Hacker News Reader

Comment by Mononokay | Hacker News Reader

The EU has been way too overbearing lately. I have to say, it's made me a bit more welcome to Brexit happening; taking out one of the more economically-important countries from it should cut its power a bit, along with insuring that there's a decent chance of small businesses and the like to expand into Britain sanely.

View on HN

I disagree completely. EU seems to be the only large entity that cares about citizens, and GDPR is likely to bring a lot of sanity to the field. It seems that the positive effects are often extended also to people that aren't strictly in the target group.

I'm saying this as an employee in a company that has been doing changes to ensure compliance. Some extra work, sure, but all the changes I've seen from inside have been for the better.

> EU seems to be the only large entity that cares about citizens

Business owners are citizens too, and they hire citizens.

So? Their desires do not trump the rights of everyone else.

Nobody said they did. I am unsure how that relates to my comment.

I was responding to GP who I believe was wrong and gave an example of the types of citizens that not only do they seem not to care about, but appear to actively punish.

hey are you storing customerID -> zipcode mapping anywhere by any chance. Do you purge that mapping on 'forget' ?

It would literally take me a single Ctrl+F though the codebase to see every line of code that uses CustomerID.

Does it not for you? Ah right, you're making a point about how slow the progress will be if we do not allow the small business owners to build their half-baked solutions.

I am pretty sure Romans once had the same issue with the bridge builders.

>It would literally take me a single Ctrl+F though the codebase to see every line of code that uses CustomerID.

Most real world applications aren't that simple unfortunately. You can Ctrl+F all you want, but that won't show you the logging that automatically logs parameters from requests that include customerID or the reports based on DB replications or ETL.

Well, then remove all of the other data associated with the customer. CustomerID then is then going to be irrelevant anyway.

But frankly, all of your points are equally invalid. Replications are a copy. Replace values in replications with faux values if that's required. ETL? Absolutely the same. Logs? sed s/UserID/FauxUserID.

You're operating a semi-garage business if it's so hard to comply with GDPR. Data does not belong to you anymore, and you've had a few years to make sure you complied.

That's only because the people building them haven't cared about it. Now, hopefully, people will care about it.

ok? Not sure what you are trying to say with ctrl+F.

Don't care for your dumbass comment about some small business thing.

The UK implements GDPR like every other EU country. Maybe they roll it back when Brexit is done, but I wouldn't hold my breath for it.

I think Theresa May recently reaffirmed her commitment to GDPR. The UK was even heavily involved in drafting it.

Does "expand ... sanely" mean building businesses on citizens' data without regard to possible harm to those citizens or society at large?

If not, what alternative do you propose to GDPR?

> If not, what alternative do you propose to GDPR?

There are lots of alternatives. How about enforcing the existing statutes before expanding them? My preferred alternative would be to start with a smaller scope and just require clear transparency on what is taken (i.e. not stored, taken). You can grow from there. But first, show you are capable at enforcement before increasing scope so vastly.

Actually (as a user) I very welcome GDPR. Why would it be so terrible for a user?

SOT: As for Brexit - I'm very curious how it would turn out, especially with so many conflict points (Ireland border and Scots wanting referendum for example)

Law is terrible because after two years people still don't know what to do and how to be complaint. There is as many interpretations as interpreters and so on. GDPR is a tool to shut down websites under guise of protecting privacy.

Oh come on. Hanlon's Razor.

GDPR, like all laws, has something to do with power struggles. But do you have evidence supporting your doubt that it's actually intended to be about protecting citizen privacy?

This has opened so many attack vectors than it closed. For example you no longer need to hack a database to get user data. Just impersonate and request the data from target company. Cookie law trained people to click anything without reading and people don't understand what they do online. Then data portability will enable more pii in circulation. For example fake social network enables Facebook account import for prizes and so on. Now GDPR emails train people to mindlessly signup and agree to whatever. Just create fake email asking to sign up to copy of a target site. Obtain password and download all data. Furthermore employees will have easy access to neatly packaged user data, so that they can sell it in the site. This law is hackers wet dream.

Indeed, there may be really negative consequences of incompetence. But understanding when it's incompetence versus malice is still useful perspective.

