Hacker News Reader

Comment by shiado | Hacker News Reader

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going to target American banks of American businesses and try to extract fines? Is the EU going to extradite owners of these businesses? Are EU courts going to issue default judgements on businesses and individuals?

View on HN

> Is the EU going to target American banks of American businesses and try to extract fines?

You mean like America? That time when the USA decided to enforce their embargo against Cuba by intercepting a payment from one of the Nordics for a bunch of Cuban cigars? No, that's unlikely.

> Is the EU going to extradite owners of these businesses?

Extremely unlikely, besides that would require the cooperation of the other country. But - and this is interesting - the other countries typically expect the EU to cooperate with extraditions when the law is broken and we do. So who knows.

> Are EU courts going to issue default judgements on businesses and individuals?

Against individuals: Unlikely, but it could happen, against businesses, that's typically how things go when one party doesn't show up.

But note that for that to happen you first have to ignore the regulators for long enough to get them really pissed off, an action I would recommend against.

There are plenty more examples of the US twisting Europe's arm. Currently it's looking like that is the plan for Iran.

I hope not. They really need to tell the US to go to hell on that front. Pissing away a deal that is seemingly working because Trump got made fun of by Obama.

> They really need to tell the US to go to hell on that front.

Would be easier if Europe had a coherent voice. You got the former Eastern Bloc countries desperately clinging to the US (because they, rightfully, fear that Putin will screw them over), you got the UK which is trying to not fall apart due to Brexit, France is... France and Merkel is trying to prevent the worst of the shitshow, even though she's miserably failing at that (and under heavy pressure from the AfD nazis and her own sister party which is openly copying the nazis).

In addition, Europe is so damn far behind the US when it comes to military power - jeez, German army is practicing tank shooters with broomsticks as munition, the NH90 marine helicopters are not allowed to fly over water and we all know what a fuckfest the A400M is. No money, no competence, but it wasn't a problem since WW2 as the USA had always covered the EU... now that Trump is, well, being Trump the EU has yet another giant problem to tackle.

> Europe is so damn far behind the US when it comes to military power

As a European, I consider this a good thing.

As a Canadian I'm fine with my country being behind too.

Would like more spending to make sure soldiers don't die due to shitty equipment, but still largely fine.

> As a European, I consider this a good thing.

I am ideologically more aligned to pacifism, the problem is that it does not work in a world of wannabe highschool bullies (USA, China, Russia, Iran, Saudi-Arabia, Qatar) vying for regional dominance.

Europe is so damn powerless and underfunded that we cannot even ensure that basic human rights are respected in conflict areas. On a bully stage, the tiny kid will always be the one that's bullied. No matter how economically powerful the EU is.

The US has all the leverage. They can just say "you can trade with Iran or you could trade with us," and what is the EU going to do? I'm not happy about the Iran deal being torn up either, but there is nothing European leaders can do about it.

Call a rather obvious bluff and put political pressure on American leaders over it.

They have a pretty easy to defend position.

It's not really a bluff; they can cut off any European business that deals with Iran easily. Someone else will play ball. This wouldn't be the first time they did it either.

Jacques - I love the effort you've put into explaining the GDPR to clueless and needlessly exasperated (mostly) americans here on HN.

To be honest I used to think you were just a shameless self-promoter like almost everyone else, but in this case you've risen to the occasion. Bravo. I think you're now rating quite high in most people's "mental books of good people". Or at the very least, in the minds of people who actually have a strong impact.

>clueless and needlessly exasperated (mostly) americans

I'd love to see the dataset you have access to backing up any of that statement. It must be fascinating.

> I'd love to see the dataset you have access to backing up any of that statement.

That would make you a sub-processor.

Hehe.

> You mean like America?

Yes, like America. This may shock you, but America isn't always right.

> Yes, like America. This may shock you, but America isn't always right.

That was exactly your parent's point?

So whataboutism is a valid justification to continue the practice?

They're arguing that US companies are afraid of the EU behaving like the US, & then asserting that the EU will not behave like the US

It's always wrong to be the first in the thread to invoke "whataboutism".

Exactly. It's possible to criticise what the EU are doing without thinking the United States does everything right - or even that it does it better.

Disappointing to see so many EU apologists defaulting to whataboutism.

> You mean like America?

