Hacker News Reader

Comment by mediascreen | Hacker News Reader

I think we (in the EU) will soon realise the bizarre consequences of these regulations. European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US (like most of them are). No cloud services, no Office 365 or Google Workspace.

It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs will just end up starting companies in the US instead.

There must be some reasonable middle ground before we fragment and destroy the entire Internet. Why not start by making a general exception for temporary storage of less sensitive data like IP-addresses for efficiently and cost effectively delivering a web service.

If there is one thing they could start looking in to it would be handling of personal information by governmental organisations. I work a little bit with a few municipalities, and the number of documents with deeply personal information that are just emailed around over unencrypted email is shocking.

View on HN

On the contrary, it only forces those providers to have a European presence.

We're not fragmenting the internet by looking after our own interests. This wouldn't be an issue if Americans viewed rights (and in this case privacy rights) as belonging to human being as opposed to Americans citizens. The US's policy is what led to this:

> Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information

https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield

This is a great response to OPs comment.

At the end of the day we should be doing what is good for the People and somehow its always assumed that they will/should be the ones impacted when policies like these are enacted.

But Europe has leverage here - I don't think Amazon would want to miss out on a giant market base out of some moral principle and there are probably other levers to be pulled here to encourage that.

Anyway, not adding much to your comment other than kudos.

You are absolutely fragmenting the internet.

We had PII on Azure. We wanted to do business in France. We had to fork our services, and run a full stack on a crappy provider in France. They charged a lot more, would take weeks of vacation with zero support for us. It was a freaking nightmare.

EDIT: I love the responses I'm getting. People are in absolute denial that this does in fact fragment the internet. You may believe that's a good thing, and that's a rational discussion we can have. But don't lie to yourself, or to me, that this doesn't fragment the internet.

The fragmentation is acceptable since the alternative for non-US citizens is to be treated as "free game"?

The solution to this is to get your government to get its shit together on privacy. This is just a defensive act by the Europeans and to blame it on them is victim blaming.

This completely misses the point, the laws shouldn't be written to accommodate businesses, its the other way around. If fragmenting is a consequence of better privacy laws, so be it.

Businesses exists for consumers. Fragmenting hurts people - European users - in the first place.

I see very little advantages from these privacy laws but I use and appreciate US businesses every day.

What, you don't appreciate a pop-up on every web page telling you that cookies are going to be used? XD

The cookie banners are a byproduct of companies still wanting to abuse your data, when was the last time you saw a cookie pop-up on HN? Logged in or not.

If only there were some way that European citizens could have told their browsers to not accept Cookies, then maybe we all wouldn't have to click on those banners all the damn time.

But I do want most non-tracking cookies.

Still, the "please let us track" popups can be fixed by policy or law, and I hope they are.

So if those businesses utterly refuse to serve consumers then they have no business existing?

They are definitely serving consumers, otherwise they would cease existing. They're not serving politicians and their pet cause of the day though.

If a business pays taxes, and the laws don't take their needs into account to some extent, that's not justice. It's just mob protection with a veneer of legitimacy.

Lots of loaded assumptions there, of course, starting with the first conditional clause.

Laws should be written to facilitate and improve the growth of civilization. This includes practical and fair measures for conducting business.

Imposing byzantine regulations on every webmaster on the planet isn't helping anyone, least of all the European user, who will increasingly be locked out from the rest of the planet.

Depends on your perspective. It might be that American/Chinese predatory service providers are instead locked out of the European market, allowing the breathing space for local solutions to flourish.

If your local providers need the rest of the world to be kneecapped in order to compete, you may want to start with that problem.

The EU consumer will end up with strictly worse solutions and all the rest of the world will “gain” will be the crappy trade-barrier-supported Euro versions of Google and Facebook.

This is a short term view. There's a certain amount of 'activation energy' that a system needs to be able to kick off and become self sustaining. If a giant generalized, subsidized solution already exists PHBs are much happier to spend years trying to knock a round peg into a square hole than take the risk of doing something bespoke for the problem at hand.

Creating an artificially easy sandbox for your local engineers and entrepreneurs by banning the competition will not lead anywhere good. Competing with the best forces you to improve; playing on easy mode leads to stunted skills and inflated confidence - and worse products, companies, and economies.

It isn't banning the competition. It's forcing the external competition to follow the same rules as the locals w.r.t. privacy laws. The fact that the external competition can't comply means that there's a market niche available which locals have an opportunity to exploit.

> would take weeks of vacation with zero support for us

Heh. Somethings tells me a devops engineer in France has way better work-life balance.

You'd think a _team_ of them could provide 8/5 (8 hours a day, 5 days a week) service...

The internet was designed to be resilient in the face of nuclear war. If it can't handle governments that actually protect their citizens from predation by multinational corporations, then we should rethink some things about the direction that we've taken with it.

Sure, so, let's say that France decides that HN info is PII.

So then Hacker News has to launch servers in France.

And then French HN users are in an island, and only see other French HN users' posts and comments.

And, to be clear, you think that's a good thing?

Do you think it would be difficult to allow the different HN servers to federate their content across regions?

In what way is a French resident protected if their data is stored on a server in France but can be federated to other countries?

Would it be impossible? No. But would it be, say, 5x the amount of effort to build and maintain a federated system with no data stored across boundaries? Probably.

Difficult? Not so much. Demanding a yet another great firewall on the other hand sounds absolutely atrocious to me.

To be clear, you are underestimating the population size of European countries, as if would be a drama to lose HN or simply fork it.

I love hackernews, but there’s way more world out there to discover.

This is protecting EU citizens from EEUU companies having a free lunch on their data.

At last someone admits it outright - you want the EU to be an island, walled off from the rest of civilization, and perhaps also reality

How on Earth did you conclude that I am underestimating the population size of European countries?

I enjoy communicating with all HN users, across the world.

If we each had to use only our own country's fork of HN, we wouldn't communicate with each other, and that would be a bad thing.

I don't think that's what's happening here. This is about a French company being disallowed by France from selling French citizens' data to a US Company.

