Comment by cromwellian | Hacker News Reader

Comment by cromwellian | Hacker News Reader

Parent Full thread

Let’s all have a moment of silence for John Perry Barlow’s Declaration of Cyberspace Independence back when it was envisioned the internet would be a place where any entities could communicate or associate free of government control or censorship.

Loads of people in here who support the concept of net neutrality which helps enable permissionless innovation by not imposing huge costs on those who publish or allowing others to impose costs on them, now cheerlead for the right to impose extraterritorial regulation without representation.

There was a time you could just set up a site on the net and not have to worry about much, apparently now you have to worry about the Union of all possible foreign laws in case anyone from outside geographic regions visits your site. It’s could be a race to the lowest common denominator of freedom, or conversely yield bulkanizarion of the internet as more Geo-IP blocks go up or more great firewalls.

How many of you love “this video or music isn’t available for playback in your region”?

That could be much more common in the future and contrary to commentary far more likely to hurt smaller and medium sized players than the real targets of the laws.

You can still set up a site and not have to worry about much, as long as you're not processing other peoples personally identifiable information without their explicit consent.

Or as long as nothing on my site insults the Thai king, or mentions the Armenian genocide, or Tiananmen Square?

There is a process for international regulations, we sign treaties like with copyright, and I get some legal representation in these regulations from my elected representatives. I didn’t elect the European Parliament. If you don’t like my website, don’t use it.

I mean, obviously you’d say that if you physically flew to the US and bought something in a store, those store only need to obey US regulations. Or if you ordered an international package and had it delivered.

So why do you think sending packets to my geographic location suddenly imposed restrictions on my sovereignty? Virtual goods require more regulations than physical ones?

Even if I agreed with the spirit of these regulations, the idea that you can force your local regulations on a global audience without negotiation opens up a real slippery slope.

By what ethical or legal argument are European regulations any more relevant to Chinese, Thai, or Turkish? Doesn’t Saudi Arabia have an equal right to claim you can’t run a site that slanders the prophet Mohammed and you have Saudi Citizens on your site?

Why are your regulations more relevant than anyone else’s? What if my country rules that running a web site is protected free speech?

Any kind of international regulation of the internet must be agreed to by international treaty.

But then you don't consider the IP address personally identifiable information? The GDPR does.

You can serve web content without storing the IP address of the user. If you need to use it for anonymous correlation of requests, you can hash it first.

In addition, you can store the IP address if you want to use it for infosec (such as, finding out who to block in case of a ddos attack). See https://gdpr-info.eu/recitals/no-49/

The recital also mentions "accidental events that compromise availability, integrity, authenticity,..." That seems to cover debugging for me. No need to ask for consent.

To do certain analytics like page count, you don't need the IP, so that seems ok for me. To track individual customers however, that's something else.

PS: according to GDPR, a hashed IP will be "pseudonimisation", not anonymisation because you can have a key to go back to the original value. True anonymisation removes all info (the IP in this case)

Most small web sites don’t have the resources for this. Many don’t even know if they will have analytics in the beginning, or info sec.

People tend to set up sites and just stash web logs in the beginning. They then learn later what their business needs are and may decide to post process their logs.

You're suggesting a new site pay all of these costs up front to comply with these regulations, you can’t time shift concerns by collecting data and deciding whether you need it later.

Granted, you could argue that this is bad practice anyway, but many startups work exactly like this, maximum logging early, dropping rention later after beta.

If you are not physically hosting in the EU, how many people want to even read the GDPR? A lot of sites don’t even know where their users are coming from until they run analytics.

Actually, I was trying to point out ways to not have to remove/prune your logs...

Right but these days, if you rent a cloud hosted docker container with say, nginx or httpd, you'll get HTTP logs via fluentd with full IP address information, and a lot of people will push these into storage like S3 or GCP buckets for analysis later.

If you say, use a point-and-click installation of Wordpress on AWS/GCP/Azure, you're going to get IP logs being held. I'm just pointing out that the regulations impose a lot of costs and expose people to huge risks.

I mean, can I be held liable if I use an open source downstream dependency from npm or Maven, and it just so happens to have debug logs that are storing info, and I didn't know about this logging cause I didn't audit every line of code from a downstream dependency?

For large companies, this isn't going to be a problem, but the entire open source ecosystem operates on a system that for the most part, you aren't exposed to legal liability by them, except in cases like patent violations or copyright infringement, but now there's a huge cognitive burden being levied on top by a massively complicated new regulatory framework.

The IP space is so tiny that hashing doesn't make any difference.

In addition, watch out for logs. By default all web servers log requests with the IP address, and depending on what you do with these logs, the IP are there.

Yes sure, an internet free of control and censorship is a nice fantasy. But look at today's internet. It's a giant surveillance machine. And that's not going away on its own, because collecting user data is such good business. So the market will not solve this, quite the opposite, it will only do more of the same if it gets the chance. Regulation is the only thing that can save the internet from itself now.

Reply on news.ycombinator.com