Hacker News Reader

Comment by WesolyKubeczek | Hacker News Reader

By not collecting data it has no need for, and not passing that data on to third parties? By providing an ability to delete any user account, and for editing any personal information? By not using EBCDIC to store said information?

Are you making this more complicated than it needs to be?

View on HN

> Are you making this more complicated than it needs to be?

I'm not sure. I guess if one trusts the default logging settings on the server software to be compliant, and only uses static HTML, maybe that's adequate? But as soon as any third-party code or data provided by some other server gets involved, it's hard to know what might be logged elsewhere as a result of visiting your site.

I mean, would an old-fashioned web visitor counter be compliant? It's tracking something in order to provide that number.

You tell us you have no idea what third-party code you add might be tracking from users. And say this is a reason why you/they should be allowed to do it? (With "it" being... anything the third-party sites want to at all?)

You can +1 a database `views` column without storing anything at all about the user. If you’re just doing that you’re good to go

I mean, most "unique view counters" store the users IP address, so that would be right out. I'm fairly sure even being aware of what complying with a complex legal documents implies constitutes enough of a complication that it's worth mentioning.

It is a complication, but I believe it's worded so that small companies and individuals are immune from its consequences.

You could always hash the IP on the client side before sending it to your counter. That way you have no information which you can backtrack to a specific IP and therefore a person.

Except there's so few IPs (v4) you could just bruteforce it in not too much time.

There are different kinds of hashes. You can, for example, assign numbers to your incoming IPs. The first one to come in gets 1, the second gets 2, and so on. Numbers zero out at midnight, correlation between them and real IPs are at the load balancer. Good luck bruteforcing these.

As long as you can describe the full extent to which the collected IP addresses are being used and which data they are being correlated with, and use a language comprehensible without requiring a legal degree, you can very easily be compliant. Once you involve an undisclosed number of "trusted partners" and start using weasel words to describe what you're using the data for and who you're giving them to, not so much.

That said, an IP address is a shitty device to detect unique visitors. Session cookies, as long as you aren't trying to correlate them to usage patterns and such, are more reliable (you can tell that this is the same phone jumping networks, or you can tell apart users coming from behind multiple layers of NAT) and anonymous.

> Are you making this more complicated than it needs to be?

A large proportion of folks on HN seem to think GDPR is "out to get" everyone rather than a set of common sense regulations that should not at all be a concern for an individual who's serving a blog or personal site and doing nothing to collect PII/track their visitors.

I don't understand why this view is so prevalent.

> I don't understand why this view is so prevalent.

Fearmongering from those actually affected by these common sense regulations.

Companies whose bottom lines are affected by GDPR are screaming that it's too difficult to understand and apply. Many HackerNews, especially for some reason North American ones, are parroting what they hear in this echo chamber without giving it a glimpse of a thought.

I think we underestimate the power of PR way too often.

Last I've read GDPR itself it's been way clearer than any of the Terms of Service written by the very same companies who complain that GDPR is too incomprehensible.

I don't think "parroting" is very charitable. What I think is going on is that we have a bunch of people who are seeing the internet driven by ads that are only a synthesis of print ads and TV commercials. The fact that the medium of advertising (and business itself, evidenced by all the people who say that's the only way businesses can be run anymore) resembles the past so much means the value of participating in it at all for Computer Science and nerdly interests in general is contained on the backend, in the surveillance. I think the resistance to this (not to mention the suit against Google to prevent them from eliminating third-party cookies from Chrome) is because advertising becomes boring without the PII shenanigans. If you can't slice and dice people's activities into predictions about what they're going to click on if not buy, then what did I acquire these student loans for, to write HTML and JavaScript like a schmoe?

Of course reality is more particularized and varied, but in the big picture I think GDPR and other threats to surveillance advertising is treated as an existential threat to an entire class of skills, skills that can buy houses.

Days late and this will probably go unread by anyone, but further evidence that GDPR compliance is complicated, and it's difficult to avoid fines:

https://news.ycombinator.com/item?id=30135264 "GDPR penalty for passing on of IP address to Google by using Google Fonts"

It's absolutely true that using Google Fonts will cause a user's IP to be shared with Google, and that this is a violation of the GDPR. But having to review content at this level of detail is burdensome for individuals or small organizations putting anything onto the internet.

Reply on news.ycombinator.com