Maybe this decision makes France toxic/favorable to certain kinds of business--much like how many privacy companies operate in Switzerland because the Swiss government is less likely to snoop than certain others, or how advertising companies operate in the US because they'll let you do whatever you want to their citizens. So yeah, fragments.

But you as a user are free to opt-into any fragment of the internet that will have you. If your government wants to stop you from doing so you should either take it up with your government or circumvent those limitations.

I don't particularly like the kind of fragment that France is creating here, the notion that data has a physical location in space strikes me as a rather shaky one, and I think policies following therefrom are likely to create convoluted architecture that exfiltrates the benefits of access without exfiltrating database instances (I've written enough code that tap-dances around the GPDR to know). Since I'm not trying to start an ad supported business in France, though, I'm happy to respect their right to come up with whatever weird policies they want.

There is so much I want to say about this comment! First of all, it sounds like you had a terrible experience because you picked a bad ISP. I sympathize. But then you generalize from that and imply that anyone wanting an EU host will experience the same. Obviously that's not true - or do you believe no good ISPs exist in France? Second of all, why did you fork your code? Did you write your service to use proprietary Azure APIs without regard to vendor lock-in? Why not take this as an opportunity to incrementally extract the proprietary apis out of your application and replace them with processes you actually own? This will allow you to undo the fork and continue on, able to deploy your application anywhere you want.

We did our research, and settled on the French cloud provider that fit our parameters. They made promises about support hours that they did not keep. Changing cloud service providers is not cheap. We were a small team, and this cost us lots of effort.

We didn't fork our code, we forked our services. We ran everything on Azure. Then we had to configure our kiosk devices to either talk to Azure, or to talk to our servers in France.

"Did you write your service to use proprietary Azure APIs without regard to vendor lock-in? Why not take this as an opportunity"

I'm sorry, do you have any idea of the cost of doing these things?

If you have 6 developers, total, how many of them are you willing to allocate to rewriting your stack, so that you can sell your product in Europe?

Do cloud service providers like Azure not have a way to "pin" some of your service instances to servers in specific countries? Seems like this capability would be important differentiating feature given EU privacy laws about where user data is hosted.

They do, in fact Azure is totally compatible with French law for handling private data. Many large companies use it.

>I'm sorry, do you have any idea of the cost of doing these things?

Oh indeed yes, which is why for years now I've been warning people to not write to proprietary APIs in the first place. It's a faustian bargain and sooner or later the bill is going to come due! If not because of legal requirements, then because MS or Amazon saturates the market, and has to increase revenue somehow. This is an example of where an ounce of prevention is worth a pound of cure. The upshot is that ignoring the warnings of people like me was a mistake.

(It's funny how people have moaned for years about "vendor lock-in" WRT Oracle. "They charge for every core!" But the cloud providers charge for every invocation, which is infinitely worse. And yet no-one seems to worry about it. It's really odd.)

So yeah, using HTTP to connect to a server that happened to be in the US... That's the thing that prevented us from selling in France.

But thanks for lecturing me that "vendor lock in" was what killed our 6-developer team that was developing hardware, and computer vision, and 3D computer graphics, while developing a health care product under the tons of regulation that comes with that.

Your arrogance is just stunning.

Hey, I feel your pain. Companies are like children to a founder, and you have described the heroic acts you've taken to save your child. It absolutely sucks to be in your position.

I think it's important to warn "parents" (or future parents) to avoid this particular tragedy, which I think is quite avoidable. I want to encourage people to question the orthodoxy around cloud, that everyone is doing it so its fine, and worse is better anyway, yada yada. It may be insensitive to use your situation to illustrate the downside of cloud vendor lock-in, but my motivation is not to look down on you, but to warn others about this very real, very painful outcome that they court when they make the popular choice.

I wasn't a founder. I was one of the 6 developers.

We happened to not use any vendor-specific APIs.

And it still killed us to fork our stack, and to teach our kiosks to be able to talk to the right server, and the extra cost of the servers in France, and the lack of support we saw from the provider in France...

Would you reconsider naming the provider?

Many noble efforts fail this way. You are not alone. This is one of those lessons you learn in regards to keeping your audience narrow, and executing on one thing at a time.

It's embittering, hardens the heart, and makes you want to give up, but you've gotta redouble and bust through it.

And by all means, shame the provider if they didn't live up to their end of the bargain.

your frustration is justified. azure/aws is the entire environment. i dont think you could have implemented the suggested magical suggestion in any relevant or practical way.

Thank you for this response. Calling it a magical suggestion really does feel accurate. I was sitting here trying to think how you would even do this when everything is running on AWS (or Azure).

> your arrogance is just stunning.

Sorry if I don’t follow your reasoning, I’m still stuck at this piece of USA policy you seemed to have glossed over:

> Sec. 14. Privacy Act. Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.

https://www.govinfo.gov/content/pkg/FR-2017-01-30/pdf/2017-0...

"Agencies" refers to parts of the US govt; that is a US govt regulation for its own agencies with respect to its own citizens and the regulation of immigration. It has nothing to do with e-commerce, cloud storage, start-ups, web services, etc.

Just as France accords its own citoyens rights that foreigners aren't entitled to.

"Don't make HTTP calls outside of our borders."

"We're not fragmenting the internet."

???

A better wording would be “don’t make calls into jurisdictions that violate our legal statutes”.

Ok, let me make a simple “marvel comics” example: what if all your calls were funneled through “Putin servers” or “Iran cloud” or “ People's Liberation Army computers”? Would you mind?

I hear you arguing “but we’re the good guys! We’re USA, flag bearers of Democracy!” but no. Really according to EU law, under USA jurisdiction Pricacy Rights are fair game for people like Zuck. The guy that said “ I have over 4,000 emails, pictures, addresses, SNS. People just submitted it. I don't know why. They "trust me". Dumb fucks.”

Now, granted: our politicians likely want to stay on top of the consensus forming media, and make sure it’s within reach of their network. Annoying to see all the action moving to a different platform after all the years spent building relationships with the old media, but that’s the business.

