet another great firewall on the other hand sounds absolutely atrocious to me.
    - 5y ago
- javajosh 5y ago
  There is so much I want to say about this comment! First of all, it sounds like you had a terrible experience because you picked a bad ISP. I sympathize. But then you generalize from that and imply that anyone wanting an EU host will experience the same. Obviously that's not true - or do you believe no good ISPs exist in France? Second of all, why did you fork your code? Did you write your service to use proprietary Azure APIs without regard to vendor lock-in? Why not take this as an opportunity to incrementally extract the proprietary apis out of your application and replace them with processes you actually own? This will allow you to undo the fork and continue on, able to deploy your application anywhere you want.
  - VikingCoder 5y ago
    We did our research, and settled on the French cloud provider that fit our parameters. They made promises about support hours that they did not keep. Changing cloud service providers is not cheap. We were a small team, and this cost us lots of effort. We didn't fork our code, we forked our services. We ran everything on Azure. Then we had to configure our kiosk devices to either talk to Azure, or to talk to our servers in France. "Did you write your service to use proprietary Azure APIs without regard to vendor lock-in? Why not take this as an opportunity" I'm sorry, do you have any idea of the cost of doing these things? If you have 6 developers, total, how many of them are you willing to allocate to rewriting your stack, so that you can sell your product in Europe?
    - cpeterso 5y ago
      Do cloud service providers like Azure not have a way to "pin" some of your service instances to servers in specific countries? Seems like this capability would be important differentiating feature given EU privacy laws about where user data is hosted.
      - seszett 5y ago
        They do, in fact Azure is totally compatible with French law for handling private data. Many large companies use it.
- na85 5y ago
  Sounds like the market in france is ripe for disruption.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- titzer 5y ago
  > You are absolutely fragmenting the internet. It's not fragmenting the internet; fragmentation is the whole point of the internet. It's (re-)decentralizing something that has been decentralized the whole time, until these gluttonous whales decided try to eat the whole pie.
  - VikingCoder 5y ago
    So a computer in France can not legally talk to a computer in the United States, but if I instead put that computer in France, I'm legally okay. And you're convinced that embodies "the whole point of the internet"?
    - titzer 5y ago
      It isn't about "one computer talking to another", it's about where sensitive information is stored. It has never been legal to store classified US intelligence on computers outside of the control of the US government. That's an extreme example, but the handling of many types of information is prescribed by laws in different jurisdictions. Does that mean that US computers cannot "talk" to another other computers? No. Does that make the internet invalid? No. Decentralization of the cloud is a good thing for so many reasons. I think you're deliberately confusing it with your PII issues and not grasping the larger picture.
      - VikingCoder 5y ago
        I think you're ignoring the harm done to small businesses who cannot afford to implement decentralized services. You are raising the barrier to entry, limiting competition. Competition is good for so many reasons. I think you're deliberately ignoring the impact on small companies and not grasping the larger picture.
        6gvONxR4sf7o 5y ago
        Those poor small international businesses? If you want to do business internationally, it'll be complicated, and that's fine. The internet has spoiled us by making it so easy for a while.
- karmelapple 5y ago
  Quick question: was there a reason you could not use Azure’s region support? https://azure.microsoft.com/en-us/global-infrastructure/geographies/#geographies https://azure.microsoft.com/en-us/global-infrastructure/geog... Or was it before Azure had that? Looks like they’ve had it for awhile, at least back to 2009 or 2010.
  - VikingCoder 5y ago
    France, Year Opened 2018, is what I see on that page. This was impacting us in 2014 to 2016, as I remember.
    - PeterisP 5y ago
      However all the GDPR requirements entered into force just in may 2018? But in any case, the point is that the issue is solved without changing the laws or people having to switch cloud providers, as simply the global cloud providers have started offering compliant services.
    - Ruphin 5y ago
      Looks to me like the regulations did exactly what they were designed to do, and Azure implemented support for the EU market. The goal of these regulations is not to make things harder for companies trying to publish products in different regions, the goal is to get the big platforms (AWS, Azure, GCP) to implement systems that are in line with EU privacy requirements. I'm sorry your business was impacted during the period where the regulations came into effect and the big platforms did not have compliant services ready. It would have been better if the negative externalities of these regulations would be entirely carried by the big platforms who are responsible for consumer privacy in the first place.