Ahh yes, one of my favorite logical fallacies: https://en.wikipedia.org/wiki/Tu_quoque

Tu quoque is not a logical fallacy. There's no logical step that's violated. It's an informal fallacy.

Technically, yes. It's an informal logical fallacy. The point is that it's a pretty ineffective means of advancing the discussion.

Right FTA: it's an "informal logical fallacy.

But since the answer is no, is this still a fallacy?

It's not being used as a fallacy, since it's not part of an argument that proves a point.

I don't follow you. My interpretation was that OP said roughly, "I don't understand/approve of GDPR because of this and this." Child then responded by saying roughly, "but America does it too." Seems like the child was trying to imply that OP's claims/concerns are false because they are hypocritical.

Not really, he said in substance: "America do this, EU will not". Using this example to somehow gain a moral high ground.

The intended effect was to provide some context and to take away a worry. I can see why Americans would be worried because there are many examples of where America has 'exported' its laws all over the globe. The EU is emphatically not doing this, they simply require that if you do business in Europe that you have a European presence so they can enforce their local laws against you.

That "European presence" requirement is, by itself, an attempt to force their laws on the world, and if it's going to have teeth, will require other countries to bow to pressure to enforce it even though they had no input.

If Jamaica passed a law fining any company that hired homosexuals, we'd consider it bullshit even if they tried to abstract it a level up by only passing it as a local law, and then passing another law saying companies that serve Jamaicans have to have local representatives. I'm not sure why you think this is any less bullshitty a tactic, other than the fact that the law they're trying to push seems more reasonable (which I agree with).

So you're saying F. local laws that get in the way of international commerce? You could stop doing business with Jamaica, and hence put pressure on it's elected bodies.

If you don't like foreign markets, don't enter them.

I think that child was saying that since America does that routinelly, Europe is entitled to do it too. Alternatively, may do it for strategical power reasons.

>> Are EU courts going to issue default judgements on businesses and individuals?

> Against individuals: Unlikely, but it could happen

AFAIK IANAL: GDPR doesn't apply to individuals that e.g. host mastodon instance.

Agreed, but execs of companies violating the law are also individuals, and those were the individuals I had in mind.

> GDPR doesn't apply to individuals

>> Agreed

Not a lawyer too, but I'm interested what makes you (and jbfoo) believe that it doesn't apply to individuals. It's a EU regulation it should apply to natural and legal persons.

Ok, it has an exception for the processing of data by natural persons in the course of a purely personal or household activity but that doesn't mean it doesn't apply to individuals in general.

> Ok, it has an exception for the processing of data by natural persons in the course of a purely personal or household activity but that doesn't mean it doesn't apply to individuals in general.

If you set up a service that operates in the same way as a similar service would operate if it were done by a business then I suspect that you being a private individual is not going to be much protection, after all you are effectively roughly in the same situation as a sole proprietor business minus the incorporation.

If you process data for family and friends then that would most likely be enough to trigger the exception.

So the dividing line in the case of a Mastodon server would likely be whether or not you allow total strangers to make use of the service and whether or not you respect their rights.

It's true that the GDPR has exemptions for "personal or household activity". Ideally, this should apply to non-commercial Mastodon instances.

However, some non-commercial Mastodon instances are now supporting thousands of users. An argument could be made that operating such instances is no longer a "personal or household activity".

Whilst I would hope that the local data protection agency would side with the Mastodon instance operator, it does put them in a rather difficult situation.

I think this possibility raises a lot of concern for operators of Mastodon instances and other online services.

> You mean like America?

I get the impression that a big part of the motivation for GDPR is this type of resentment against America.

The companies that are most guilty of mishandling personal user data are American companies. If it could not apply to them in protection of EU citizens any regulation would be useless.

Thats because the EU has no tech giants.

If Facebook was german there's no way that GDPR would of passed.

That makes me wonder: what about wechat? Surely Tencent has many overseas Chinese users in Europe, and I’m sure they play as or more aggressively as the American majors. Is Europe going to sanction Chinese companies for violations along with American ones?

Facebook is legally an Ireland company FYI.

Facebook is most definitely American even if their European subsidiary is based in Ireland. That is all moot under the law anyways, as they consider global revenue of any parent company, not just that of the subsidiary.

