Hacker News Reader

Comment by PragmaticPulp | Hacker News Reader

> because they insist on violating their readers' privacy rights and that would be illegal in the EU.

Bad assumption. Maybe an unpopular fact, but many sites simply block EU access to avoid potential legal pitfalls of navigating foreign laws. Getting the site compliant would require review from legal teams and work from (likely contracted) web developers, which is almost certainly not in the budget for a side site like this.

Not every website is backed by a corporation with on-staff web developers and corporate counsel to double-check everything. Their audience is primarily a local one, so allocating the budget to do this and maintain it isn’t worth it.

View on HN

It’s a form of purity spiral where the consensus on acceptable behaviour becomes narrower and narrower as peope try to out-compete each other on who is the most virtuous, or in this case who is the most careful about nonexistent GDPR risks.

> or in this case who is the most careful about nonexistent GDPR risks.

Parent comment is convinced the site is doing something that would be illegal.

You are convinced that the site’s GDPR risk is non-existence.

It’s amazing how many people sitting on the sidelines can be so confident about GDPR while having entirely opposite opinions.

But my point stands: This stuff is complicated and requires sign-off from the lawyers in any large institution. If you don’t have a reason or budget to go through that process, you don’t do it. It’s not virtue signaling or anything silly like that. It’s basic corporate legal protections.

With respect, your assertion that these 451s serve a useful purpose does not match up with my experience of seeing them in the wild.

In fact this is the first one I’ve seen that isn’t being done as a protest.

Within the EU itself, GDPR is rarely enforced. A paper tiger of sorts. Its main meaning is to scare some people straight, but the resources for actual enforcement of its provisions are rather limited.

For example, I still receive a lot of commercial spam that advertises in-EU businesses.

Maybe but no lawyer is going to say it’s probably fine to break the law since enforcement is lax, and the engineering team isn’t going to say we can stand by all the random code this we pulled from npm. The obvious thing to do here is blocking readers from 7 time zones away which up until today went unnoticed.

"which up until today went unnoticed"

GDPR-related 451 is quite widespread in my experience, but that is what VPNs are for :-)

> rarely enforced. A paper tiger

https://news.ycombinator.com/item?id=28140406

This is a completely backwards way of looking at it. If you don't have the budget, create a static website and throw it behind github pages or s3 or whatever. An entire university with a school of computer science cannot figure out some standard way of doing this ?

This publication is independent and not run by the school.

Right, but surely they have resources at the school if they need technical assistance. It's a university. Just find any CS major and they'll tell you how to set up a website.

It's not the technical assistance needed it's the legal review. Go get that from a CS major.

You don't need a legal review.

• A static site without JavaScript;

• with all images / external resources hosted on the same domain;

• where the logs are default configuration, don't leave the server (except as GoAccess reports), and are deleted / anonymised eventually;

is GDPR-compliant. Sure, there are other ways to be compliant, but this works, and is basically the default way of setting up a website. It's not hard to check whether this is how your website works.

When you put together that simple bulletpoint approach you still leveraged baselevel knowledge about the GDPR that would be ridiculous to assume of a CS major.

I'm not even a CS major. I just read the thing. It's not that long. https://gdpr-info.eu/

You can get this knowledge with just the first 7 articles.

I miss the web of the 90s too. User expectations and web economy have changed a lot since then though.

> is basically the default way of setting up a website

It's not the default way of setting up an online content management system to which student journalists can post articles without going through some convoluted command-line build process ("...then you do a git commit and push, run the Hugo script, and rsync the files to the server"... yeah, no.)

> It's not hard to check whether this is how your website works.

Since they're using a third-party content management system, they most likely neither know nor even care how the website works. Why should they? They're journalists, not system administrators.

As others have noted, this is an independent student newspaper. Their normal readership outside the Purdue community is probably in the low single digits on a percentage basis, and their EU readership is likely close to non-existent. They (or, more likely, the people who run the CMS for them) have concluded that a full audit of their system to ensure GPDR compliance is simply not worth it for the minuscule number of additional readers they'd gain. And they're almost certainly right.

I don't know about you, but when I was at school I didn't have much luck getting randos from other majors to do free work for me.

I collaborated with some EE and ME students on personal projects, but they were 1) more interesting than GDPR and 2) friends.

I don't know how this newspaper works, but typically the team itself will comprise students from different majors, seniority, etc. So it's not a question of begging for help or money.

This is an independent website, not part of the official University budget.

You can’t just round up some CS students and have them produce a website compliant with international law for free.

This involves legal teams, contracted developers, and constrained budgets that are already stretched thin on operating in their core business. It’s not reasonable to demand they invest tens of thousands of dollars (or demand equivalent free labor from CS students and lawyers) to serve a population that almost never visits the site.

How are they producing a website compliant with local laws then ? What if they inadvertently end up violating DMCA ? What happens then ? The answer to that is one can be reasonably sure that they aren't doing anything stupid or malicious. It's the same with GDPR. Don't use trackers, cookies, adware etc., none of which are necessary for a college newspaper. This is a simple technical problem.

> You can’t just round up some CS students and have them produce a website compliant with international law for free.

But the issue isn't "international law" in the general case (which, indeed, would be very hard), it's the specific case of the GDPR, the solution to which (for this particular site, which only serves static content) is mind-numbingly trivial: don't collect personal data, don't set cookies. That's it. That's all you have to do.

You're only talking about the technial part. But there are non technical requirements as well: In many cases you need to name a person responsible for data protection, a privacy policy, a list of services you're sharing data with,...

Though I'm not sure if a local US newspaper even needs to be compliant, since it doesn't target EU residents and thus might be out of scope.

Reply on news.ycombinator.com