Hacker News Reader

Comment by fwdpropaganda | Hacker News Reader

> Instagram has become the dominant image sharing social network with over 800 million users. It shouldn’t need to lock up users’ data in order to keep them around.

> That's fine for Instagram, but what about startups that want to compete and find that users can now build up collections of photos and videos (perhaps using proprietary filters that make a given application popular for a while) at their expense and then instantly abandon their platforms? GDPR is great, or at least not a negative for large companies, but a disaster for startups.

So what are you saying? That startups should have the right to lock up their users just so they can have a business?

No, sorry. If your business depends on "locking up users", maybe you shouldn't have a business.

View on HN

So you would rather have only 2-3 giant internet companies that obey GDPR, than a web of smaller sites like internet used to be? I find it a bit arrogant to think of users as so dumb that they cannot choose for themselves which site to use.

A better law would be one that simply required a disclosure and transparency of what a company does with the user data.

So what are you saying? That startups should have the right to lock up their users just so they can have a business?

I'm saying that startups should have the right to engineer their platforms in the way that they see fit. Because of GDPR, no startup (at least those that accept EU traffic) will ever achieve the social lock-in that Instagram has. Instagram built their user base in an era where it was difficult for average users to get their pictures out. Did your startup come up with a new set of filters that make photos go really viral? Awesome! Users will just make it in your app and then export it to Instagram, where people will actually see it. You'll go bankrupt...but Instagram usage will increase as a result of your efforts.

> Startups should have the right to engineer their platforms in the way that they see fit. Because of GDPR, no startup (at least those that accept EU traffic) will ever achieve the social lock-in that Instagram has. Instagram built their user base in an era where it was difficult for average users to get their pictures out. Did your startup come up with a new set of filters that make photos go really viral? Awesome! Users will just make it in your app and then export it to Instagram, where people will actually see it. You'll go bankrupt...but Instagram usage will increase as a result of your efforts.

Do you realize how backwards that is?

All throughout history it's been the case that circumstances change. Maybe what was a viable business to start before, isn't now. Well, those that took the chance when this was allowed are banking on it, but now no one else can.

Your argument is: person X exploited bad thing Z before, so we must continue to allow back thing Z just in case person Y also wants to exploit it. No, that's completely backwards.

Some people got rich off slavery, so we shouldn't make slavery illegal because my startup wants to take advantage of it too. /s

It's astounding to me that people believe they're entitled to force free services to provide them extra features by the force of law.

You're not allowed to launch a service that provides X, and if you want to, you must also include X + Y + Z.

Am I allowed to even open a port to a server on my local machine that allows users to voluntarily enter some information and does something with it, without being subjected to the full force of the legal system?

I have some experience with the US medical software industry, and this sort of feature-checklist regulation doesn't improve anything. All it does is lock in the existing players and prevent any innovations that aren't explicitly outlined in the law.

> It's astounding to me that people believe they're entitled to force free services to provide them extra features by the force of law.

> You're not allowed to launch a service that provides X, and if you want to, you must also include X + Y + Z.

If you stop for a bit you'll realize that most things in society work like that. It's called regulation. Once you get used to it you'll stop being astounded and wonder how things were ever done differently.

Right, that's fine in the real world, where the existence of something affects you. Real objects take up physical space, and can be noisy, polluting, or inaccessible.

Nobody is forcing you to look at, interact with, or even acknowledge the existence of my local web server. There is no stronger sense of the word "voluntary" than the one that can be used to describe web services. My service doesn't even exist to you, unless you explicitly choose to engage with it.

You, on the other hand, believe that it should not be allowed to exist for other people (at legal gunpoint!), unless it conforms to the features that you believe it should have.

This is more akin to not being allowed to invite people into my home, unless my bathroom and kitchen meet certain (arbitrary, non-structural) requirements.

The same is true in many other cases. For example, employment law - nobody forces people to work for me, yet there are many restrictions on what I can write in the contract.

Defending a laissez-faire model of society, only with restrictions on externalities, is reasonable, but it's also very far from how societies currently operate. The GDPR is not an exception. In fact, not even on websites - the Data Protection Directive, from 1995, already implemented restrictions on how EU sites can be run. The GDPR is only an expansion on that.