I am so delighted I am able to access blog posts from people in Russia or Iran or China. Otherwise, it would be far easier for human rights abuses to exist. (This is somewhat tongue in cheek. My point is that information wants to be free, and we're all better off if there's LESS friction.)

When I found out Parler was being hosted on Russian servers, I immediately informed everyone I knew who was thinking about switching to Parler that it was a really bad idea. And it's their choice whether to use Parler or not.

I think it's great if companies can't hide that they're doing something like routing data through Russia. I think it's pretty stupid to not let someone use a product that routes data through Russia.

I also think that if Facebook stands up servers in France, it'll still be just as problematic as it is today.

This sounds really americentric. Have you considered that the every non-US citizen'd PII is fair game for US companies one in the county? As a European I wouldn't want my stuff to be routed through the US the same way you don't want your data going through Russia.

Yeah, it sucks that the US doesn't respect non-citizen data. But TBH I really don't think it respects citizen data either. Consider that Snowden discovered all kinds of ways the CIA and NSA were hoovering up data, in defiance of the law. But did the American people get pissed and force a change in those agencies, and call the leadership to account for disregarding the law because it was convenient? No: they successfully demonized the whistleblower who is still on the run. (Although I will say that excessive snoopiness is a lesser evil than censorship).

In the end, though, there is a high-tech solution here, and that's to migrate to 100% asymmetrically encrypted messaging, at the application level, regardless of underlying transport. This would force nation states to risk large scale hacking of devices, but that's more visible and easier to combat, as long as we remain free to make (and buy) the compute hardware we want to make.

The U.S. doesn't even respect Citizen@s data half the time. Remember, the Courts ruled that expectation of privacy, and therefore 4th Amendment protections are waived as soon as you engage with a Third Party.

> This sounds really americentric

His whole comment was about how he want to let traffic route through Russia even though he doesn't like it... but it's really Americentric? Could you explain that point please?

You pay for every invocation of what exactly? Lambda, certainly not fargate or ec2.

Then there’s the cost of your devs implementing the same feature azure and aws already has, which is usually forgotten about.

Also the icing on the cake for oracle was a contract termination fee. No cloud provider comes close to the oracle billing nightmare.

> do you believe no good ISPs exist in France

Nothing comparable to AWS/GCP/Azure.

There are AWS and Azure regions in France.

GCP should open one early 2022.

But they don't count because they're still controlled from the USA.

Is this really true? As far as I know you can be perfectly compliant with EU law by running in AWS's EU regions.

The core issue here are the CLOUD ACT and FISA Section 702.

Basically the US government says it gets free access to all data stored by any US company or its international subsidies anywhere and that non-us-citizens have absolutely no right to any data privacy at all.

However european citizens do have such a right, and as such, companies can not process personal information using american subprocessors, because those can not guarantee to respect the citizens rights.

For a long time this was all about some contractual clauses between processor and sub-processor: the american subprocessor guarantees by contract to respect the data subjects fundamental right to data privacy.

And then the USA made the CLOUDA and FISA and all those contracts are no longer worth the bits they are encoded in. American companies are by law required to not respect the right to data privacy and can not guarantee to respect it in good faith, as they are themselves subjects of a surveillance state.

Now look at how AWS reacted to this problem: they added new clauses to the contract with their european customers, in which they promise to challenge law enforcement requests, especially those that are overbroad.

When EU goes after FAANG like this, it pushes them to position themselves against mass surveillance and in favor of a global basic human right to data privacy. In my honest opinion this fight is very necessary and i can only hope that humanity wins against surveillance capitalism in the end.

Wonderful reason to break up the goliaths!

If you're the EU yes. Not so much if you're the US.

AWS most certainly isn't for as far as the data protection is concerned. An EU entity runs the EU regions of AWS cloud, you enter a contract with that entity and _not_ with the parent and the data is under the EU law.

have you tried Linode?

Linode is also based in the US. Wouldn't it have the same can't-make-requests-to-the-US problems?

The small startup I worked for in Hamburg had a similar problem. They had to run all their infra on premise due to some wording of some of their largest clients and some odd rulings from BaFin.

The colo/managed provider they chose and had been working with for years was nigh incompetent. I was positive that being able to spin up infra in any of the clouds would have been a ton more reliable.

Sounds like the market in france is ripe for disruption.

> You are absolutely fragmenting the internet.

It's not fragmenting the internet; fragmentation is the whole point of the internet. It's (re-)decentralizing something that has been decentralized the whole time, until these gluttonous whales decided try to eat the whole pie.

So a computer in France can not legally talk to a computer in the United States, but if I instead put that computer in France, I'm legally okay.

And you're convinced that embodies "the whole point of the internet"?

It isn't about "one computer talking to another", it's about where sensitive information is stored. It has never been legal to store classified US intelligence on computers outside of the control of the US government. That's an extreme example, but the handling of many types of information is prescribed by laws in different jurisdictions. Does that mean that US computers cannot "talk" to another other computers? No. Does that make the internet invalid? No.

Decentralization of the cloud is a good thing for so many reasons. I think you're deliberately confusing it with your PII issues and not grasping the larger picture.

I think you're ignoring the harm done to small businesses who cannot afford to implement decentralized services.

You are raising the barrier to entry, limiting competition.

Competition is good for so many reasons. I think you're deliberately ignoring the impact on small companies and not grasping the larger picture.

Those poor small international businesses? If you want to do business internationally, it'll be complicated, and that's fine. The internet has spoiled us by making it so easy for a while.

Seems like it doesn't bother you at all if this hurts competition. Or maybe you don't understand that by hurting competition, consumers are hurt? In our case, with a medical product, it was patients who were hurt.

It just shifts competition into new areas that are compliant with the law. If you can't use aws-us-east from france, then AWS is incentivized to build a (compliant) center in france or else lose that slice of the pie to the locals (or to a potential compliant azure center there).

It's always a tradeoff between racing to the bottom and stagnating. Both are bad, both hurt consumers, and this seems like a good balance between them.

