DEADMINCE

> I can’t force you to see parallels you are very firmly convinced don’t exist, nor can I force you to provide new evidence or arguments instead of rehashing conclusions I’ve already refuted as best I can

Oh. OK. So you're not actually providing any of the proof I asked you to, you're just wanting me to trust your arguments as correct in spite of all the evidence I've seen to the contrary. Yeah, that sure is reasonable. The 'trust me bro' defense.

> This is especially true when you’ve declined my open-ended request to provide one of the “plenty of” peer-reviewed legal journal citations you say exist and don’t engage substantively with the evidence I do share

Because I'm not particularly interested in doing research for you. That would actually take me maybe 10 0or 15 minutes, to find something you wouldn't just dismiss because it was cited by students and whatever reason you found convenient.

You're making a claim which against common knowledge and understanding, so the onus is on you to support it. Not just say 'read X section of the GDPR' and treat that as though you've provided proof.

> asking me to do all the legwork of substantively explaining “some [interpretation of my evidence] that [you] can actually refute.”

No. I'm just first asking you to support your point directly and not with vague handwaving. That's more than reasonable.

> These asymmetries are beyond the scope of what’s warranted here: we are two people having a casual unpaid Hacker News discussion, not you as a judge or juror and me as a lawyer trying to prove my client’s case in court.

Sure. I'm not trying to make it that. But clearly one of us is incorrect. You've been confident from the start it's me, but instead of actually showing how, you're just saying read section X of the GDPR and wanting me to trust your interpretation as correct. How is that reasonable?

There's plenty of peer reviewed legal articles talking about EU overreach. There really are not many saying "whoah, hold up guys, there's been a huge misunderstanding!" - you didn't even provide so much as a blog post claiming that.

The way I see it, EU tribalism can be just as bad as US tribalism, and EU citizens often try to defend EU laws even when it doesn't necessary make sense to do so. Likek how many EU citizens will try and say cookie banners are not the fault of the EU and try to shift blame to the websites, which is nonsense.

> Similarly, if the point of me doing interpretive legwork is just to give you something to refute, that’s not worth my time.

WHy do you think that stance wouldn't apply to me?

> I don’t think we have anything productive left to say to each other in this subthread, so don’t be surprised if this turns out to be my last reply to you here.

Fair enough. Take care.

> There's something... oddly satisfying about tailing your logs and watching skiddie exploits harmlessly glance off OpenBSD's hide

It's nothing to do with OpenBSD though, is it. I swear it's ingrained to people to just unconsciously compliment OpenBSD's security and spread the myth.

Put fail2ban on a public facing webserver or setup any kind of honeypot and enjoy the exact same thing.

> Your hosting provider and ISP will see this differently. So will the FTC.

No. They absolutely won't. Not if I'm not breaking any US laws. The EU bitching would have as much impact as a government official from say Narau doing the same. None.

> Your butthurt about the GDPR doesn't absolve you from your obligations under the CAN SPAM act.

No. You are misunderstanding and conflating things. My point is I can do whatever I want so long as I am in compliance with US law including CAN-SPAM, and even if I violate GDPR as much as I want (again, as long as it doesn't violate US law).

The GDPR has no teeth to enforce fines outside of its jurisdiction. Which is why it never has despite finding violations.

> So *BSD is a joke because all the apparatus, "compliance processes" and "standards" are not followed? Is that the gist of it?

No one said anything like that. They're just saying it's harder for developers and businesses to utilize them as they do other projects that use standard formats and practices. Relax.

> Not so sure about switching on desktops.

I've been using it for years. It's the successor to slack for me. Not a fan of rolling release and prefer minimalism to Devuan's approach. Void looks interesting but I had issues, whereas I had none with Alpine. I recommend it.

The thing is I find stuff like pledge adn unveil to be basically toys. Pledge especially since it relies on the software author utilizing it. We've had stuff like RBAC and MAC implementations for 20 years, and RBAC doesn't have to be complicated, look at AppArmor. If the OpenBSD guys really cared about security, they would be working on something like that.