- unknown2374 5y ago
  You do realize by the same logic this inspires competitors to innovate...
- forty 5y ago
  Agreed. But the internet is already fragmented. Each countries have their own laws and other countries no reason to follow them. All kind of content is accessible only in certain countries. It's also true for physical goods. I'm not sure why it's a problem.
- miohtama 5y ago
  Microsoft has set up a fully independent data center and business in German just because of this: https://news.microsoft.com/europe/2020/09/30/our-commitment-to-delivering-the-microsoft-cloud-in-germany/ https://news.microsoft.com/europe/2020/09/30/our-commitment-...
  - VikingCoder 5y ago
    Unfortunately, that didn't exist for us back in 2016, and our product is no longer in development.
    - teddyh 5y ago
      So your argument is out of date and no longer valid.
      - VikingCoder 5y ago
        Right. All I have to do is to stand up two complete copies of my full stack, and support both of them. There's no way that adds extra burden to me. My argument is completely invalid. Thanks for explaining that to me.
        nickforr 5y ago
        If you want to sell in two different countries don’t you have to comply with two different legal codes and support both of them?
        jdrc 5y ago
        noitpmeder 5y ago
        The purpose of laws is to protect and govern their local citizens. I would hate to live in a world where a law does not get passed because of an argument like "but imagine how much work developers will have to do to follow the law!"
- 6510 5y ago
  I feel your pain but as an argument in this discussion it doesn't work. Your problem was in 2014 and Azure works just fine now. It took some doing which was the whole point. The local provider even got a chance to match the offer.
- belorn 5y ago
  Its very interesting if limiting how companies are allowed to track, store and sell private information would be the central issue for which the internet will fragment around. It almost like tracking, storing and selling is the center of the modern Internet, rather than protocols like tcp, upd, https and so on. In the past people said that the Internet was made for porn. Today the Internet is seemingly made for advertisement and surveillance. It not strange that so many people who worked in this industry for decades are feeling a bit lost in this new horrifying industry, which if the Internet really is made only to do advertisement and surveillance, I honestly think humanity is better off without it.
  - VikingCoder 5y ago
    The internet is a tool. You should support companies with the best behavior. I worked at a company that enabled a radiologist in over country to do a preliminary read of a CT scan performed in another country. Cutting the amount of time for a CT scan, and even connecting a CT scan with a radiologist who specialized in that particular kind of scan, we saved lives. And yes, there's also furry porn. It's a tool. I feel like I'm trying to convince you that BOOKS are good, despite the existence of hentai.
    - belorn 5y ago
      Could that company exist if it wasn't allow to use advertisement or sell private information? In the past I would say yes without question since there is nothing inherently in connecting a CT scan with a radiologist specialist that require Google Analytics. Nothing at all.
- dspillett 5y ago
  > We had PII on Azure. So why didn't you use Azure resources in Europe instead of "some crappy provider"? Sounds like you made a rod for your own back. If our clients are happy with Azure (in the right region) then I can't imagine many in the EU (other than perhaps national security services and their suppliers) reasonably refusing to allow use of it. We host in Azure for some pretty significant financial organisations, mostly UK based but spreading our area. Some companies are requiring us to fully host in Azure DCs in their region, and some of those are Eastern, not UK/EU, based companies. At least one US interest that a friend's employer supplies demands data about its employees be hosted over there rather than over here, presumably so they can be assured it is kept to standards they are locally required to follow. Is it wrong that way around in your book too? It isn't as easy as having everything in one region of course, but not much harder nor massively more expensive (caveat: most likely, as far as I know, I have the luxury of ignoring the bits that don't interest me and money is often one of those things, but I'm also senior enough that if there was something expensive happening, or something not happening due to expense, I'd catch wind as it would affect things I need to plan around) and it can't be as faffy/costly as using different providers in each territory. If you are correctly following relevant regulations everywhere this does not fragment things any more than other rules that already existed. Aside from the fact things are being enforced this time, forcing companies handling PII to not quietly do things wrong because it is inconvenient to do things right. As an individual I'm perfectly fine with this.