Given that protectionism is stupid and protectionists genuinely believe that they are doing something good for their nation when they implement protectionist policies I can use Hanlon's razor and assume both.

"protectionism is stupid" can be used as a generality, but if you make it a broad, confident assertion you're removing human judgment and trying to apply simplistic rules to the world — which is exactly the type of thinking that makes bureaucracies stupid.

And yes, with Hanlon's Razor, you can still criticize things that you accept as likely coming from good intentions.

Isn't that mostly because, despite being given 2 years to implement, nobody's really bothered to do anything until the last second?

If it is unclear what to do, then why would anyone risk doing it wrong?

If you start out early, you can contact your country's regulator for guidance.

Which are not going to know either, because it is all free to interpretation. It is not uncommon that even when government offers paid interpretation, so that company can back what they do by it, to withdraw it couple years later and fine the company (Because civil servant giving out the interpretation was wrong or for other reasons).

Since it applies quite a few new rules that pertain to the development of software, many of which do not store data that is that interesting. (Things like the usual user and IP address logging used to fight spammers.)

So the result is that developing software is more complicated and expensive, and hence less services that people want to use (and only services people want to use matter) come into existence, leading to a lower quality of life.

I don't buy that last sentence for a single second. Fewer services not caring about your data is not a bad thing. And those that do pop up will have done so in an age of caring about user data, thus leading to higher quality services, and a higher quality of life.

Hell, something like this should have been instituted from the very start of the internet.

Any European country outside EU still does bilateral agreements when it's convenient for them, just check Norway and Switzerland for two examples.

It remains to be seen how much exit Brexit will actually mean in reality.

What else did the EU do bad for you?

Make me click throughly thousands of useless cookie warnings.

You know, I used to get really aggravated at those. "This is silly!" I would rant. "Cookies are harmless!" But I've started to come around.

Yes, they're still irritating. But I like the fact that site owners have to THINK about how they're irritating their users and I'd like to think they're questioning whether or not they _really_ need to use cookies to serve static content...

I think they should rather press browser companies to expose privacy settings more and make management easier. So instead of having millions of popups, you could do it from the browser level. That would be more secure and easier to implement.

Websites don't need a cookie warning for harmless cookies (like login cookies or language preferences). Cookie warnings are only needed for tracking cookies, and those aren't exactly harmless.

Or more likely, they search for and install "cookie warning plugin" in 2 minutes and then forget about it forever.

It is not only that, but also that enabled huge vulnerability, because people now click these without reading.

Many aspects of GDPR seem as direct attempt to learn from the failures of the Cookie warning law and fix them - namely, the big flaw was that the law was written so that flashing a banner with no real choice was considered sufficient to consider that the user "agreed", and that's why everyone did the intrusive banners.

GDPR is designed so that these intrusive banners with no real choice are absolutely worthless to the site, they can't construe freely given informed opt-in consent, so the expectation is that websites won't bother with such measures anymore. Of course, time will show what workarounds people will imagine, but both intent and actual wording is wide enough to ensure that this time the adtech tracking business will have no reasonable legal way to get permission to continue what they did and will actually have to stop tracking most users.

The problem isn't the warnings. The problem is that every damn website where you read a single article thinks it's somehow ok to set a cookie (and track you).

The problem is both. We can't pretend that failed solutions with good intentions are not problems. It is not worth adding more problems on the stack because the guess-and-check solution whims fail. Solutions can be measured and worked towards, not guessed at where they do such large changes that their failure is also large.

Cookie warnings are the new ads. My ad-blocker eats them.

I find this opinion amusing, given that at the same time US was successfully failing to keep the net neutrality.

It could have been a bad decision per se, but historically laws take years to become actually useful. And internet is only now getting out of the "Wild West" phase.

On that matter: how many of NH'ers here have voted for Brexit due to the cookie laws?

You know what a cookie is, most non technical people, those whose idea of Internet overlaps with Facebook, do not.

That wasn't the EU's fault; that was purely and 1000% the fault of the websites that implemented them and chose to do a half-assed job of it.

Reply on news.ycombinator.com