So eventually, we'll all just run a full copy of our stack in each of the 50 United States, plus the few extras for cities that have different laws, and then in each of the other 190 countries around the world?

Does that seem like a good balance of needs to you?

If that's what it takes to allow locals to govern themselves independently, sure.

The technical difficulties seem so entirely solvable, in time (and with that competition you mentioned). Right now it's easy to deploy servers across tons of instances. In the future, if we need to, we can build analogous solutions to the problems you're talking about.

And where we can't build our way to easy solutions, that's fine. Those cases are probably the ones where there are legitimate local differences in what's acceptable, and I want locals to be able to decide that for themselves. It's an absurd goal to try to make it easy for six engineers alone to scale to the entire planet.

> It's an absurd goal to try to make it easy for six engineers alone to scale to the entire planet.

That's an interesting assertion. As counter-example to that assertion, [gestures at huge amounts of the internet as we know it, which was started by small teams.]

And I'm not talking about scaling to 7 billion users. I'm talking about scaling to all of _my_ users, even though they live in dozens or hundreds of countries.

Your demand of having users does not supersede my right to have laws enforced in my jurisdiction. That's the point of sovereignty.

If that means I don't get your business and I'm worse off for it, I'm happy to have my laws changed. Or maybe someone else will come up with the same service who does follow the local law.

You're basically discovering something that physical stores have had to deal with forever. Gary's International Store of Chainsaws and Weed knows that it can't sell chainsaws in jurisdictions where chainsaws are illegal to sell from stores. The people of that jurisdiction made the decision that chainsaws should not be sold from stores; Gary doesn't get to ignore that. Instead he has to incorporate the fact that not all stores get the same inventory in his logistics.

If that means Gary refuses to open his stores in such jurisdictions at all, that's fine. The people of the jurisdiction can decide whether they're happy with the outcome and change their laws if they're not.

Gary has every right to object if Indiana says he can only sell chainsaws made in Indiana, as that would be an absurd law.

Forcing me to run servers in France is absurd.

If anything, it increases the attack surface and makes it more likely that private data is exposed.

>Gary has every right to object if Indiana says he can only sell chainsaws made in Indiana, as that would be an absurd law.

He has the right to object in any case. That's free speech. But despite all his objections, he either does his business respecting the law or doesn't do business at all.

It's funny that you think that such a law would be absurd, when laws that require a store to sell locally-produced goods over imported ones also already exist in the real world.

>Forcing me to run servers in France is absurd.

You're welcome to think that. Don't run servers in France then.

> [gestures at huge amounts of the internet as we know it, which was started by small teams.]

Hence my original comment: The internet has spoiled us by making it so easy for a while.

And I think your team did not think through before implementing your product. The GDPR and its consequences have been discussed for a very long time. And the product even managed to get locked into Azure.

> a very long time

What's a very long time to you might not be a very long time to me. GDPR wasn't a draft when the product I'm talking about first launched.

The Azure offering did not exist when my small team needed it.

You're absolutely right. Unfortunately, the little guy is more easily accommodated for with lenoency during onboarding regulation-wise, and the bigger actors can never be brought to heel if something doesn't go down on paper.

You are building up a whole strawman here. This is all about sending personal data to a machine in the US, owned by a company, which falls under US law. You don't have to send that personal data to the US, do you? Why would you do such a thing in the first place? Surely informed people would not simply consent to such a practice. And I mean informed. Not just clicking "OK OK next OK" without knowing what actually goes on, just to be able to see the actual content of a website.

It's not a strawman, it was the company I worked for.

We helped manufacture medical devices. We sold a device that took medical images, and then sent the images to a server. The server would do tons of processing on the images, and help manufacture a medical device custom to the patient.

We ran our servers in the United States.

We could not sell our product in France, until we stood up servers in France to store and process the data.

Why would we do such a thing? To provide excellent healthcare to people. Even ungrateful French people. Our product was lower cost and higher quality than our competitors, with better patient outcomes.

What monsters we were for running our servers in the U.S., right?

This sort of regulation is not new when it comes to health data. I'm actually surprised storing medical data outside the country was legal in France at any point, I don't think it would have been in my country.

So blaming the GDPR and new rules, seems a bit weird in this case.

Now, consumer protection regulation is always a balancing act. And most consumer protection laws will hurt some companies that didn't actually do anything bad. That doesn't mean I don't want any regulations. Particularly when it comes to healthcare.

Sorry, I'm talking in general, not specifically about GDPR and new rules. The whole trend stifles innovation because it's literally a barrier to entry.

And my real concern was people who want that cake, and also want to pretend they're not "fragmenting" the Internet. I wish people would call it what it is.

Under which law, please provide them specifically, were this not possible to do in France with data being processed in the US?

I am truly interested in this since I am in EU and use Azure for similar processing.

I wish I had it for you. I'm a developer, and I don't work for that company any more. Our legal representation came in and explained it to our upper management, who assigned projects to us. I don't know the regulation.

It is kind of a strange idea in the first place, to store medical data outside the country, in a country like the US. I don't know if any country with good data protection laws would allow such a thing. I find the idea, that this could be OK for patients to be weird. I surely wouldn't want my medical data put onto US servers, likely without even knowing, because the hospital stuff does not know themselves and not telling me either. Maybe even worse being put to the choice of having some equipment used on me, which automatically shares that data to the US.

At some point in your project there seems to have been a time, when such basic questions of consent were overlooked and later you paid the price. Your intentions may have been nothing but good, but I for one am glad, that such practice was not allowed to happen.

You're in country X, and the top radiologist in the world dealing specifically with your disease process, is in country Y.

Walk me through exactly what you would like to happen.

If you think the best outcome is that only radiologists who live in country X can look at your medical images, then please really think about what that means for under-developed countries.

Please also think about the fact that people have medical imaging exams 24 hours a day, and think about where radiologists live and sleep.

The next time you get a CT scan and have to wait 4 days for the results, you'll know that your hospital system doesn't have teleradiology.