Look at their remote root ssh bug. If they were a secure OS, someone getting remote root wouldn't be such a big issue, with RBAC/MAC it's clearly not such an issue, with the default 'secure' install, it sure was. Then again, I don't think the obsd devs have a real interest in security, so much as an interest in correcting bugs, which they falsely equate to be the same thing. Pretty sure one dev had no idea what MAC/RBAC even is and was trying to claim pledge is the exact same thing, which only lessens any confidence I had in them.

I wouldn't say it's missing. I deliberately generalized. I mentioned RBAC as an example.

If people want to learn more there is no shortage of info. There was even a talk[0] at the 36th CCC.

[0] - https://www.youtube.com/watch?v=3E9ga-CylWQ

> If they run into OpenBSD, however, their efforts are quite likely to be thwarted just because the blowfish is so darn spiky.

Ehhhhhhh.

As a teen eating up all the computer security stuff I could find, and getting into osdev and learning as much as I could, OpenBSD always seemed kind of off to me. The security claims are hugely overstated, and for an OS that claims security as its focus, they are slow if not reluctant to add tools that vastly increase security, like even a simple RBAC implementation.

Disabling services by default should have been the default for all operating systems, and writing OpenSSH has been great, but let's all stop perpetuating the myth of OpenBSD as an especially hardened OS.

I agree about the BSDs being a secret weapon, but that's more to do with the license as someone else mentioned, and I'd think Net and Free are more commonly taken from.

I haven't changed the meaning, I simply stated things accurately.

Here, though, you've misstated things inaccurately. You seem to think the points are interchangeable, and the only issue here is semantics. You couldn't be more wrong.

> Once privacy is considered as a fundamental human right, everything makes sense.

Does it? I agree it should be, and I want to work towards a better world also, but pretending you have jurisdiction when you clearly do not, doesn't seem helpful in any way.

> There's lots of bullshit in legal journals too, partly due to how most of those journals are student-reviewed rather than peer-reviewed, and partly due to how politicized the legal academy is. Care to provide a cite?

I do't care to provide a cite, but this seems rather dismissive. Plenty of peer reviewed legal journals also found the idea mockable.

> No, I'm saying that a UK entity can sue a Brazilian for defamation in UK court, not Brazilian court, and win jurisdictional arguments in the UK court based on the Brazilian's publications being targeted to the UK - even if the Brazilian has never been to the UK. And all of this would be based on UK law, not Brazilian law.

Oh, sure. There's nothing really special about that. I can sue anyone in the world if I want to, it won't matter much if they are not in the same country as me and never come. A best case scenario would be getting a default judgement that couldn't be enforced and if they ever did come would be overturned instantly, so basically worthless.

That doesn't mean US laws apply to everyone in the world though.

> I said nothing about the foreign defendant being present in Quebec, no. Everything I said applies even when that is not true.

OK. Then like your previous example it isn't relevant or analogous.

> This is among the common global misinformation about the GDPR that does not reflect the EU's actual legislation or their actual guidance about the GDPR

Except it does. They explicitly assert extra-territorial jurisdiction for cases like this. That's why there was so much written about it.

> However, monitoring behavior by visitors where that behavior occurs in the EU does. So if a website's preferred online advertising model depends on monitoring the behavior of their visitors and they don't want to make an exception to that for visitors in the EU, that's the source of the GDPR applicability - not the online advertising itself.

Right, and that's nonsense. It still all boils down to the basically zero possibility of practically enforcing any of their laws against, say, actors in developing countries with no relationship with the EU, or worse, hsotile to the EU.

> And I already explained why this is necessary to avoid a huge truck-sized loophole.

And I responded explaining why I think you're explanation is incorrect.

> Again, read Article 3 of the GDPR and Recitals 23 and 24 of the official guidance. The EU does not claim the GDPR applies there.

Instead of just quoting the GDPR, which we've both read, how about sharing the text you think applies and your interpretation? Something I can actually refute.

