4 ms·

Using IPs to protect from abuse has been debated to death and is considered legitimate use.

by tpxl 4y ago

davidmurdoch 4y ago
Just some questions off the top of my head, that I, a FOSS developer have, and can not say with absolutely certainty that an EU court won't have problems with. How long can the IP kept around for? And in what form? If it lands in a database, does it need to be encrypted at rest? Can it just be hashed? Salted, too? Do I need to rotate the salt? This limits the ability to protect the service though. Are the tools in my stack logging something somewhere else I don't know about? Could I get in trouble if it is? Cloudflare forwards IP-derived data to me, like the city of IP may be in, do I have to be concerned with that as well? Do I have to tell users upfront that I use Cloudflare and it derives data? I'm guessing I have to fully understand what CLoudflare does with this data. It eventually hits my Digital Ocean droplet, what does it log?, are there separate logs I can access from them outside my droplet? Certainly they have logs, too, what do I do about that? If I just require all users to explicitly agree to some form of data collection this probably goes away. Oh wait, now I have to manage obvious PII and ensure Right to be Forgotten can be exercised in a timely fashion, I've just made the whole thing more difficult for myself. There is a cost, and it affect the small honest devs the most. I'm not saying what GDPR is attempting to do is a bad thing, I'm just saying that it is not easy to comply like everyone keeps saying.
- neoromantique 4y ago
  Those questions are not in good faith, and answers are readily available and have been for a long time. e.g https://law.stackexchange.com/a/28609 https://law.stackexchange.com/a/28609
  - davidmurdoch 4y ago
    How can you say the questions aren't in good faith and then link to a popular Stack Exchange question and argument about some of them? Developers do need to ask these questions.
    - neoromantique 4y ago
      I am saying that you in this particular instance are not asking those questions in good faith.
- scoutt 4y ago
  An IP by itself is not PII. You have to be sure that you or anyone else in your chain can't link an IP to a specific person without explicit consent (and thus compliant with the rest of the regulation). You can have cloudflare giving you IP/location pairs as long as cloudflare doesn't know who that person is. You can keep your own logs of IP/person. You have to keep it safe, and inform somewhere in a policy that you are doing that. If the logs are kept abroad or cloud, then you need consent (and comply with the rest of the regulation). It's all made to avoid companies tracking using across boundaries, selling data and having all that PII unwarranted for the next "We take your data and security very seriously" blog post about a leak. It's easier not to keep any PII around. IPs? you can have as many as you want as long it can't be used to identify a person (without consent). PS: here is a checklist => https://gdpr.eu/checklist/ https://gdpr.eu/checklist/

Using IPs to protect from abuse has been debated to death and is considered legitimate use.

by tpxl 4y ago

Using IPs to protect from abuse has been debated to death and is considered legitimate use.

Just some questions off the top of my head, that I, a FOSS developer have, and can not say with absolutely certainty that an EU court won't have problems with. How long can the IP kept around for? And in what form? If it lands in a database, does it need to be encrypted at rest? Can it just be hashed? Salted, too? Do I need to rotate the salt? This limits the ability to protect the service though. Are the tools in my stack logging something somewhere else I don't know about? Could I get in trouble if it is? Cloudflare forwards IP-derived data to me, like the city of IP may be in, do I have to be concerned with that as well? Do I have to tell users upfront that I use Cloudflare and it derives data? I'm guessing I have to fully understand what CLoudflare does with this data. It eventually hits my Digital Ocean droplet, what does it log?, are there separate logs I can access from them outside my droplet? Certainly they have logs, too, what do I do about that? If I just require all users to explicitly agree to some form of data collection this probably goes away. Oh wait, now I have to manage obvious PII and ensure Right to be Forgotten can be exercised in a timely fashion, I've just made the whole thing more difficult for myself. There is a cost, and it affect the small honest devs the most. I'm not saying what GDPR is attempting to do is a bad thing, I'm just saying that it is not easy to comply like everyone keeps saying.

neoromantique 4y ago
Those questions are not in good faith, and answers are readily available and have been for a long time. e.g https://law.stackexchange.com/a/28609 https://law.stackexchange.com/a/28609
- davidmurdoch 4y ago
  How can you say the questions aren't in good faith and then link to a popular Stack Exchange question and argument about some of them? Developers do need to ask these questions.
  - neoromantique 4y ago
    I am saying that you in this particular instance are not asking those questions in good faith.
scoutt 4y ago
An IP by itself is not PII. You have to be sure that you or anyone else in your chain can't link an IP to a specific person without explicit consent (and thus compliant with the rest of the regulation). You can have cloudflare giving you IP/location pairs as long as cloudflare doesn't know who that person is. You can keep your own logs of IP/person. You have to keep it safe, and inform somewhere in a policy that you are doing that. If the logs are kept abroad or cloud, then you need consent (and comply with the rest of the regulation). It's all made to avoid companies tracking using across boundaries, selling data and having all that PII unwarranted for the next "We take your data and security very seriously" blog post about a leak. It's easier not to keep any PII around. IPs? you can have as many as you want as long it can't be used to identify a person (without consent). PS: here is a checklist => https://gdpr.eu/checklist/ https://gdpr.eu/checklist/