We absolutely understand patient consent, and then France started establishing laws that denied patients the right to consent to having their data transferred to the US. (As I understood our legal representatives, at least.)

(For the record, in case it's confusing to anyone following along, I worked on half a dozen different medical products in my career, in different companies, in different parts of the body, in different modalities, etc.)

I think that is the crux of the whole thing. You cannot assume, that any randomly selected patient can actually make an informed decision about consenting, when being asked, because people in general are not so informed about these data decisions. Getting informed properly can already take 4 days or more. So what you win on one end you lose on the other end when asking for actual consent.

My guess is, that they want to avoid the situation entirely, in which a doctor (or other people in the hospital or other institution) has to ask the patient for their consent for such a thing. It would come down to things like framing, for example: "The best people for x are in country y.", which might be true or just opinion of that doctor. There are issues with this:

(1) Usually the doctor is not informed about these data protection issues themselves. Usually the doctor did not also graduate in some mathematical / statistical / data science subject or following along the various data protection scandals. Most of the doctors probably have other things to do. Just like the rest of the population is mostly not well informed.

(2) We probably don't want a situation, in which the doctor dangles a carrot (the best people are in country x) in front of the patient, luring them into consenting.

(3) Doctors want to get their work done. They don't want to have to ask every patient for consent for things outside of their own expertise. Even if you transfer the paperwork to someone else, who will want that additional workload? Also the people going to a hospital might not want to have to deal with that stuff.

(4) What is the legal side of this? For example say you send data to the best experts in another country and you get a misdiagnosis and operate based on that. How does this work?

I think it is possible to keep data generally in France for example and only have the experts look at the data via conferencing tools. Then the experts can be made aware, that obviously they may not share any of that data with anyone and that they can only look at it, while it resides in France. For that we need a secure conferencing system, which is not run by big corp living off selling data directly or indirectly. We need capable tech people in the right place to set things up. We might also need Computer literacy on higher levels for the experts.

You were transferring dicom files out of country? Madness. That's identifiable medical data.

Tell me you were at least running anonymisation software in hospitals before you transferred?

Nope. This is a common practice in some huge businesses. Teleradiology.

We don't do it for fun. This is a part of patient care.

Radiologists awake in Australia can read images from the United States. It saves lives.

The radiologists are licensed and certified in the hospitals and states.

And by the way, if I get a CT scan of your head, I can trivially reconstruct your face. Might even recognize you with it.

If you want to freak out, medical records are sent by fax machine ALL THE TIME.

Thanks for the insight about this. It does not make me personally feel better about this situation, but it adds some to the general picture.

Why are you so shocked that people want to assert control over their medical data? This is the crux of the problem. You're being absolutely incredulous that someone have a say in data that is about them.

Other people exist and have rights. It's about time that people assert their rights over data that is absolutely consequential to their lives, instead of being tiny pawns of companies who treat them like a highschool science experiment with live ants.

You either trust my company with your data, or you don't.

The idea that storing your data, encrypted at rest, on spinning rust platters inside your country somehow makes it safer than storing that same data, encrypted at rest, on spinning rust platters inside my country, is bizarre to me.

But that's fine. I think giving you the choice makes tons of sense. I'm not saying France should have a law forcing all data to be kept in the US. I'm saying it's bonkers that I cannot offer a product in France that happens to store data and process data on a server in the US. Even with a waiver. French citizens do not have the right to let their health care information be stored on a server in a different country. (As I understood the laws, at least - perhaps our legal representatives were misinformed.)

If you want control over your medical data, then I'm sorry, none of the existing tooling does what you should actually want it to. It should be stored on systems you designate. Not on some lowest-bidder French server that has unknown security practices.

It's amazing to me that you're lecturing me about other people's rights, when you're literally denying French people the right to buy my product, unless I meet some ultimatums. I'm not denying them, you are.

And you talk about consequential to their lives? My product lowered costs and had better patient outcomes, and we couldn't sell it. Maybe try a different argument.

désolé!

Je suis un homme occupé, et te faire passer pour une risée peut prendre du temps, mais tout le monde a besoin d'un passe-temps.

Quick question: was there a reason you could not use Azure’s region support? https://azure.microsoft.com/en-us/global-infrastructure/geog...

Or was it before Azure had that? Looks like they’ve had it for awhile, at least back to 2009 or 2010.

France, Year Opened 2018, is what I see on that page.

This was impacting us in 2014 to 2016, as I remember.

However all the GDPR requirements entered into force just in may 2018?

But in any case, the point is that the issue is solved without changing the laws or people having to switch cloud providers, as simply the global cloud providers have started offering compliant services.

Looks to me like the regulations did exactly what they were designed to do, and Azure implemented support for the EU market. The goal of these regulations is not to make things harder for companies trying to publish products in different regions, the goal is to get the big platforms (AWS, Azure, GCP) to implement systems that are in line with EU privacy requirements.

I'm sorry your business was impacted during the period where the regulations came into effect and the big platforms did not have compliant services ready. It would have been better if the negative externalities of these regulations would be entirely carried by the big platforms who are responsible for consumer privacy in the first place.

You do realize by the same logic this inspires competitors to innovate...

Agreed. But the internet is already fragmented. Each countries have their own laws and other countries no reason to follow them. All kind of content is accessible only in certain countries. It's also true for physical goods. I'm not sure why it's a problem.

Microsoft has set up a fully independent data center and business in German just because of this:

https://news.microsoft.com/europe/2020/09/30/our-commitment-...

Unfortunately, that didn't exist for us back in 2016, and our product is no longer in development.

So your argument is out of date and no longer valid.

Right. All I have to do is to stand up two complete copies of my full stack, and support both of them. There's no way that adds extra burden to me. My argument is completely invalid. Thanks for explaining that to me.

If you want to sell in two different countries don’t you have to comply with two different legal codes and support both of them?

I like the hot take but it speaks to the bigger point. The dual stack didnt kill the business, nor did the privacy law.

The company failed - it is what it is, and it sucks for the team - but you can't blame the EU protecting privacy/rights for bad business.