- ghostoftesla 5y ago
  company stooge.
voldacar 5y ago
lhorie 5y ago
I think fragmentation and looking after one's interests aren't even opposites. Analytics in particular seem like a very lopsided value prop: the american entity (Google) stands to gain from collecting analytics but doesn't really provide a perceivable equivalent value through the analytics service to the affected parties (EU consumers) in return, as you'd normally expect in a fair trade policy between two countries. Looking at it from this angle, it seems perfectly reasonable for the EU to dislike the specifics of the analytics use case while still being ok with something like Google Docs.
- aksss 5y ago
  > lopsided value prop But that's not what CNIL is basing their decision on: "The CNIL concludes that transfers to the United States are currently not sufficiently regulated...Indeed, although Google has adopted additional measures to regulate data transfers in the context of the Google Analytics functionality, these are not sufficient to exclude the accessibility of this data for US intelligence services." I probably don't understand the legal issues fully, but it seems the worry is that US intelligence services may be tapping the lines and databases of Google, may have agents working at Google as badged employees, or may be able to subpoena Google (or any US service provider). [for the record, I wouldn't doubt if all the above are true] I don't see how Google Docs is less susceptible to Google tracking user activity (and by extension US intelligence). > "CNIL recommends that these tools should only be used to produce anonymous statistical data" So the tools are not anonymous because the request headers of the client are being logged and used to identify a session, along with what resources on the site were accessed in that session. Any site operator has this data on their visitors. CNIL doesn't want sites hosted in France to be making client-side calls to services provided by Google (whether analytics, fonts, etc) or theoretically any US-based service provider because the client request will be logged by that resource host and open to access by US law enforcement? Do I understand that correctly? What's the solution? A site builder can't let web clients make direct calls to any resources in the US? That seems... sweeping, profound, surprising, impactful. Have fun with that.
  - kilburn 5y ago
    > because the request headers of the client are being logged and used to identify a session No need to dig so deep: IP addresses are considered private information under the current EU law, meaning that just opening a client-side connection somewhere leaks that data to that somewhere. > I don't see how Google Docs is less susceptible to Google tracking user activity (and by extension US intelligence). There is none. The difference is that the website studied in the ruling was not including resources hosted at Google Docs, and hence no mention of it. If the site embedded or directly linked to a google docs document the same reasoning would have been applied. > CNIL doesn't want sites hosted in France to be making client-side calls to services provided by Google (whether analytics, fonts, etc) or theoretically any US-based service provider because the client request will be logged by that resource host and open to access by US law enforcement? Do I understand that correctly? Almost. They don't want any calls prior to explicit user acceptance. > What's the solution? For fonts/images required to load the page, use EU-based hosting facilities. If you want to link to a google docs document, a youtube video or something like that, ask the user before following that link. > That seems... sweeping, profound, surprising, impactful. Have fun with that. It is, I don't think anyone is denying that. There are several things that may happen here: 1. US tech companies take it as common practice to spin-off EU-based companies that are not subject to US law and store everything in EU soil. When they don't, EU competitors pop up and EU companies use those. 2. The US passes laws that offer EU-level protections to both their own citizens/companies and (at least) EU-based citizens/companies. 3. The EU backtracks on this by adjusting their current laws.
blibble 5y ago
the EU is shrinking in importance in terms of the world economy [1] another 20 years and companies simply won't bother with it at all [1]: https://fullfact.org/europe/eu-less-important-world-economy/ https://fullfact.org/europe/eu-less-important-world-economy/
- FredPret 5y ago
  It's at 15% and forecast to go down to 12% by 2030. Also they're raising hell for corporations in the form of regulations and taxes. Why would any entrepreneur even bother?
gigatexal 5y ago
> On the contrary, it only forces those providers to have a European presence. All the big cloud providers have presences in Europe. What am I missing here?
- phatfish 5y ago
  Nothing, this is now a solved problem. The EU didn't want the entire internet being hosted from the US. They designed policies to force hosting within EU countries. It happened. The only people still moaning are Americans and hold-outs like Google refusing to move data.
ineedasername 5y ago
