gingerlime

If you’re in Europe (or a citizen living outside) you can make a GDPR subject access request to get a copy of your data. Try to specifically ask for a record of how your data was obtained. And you can also ask to be deleted permanently. It might or might not work but it’s what you are entitled to under the GDPR.

edit: check out https://yourdigitalrights.org/ which might give you some templates and check whether you’re covered by other privacy regulations in case the GDPR does not apply.

yes, and that’s why some countries are far friendlier destinations for HQs of global orgs. But even the more privacy friendly countries are (badly) handling huge backlogs, and are far from efficient in enforcing legislation.

Data protection authorities don’t need to go through the courts. They have the authority to levy fines. They are by and large slow, understaffed, and in some cases allegedly criminally negligent or coerced into inaction. Try to file a GDPR complaint and see where it gets you. I’ve done it a couple of times. Once with the backing and support of NOYB (argueably one of the most prominent privacy organizations), and didn’t get any sense of the system actually working. Yes, there are some prominent fines trying to set example, but as you say with millions of website and thousand upon thousand of violations, this is a drop in the ocean.

in theory, yes. In practice, good luck getting your complaint acted on. Enforcement of GDPR is a sad joke. To a point that there are law suits and criminal charges[0] against data protection authorities in some countries.

[0] just one example https://noyb.eu/en/irish-dpc-removes-noyb-gdpr-procedure-cri...

totp is good in theory but not ideal for sending via email. Users might miss the email, or it gets delayed, then they want to resend the email and end up with two codes or more. Which one to use then? and you might want bruteforce protection so you introduce a rate limit, which can lock users out in those scenarios.

Sharing your birthday is fine. Or your email. Not both obviously. /s

is it still a problem?? recently bought a switch and only plugged to the official adapter that came with it, but my first thought was “too bulky” so was wondering if I can use my M1 air USB C charger on the go instead.

esbuild is great, but our only blocker for using it was that there was no way to control the number of chunks. On a moderately sized modular app, this can slow down things significantly[0]

[0] https://github.com/evanw/esbuild/issues/2317

I’m not sure this is the issue precisely. However there’s been rulings that ban using Google analytics simply because doing so means the user sends a request to Google, and the user IP address is considered personal data (look up Schrems II). The same applies to Google fonts or anything hosted by Google.

The interesting thing specifically about the fonts case is that, unlike other privacy regulation that defines only fines, and not compensation/damages (fines are levied by the data protection authorities). However in the font case there was a precedent that awarded damages to the claimant in the tune of 500€. Now we see a wave of ambulance chasing lawyers exploiting this ruling to shake up companies. Sad, but potentially useful for privacy. IANAL and all that jazz.

For those who appreciate a fair degree of skepticism and critical thinking, I would also recommend the Crypto Critics corner podcast, as well as the broader focused Griftonomics from Jackson Palmer (of Dogecoin fame). A lot of their stuff is way over my head in terms of financial regulations and lingo, but very sobering even without getting too far into the weeds.

I didn’t know that the day ends at sunset. Did they also have a different clock for hours and minutes or it simply didn’t exist?

Just wondering about Jewish timezones and keeping server times if days get longer and shorter at different places based on both latitude and longitude ;-)

I'm not sure I understand your question, particularly in relation to my comment. There were a few people involved in the conversation so it could be confusing :)

I was commenting about the limitation of fail2ban and the potential for a kind of DoS if lots of users share the same IP. Then one naughty user can DoS all other users.

However, what I typically do with fail2ban is look at Nginx status codes like 4xx, 5xx and then rate limit them (e.g. ban if the rate is higher than expected in a given time). We also monitor our application logs for some errors, e.g. failed authentication or registration will also get matched and banned if over a certain threshold.

> The important part here is the list of scanned endpoints for blocking bad traffic is doing things the hard way.

Yes, I agree with you, even though there are some patterns that might be useful for placing instant bans? e.g. "../../" or if your site is not using php, then any access to a .php$ can get banned etc.

Do AWS and Cloudflare allow you to correct their false-positives? any other 3rd party WAFs worth considering?