Recital 23 [1] of the GDPR excludes most US-based businesses from compliance with GDPR. It essentially says that sites that don’t “envisage” (their word) offering services in the EU are in fact not offering services there for the purposes of the GDPR and are thus are not subject to it. It also explicitly states that the mere accessibility of a foreign-based website from within the EU does not by itself subject the site to GDPR.

So while blocking the EU isn’t required, the other tests they use to determine whether or not you intended to offer services to EU residents are a bit murky. In light of that, what better way is there to make your intention to not serve EU users clear to all than to block EU users? That’s the main reason to do it. This kind of blockade will not prevent all EU users from accessing your site, but it doesn’t matter. You’ll have made your intent to not serve EU users clear, which will preserve your immunity to GDPR.

[1] http://www.privacy-regulation.eu/en/recital-23-GDPR.htm

A point with many sites is that they use ad networks and those ad networks send localized ads to Europeans, thus the site targets (or "envisages") Europeans. Even if the actual content is about quite local things.

In my personal opinion, that would be both a stretch of this recital and an abusive use of the GDPR. You don’t control what ads are shown to anyone because they are served by a third party, and you have a good faith belief that you are not subject to GDPR under Recital 23. My guess is that if you used an ad network that specialized in EU ads, you’d be subject to it. But using code from a US ad network that may have some EU advertisers now or in the future shouldn’t expose you.

But I don’t disagree that some EU countries that intend to abuse the GDPR for the purpose of generating massive amounts of revenue from fines may try to make this kind of claim. One of the problems with GDPR is that when you combine unclear regulation with the lack of moral hazard that government agencies enjoy and the financial incentive of massive fines, you create a monster that will constantly seek to expand who and what is covered under it.

You control to whom you give the space on your site. You contract somebody to do this under the terms you negotiate with them. "This is somebody else, they are just paying me" won't work. (And well, if the ad network is GDPR compliant it is relatively little work for you to add the note, if they are not GDPR compliant they may not target Europeans)

Again, this argument is a stretch for sites that are otherwise immune under Recital 23. It is one that may be tested by the most abusive GDPR enforcers, but I believe that test will ultimately fail.

Regardless, it’s one more reason to block radioactive EU traffic.

Your page is showing European ads and you are earning money of those. For me, as a user, the ad network is an implementation choice of your business.

Probably you can offload some challenges to the ad network, if they don't tell you enough of their business, but that's between you and them. For me I'm accessing your site.

I don't see how you can possibly say that. If I'm serving a german an ad in german, for a german business, then how the hell am I not clearly doing business in germany?

If I'm serving a german an ad in german

You aren’t serving any ads in the case of an ad network. You contracted with an ad network that is within the US and the site on which you served their code is not otherwise subject to the GDPR. Your intent to not serve the EU market is clear.

For those purposes, a simple JS snippet as provided by my https://euroshield.xyz/ would serve very well.

Read up on FATCA (https://en.m.wikipedia.org/wiki/Foreign_Account_Tax_Complian...) before you argue further down that path. The US already has extraterritorial laws that have to be enforced by banks worldwide that don’t operate in the US.

Yes, and that sucks. Adding more overly broad extraterritorial laws is going in the wrong direction.

Note that a common response by foreign banks to FATCA is to refuse to do business with Americans, which is very likely the best course of action. So it shouldn't be surprising when companies take similar precautions because of GDPR.

There seems to be a big difference between enforcing a law on all financial institutions and enforcing a law on all websites basically that serve the EU. The latter seems next to impossible to enforce.

FACTA is why banks refuse US citizen or PR customers.

As long as you're just "responding to HTTP requests", there's nothing to worry about and the GDPR does not apply.

It's when you start collecting personal data on EU residents, send their personal data to third parties for analytics/targeted advertising, and so on, that things get interesting.

I can't think of any web server that doesn't log ip addresses by default, and I think it's been established that satisfies the GDPR threshold test for personal data. So while what you say is true, I think you're being a little bit deceptive when you say 'As long as you're just "responding to HTTP requests"' because all practical and established means of doing that violate the GDPR by default.

So hash the IP before you log. Now it cant be traced to a user and you are GDPR compliant. Its really not that hard.

What's the setting in httpd.conf for that?