Standing up a second stack certainly didn't help. And who knows what the opportunity cost was.

I feel your pain but as an argument in this discussion it doesn't work. Your problem was in 2014 and Azure works just fine now.

It took some doing which was the whole point. The local provider even got a chance to match the offer.

Its very interesting if limiting how companies are allowed to track, store and sell private information would be the central issue for which the internet will fragment around. It almost like tracking, storing and selling is the center of the modern Internet, rather than protocols like tcp, upd, https and so on.

In the past people said that the Internet was made for porn. Today the Internet is seemingly made for advertisement and surveillance. It not strange that so many people who worked in this industry for decades are feeling a bit lost in this new horrifying industry, which if the Internet really is made only to do advertisement and surveillance, I honestly think humanity is better off without it.

The internet is a tool.

You should support companies with the best behavior.

I worked at a company that enabled a radiologist in over country to do a preliminary read of a CT scan performed in another country.

Cutting the amount of time for a CT scan, and even connecting a CT scan with a radiologist who specialized in that particular kind of scan, we saved lives.

And yes, there's also furry porn.

It's a tool.

I feel like I'm trying to convince you that BOOKS are good, despite the existence of hentai.

Could that company exist if it wasn't allow to use advertisement or sell private information? In the past I would say yes without question since there is nothing inherently in connecting a CT scan with a radiologist specialist that require Google Analytics. Nothing at all.

So pass the cost of doing business in France on to the french.

> We had PII on Azure.

So why didn't you use Azure resources in Europe instead of "some crappy provider"? Sounds like you made a rod for your own back. If our clients are happy with Azure (in the right region) then I can't imagine many in the EU (other than perhaps national security services and their suppliers) reasonably refusing to allow use of it.

We host in Azure for some pretty significant financial organisations, mostly UK based but spreading our area. Some companies are requiring us to fully host in Azure DCs in their region, and some of those are Eastern, not UK/EU, based companies. At least one US interest that a friend's employer supplies demands data about its employees be hosted over there rather than over here, presumably so they can be assured it is kept to standards they are locally required to follow. Is it wrong that way around in your book too?

It isn't as easy as having everything in one region of course, but not much harder nor massively more expensive (caveat: most likely, as far as I know, I have the luxury of ignoring the bits that don't interest me and money is often one of those things, but I'm also senior enough that if there was something expensive happening, or something not happening due to expense, I'd catch wind as it would affect things I need to plan around) and it can't be as faffy/costly as using different providers in each territory.

If you are correctly following relevant regulations everywhere this does not fragment things any more than other rules that already existed. Aside from the fact things are being enforced this time, forcing companies handling PII to not quietly do things wrong because it is inconvenient to do things right. As an individual I'm perfectly fine with this.

company stooge.

I think fragmentation and looking after one's interests aren't even opposites. Analytics in particular seem like a very lopsided value prop: the american entity (Google) stands to gain from collecting analytics but doesn't really provide a perceivable equivalent value through the analytics service to the affected parties (EU consumers) in return, as you'd normally expect in a fair trade policy between two countries.

Looking at it from this angle, it seems perfectly reasonable for the EU to dislike the specifics of the analytics use case while still being ok with something like Google Docs.

> lopsided value prop

But that's not what CNIL is basing their decision on: "The CNIL concludes that transfers to the United States are currently not sufficiently regulated...Indeed, although Google has adopted additional measures to regulate data transfers in the context of the Google Analytics functionality, these are not sufficient to exclude the accessibility of this data for US intelligence services."

I probably don't understand the legal issues fully, but it seems the worry is that US intelligence services may be tapping the lines and databases of Google, may have agents working at Google as badged employees, or may be able to subpoena Google (or any US service provider). [for the record, I wouldn't doubt if all the above are true]

I don't see how Google Docs is less susceptible to Google tracking user activity (and by extension US intelligence).

> "CNIL recommends that these tools should only be used to produce anonymous statistical data"

So the tools are not anonymous because the request headers of the client are being logged and used to identify a session, along with what resources on the site were accessed in that session.

Any site operator has this data on their visitors.

CNIL doesn't want sites hosted in France to be making client-side calls to services provided by Google (whether analytics, fonts, etc) or theoretically any US-based service provider because the client request will be logged by that resource host and open to access by US law enforcement? Do I understand that correctly? What's the solution? A site builder can't let web clients make direct calls to any resources in the US? That seems... sweeping, profound, surprising, impactful. Have fun with that.

> because the request headers of the client are being logged and used to identify a session

No need to dig so deep: IP addresses are considered private information under the current EU law, meaning that just opening a client-side connection somewhere leaks that data to that somewhere.

> I don't see how Google Docs is less susceptible to Google tracking user activity (and by extension US intelligence).

There is none. The difference is that the website studied in the ruling was not including resources hosted at Google Docs, and hence no mention of it. If the site embedded or directly linked to a google docs document the same reasoning would have been applied.

> CNIL doesn't want sites hosted in France to be making client-side calls to services provided by Google (whether analytics, fonts, etc) or theoretically any US-based service provider because the client request will be logged by that resource host and open to access by US law enforcement? Do I understand that correctly?

Almost. They don't want any calls prior to explicit user acceptance.

> What's the solution?

For fonts/images required to load the page, use EU-based hosting facilities. If you want to link to a google docs document, a youtube video or something like that, ask the user before following that link.

> That seems... sweeping, profound, surprising, impactful. Have fun with that.

It is, I don't think anyone is denying that. There are several things that may happen here:

1. US tech companies take it as common practice to spin-off EU-based companies that are not subject to US law and store everything in EU soil. When they don't, EU competitors pop up and EU companies use those.

2. The US passes laws that offer EU-level protections to both their own citizens/companies and (at least) EU-based citizens/companies.

3. The EU backtracks on this by adjusting their current laws.

the EU is shrinking in importance in terms of the world economy [1]

another 20 years and companies simply won't bother with it at all

[1]: https://fullfact.org/europe/eu-less-important-world-economy/

It's at 15% and forecast to go down to 12% by 2030. Also they're raising hell for corporations in the form of regulations and taxes. Why would any entrepreneur even bother?