You're making this argument as if the whole FB/Cambridge Analytica thing hadn't happened. There is power in these systems and when they're affecting our governmental structures we have a vested interest in regulating them.

This is perfectly analogous to the real world where e.g. pollution has tangible negative externalities. It will always be the case that when responsive governments exist, and a thing comes into existence that people perceive as a threat, people will leverage the government to mitigate that threat.

If your home were perched on a cliff above a school playground, to use a contrived example, the townspeople would have a keen interest in the integrity of your home including the kitchen and bathroom.

>This is more akin to not being allowed to invite people into my home, unless my bathroom and kitchen meet certain (arbitrary, non-structural) requirements.

Like fire code? :)

I was debating whether to remove that sentence, and ended up adding the (non-structural) part because I though someone might take the analogy that way. Note that fire codes in particular don't exist in many places, including much of the U.S.

Nobody is going to die from not exporting their data - except in medical software, where the current U.S. feature checklist regulations haven't helped. For many websites, GDPR is next to pointless while adding broad legal requirements.

You were subject to the full force of the legal system way before you set up a port on a server.

And you can totally set up a port on a server to allow users to voluntarily enter some information and do stuff with it. The law does not prevent that at all.

I think that you're misunderstanding the spirit of the "full force" comment. The fact that I'm subject to the "full force of the legal system" to with regards to preventing murder, doesn't justify every new regulation and its effects.

Does the law prevent it, if I don't want to spend time adding a full account verification system for personal data dumps, permanent data deletion, and other requirements?

You're comparing the inability to easily move pictures from one service to another to slavery? That's quite the leap, though not unexpected on HN these days.

Anyway, I hope you enjoy Instagram if you are in a GDPR-affected country, because no competitor will ever emerge as a result of this law. They'll have all of your data, and you'll have to agree to it being analyzed in whatever way they choose because there is not and never will be another service to go to (which renders this entire point of this law moot).

> I'm saying that startups should have the right to engineer their platforms in the way that they see fit.

We don't let people build homes or other buildings as they see fit because over time we've realized that the failure of one building can adversely affect the neighborhood.

We don't let businesses handle their financials in any way they see fit because over time we've realized that using a generally accepted set of accounting principles helps avoid cascading financial disasters.

Now, honestly, how can you say with a straight face that we should let businesses manage data in any way they see fit because it's "their platform"?

Nonsense, we have an obligation to regulate how data is collected, processed, and used or sold to protect society against the adverse effects of data that is used to abuse.

Only public companies are required to respect GAAP, and they choose to do so because they want access to a regulated market.

Is a building on Pluto subject to the same building codes? If my server spontaneously combusts, should I warn those with IPs near mine that theirs may catch fire?

You have no obligation to visit my web service, enter data into it, or interact with it. It takes up no space, and you have no "passing" interactions with it.

The contention is that others should not be allowed to use my web service, unless it provides you certain features.

I'm believe we should support privacy on the web, but this is not the way to do it.

Well, remember, what is actually happening here is that your web service is deploying code, including malware, onto my computer. The malware payload steals all of my personal data unbeknownst to me, and sends it to random 3rd parties.

So, that's pretty nasty, and yes, I want it to be regulated.

No, not my web service. Some may be, but my web service is still punished. Most of the rules apply even if you are sharing no data with third parties.

If this was just about third-party trackers, the EU could have written a law similar to the cookie warning. People who care about that (including myself) can use browser addons or block third-party cookies.

I think these rules are all fine, desirable even -- if your web service isn't able to follow them, perhaps consider buying some off-the-shelf applications with built in support for these regulations.

This isn't punishment any more than making sure your electrical box is 72" off the ground and your gas meter has nothing around it within 5'.

Thank you, all great examples. Gee, people can be quite blinded when you challenge their worldview a tiny bit.

Peoole can die without building codes. Nobody is going to die if you get a targeted ad. This is all a false equivalence.

The GDPR doesn't ban targeted ads. You just have to get explicit consent. Only yes means yes :)

Reply on news.ycombinator.com