Post process the bloody logfile on a regular basis. You can legitimately capture IPs etc for a while, provided that it is for a good reason - fixing a problem, or gathering aggregate trends but not for direct marketing reasons against individuals who have not given consent. So, your logrotate.d/ might get a few post/pre rotate scripts, if it really bothers you.

I run a small UK based IT firm. So far I've turned down some of the logging on my HA Proxy instances and stopped logging IPs and user agents in general and a few other things. If I need to do some diags then I'll turn them on again. That's on the long term stored logs (due to backups). So far, my backups are smaller 8)

I do keep very detailed logs with IPs (actually full packet capture) in the ES cluster for IDS purposes but those are turned over (deleted) within a few hours. Less detailed logs last a lot longer.

> Post process the bloody logfile on a regular basis.

Or, maybe, just block all of the EU.... probably a lot easier for a small site.

It's pretty much trivial to reverse a hash when there are only 2^32 possible inputs.

Ip used for technical reasons such as logging access are not concerned by the gdpr per se. The same goes to KYC informations. The gdpr is actually a well written piece of legislation which should worry you only if you do shady stuff. The only edge case that I know are not well addressed concerns the status of encrypted data (would be deleting private keys considered to be deleting them? This question is important on blockchain data storage)

If you log for security purposes that is a "legitimate interest" which would allow you to keep doing that, provided:

- You make a note that this data is being logged.

- You state for how long this is logged (6 months is reasonable), and justify that time frame.

- You state who else has access to these logs.

- You state what steps you have taken to try to minimize unauthorized access to these logs.

- In a register (these statements should be delivered on request of a law supervisor) you also provide your personal details, which users are affected by this data processing, and your goal (which should be something along the lines of: "fraud prevention and intrusion mitigation" to have legitimate interest. Expect big companies with law firms to push this "security interest"-angle hard, as they try to justify their data processing).

Pretty reasonable, no? It would be nice if the large web logging softwares provide standard options to automatically limit disclosure of PII web logs.

You already described far more work than I'm willing to do for the small web site I happen to host. If there's a simple geoblocking switch I'd much rather flip the switch and block Europe than continuously worry that I didn't dot every 'i' and cross every 't' to make some obscure European regulator happy.

You'd also make me happy :).

So if your dating site matches gay couples should you expect fines or worse if a Saudi expat uses it?

My understanding was that an IP address is considered personal information under GDPR, which would put it in your class #2

I'm wondering this too actually, I run a small business, we collect only the bare minimum of information from our customers but we do have some European customers. I'm ignoring GDPR completely, is there any downside for me? Will they block customers from using my service? Will they sieze my European cloud servers? Or can I safely do nothing as I currently am because I don't reside or have a registered business in Europe?

You're probably fine.

If you have a lawful basis for collecting the information, you're only passing it along to others as necessary to provide your service to your customers, the customers have clearly consented, and you employ reasonable protection of that data... it's extremely unlikely that you're in violation.

And if you were, they'd come to you first with a warning (at least based on past behavior). They're not going to seize assets unless you seriously provoke them.

You have two solution:

1: ignore GDPR, you'll probably fly under. And if you dont, fine are scaled for business and people affected, as well as privacy infraction. Encrypt your backups, encrypt PII if you can do it effortlessly, and you're good. If you are not using emails except for checking double inscription, encrypt them too, the entropy is low BUT this is better than nothing .

2: If you have some time and money to spend to try to improve your services: self-report. A public agent will point you the weakness of your data processing.

Is there some way they can fine me with me being in a country completely and totally unrelated to the EU?

Yes, they can fine you, and if you don't pay it they can trash your credit. Don't ignore this.

I'm going to call bullshit unless you can provide a source that any overseas government can levy a fine for whatever reason and then "trash my credit".

How? I'm not in their country, their laws don't apply to me or my business in any way, shape or form. They could perhaps argue I do business there, but that still doesn't give them anything to press charges against. Best they could do is block my site as far as I can guess...

"but we do have some european customers"

The entire point is, NO you can't just ignore GDPR. Your lack of action toward compliance is negligent.

There are thousands of laws on the books where nothing happens when you ignore them. Sure it is possible that the EU will pick some obscure small company doing boring business things outside of the EU to make a test case out of, but how likely is this?

Anyone not up to shady activity can afford to wait for the case law and best practices to settle before doing anything.