If by those providers you mean Google, AWS etc. then that might not solve much. As subsidiaries of American corporations they would be obligated to hand over data to the parent corp, especially if the US DOJ required it. I think the only solution would be for them to not collect and store data from GDPR jurisdictions that would violate the GDPR if they were forced to hand it over to the parent American corp.
- pg_1234 5y ago
  No, the subsidiary would be governed by European law, and would be prohibited from handing data over to either the US parent company or the US DOJ if that violated GDPR. The US parent company could not compel the subsidiary to violate the law of the region it was located in.
  - ineedasername 5y ago
    Yes, I suppose you're right, at least so long as they actually host their data in the EU. But what happens when senior data scientists at Google want to do some analysis? Each dataset for each global region can't remain fractured from each other. The subsidiary may not have to hand it over to the US government but does the GDPR prevent data from leaving the EU zone? If not, then local copies in the US would be exposed. I think there would be a lot of loopholes that needed to be closed. "Will be" a lot might be the better choice if words if France's decision becomes guiding legal doctrine in the region. I don't think Google would willing give up that data either so they could be forced to change their practices to at least get that which allowable under EU law. And I don't want to get too slippery slope in this, but that could mean privacy-minded services begin using servers in the EU as an added layer of user privacy.
    - pg_1234 5y ago
      You're making the mistake of assuming that "something can't happen" if it is inconvenient for the business. The convenience of the business is irrelevant - it must operate within the law. And yes, GDPR prevents data from leaving the EU zone if there is then a possibility that GDPR could be violated. That's the crux of the recent court cases in Austria and France. You may not collect GDPR protected data if as a consequence of that collection there is a reasonable prospect GDPR will eventually be violated by ANYONE. For your example case, all initial data processing would have to physically occur within Europe, performed by a subsidiary not subject to US law, and only after they had reduced it to aggregate data that could not be reverse engineered to get GDPR protected data would they be permitted to export it to America.
__MatrixMan__ 5y ago
Perhaps it's a fragmented internet that is best aligned with our own interests. I, for one, would really like to have more fragments to explore.
- quocanh 5y ago
  For me it's philosophically reminiscent of the Berlin Wall or the Chinese Great Firewall. Personally, my knee-jerk reaction is that it threatens certain freedoms, but I am also a liberal raised with a Western education.
  - FredPret 5y ago
    >I am also a liberal raised with a Western education. Lucky you. We need more Western education, not less, which is why fragmentation is a bad thing. My country of birth - in Africa - is aligned with the formerly communist nations; if they had to opt-in to a fragment, it wouldn't have been to the Western one. I might have never been able to emigrate. Fragmentation seems like a leap backwards in time and a slap in the face of the promise inherent in the free flow of information.
  - __MatrixMan__ 5y ago
    I guess I'm seeing more like a huge swath of farmland growing a monoculture for export, versus the same land being used as a patchwork of different crops based on the various farmers' tastes and relationships with their neighbors. The latter is more likely to change gradually as the climate and the needs of the people around it change, while the former is prone to changing all at once, perhaps unexpectedly. People's ideas about how their technology should serve them will change over time. I don't want to have to overthrow the old internet before we can try something new, I want it to grow with us--the parts that aren't serving us die off, the parts that address new challenges flourish. If its all one thing, subject to one set of rules, that doesn't happen.
Razengan 5y ago
Wow > Agencies can snoop on non-US citizens but shouldn’t snoop on US citizens and they went and snooped on US citizens anyway.
908B64B197 5y ago
> On the contrary, it only forces those providers to have a European presence. It’s interesting to see the pattern here: if you can’t innovate, regulate.
- FredPret 5y ago
  Whine and fine
jart 5y ago
> On the contrary, it only forces those providers to have a European presence. If the EU has this much power to regulate operations that happen in America, then imagine how much worse it's going to be if you relocate your operations to the EU? In that case you actually become one of their subjects, rather than simply recording information about their subjects.
matheusmoreira 5y ago
> We're not fragmenting the internet by looking after our own interests. Of course you are. This is the only possible outcome of any attempt to impose national rules on an international network. Instead of one global network, we'll end up with several local ones. The internet is among the most incredible achievements of humanity. I'm glad I got to experience it before they destroy it. By now it's only a matter of time.

