3 ms·

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you m

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space. When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegally-configured in Europe out of the box. (The result is, of course, that the law ends up unfairly enforced, which could be considered worse depending on one's legal philosophy.)

Nextgrid 4y ago
The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.
- shadowgovt 4y ago
  Is it not incumbent upon the admin to prove they didn't use the data for analytics? If so, that makes the data default-radioactive where before GDPR it was legally harmless. And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?
  - rrdharan 4y ago
    > If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics? Yes. However enforcement is intentionally discretionary and selective and hence sensitive / prone to political, protectionist and sentimental whims. Your 1 person outfit in Europe is less likely to suffer in actual court, or the court of public opinion, than a big bad American tech company will.
    - shadowgovt 4y ago
      Maybe it's just personal preference, but I find "This criminalizes a very common behavior, but don't worry, prosecutors will use broad discretion while enforcing it and only enforce it on the right sort of people" to be very, very disquieting. It's how you get war-on-drugs-level legal atrocities.
- spacebanana7 4y ago
  Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.
  - gizmo 4y ago
    And those defaults must be changed. GDPR rightly forces businesses to reconsider hoarding data because it “might be useful sometime in the future”.
    - spacebanana7 4y ago
      With GDPR most businesses still hoard as much data as they can, then work backwards to find a plausible excuse like debugging or customer support.
      - Nextgrid 4y ago
        That's technically an enforcement problem though. Hopefully one day regulators get the skills they need to see through this bullshit.
  - djbusby 4y ago
    Logrotate is part of a lot of defaults (eg: Debian) and keeps only a few weeks of logs.
superkuh 4y ago
What I miss the most, and where the most damage to the net has been done so far, is in terms of whois. Without WHOIS it's become near impossible to contact people. Before you'd find an interesting domain, whois, email 'em up. Now that GDPR has made whois illegal, or a high enough legal risk that registrars are chosing to turn it off, there's no way to contact any arbitrary domain. It's made the web a lot more impersonal and corporate.
- madeofpalk 4y ago
  WHOIS was next to useless for getting contact information prior to GDPR thanks to every domain register defaulting to 'free privacy protection'. I don't consider it a loss that there's one less place my phone number and address is posted online.
- chrismorgan 4y ago
  Eh, I never had much success with at least corporate whois email addresses even before they started being effectively removed (by registrars masking them, years before GDPR). Even addresses like postmaster@ which are mandated by the SMTP spec (RFC 5321 §4.5.1 and other places) don’t tend to work.
- Hitton 4y ago
  This is wrong. Look how whois works on .eu domain.
gizmo 4y ago
Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted. GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights regardless.
- chrismorgan 4y ago
  Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff. (Cookie banners are the most obvious example of this. The businesses say “our hands are tied, the EU told us to do this”, whereas in actual fact the EU more told them to stop doing the storing and collecting. And very few cookie banners and such actually comply, and they made them a much bigger deal than they should have legally. All up there was very clear intent to poison perception in many cases.)
  - gizmo 4y ago
    I agree with all your observations. Enforcement actions will slowly nudge businesses into compliance, but this will easily take another decade. It takes a long time for the law to solidify in the courts.
  - orangecat 4y ago
    If you're trying to regulate a bunch of bad actors, and you don't anticipate that they will try to game whatever regulations you come up with, you are not doing your job well.
    - account42 4y ago
      Sure they should have and probably did expect that there would be bad actors. But should they have expected that pretty much all businesses and even individuals would rather make their users miserable than give up tracking them? Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected? Also, a lot of the problems are not bad actors finding ways around the law but straight up violating it. The most prominent example is the consent bannes that try to discourage the deny option in various ways. The lawmakers did anticipate that kind of maliciousness and made sure to disallow it. What is lacking is mostly enforcement, and that is not something the lawmakers control.

Nextgrid 4y ago

The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.

shadowgovt 4y ago
Is it not incumbent upon the admin to prove they didn't use the data for analytics? If so, that makes the data default-radioactive where before GDPR it was legally harmless. And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?
- rrdharan 4y ago
  > If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics? Yes. However enforcement is intentionally discretionary and selective and hence sensitive / prone to political, protectionist and sentimental whims. Your 1 person outfit in Europe is less likely to suffer in actual court, or the court of public opinion, than a big bad American tech company will.
  - shadowgovt 4y ago
    Maybe it's just personal preference, but I find "This criminalizes a very common behavior, but don't worry, prosecutors will use broad discretion while enforcing it and only enforce it on the right sort of people" to be very, very disquieting. It's how you get war-on-drugs-level legal atrocities.
spacebanana7 4y ago
Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.
- gizmo 4y ago
  And those defaults must be changed. GDPR rightly forces businesses to reconsider hoarding data because it “might be useful sometime in the future”.
  - spacebanana7 4y ago
    With GDPR most businesses still hoard as much data as they can, then work backwards to find a plausible excuse like debugging or customer support.
    - Nextgrid 4y ago
      That's technically an enforcement problem though. Hopefully one day regulators get the skills they need to see through this bullshit.
- djbusby 4y ago
  Logrotate is part of a lot of defaults (eg: Debian) and keeps only a few weeks of logs.

superkuh 4y ago

What I miss the most, and where the most damage to the net has been done so far, is in terms of whois. Without WHOIS it's become near impossible to contact people. Before you'd find an interesting domain, whois, email 'em up. Now that GDPR has made whois illegal, or a high enough legal risk that registrars are chosing to turn it off, there's no way to contact any arbitrary domain. It's made the web a lot more impersonal and corporate.

madeofpalk 4y ago
WHOIS was next to useless for getting contact information prior to GDPR thanks to every domain register defaulting to 'free privacy protection'. I don't consider it a loss that there's one less place my phone number and address is posted online.
chrismorgan 4y ago
Eh, I never had much success with at least corporate whois email addresses even before they started being effectively removed (by registrars masking them, years before GDPR). Even addresses like postmaster@ which are mandated by the SMTP spec (RFC 5321 §4.5.1 and other places) don’t tend to work.
Hitton 4y ago
This is wrong. Look how whois works on .eu domain.

gizmo 4y ago

Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted. GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights regardless.

chrismorgan 4y ago
Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff. (Cookie banners are the most obvious example of this. The businesses say “our hands are tied, the EU told us to do this”, whereas in actual fact the EU more told them to stop doing the storing and collecting. And very few cookie banners and such actually comply, and they made them a much bigger deal than they should have legally. All up there was very clear intent to poison perception in many cases.)
- gizmo 4y ago
  I agree with all your observations. Enforcement actions will slowly nudge businesses into compliance, but this will easily take another decade. It takes a long time for the law to solidify in the courts.
- orangecat 4y ago
  If you're trying to regulate a bunch of bad actors, and you don't anticipate that they will try to game whatever regulations you come up with, you are not doing your job well.
  - account42 4y ago
    Sure they should have and probably did expect that there would be bad actors. But should they have expected that pretty much all businesses and even individuals would rather make their users miserable than give up tracking them? Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected? Also, a lot of the problems are not bad actors finding ways around the law but straight up violating it. The most prominent example is the consent bannes that try to discourage the deny option in various ways. The lawmakers did anticipate that kind of maliciousness and made sure to disallow it. What is lacking is mostly enforcement, and that is not something the lawmakers control.