> On the contrary, it only forces those providers to have a European presence.

All the big cloud providers have presences in Europe. What am I missing here?

Nothing, this is now a solved problem. The EU didn't want the entire internet being hosted from the US. They designed policies to force hosting within EU countries. It happened.

The only people still moaning are Americans and hold-outs like Google refusing to move data.

If by those providers you mean Google, AWS etc. then that might not solve much. As subsidiaries of American corporations they would be obligated to hand over data to the parent corp, especially if the US DOJ required it.

I think the only solution would be for them to not collect and store data from GDPR jurisdictions that would violate the GDPR if they were forced to hand it over to the parent American corp.

No, the subsidiary would be governed by European law, and would be prohibited from handing data over to either the US parent company or the US DOJ if that violated GDPR.

The US parent company could not compel the subsidiary to violate the law of the region it was located in.

Yes, I suppose you're right, at least so long as they actually host their data in the EU.

But what happens when senior data scientists at Google want to do some analysis? Each dataset for each global region can't remain fractured from each other. The subsidiary may not have to hand it over to the US government but does the GDPR prevent data from leaving the EU zone? If not, then local copies in the US would be exposed.

I think there would be a lot of loopholes that needed to be closed. "Will be" a lot might be the better choice if words if France's decision becomes guiding legal doctrine in the region.

I don't think Google would willing give up that data either so they could be forced to change their practices to at least get that which allowable under EU law. And I don't want to get too slippery slope in this, but that could mean privacy-minded services begin using servers in the EU as an added layer of user privacy.

You're making the mistake of assuming that "something can't happen" if it is inconvenient for the business. The convenience of the business is irrelevant - it must operate within the law.

And yes, GDPR prevents data from leaving the EU zone if there is then a possibility that GDPR could be violated. That's the crux of the recent court cases in Austria and France. You may not collect GDPR protected data if as a consequence of that collection there is a reasonable prospect GDPR will eventually be violated by ANYONE.

For your example case, all initial data processing would have to physically occur within Europe, performed by a subsidiary not subject to US law, and only after they had reduced it to aggregate data that could not be reverse engineered to get GDPR protected data would they be permitted to export it to America.

Perhaps it's a fragmented internet that is best aligned with our own interests.

I, for one, would really like to have more fragments to explore.

For me it's philosophically reminiscent of the Berlin Wall or the Chinese Great Firewall. Personally, my knee-jerk reaction is that it threatens certain freedoms, but I am also a liberal raised with a Western education.

>I am also a liberal raised with a Western education.

Lucky you.

We need more Western education, not less, which is why fragmentation is a bad thing. My country of birth - in Africa - is aligned with the formerly communist nations; if they had to opt-in to a fragment, it wouldn't have been to the Western one. I might have never been able to emigrate.

Fragmentation seems like a leap backwards in time and a slap in the face of the promise inherent in the free flow of information.

I guess I'm seeing more like a huge swath of farmland growing a monoculture for export, versus the same land being used as a patchwork of different crops based on the various farmers' tastes and relationships with their neighbors. The latter is more likely to change gradually as the climate and the needs of the people around it change, while the former is prone to changing all at once, perhaps unexpectedly.

People's ideas about how their technology should serve them will change over time. I don't want to have to overthrow the old internet before we can try something new, I want it to grow with us--the parts that aren't serving us die off, the parts that address new challenges flourish. If its all one thing, subject to one set of rules, that doesn't happen.

Wow

> Agencies can snoop on non-US citizens but shouldn’t snoop on US citizens

and they went and snooped on US citizens anyway.

> On the contrary, it only forces those providers to have a European presence.

It’s interesting to see the pattern here: if you can’t innovate, regulate.

Whine and fine

> On the contrary, it only forces those providers to have a European presence.

If the EU has this much power to regulate operations that happen in America, then imagine how much worse it's going to be if you relocate your operations to the EU? In that case you actually become one of their subjects, rather than simply recording information about their subjects.

> We're not fragmenting the internet by looking after our own interests.

Of course you are. This is the only possible outcome of any attempt to impose national rules on an international network. Instead of one global network, we'll end up with several local ones.

The internet is among the most incredible achievements of humanity. I'm glad I got to experience it before they destroy it. By now it's only a matter of time.

> like AWS, Azure, Mailchimp, PayPal etc [...] No cloud services, no Office 365 or Google Workspace.

Maybe an unpopular opinion, but imho AWS, GCP and Azure are popular with startups because of their generous free credits, not because they are good tools for startups. As a startup you are typically better served by a DigitalOcean-level of complexity, and there are plenty of such offers in the EU (Hetzner Cloud, Gridscale, OVH, etc)

For Mailchimp you have plenty of competition, some of it in the EU (SendInBlue and Mailjet come to mind).

For payment processing there are also plenty of offers, Adyen is probably the biggest European alternative but there are countless smaller ones.

Microsoft Office 365 can be replaced by (shocker) Microsoft Office (the offline version). But most of your documents probably don't even contain PII and would be fine in Office 365 or Google Workplace. The exception is obviously email, but the market is flooded with E-Mail services from any country you like (and your preferred Hoster probably offers an email package too).

So I'm not really sure what part of the ecosystem we are missing here? European companies often have the smaller advertising budget and mindshare, but it isn't like they don't exist.

> As a startup you are typically better served by a DigitalOcean-level of complexity, and there are plenty of such offers in the EU (Hetzner Cloud, Gridscale, OVH, etc)

As an actual startup founder who started as a 1 man startup, strongly disagree.

Spent maybe $200 a month on Google Cloud, got an actual production ready cluster. Scaled up to Millions in revenue, never had to deal with any Linux Server admin BS.

More time on business, less time on Linux Sysadmin.

Just make sure your BCP plan includes other provides. HN is full of stories where peoples' accounts are blocked with no reason and without means of effective contact.

That is consumer accounts, not business accounts at GCP. People confuse personal gmail with paid GCP. I have actual reps I can talk to.