Why can't I ignore it? I have european customers but they chose to sign up with a business in a foreign jurisdiction where their laws don't apply. If it's a problem, the EU can feel free to block my sites, but I can't see how it's negligent to not comply with laws that don't apply in my country.

I don't comply with laws from many other jurisdictions either. Should I start applying censorship laws for China and Saudi Arabia too? Why should the EU be special?

I answered your question the first time. The answer is no. If you really had to ask this, just google "does gdpr apply to non eu companies?"

EU has a history of moralistic bullshit proposals like that stupid cookie law. Which looked good in the eye of the law-makers (career politicians I should call them) but doesn't really work in the real world.

People get used to accepting the stupid cookie law and it becomes a habit, and in a couple of years the law lost it's meaning (people blindly accept cookie law) and no-one cares about "the great privacy laws of the EU".

This is probably how GDPR will end up, no sane person would have the time to read all the privacy notices and the crappy opt-ins to just order food as fast as possible.

Hey I'm starving I need that food ordered now, here's my location so you can deliver food here, I don't give a rat's ass about your privacy statement and clickady clack are there any more opt-ins to check before I can finally order my food?

Nobody just doing ordinary business things is going to get caught up in the GDPR. The EU are going to go after the local companies first and/or the worst offenders. Just sit back and wait for the case law and best practices to settle down and then decide what to do.

My feeling is it is going to end up like the cookie law, but who knows at this stage.

EU will not be able to enforce GDPR law in other countries, unless company has a subsidiary in the EU. Otherwise any country in the world can create their laws and expect that anyone in the world following them.

Unfortunately that horse has already left the barn. Have a look at the USA's FATCA law or any of their sanction laws against countries like Cuba or Iran.

Well thats because you dont understand GDPR. If the company doesnt conduct any business in EU - or more correctly with EU private persones - then GDPR doesnt apply to the company. It also doesnt apply for any Business-2-business relations.

GDPR only applies if you are providing a service to a EU citizen. That also explains what EU will do if a company doesnt comply with GDPR (where it should); they will stop the company from providing those services to the EU citizen.

This is also why blocking EU traffic doesnt make you GDPR compliant (I can use a vpn or visit your site when travelling, and then you are still providing a service to a EU citizen).

If the case really is as you say, with just serving http request, then you have no issue with being GDPR compliant, because you dont store and information about the EU citizen. If however you are not just serving http requests, but track the user or otherwise store information on the site visitor, then you may have GDPR issues. But if you do store data about your users, you really should treat the data correctly.

GDPR is common sense, and if you bother to understand it correctly, its fairly easy to be compliant. Though I’d say, the bigger the company the more complex the implementation.

You're mistaking GDPR's intent with its implementation, an error that lots of people are making.

As Americans we're particularly sensitive about having to follow rules made by people who don't represent us and are not accountable to us. This is a totally fair and justifiable reason to be against GDPR even if you agree with its objectives.

“As Americans we’re particularly sensitive about having to follow rules made by [others]”

That may be one of the most ironic comments I’ve ever heard. I love americans, but as a super power you stick your nose into so many other countries business, directly or indirectly. So, lets just say that argument is not gonna change my view in any way.

I don’t think I am mistaking intent with implementation. The regulation’s written text leavea many details to be answered along the way and the first couple of rulings on GDPR will (hopefully) bring us a lot of insigts into how to interpret and implement GDPR in practice. So I guess no one really knows the implementation yet. Until then we have to go by what is reasonable and the intent. And if you store data on private citizens you better treat it correctly.

It's because:

A) The law seems to extend beyond the borders of the EU.

B) It's extremely long and vague, doesn't really offer a lot of actionable advice, and nobody outside of privacy lawyers seems to really understand it fully.

C) The penalties are harsh.

Further muddying the waters, the EU and US already have some existing bilateral agreements with respect to data privacy [1], but does the GDPR supersede or unilaterally invalidate these...? Who knows?

[1] https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield

GDPR is far stronger that Privacy Shield... so you can't use that

> The law seems to extend beyond the borders of the EU.

Hi guys,

It's Kim from the Best Korea, and we just decided that we are going to allow our people to access the Internet.

There is a tiny little thing though, our internet policy stipulates that for every traffic hit to sites outside our borders, the country of origin either donates 1 nuke or if it doesn't have nukes an item of great value, or a 24 hour TV broadcast featuring me.

