<story><title>GDPR for lazy people: Block all European users with Cloudflare Workers</title><url>https://apility.io/2018/05/25/gdpr-lazy-block-eu-users-cloudflare-workers/</url></story><parent_chain><item><author>strken</author><text>&lt;i&gt;If you don&amp;#x27;t store PII, you don&amp;#x27;t have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights&lt;/i&gt;&lt;p&gt;The problem is not the work that the GDPR requires, the problem is the work I&amp;#x27;ll have to put into understanding the GDPR.&lt;p&gt;&lt;i&gt;I think it&amp;#x27;s mainly a difference in viewpoint: this is my data for me. Not yours.&lt;/i&gt;&lt;p&gt;This is the part that I don&amp;#x27;t understand. If I own a shop, and you come in and buy something, you have absolutely no right to demand that I forget your face and your purchase. In the real world, it&amp;#x27;s not &lt;i&gt;your&lt;/i&gt; data, it&amp;#x27;s &lt;i&gt;my&lt;/i&gt; memory. If I go home and write in my diary that today hekfu bought lots of broccoli, you don&amp;#x27;t have the right to come to me in five years and demand that I remove all mention of you from my diary at my own cost.&lt;p&gt;I don&amp;#x27;t understand the concept of data ownership, because it does not align with how I understand the real world to work.</text></item><item><author>hekfu</author><text>&amp;gt; This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you&amp;#x27;re storing levels of information on me that are similar to facebook&amp;#x2F;google&amp;#x2F;etc., I do not give a damn whether you&amp;#x27;re soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every website using social media buttons and GA.js, I don&amp;#x27;t think it matters in the slightest.&lt;p&gt;&amp;gt; It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop.&lt;p&gt;If you don&amp;#x27;t store PII, you don&amp;#x27;t have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights&lt;p&gt;&amp;gt; There&amp;#x27;s so much smugness about the GDPR being a &amp;quot;good reflecting moment&amp;quot;, etc. which makes me think that people who support the GDPR believe that there&amp;#x27;s no way detractors could disagree with it in good faith or for good reasons.&lt;p&gt;I think it&amp;#x27;s mainly a difference in viewpoint: this is &lt;i&gt;my&lt;/i&gt; data for me. Not yours. GDPR makes it easier for me to enforce that. From my perspective I don&amp;#x27;t care about you violating my rights &amp;quot;in good faith&amp;quot;, just like most people don&amp;#x27;t cares if you trespass on my property and steal something &amp;quot;in good faith&amp;quot;.</text></item><item><author>strken</author><text>This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you&amp;#x27;re storing levels of information on me that are similar to facebook&amp;#x2F;google&amp;#x2F;etc., I do not give a damn whether you&amp;#x27;re soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every website using social media buttons and GA.js, I don&amp;#x27;t think it matters in the slightest.&lt;p&gt;It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop.&lt;p&gt;There&amp;#x27;s so much smugness about the GDPR being a &amp;quot;good reflecting moment&amp;quot;, etc. which makes me think that people who support the GDPR believe that there&amp;#x27;s no way detractors could disagree with it in good faith or for good reasons.</text></item><item><author>yzmtf2008</author><text>The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before.&lt;p&gt;If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all.&lt;p&gt;To your example, you could easily not switch to a  CASCADE, but instead set delete=1 and rewrite every sensitive field with a special value. Doesn’t even require a DB migration.&lt;p&gt;If your attitude to properly handling sensitive information is “it’s too complicated and costly, so we’ll just not handle it and YOLO”, perhaps GDPR is a good reflecting moment for you.&lt;p&gt;[edit:typo, edit:clarification]</text></item><item><author>jeremyt</author><text> I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and&amp;#x2F;or technical people on here anymore.&lt;p&gt;The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling.&lt;p&gt;Let’s just take one feature: the requirement that you can permanently delete all of your information.  Most early-stage startups use the (in 2008, when I did mine) best practice of “delete=1”.   Changing your whole database over to permanent cascade delete is only easy if you’re a very experienced programmer or who knows what he’s doing.  And that sets aside the fact  that even if you know what you’re doing technically, there are lots of business logic problems with just deleting things out of the database and anonymizing users is very tricky.&lt;p&gt;I was not a great programmer when I started my first startup.  I was learning as I went along.&lt;p&gt;We couldn’t afford a lawyer, and the amount of time for me (the only programmer) to go through and read all the regulations and make all the requisite changes in the product I would estimate might take on the order of a month or two, which if timed poorly would’ve killed our company.   