> You would be amazed at how many countries would apply their jurisdiction to foreigners with respect to how many laws in this kind of secnario. People have been persuaded otherwise by anti-GDPR propaganda by the industries that depend on routinely violating the GDPR, but it's really true.

I don't think it has anything to do with "anti-GDPR propaganda", more the GDPR being uniue. The examples you gave didn't map to the GDPR, can you give some that do?

> They claim just as much jurisdiction as most countries do

This is false. They claim more than any other western country does.

> Everything and everyone is mockable, even me, even you, even everyone we know. That doesn't mean what you think it does.

It means exactly what I think it does. To try and dismiss the meaning I intended and suceeded in conveying and that you understood, you are taking the meaning literally when you know that isn't the meaning conveyed here - "mockable" here means, having something juicy and rich to milk for material, the results of which are relateable and appreciated by the intended audience. Not everything meets that definition, certainly not everything and everyone.

> while there are indeed some multilateral treaties about the recognition of foreign judgments such as can happen for unpaid GDPR fines,

Can you name one non EU country that has a treaty that specifically covers the GDPR?

> However, US state laws do allow recognition of foreign judgments, with the details varying widely.

They sure do, and the details as to why can be interesting, but usually it's going to be a case of there being an equivalent US law. There isn't in this case, and several judges would be repulsed by the suggestion that the law should apply in the US at all.

> I would be quite surprised if all US states would never enforce a court judgment from an EU country resulting from a GDPR violation. Said differently, I expect that at least some US states would enforce it in some scenarios, dependent on the relevant facts and circumstances.

I don't really see that ever happening, to be honest. Well, to be fair, maybe states with data privacy legislation like CA might, as long as only parts that map to CA's own legislation were being enforced. Although even then they would have to be present in the state. I can make a site in the US, target it as much as I can to EU citizens, blatantly violate the GDPR as much as I can, and the EU can't touch me if I didn't break any US laws. I can do what I like with that EU citizen data I collected, sell it to whoever I want, etc - as long as I don't break any US laws.

> Even when the company has no assets in a jurisdiction that allows recognition of EU judgments resulting from GDPR fines, they can also seize movements of money or goods into or out of the EU which belong to the company that isn't paying the judgment.

Sure, like I said, they have power within their borders and that's it. If the entity never goes through EU borders, then they can't really be touched.

> Anyway, "police and punish its own citizens" isn't the scenario being discussed here

I mentioned it because it's one of only 3 things the EU can do to try and deal with a website violating the GDPR outside their borders. The other is dealing with it any way they can if anything physical, or any money goes through their borders, and the final is what I suggested - to police and punish its own citizens. This nonsense of claiming global jurisdiction is nothing but theater.

> The violation is the website's alone.

And when that website is firmly out of EU jurisdiction, they can't do a damn thing about it. Sometimes, they might get a country to enforce a fine, but that has yet to happen despite fines being issued.

> It doesn't; it applies to EU residents. Your non-EU business is free to do whatever it wants, but as soon as you do business with EU residents EU law applies.

See, you say it only applies to EU residents, but that isn't the case.

The real issue is where you say but as soon as you do business with EU residents EU law applies., and, well, that's just nonsense.

I have a US site. I can operate my business any way I like as long as I don't break any Federal or State laws, and I can break every single EU law that doesn't have an equivalent US law.

The EU can't touch me. EU law doesn't apply to me, even if I advertise the hell out of my site to try and attract as many EU citizens as possible.

All the Eu can do is firewall me off, prosecute me if I come to the Eu and police or punish its citizens.

> This is more or less how it works everywhere (with some exceptions).

It's really not. The EUs claim of global jurisdiction is unique and a first. There may have been loosely similar things, but nothing quite like this.

> But not because "EU laws apply globally".

You should inform the EU they should correct their legislation then.

> Most of this mockery is based on misunderstandings that overgeneralize what the EU is asserting and overlook what most other countries assert.

I think that mostly assumption. Much of the mockery was in legal journals for example - an audience that would be more familiar with the ext of the legislation than most.