This is a useful approach unless your customers are behind CGNAT, huge enterprises, government offices, university campuses, hospitals etc. In those cases you have a small number of IPs with lots of people behind them, and one employee who keeps refreshing an error page too many times can block the entire access for everyone else.

this is neat. I wonder how to combine it with fail2ban / nginx. That said, from a practical perspective, I wonder if "boring" consistent responses might be better, not to encourage attackers to keep trying? (plus false-positive might be costly)

Thanks for the tip about milvus, which might help on its own. I’ll try the playground when I get a chance as well.

I think that’s why the DRV might step in and force a freelancer to pay into the social security system if they have a single client. If I recall it also applies to foreign clients, but I’m not 100% sure how far it extends. It’s definitely easier to bypass the DRV if your client is not German, but not entirely waterproof as I recall.

the only issue is that you might be liable to pay social insurance (DRV), but only if they can show that you have only one long-term client, and I’m not sure if it applies to foreign clients, especially outside the EU (but it might)

No problem at all. US company pays zero VAT. Any accountant can help with billing and tax reporting specifics.

OT but can these AIs generate text based on existing corpus? eg helpdesk system that suggests responses to (human) agents based on previous (human) questions and replies or a bank of frequent saved snippets/replies.

edit: or find previous conversations with high similarity

where did you find a good developer for Wordpress? there are so many that it’s hard to separate wheat from chaff. Especially when it comes to doing things with security/authorization.

As a CTO/developer who works with Ruby/Rails and hates php, I think you made the best choice! Especially as a solo who needs these types of “auxillary” functionality. Wordpress is crazy productive in this way. Their plugin ecosystem, ease of upgrades, admin interface with roles is amazing. And the extensibility using filters and hooks is insane. I sometimes wish other libraries could offer this customization abstraction, even though it’s hard to reason about hooks and filters and it’s weird to get used to. But so powerful.

> or if https://developers.cloudflare.com/ssl/origin-configuration/o... is used.

How is using CF’s origin CA preventing the connection to the real backend in order to bypass Cloudflare? you cam just ignore the SSL error couldn’t you?

Thank you! First I hear about either of those, but definitely interesting. Are there paid / hosted versions of lago? after a sub-par experience trying to switch to ChargeBee I'm looking for alternatives, but struggle to find something that fits our needs.

Besides being a single point of failure, we tried to switch to ChargeBee and found them to be pretty lacking (to put it mildly). The platform looks nice and has lots of options, but under the hood things seem pretty fragile. Horrible docs, random 500 errors that weren't showing on the status page (and support ignored until more customers reported it), our Stripe gateway disconnected and the system still appeared to be working (partly, partly failing) with no alerts, plus lots of other odd behaviour. To be fair, all of this was on the test system, but we didn't feel confident to go live so we put the migration on hold. YMMV of course.

I’m using a free app called SMS block[0] for a number of years. Other than a weird app icon (has a strange logo that has the word TAXI on it with a cross mark for some odd reason), it seems to run local and does the job simply and effectively. Wonder if I need to worry about it leaking any data? I guess it’s easy to switch to Bouncer

[0] https://apps.apple.com/de/app/sms-spam-block/id1283355601?l=...

Yes, from what I heard, YouTube is looking at a 70/30 split with creators.

sounds intriguing. is there a blog post with your setup? can this be (easily) used between several developers? each needs their own server? can the server spin on-demand?

office 365 hosts a bunch of domains though. My bounce was to a .berlin domain hosted there. Yes, I could route all smtp via a ESP and pay for it, but that’s centralization.

Thanks I’ll check it out. The bounce link was to an office 365 spam delist portal. My request was auromatically rejected and my only option was to escalate it to support (one click luckily). I’m yet to hear back, but from the stories on the link I shared, I doubt it will do anything.

mine is maybe 10 years? I don’t recall. No issues so far, but started seeing those Microsoft blocks when I moved my brother’s domain over to my server. I hardly send email out, so it could be unrelated to his domain, just that he sends much more email out.