gxs 5y ago

This is a great response to OPs comment. At the end of the day we should be doing what is good for the People and somehow its always assumed that they will/should be the ones impacted when policies like these are enacted. But Europe has leverage here - I don't think Amazon would want to miss out on a giant market base out of some moral principle and there are probably other levers to be pulled here to encourage that. Anyway, not adding much to your comment other than kudos.

VikingCoder 5y ago

You are absolutely fragmenting the internet. We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare. EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may believe that's a good thing, and that's a rational discussion we can have. But don't lie to yourself, or to me, that this doesn't fragment the internet.

0des 5y ago
désolé!
- benreesman 5y ago
  Je suis un homme occupé, et te faire passer pour une risée peut prendre du temps, mais tout le monde a besoin d'un passe-temps.
anothernewdude 5y ago
So pass the cost of doing business in France on to the french.
richardfey 5y ago
The fragmentation is acceptable since the alternative for non-US citizens is to be treated as "free game"?
- nickpp 5y ago
malermeister 5y ago
The solution to this is to get your government to get its shit together on privacy. This is just a defensive act by the Europeans and to blame it on them is victim blaming.
mping 5y ago
This completely misses the point, the laws shouldn't be written to accommodate businesses, its the other way around. If fragmenting is a consequence of better privacy laws, so be it.
- nickpp 5y ago
  Businesses exists for consumers. Fragmenting hurts people - European users - in the first place. I see very little advantages from these privacy laws but I use and appreciate US businesses every day.
  - aksss 5y ago
    What, you don't appreciate a pop-up on every web page telling you that cookies are going to be used? XD
    - lillecarl 5y ago
      The cookie banners are a byproduct of companies still wanting to abuse your data, when was the last time you saw a cookie pop-up on HN? Logged in or not.
      - VikingCoder 5y ago
        If only there were some way that European citizens could have told their browsers to not accept Cookies, then maybe we all wouldn't have to click on those banners all the damn time.
        Dylan16807 5y ago
        But I do want most non-tracking cookies. Still, the "please let us track" popups can be fixed by policy or law, and I hope they are.
  - Nullabillity 5y ago
    So if those businesses utterly refuse to serve consumers then they have no business existing?
rightbyte 5y ago
> would take weeks of vacation with zero support for us Heh. Somethings tells me a devops engineer in France has way better work-life balance.
- VikingCoder 5y ago
  You'd think a _team_ of them could provide 8/5 (8 hours a day, 5 days a week) service...
__MatrixMan__ 5y ago
The internet was designed to be resilient in the face of nuclear war. If it can't handle governments that actually protect their citizens from predation by multinational corporations, then we should rethink some things about the direction that we've taken with it.
- gjs278 5y ago
- VikingCoder 5y ago
  Sure, so, let's say that France decides that HN info is PII. So then Hacker News has to launch servers in France. And then French HN users are in an island, and only see other French HN users' posts and comments. And, to be clear, you think that's a good thing?
  - kyletns 5y ago
    Do you think it would be difficult to allow the different HN servers to federate their content across regions?
    - VikingCoder 5y ago
      In what way is a French resident protected if their data is stored on a server in France but can be federated to other countries?
    - jonas21 5y ago
      Would it be impossible? No. But would it be, say, 5x the amount of effort to build and maintain a federated system with no data stored across boundaries? Probably.
    - esyir 5y ago
      Difficult? Not so much. Demanding a yet another great firewall on the other hand sounds absolutely atrocious to me.
  - 5y ago
javajosh 5y ago
There is so much I want to say about this comment! First of all, it sounds like you had a terrible experience because you picked a bad ISP. I sympathize. But then you generalize from that and imply that anyone wanting an EU host will experience the same. Obviously that's not true - or do you believe no good ISPs exist in France? Second of all, why did you fork your code? Did you write your service to use proprietary Azure APIs without regard to vendor lock-in? Why not take this as an opportunity to incrementally extract the proprietary apis out of your application and replace them with processes you actually own? This will allow you to undo the fork and continue on, able to deploy your application anywhere you want.
- VikingCoder 5y ago
  We did our research, and settled on the French cloud provider that fit our parameters. They made promises about support hours that they did not keep. Changing cloud service providers is not cheap. We were a small team, and this cost us lots of effort. We didn't fork our code, we forked our services. We ran everything on Azure. Then we had to configure our kiosk devices to either talk to Azure, or to talk to our servers in France. "Did you write your service to use proprietary Azure APIs without regard to vendor lock-in? Why not take this as an opportunity" I'm sorry, do you have any idea of the cost of doing these things? If you have 6 developers, total, how many of them are you willing to allocate to rewriting your stack, so that you can sell your product in Europe?
  - cpeterso 5y ago
    Do cloud service providers like Azure not have a way to "pin" some of your service instances to servers in specific countries? Seems like this capability would be important differentiating feature given EU privacy laws about where user data is hosted.
    - seszett 5y ago
      They do, in fact Azure is totally compatible with French law for handling private data. Many large companies use it.
na85 5y ago
Sounds like the market in france is ripe for disruption.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
titzer 5y ago
> You are absolutely fragmenting the internet. It's not fragmenting the internet; fragmentation is the whole point of the internet. It's (re-)decentralizing something that has been decentralized the whole time, until these gluttonous whales decided try to eat the whole pie.
- VikingCoder 5y ago
  So a computer in France can not legally talk to a computer in the United States, but if I instead put that computer in France, I'm legally okay. And you're convinced that embodies "the whole point of the internet"?
  - titzer 5y ago
    It isn't about "one computer talking to another", it's about where sensitive information is stored. It has never been legal to store classified US intelligence on computers outside of the control of the US government. That's an extreme example, but the handling of many types of information is prescribed by laws in different jurisdictions. Does that mean that US computers cannot "talk" to another other computers? No. Does that make the internet invalid? No. Decentralization of the cloud is a good thing for so many reasons. I think you're deliberately confusing it with your PII issues and not grasping the larger picture.