> Most countries have some laws that under some circumstances purport to apply to foreign non-citizens located outside the country, not just the EU.

Maybe a few other countries have something in the same general category, but none as far reaching as GDPR law tries to be. And certainly it's a minority of countries that have such laws, not most.

> A key example is defamation law. If you are a Brazilian citizen located in Brazil and you specifically target publications online to UK or Canadian or US audiences in ways that are viewed as defamatory in those jurisdictions, you could very well get sued in those countries' courts, and there are absolutely cases where those courts would uphold their jurisdiction based on the specifically targeted publication.

I'm not exactly clear what you are saying here, but in any event, at least in any interpretation I can think of, the analogy doesn't map. If a UK entity sues a Brazilian in a Brazilian court, that's all pretty normal. That's just the UK entity doing something they are able to do in compatible courts, that's not UK law applying to Brazilians.

> Similarly, when asked to decide if they have jurisdiction to enforce local consumer protection law against a foreign defendant, the courts in the Canadian province of Quebec will consider whether the foreign defendant has tried to target Quebec consumers, should know that it has ongoing substantial sales to Quebec consumers, et cetera - not only whether it has a business establishment in Quebec.

And how is this relevant? That foreign defendant would be present in Quebec to be tried, so it's quite a bit different from the EU claiming Joe Schmoe halfway around the world who has no interest in the EU or Europe and has never been there, is subject to EU law because an EU citizen visited their data collecting site.

> Conversely, if you are a hotel in New Hampshire, USA and someone located in an EU country visits your US-based English-language USD-only hotel website and books a room for their upcoming visit, the GDPR probably does not apply, since there is no attempt to target the EU.

The attempt to target the EU would be simply be having online advertising that would show up in the EU.

> Among other exceptions, the conclusion could be different if the hotel website allows bookings in EU currencies or languages (not counting English and maybe not US/Latin American Spanish because of their use in the US), since that shows an intention to target EU visitors.

I don't think this is the actual text of the law. The EU claims GDPR applies to a small data collecting site, say, in Vietnam, that wants to store and retain and sell all the data it can about anyone that visits its site. That's what is ridiculous, that's what is incomparable to anything else you have listed.

But in any event, let's say that is the law. Let's say this site in my Vietnamese example goes out of it's way to target the EU, having French and Spanish as default languages, having language flags for every EU country, and paying for advertisements (but only on US sites with US companies, lets say, just to reinforce the point that no business has been done in the EU) - well, in that case, it's still bonkers that the EU thinks they have any jurisdiction over the operator of that site.

The ONLY thing they can do is firewall it off, like China does. That's it. Claiming to have global jurisdiction as they do just makes them look foolish.

> If merely being foreign allowed EU-focused businesses to avoid the GDPR, that would be an extremely huge loophole,

This is already reality, though. Any business in the world can court EU consumers, and only the EU can prevent that by further policing its citizens. They are powerless to stop foreign businesses any other way since they only have jurisdiction in their own borders...yet they claim the opposite.

> Of course, you're quite right if you view it as a mockable idea that the EU would be going into foreign countries to bust down doors and collect fines from foreign businesses. Just as clearly, they aren't pretending they can do that.

It's mockable that they claim they have any jurisdiction outside their borders in the contexts they do, period.

> But if a foreign company does get assessed with a GDPR violation fine in the EU, it certainly gets harder for them to continue to engage in business dealings with anyone in the EU without that fine more becoming possible to collect - and in some cases there are established mutual legal assistance treaties through which EU countries can get foreign countries to help with collecting a judgment outside of the EU.

There is absolutely no instance of a foreign court upholding a GDPR fine and I don't expect there ever will be, nor is there any treaty that would allow for that as far as I know. If you know otherwise and could name such a treaty I would appreciate it.

The only thing the EU can do is get a judgement against that person or company and arrest people if they enter the EU, firewall off hosts, or police and punish its own citizens.

> It absolutely does.

Absolutely, absolutely, it does not.

The USA law is saying US law applies to US persons wherever they may be in the world.

