Hacker News Reader

Hacker News

Comment by amelius | Hacker News Reader

Parent Full thread

amelius

Does that mean that in ActivityPub, I can't share messages with a restricted group of people?

View on HN

You can do DMs, but it's possible for admins with sufficient access on each recipient's instance to read them.

edit: I didn't see that this was in the context of GDPR.

Ok, that sounds like they don't comply with the GDPR then.

Also, doesn't ActivityPub allow closed groups?

Just as GDPR-incompliant as e-mail then, or any social media platform that's not e2e encrypted?

Yes, which is why you can't use email to send sensitive personal data anymore.

That doesn't mean your mail provider isn't GDPR compliant. And with the proper agreements and technical steps in place, a business sending personal data via e-mail could be totally fine to. (a big one would be requiring transport encryption, which is a sensible choice for ActivityPub too, and made by implementations, e.g. Mastodon)

It's specific to the use case and what guarantees you have, and not a strict property of a protocol.

What technical steps? My business used to send personal data to normal people via email (their own data). Now we can't do that anymore.

Why can't you do that? GDPR does not require end-to-end email encryption.

Yes you can.

What do you do instead? Ship it to them on CD?

They need to log in to access the information.

Sounds silly and inconvenient that you can't send their own info to their own email. Recommend you go back to what you did before. If you receive any GDPR letters, sort it out then.

GDPR does not imply end-to-end encryption. Instance administrators on each and every service that isn't E2EE have the technical possibilities to read users' messages simply because they are not encrypted, and that behavior is GDPR-compliant.

Why do you think that? Please explain with reference to the text of the directive.

No, you can have closed groups, by addressing a list of people (if I remember correctly, either explicitly listing people or referencing a list defined elsewhere)

Reply on news.ycombinator.com