I say again: at an early stage startup with one programmer, you cannot have that one programmer spending two months on compliance.&lt;p&gt;It’s just gotten to the point that there’s one comment after another responding to this regulation or that regulation or this situation or whatever with “well, just call HR“, or “I can’t believe you don’t have a company policy for that!”&lt;p&gt;Or “well just ask your lawyers“.  It ain’t that easy.  Do you have any idea how much it would cost to have “your lawyers” go through the GDPR, tell you what you need to do, and deal with all of the edge cases and gray areas? $20k or $30k doesn’t seem too high.&lt;p&gt;My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup.  Maybe the days of two people doing a startup in someone’s garage should be in the past?  If so, that makes me kind of sad.&lt;p&gt;Regardless it’s not obvious that GDPR is the right policy or that it’s well designed or clear.</text></item></parent_chain><comment><author>ikt</author><text>&amp;gt;  In the real world, it&amp;#x27;s not your data, it&amp;#x27;s my memory.&lt;p&gt;This is where there&amp;#x27;s been a divergence on thought. In the real world you have limited capabilities to collect and store the data that is currently being collected. You&amp;#x27;re physically limited in how much you can retain and retrieve. In your old timey example I assume the diary to be sitting there in the back of the shop just being a record of my name and what I bought, but that&amp;#x27;s not how a lot of data is being used or being collected online.&lt;p&gt;The equivalent would be you making the diary automatically write down a potential unlimited amount of data on me and then using it to sell advertising the moment I enter the shop.&lt;p&gt;If I went past your store and it automatically retrieved physical details about myself, what I&amp;#x27;m wearing, my interests, hobbies, location and you then built a profile and then sold this information to advertisers there absolutely would be regulations regarding this in the real world.&lt;p&gt;A better example:&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.bbc.com&amp;#x2F;news&amp;#x2F;technology-23425297&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.bbc.com&amp;#x2F;news&amp;#x2F;technology-23425297&lt;/a&gt;&lt;p&gt;Privacy limits
As retailers trial such tech they are well aware there is a risk of a privacy backlash.&lt;p&gt;Clothes store Nordstrom recently cancelled a scheme which tracked customers&amp;#x27; movements through its stores using their phones&amp;#x27; wi-fi signals after complaints.&lt;p&gt;&amp;quot;Are we willing to accept our everyday movements being monitored and analysed, not to keep us safe but purely to allow advertisers to target us? I think people will start to say no, our privacy is worth more than a few advertising dollars.&amp;quot;&lt;p&gt;--&lt;p&gt;You say shop with a diary to present the most innocent of examples but for every shop with a diary there&amp;#x27;s billions of stalkers following people everywhere they go to learn as much about them as possible in order to sell them products and influence how they think which they never agreed to.</text></comment>
<story><title>GDPR for lazy people: Block all European users with Cloudflare Workers</title><url>https://apility.io/2018/05/25/gdpr-lazy-block-eu-users-cloudflare-workers/</url></story><parent_chain><item><author>strken</author><text>&lt;i&gt;If you don&amp;#x27;t store PII, you don&amp;#x27;t have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights&lt;/i&gt;&lt;p&gt;The problem is not the work that the GDPR requires, the problem is the work I&amp;#x27;ll have to put into understanding the GDPR.&lt;p&gt;&lt;i&gt;I think it&amp;#x27;s mainly a difference in viewpoint: this is my data for me. Not yours.&lt;/i&gt;&lt;p&gt;This is the part that I don&amp;#x27;t understand. If I own a shop, and you come in and buy something, you have absolutely no right to demand that I forget your face and your purchase. In the real world, it&amp;#x27;s not &lt;i&gt;your&lt;/i&gt; data, it&amp;#x27;s &lt;i&gt;my&lt;/i&gt; memory. If I go home and write in my diary that today hekfu bought lots of broccoli, you don&amp;#x27;t have the right to come to me in five years and demand that I remove all mention of you from my diary at my own cost.&lt;p&gt;I don&amp;#x27;t understand the concept of data ownership, because it does not align with how I understand the real world to work.</text></item><item><author>hekfu</author><text>&amp;gt; This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you&amp;#x27;re storing levels of information on me that are similar to facebook&amp;#x2F;google&amp;#x2F;etc., I do not give a damn whether you&amp;#x27;re soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every website using social media buttons and GA.js, I don&amp;#x27;t think it matters in the slightest.&lt;p&gt;&amp;gt; It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop.&lt;p&gt;If you don&amp;#x27;t store PII, you don&amp;#x27;t have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights&lt;p&gt;&amp;gt; There&amp;#x27;s so much smugness about the GDPR being a &amp;quot;good reflecting moment&amp;quot;, etc. which makes me think that people who support the GDPR believe that there&amp;#x27;s no way detractors could disagree with it in good faith or for good reasons.&lt;p&gt;I think it&amp;#x27;s mainly a difference in viewpoint: this is &lt;i&gt;my&lt;/i&gt; data for me. Not yours. GDPR makes it easier for me to enforce that. From my perspective I don&amp;#x27;t care about you violating my rights &amp;quot;in good faith&amp;quot;, just like most people don&amp;#x27;t cares if you trespass on my property and steal something &amp;quot;in good faith&amp;quot;.</text></item><item><author>strken</author><text>This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you&amp;#x27;re storing levels of information on me that are similar to facebook&amp;#x2F;google&amp;#x2F;etc., I do not give a damn whether you&amp;#x27;re soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every website using social media buttons and GA.js, I don&amp;#x27;t think it matters in the slightest.&lt;p&gt;It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop.&lt;p&gt;There&amp;#x27;s so much smugness about the GDPR being a &amp;quot;good reflecting moment&amp;quot;, etc. which makes me think that people who support the GDPR believe that there&amp;#x27;s no way detractors could disagree with it in good faith or for good reasons.</text></item><item><author>yzmtf2008</author><text>The problem isn’t so much as there’s a cost to implementing GDPR, but that the tech community has been “move fast and break things” and refused to handle things properly before.&lt;p&gt;If all you do about my PII is “set delete = 1” (which one could argue isn’t even the best practice in every scenario), then I probably don’t want you to handle my PII at all.&lt;p&gt;To your example, you could easily not switch to a  CASCADE, but instead set delete=1 and rewrite every sensitive field with a special value. Doesn’t even require a DB migration.&lt;p&gt;If your attitude to properly handling sensitive information is “it’s too complicated and costly, so we’ll just not handle it and YOLO”, perhaps GDPR is a good reflecting moment for you.&lt;p&gt;[edit:typo, edit:clarification]</text></item><item><author>jeremyt</author><text> I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and&amp;#x2F;or technical people on here anymore.&lt;p&gt;The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling.&lt;p&gt;Let’s just take one feature: the requirement that you can permanently delete all of your information.  Most early-stage startups use the (in 2008, when I did mine) best practice of “delete=1”.   Changing your whole database over to permanent cascade delete is only easy if you’re a very experienced programmer or who knows what he’s doing.  And that sets aside the fact  that even if you know what you’re doing technically, there are lots of business logic problems with just deleting things out of the database and anonymizing users is very tricky.&lt;p&gt;I was not a great programmer when I started my first startup.  I was learning as I went along.&lt;p&gt;We couldn’t afford a lawyer, and the amount of time for me (the only programmer) to go through and read all the regulations and make all the requisite changes in the product I would estimate might take on the order of a month or two, which if timed poorly would’ve killed our company.   I say again: at an early stage startup with one programmer, you cannot have that one programmer spending two months on compliance.&lt;p&gt;It’s just gotten to the point that there’s one comment after another responding to this regulation or that regulation or this situation or whatever with “well, just call HR“, or “I can’t believe you don’t have a company policy for that!”&lt;p&gt;Or “well just ask your lawyers“.  It ain’t that easy.  Do you have any idea how much it would cost to have “your lawyers” go through the GDPR, tell you what you need to do, and deal with all of the edge cases and gray areas? $20k or $30k doesn’t seem too high.&lt;p&gt;My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup.  Maybe the days of two people doing a startup in someone’s garage should be in the past?  If so, that makes me kind of sad.&lt;p&gt;Regardless it’s not obvious that GDPR is the right policy or that it’s well designed or clear.</text></item></parent_chain><comment><author>lovich</author><text>If you&amp;#x27;re using the data to make money, and the user is generating that data, why do you just get to keep and sell it? How is that any different than you owning some forest land and I just come in and take some animals from the land to sell for meat?&lt;p&gt;You might call it poaching, but that only became a crime when society made it one, and that&amp;#x27;s what the GPDR is doing now with personal data</text></comment>