    - VikingCoder 5y ago
      I think you're ignoring the harm done to small businesses who cannot afford to implement decentralized services. You are raising the barrier to entry, limiting competition. Competition is good for so many reasons. I think you're deliberately ignoring the impact on small companies and not grasping the larger picture.
      - 6gvONxR4sf7o 5y ago
        Those poor small international businesses? If you want to do business internationally, it'll be complicated, and that's fine. The internet has spoiled us by making it so easy for a while.
karmelapple 5y ago
Quick question: was there a reason you could not use Azure’s region support? https://azure.microsoft.com/en-us/global-infrastructure/geographies/#geographies https://azure.microsoft.com/en-us/global-infrastructure/geog... Or was it before Azure had that? Looks like they’ve had it for awhile, at least back to 2009 or 2010.
- VikingCoder 5y ago
  France, Year Opened 2018, is what I see on that page. This was impacting us in 2014 to 2016, as I remember.
  - PeterisP 5y ago
    However all the GDPR requirements entered into force just in may 2018? But in any case, the point is that the issue is solved without changing the laws or people having to switch cloud providers, as simply the global cloud providers have started offering compliant services.
  - Ruphin 5y ago
    Looks to me like the regulations did exactly what they were designed to do, and Azure implemented support for the EU market. The goal of these regulations is not to make things harder for companies trying to publish products in different regions, the goal is to get the big platforms (AWS, Azure, GCP) to implement systems that are in line with EU privacy requirements. I'm sorry your business was impacted during the period where the regulations came into effect and the big platforms did not have compliant services ready. It would have been better if the negative externalities of these regulations would be entirely carried by the big platforms who are responsible for consumer privacy in the first place.
unknown2374 5y ago
You do realize by the same logic this inspires competitors to innovate...
forty 5y ago
Agreed. But the internet is already fragmented. Each countries have their own laws and other countries no reason to follow them. All kind of content is accessible only in certain countries. It's also true for physical goods. I'm not sure why it's a problem.
miohtama 5y ago
Microsoft has set up a fully independent data center and business in German just because of this: https://news.microsoft.com/europe/2020/09/30/our-commitment-to-delivering-the-microsoft-cloud-in-germany/ https://news.microsoft.com/europe/2020/09/30/our-commitment-...
- VikingCoder 5y ago
  Unfortunately, that didn't exist for us back in 2016, and our product is no longer in development.
  - teddyh 5y ago
    So your argument is out of date and no longer valid.
    - VikingCoder 5y ago
      Right. All I have to do is to stand up two complete copies of my full stack, and support both of them. There's no way that adds extra burden to me. My argument is completely invalid. Thanks for explaining that to me.
      - nickforr 5y ago
        If you want to sell in two different countries don’t you have to comply with two different legal codes and support both of them?
        jdrc 5y ago
        noitpmeder 5y ago
        The purpose of laws is to protect and govern their local citizens. I would hate to live in a world where a law does not get passed because of an argument like "but imagine how much work developers will have to do to follow the law!"
6510 5y ago
I feel your pain but as an argument in this discussion it doesn't work. Your problem was in 2014 and Azure works just fine now. It took some doing which was the whole point. The local provider even got a chance to match the offer.
belorn 5y ago
Its very interesting if limiting how companies are allowed to track, store and sell private information would be the central issue for which the internet will fragment around. It almost like tracking, storing and selling is the center of the modern Internet, rather than protocols like tcp, upd, https and so on. In the past people said that the Internet was made for porn. Today the Internet is seemingly made for advertisement and surveillance. It not strange that so many people who worked in this industry for decades are feeling a bit lost in this new horrifying industry, which if the Internet really is made only to do advertisement and surveillance, I honestly think humanity is better off without it.
- VikingCoder 5y ago
  The internet is a tool. You should support companies with the best behavior. I worked at a company that enabled a radiologist in over country to do a preliminary read of a CT scan performed in another country. Cutting the amount of time for a CT scan, and even connecting a CT scan with a radiologist who specialized in that particular kind of scan, we saved lives. And yes, there's also furry porn. It's a tool. I feel like I'm trying to convince you that BOOKS are good, despite the existence of hentai.
  - belorn 5y ago
    Could that company exist if it wasn't allow to use advertisement or sell private information? In the past I would say yes without question since there is nothing inherently in connecting a CT scan with a radiologist specialist that require Google Analytics. Nothing at all.
dspillett 5y ago
> We had PII on Azure. So why didn't you use Azure resources in Europe instead of "some crappy provider"? Sounds like you made a rod for your own back. If our clients are happy with Azure (in the right region) then I can't imagine many in the EU (other than perhaps national security services and their suppliers) reasonably refusing to allow use of it. We host in Azure for some pretty significant financial organisations, mostly UK based but spreading our area. Some companies are requiring us to fully host in Azure DCs in their region, and some of those are Eastern, not UK/EU, based companies. At least one US interest that a friend's employer supplies demands data about its employees be hosted over there rather than over here, presumably so they can be assured it is kept to standards they are locally required to follow. Is it wrong that way around in your book too? It isn't as easy as having everything in one region of course, but not much harder nor massively more expensive (caveat: most likely, as far as I know, I have the luxury of ignoring the bits that don't interest me and money is often one of those things, but I'm also senior enough that if there was something expensive happening, or something not happening due to expense, I'd catch wind as it would affect things I need to plan around) and it can't be as faffy/costly as using different providers in each territory. If you are correctly following relevant regulations everywhere this does not fragment things any more than other rules that already existed. Aside from the fact things are being enforced this time, forcing companies handling PII to not quietly do things wrong because it is inconvenient to do things right. As an individual I'm perfectly fine with this.
ghostoftesla 5y ago
company stooge.