The EU law is saying EU laws applies to ANYONE in the world if an EU person interacts with them via the internet.

You realize those two things are not the same, right?

> Claiming jurisdiction by server location is the stupidest thing ever if you trying to have any kind of customer protection laws. You have to go by customer location.

I disagree, because that's impossible. That's why the EU's attempt is largely a joke. Literally - it seems to get mocked a lot when I tried reading up on the credibility and practicality of what they claim.

> However, the claim that they have jurisdiction over EU citizens abroad is very questionable.

It's the claim that they have jurisdiction over non-EU citizens and businesses in their own countries which is so laughable.

The EU claims their law applies globally regardless of if people set foot in or do business in the EU. According to the EU, an EU citizen just needs to visit a site and the law applies, regardless of where the site is hosted.

According to the EU, the GDPR applies to some small shop owner in China with a website that harvests all data it can that isn't advertising in the EU, courting EU citizens in any way, has no business with the EU, etc.

> it's effectively the same

Nope. Not even close.

Practically the GDPR law has no teeth at all because its claim of extraterritorial jurisdiction is nothing but nonsense.

FATCA applies because the US has a carrot or stick to enforce it.

Also, the US law as written is entirely reasonable and doesn't try to claim the law applies to US citizens anywhere in the world.

No, it's not remotely the same.

The US is using the fact that people want to do business with them to coerce compliance, and as written the law only applies to US persons.

The EU claims the GDPR applies globally, regardless of if people want to do business with the EU, or even if people ever set foot in the EU. It's amusing nonsense.

It's probably just an nginx fail2ban jail or something that looks for the wp pattern.

> testing recent Apache vulnerabilities by POST-ing to something like /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh .

Are they really recent vulns though?

The traffic doesn't matter if you are sure your setup is secure. Key auth only for SSH, reverse proxy in front of your actual web server and use secured containers or VMs for each service. Throw in fail2an or crowdsec and that's more than enough for a little home linux server.

That situation is quite different. The US is using its significant power and weight to coerce those non-US banks into compliance with FACTA. Those banks don't have to comply, but they want to do business with the US and US companies, then they don't have much of a choice.

It's not like they just made a law and now insisted it applies globally, which is what the EU did.

> I'll goddamn make sure your domain ends up on every goddamn possible antispam filter I can find.

Honestly, individuals can't really do much to change the reputation of a domain.

Maybe petition your representative to adjust the GDPR so they don't claim it applies globally?

> a bunch of american sites just block the whole EU due to GDPR laws.

Which is incredibly reasonable. If the EU didn't try to claim EU law applies globally, those sites might still be up.

That's very computationally inefficient.

For most people, ego dominates and comes far ahead of empathy.

They will just have AI generate unique ads for each person even though they are all slightly different.

Personally, I like my systems to be 100% free of systemd philosophy.

> "equivalent" was the word used by one of the developers working on the Proton stack during a conference talk on the subject.

Yeah? You got a source? Can you show it wasn't in a particular limited context and was used in the same sense you are using it now?

> Which is correct usage, since "equivalent" doesn't only mean exactly the same in every way but can also mean equivalent in purpose, which they are.

Nah. They are still not even close to being equivalent in purpose. SDL is a little closer, since it wants to be the API for all aspects of gaming and 3d development, but it isn't quite there. Before you double down on your point, maybe you should really look at everything DirectX offers, and everything the alternatives you claim to be equivalent offer.

> That is literally what your whole point is leaning on, taking a narrow definition of the word equivalent and spinning up a take that makes you feel right about yourself (meanwhile throwing an accusation at me re: abusing semantics). It's so desperate and stupid.

LOL! You've described yourself here and only yourself. I'm not the one arguing semantics. You claimed two things were equivalent, which are not. I simply pointed that out, and instead of just taking the L you, and only you, are arguing semantics. I absolutely agree, it is desperate and stupid.

How about just...actually supporting your claim, if you really believe you are correct? You know, instead of arguing semantics, or trying to deflect and falsely accuse me of doing so?