You haven't actually read any of it have you?

A) It covers behaviour towards the citizens (ie passport carrying members) of the EU. It basically says: "please do not be evil" - OK it says a lot more but I think you get the idea.

B) It does cover a lot of ground but it is written in pretty accessible language for such a large and complex subject.

C) The possible maximum penalties are set at a level that will not destroy a serial transgressor but should hopefully deter anyone from becoming such a beast in the first place.

Overall, GDPR is really a manifesto for how people should be treated in the burgeoning data economy. I still find it hard to understand how such a reasonable and farsighted set of regs came to be designed in the first place. As a citizen of the UK, at least I am reasonably certain that the GDPR will stay on the local statute books post Brexit because to contemplate otherwise is economic suicide.

Not directly related, but see FATCA. Because of a US law, individuals in many countries who don't deal with US securities/markets, have to fill a form saying they don't have any direct investments in US, or that they are not a citizen/resident of US.

Interesting that the end result was the same - block people from the country using their services.

Well, if you don't serve European customers, it doesn't.

yup, maybe, probably not... we'll find out

Fun fact: Russia recently approved similar law which requires all personal data of Russian citizens to be stored in a server hosted in Russia. So theoretically many webmasters are already be in trouble :)

> Russia recently approved similar law which requires all personal data of Russian citizens to be stored in a server hosted in Russia

I wouldn't call that a similar law at all, because the spirit of it is so that the government can have access to that data…

Oh are European governments and intelligence agencies going to follow the GDPR as well?

It's similar in the sense that government dictates how foreign companies can deal with personal data of its citizens. I agree that purpose seems to be different.

The fact that the regulation is so vague around it in the first place is the whole problem. There are dozens of conflicting statements (from law firms, no less) about what exactly exposes you to GDPR.

... which in part isn't since that law is that complicated, but buy law firms and consultancies looking for customers.

Companies aren't that dumb, and law firms can't lie either so those conflicting articles show just how much interpretation is involved.

You should be glad that it's so vague. The alternative is a law that lays out technical details of how you handle information, and no one wants that.

Yes, this is the way the law, prosecution and judgement works. If you violate GDPR and the EU prosecutes you and you don't even show up to court and there is judgement against you and you are fined, the EU can try to get paid from your bank. That's how law, prosecution and judgement work in America too. How else would it work? Why would anyone obey any regulation or ever show up to court otherwise?

That being said, the starting point shouldn't be, "there's no need to imagine that I'm violating GDPR. I only serve Americans". The starting point should be, "I had better imagine that I might be violating GDPR even though I only intend to serve Americans. Are there things I haven't considered? Are there resources I should seek out? As a service provider of some kind, hadn't I better spend a day or two imagining the ways I might run into trouble and plan to avoid it?"

Playing Devil's advocate, there are 193 countries in the UN; is it reasonable to ask site owners to keep abreast of the Internet laws passed in each one, and spend a couple of days for each, even if you just serve your compatriots?

I'm biased for the GDPR, since I think every site should follow its principles regardless of legal obligation, but I don't think the rationale you're proposing is scalable.

Laws are made with physical borders in mind. Digital world doesn't have those borders. But it seems that politicians are expecting those borders to work.

I'm not even sure about sane way to map IP address to country. There are some geolocation services, but I doubt that they are 100% precise and probably paid. Also if I'm using geolocation service passing IP of the incoming request, does that mean that I'm already violated someone's privacy? This is weird.

With IPv4 stretched thin, there's a lot of international trade, even of small blocks. Also, multihomed servers can announce IPv4 from one ASN on another ASN, given permission. Anyway, it's nontrivial to really know where an IPv4 is located.

The block is to pacify the lawyers, it doesn't really matter if it's effective.

It should be noted that I'm talking about the previous poster's proposal. The GDPR doesn't demand that; it specifically says that simply being available in the EU does not automatically make it fall under the regulation.

Hello mere mortals,

Its your favorite dictator, the leader of Crazystan and from 29th of May 2018 I ask that from that date, for every site accessed by citizens of my country I require the hosting company to send one employee to be sacrificed to our mighty gods.

Failure to comply will attract a fine of 50 Gazillion dollars.

Reply on news.ycombinator.com