voldacar 5y ago

lhorie 5y ago

I think fragmentation and looking after one's interests aren't even opposites. Analytics in particular seem like a very lopsided value prop: the american entity (Google) stands to gain from collecting analytics but doesn't really provide a perceivable equivalent value through the analytics service to the affected parties (EU consumers) in return, as you'd normally expect in a fair trade policy between two countries. Looking at it from this angle, it seems perfectly reasonable for the EU to dislike the specifics of the analytics use case while still being ok with something like Google Docs.

aksss 5y ago
> lopsided value prop But that's not what CNIL is basing their decision on: "The CNIL concludes that transfers to the United States are currently not sufficiently regulated...Indeed, although Google has adopted additional measures to regulate data transfers in the context of the Google Analytics functionality, these are not sufficient to exclude the accessibility of this data for US intelligence services." I probably don't understand the legal issues fully, but it seems the worry is that US intelligence services may be tapping the lines and databases of Google, may have agents working at Google as badged employees, or may be able to subpoena Google (or any US service provider). [for the record, I wouldn't doubt if all the above are true] I don't see how Google Docs is less susceptible to Google tracking user activity (and by extension US intelligence). > "CNIL recommends that these tools should only be used to produce anonymous statistical data" So the tools are not anonymous because the request headers of the client are being logged and used to identify a session, along with what resources on the site were accessed in that session. Any site operator has this data on their visitors. CNIL doesn't want sites hosted in France to be making client-side calls to services provided by Google (whether analytics, fonts, etc) or theoretically any US-based service provider because the client request will be logged by that resource host and open to access by US law enforcement? Do I understand that correctly? What's the solution? A site builder can't let web clients make direct calls to any resources in the US? That seems... sweeping, profound, surprising, impactful. Have fun with that.
- kilburn 5y ago
  > because the request headers of the client are being logged and used to identify a session No need to dig so deep: IP addresses are considered private information under the current EU law, meaning that just opening a client-side connection somewhere leaks that data to that somewhere. > I don't see how Google Docs is less susceptible to Google tracking user activity (and by extension US intelligence). There is none. The difference is that the website studied in the ruling was not including resources hosted at Google Docs, and hence no mention of it. If the site embedded or directly linked to a google docs document the same reasoning would have been applied. > CNIL doesn't want sites hosted in France to be making client-side calls to services provided by Google (whether analytics, fonts, etc) or theoretically any US-based service provider because the client request will be logged by that resource host and open to access by US law enforcement? Do I understand that correctly? Almost. They don't want any calls prior to explicit user acceptance. > What's the solution? For fonts/images required to load the page, use EU-based hosting facilities. If you want to link to a google docs document, a youtube video or something like that, ask the user before following that link. > That seems... sweeping, profound, surprising, impactful. Have fun with that. It is, I don't think anyone is denying that. There are several things that may happen here: 1. US tech companies take it as common practice to spin-off EU-based companies that are not subject to US law and store everything in EU soil. When they don't, EU competitors pop up and EU companies use those. 2. The US passes laws that offer EU-level protections to both their own citizens/companies and (at least) EU-based citizens/companies. 3. The EU backtracks on this by adjusting their current laws.

blibble 5y ago

the EU is shrinking in importance in terms of the world economy [1] another 20 years and companies simply won't bother with it at all [1]: https://fullfact.org/europe/eu-less-important-world-economy/ https://fullfact.org/europe/eu-less-important-world-economy/

FredPret 5y ago
It's at 15% and forecast to go down to 12% by 2030. Also they're raising hell for corporations in the form of regulations and taxes. Why would any entrepreneur even bother?

gigatexal 5y ago

> On the contrary, it only forces those providers to have a European presence. All the big cloud providers have presences in Europe. What am I missing here?

phatfish 5y ago
Nothing, this is now a solved problem. The EU didn't want the entire internet being hosted from the US. They designed policies to force hosting within EU countries. It happened. The only people still moaning are Americans and hold-outs like Google refusing to move data.

ineedasername 5y ago

If by those providers you mean Google, AWS etc. then that might not solve much. As subsidiaries of American corporations they would be obligated to hand over data to the parent corp, especially if the US DOJ required it. I think the only solution would be for them to not collect and store data from GDPR jurisdictions that would violate the GDPR if they were forced to hand it over to the parent American corp.

pg_1234 5y ago
No, the subsidiary would be governed by European law, and would be prohibited from handing data over to either the US parent company or the US DOJ if that violated GDPR. The US parent company could not compel the subsidiary to violate the law of the region it was located in.
- ineedasername 5y ago
  Yes, I suppose you're right, at least so long as they actually host their data in the EU. But what happens when senior data scientists at Google want to do some analysis? Each dataset for each global region can't remain fractured from each other. The subsidiary may not have to hand it over to the US government but does the GDPR prevent data from leaving the EU zone? If not, then local copies in the US would be exposed. I think there would be a lot of loopholes that needed to be closed. "Will be" a lot might be the better choice if words if France's decision becomes guiding legal doctrine in the region. I don't think Google would willing give up that data either so they could be forced to change their practices to at least get that which allowable under EU law. And I don't want to get too slippery slope in this, but that could mean privacy-minded services begin using servers in the EU as an added layer of user privacy.
  - pg_1234 5y ago
    You're making the mistake of assuming that "something can't happen" if it is inconvenient for the business. The convenience of the business is irrelevant - it must operate within the law. And yes, GDPR prevents data from leaving the EU zone if there is then a possibility that GDPR could be violated. That's the crux of the recent court cases in Austria and France. You may not collect GDPR protected data if as a consequence of that collection there is a reasonable prospect GDPR will eventually be violated by ANYONE. For your example case, all initial data processing would have to physically occur within Europe, performed by a subsidiary not subject to US law, and only after they had reduced it to aggregate data that could not be reverse engineered to get GDPR protected data would they be permitted to export it to America.

__MatrixMan__ 5y ago

Perhaps it's a fragmented internet that is best aligned with our own interests. I, for one, would really like to have more fragments to explore.

quocanh 5y ago
For me it's philosophically reminiscent of the Berlin Wall or the Chinese Great Firewall. Personally, my knee-jerk reaction is that it threatens certain freedoms, but I am also a liberal raised with a Western education.
- FredPret 5y ago
  >I am also a liberal raised with a Western education. Lucky you. We need more Western education, not less, which is why fragmentation is a bad thing. My country of birth - in Africa - is aligned with the formerly communist nations; if they had to opt-in to a fragment, it wouldn't have been to the Western one. I might have never been able to emigrate. Fragmentation seems like a leap backwards in time and a slap in the face of the promise inherent in the free flow of information.
- __MatrixMan__ 5y ago
  I guess I'm seeing more like a huge swath of farmland growing a monoculture for export, versus the same land being used as a patchwork of different crops based on the various farmers' tastes and relationships with their neighbors. The latter is more likely to change gradually as the climate and the needs of the people around it change, while the former is prone to changing all at once, perhaps unexpectedly. People's ideas about how their technology should serve them will change over time. I don't want to have to overthrow the old internet before we can try something new, I want it to grow with us--the parts that aren't serving us die off, the parts that address new challenges flourish. If its all one thing, subject to one set of rules, that doesn't happen.

Razengan 5y ago

Wow > Agencies can snoop on non-US citizens but shouldn’t snoop on US citizens and they went and snooped on US citizens anyway.

908B64B197 5y ago

> On the contrary, it only forces those providers to have a European presence. It’s interesting to see the pattern here: if you can’t innovate, regulate.

FredPret 5y ago
Whine and fine

jart 5y ago

> On the contrary, it only forces those providers to have a European presence. If the EU has this much power to regulate operations that happen in America, then imagine how much worse it's going to be if you relocate your operations to the EU? In that case you actually become one of their subjects, rather than simply recording information about their subjects.

matheusmoreira 5y ago

> We're not fragmenting the internet by looking after our own interests. Of course you are. This is the only possible outcome of any attempt to impose national rules on an international network. Instead of one global network, we'll end up with several local ones. The internet is among the most incredible achievements of humanity. I'm glad I got to experience it before they destroy it. By now it's only a matter of time.