100%. The hidden part here is "DigitalOcean-level of complexity" is actually "DigitalOcean-level of features."

The big cloud providers have a variety of offerings of different complexity. Using GCP as an example: want k8s with all it's flexibility and complexity? You have GKE. Want to still run containers, but abstract away all the cluster resource management? CloudRun. Abstract away the container itself? CloudFunctions. AWS has EKS, ElasticBeanstalk, etc.

I understand people get overwhelmed the first time they're dropped into the console of these cloud providers but really it just takes a bit of reading to figure out what you should/shouldn't care about. And the benefit of doing so is enormous.

Disclaimer: Anecdata

Privately I host nearly everything on a shared host in Germany (that is everything I can host without sudo) [1].

For company policy reasons I must absolutely use AWS or GCE.

For an internal project I need to setup Matomo. Something I did thrice in the last few month on [1].

OK login through SSO into AWS. Look around, ask Google, find the bitnami image, click few buttons. Done. OH shit. Now I need to somehow make it publicly available. OK. Google again. Ah this is the way. Few hours of reading and clicking later I have a publicly reachable Matomo instance. Oh hey. It warms me that it is not ssl encrypted. OK. How to do let's encrypt? Google again with my second batch of coffee (or was it the third). Found an easy way, just enter a command in the shell. Oh hey, how do I get my ssh pub key into my EC2 instance?

Damn the day is nearly gone and I have yet to deliver this tangential asset to an internal project while killing my CCI (how much I am booked on client work) for something that the first time took me 30 minutes with the great documentation from [1].

To me as a meager Data Analyst the complexity of cloud offerings is a nightmare. And the documentation is written for other echelons of tech understanding most of the time.

[1] uberspace.de

If you’re a data analyst, then of course infra and sysops activities on cloud seem complicated. I’m sure a sysadmin could run/write sql, but would find the rest of your domain complicated too.

I would guess that if costs is an issue then it must also be balanced compared to the potential profits. If your current $200 solution only allowed you to have US customers, while a $300 solution would allow you to have both US and EU customers, which one would you choose?

>I would guess that if costs is an issue then it must also be balanced compared to the potential profits. If your current $200 solution only allowed you to have US customers, while a $300 solution would allow you to have both US and EU customers, which one would you choose?

Whichever one let me pay rent at the end of the month

The US has plenty of customers. If I had to drop EU, I will. It's a nice bonus, but not a core requirement.

That seems good. Someone could copy your business and spin up on the EU market. If its profitable its profitable and its no worry for you. If its not profitable then the EU market is not large enough to carry the product on its own. GDP of the US is around $25 trillion, and EU is around $18 trillion, and population wise there are around 300 million people in the US and 400 million people in the EU.

Might I ask you what kind of product your 1 man startup have?

I am not 1 man anymore, we grew up a bit. But we are an ecommerce platform, basically centered around the big US marketplaces (Amazon, eBay, walmart.com). Yes Amazon and eBay are in Europe, so we are there.. but no say UK or France specific markets at this time.

We colocate about 20 servers and in any given month, spend no more than 1 person-days worth of time dealing with it. Many months we spend no time. That includes both sysadmin and hardware. But this requires knowledge that most devs these days probably don't have.

We might spend more time messing around with AWS than our colocated servers.

Right, if you legit need 20 servers than it might make sense for you. I would fit on like 2-3 decent sized servers if I did co-location, and would save not even 1 developer-day of salary...

You can rent 2 to 3 dedicated servers at affordable rates.

Right, but my time is worth more than what I could possibly save at my scale. You have to find the right balance.

OVH gave us home. Enrolled us to Startup Program. Gave us support and hefty credit.

Managed K8s. Openstack.

When we started paying for it, it was still cheaper than AWS.

Just because AWS is the default, does not mean you should use it.

When I started, no other providers had the K8s features I needed.

Still prefer Google, as they are the OG for k8s.

And power to you. You did what you though was best in your circumstances.

Today circumstances have changed. You need hassle free scalable DB, then AWS RDS might you best choice. Maybe.

You need open standard IaaS, well, there is ton of options.

Even before K8S, you had and option of Openstack with Ansible. Yes, very different beast, but still much _simpler_ and _cheaper_ than stocking on large number of IT professionals.

Was that before their datacenter caught fire and their customer servers were lost or after?

Yes, OVH experienced force majeure episode. I didn't follow exactly how the compensation was rolled out. I know it was messy. I am not going to defend their actions, I am sure they could always handle this better.

Disaster recovery planning is practice we should all adhere to. Hindsight is 20/20. Not trying to be a smartass. I know it was painful for a lot of folks.

At the same time, unless you paid for managed service with clear SLAs, then responsibility is yours.

Cloud is just someone else's computer.

FYI: we started with OVH before the fire

> never had to deal with any Linux Server admin BS.

Oh, you just had to deal with a different flavor of BS. Or you was lucky and everything just worked out for you (but why Google Cloud and not some PaaS like Heroku, so you don't have to deal with cloud infrastructure/servers BS altogether?)

I've been both a system administrator, managing GNU/Linux and FreeBSD servers in the ancient ages, and DevOps guy doing all sort of stuff in the clouds. The complexity is still there, it hadn't disappeared in some magic cloud pixie dust, even though sales would wanna tell you that fairy tale. But here's the thing - you never get to dive into those waters (or hire someone to do it for you, be it an employee, contractor or paid support) unless shit hits the fan and forces you to.

You must've cheerfully walked through a minefield and haven't stepped on and even seen any mines. Honestly, I'm happy it worked that way. And hopefully, this minefield is sparse enough those days so you're a rule not an exception - I don't have meaningful statistics. It would be actually interesting to run a poll or something. I just happen to have seen a few companies/people for whom clouds weren't all unicorns and rainbows.

And as for the flavors - it just happened that you knew how to set up stuff in Google Cloud. Would you happened to know how to spin a simple instance on Digital Ocean instead and went that way, and be lucky to not encounter any serious issues, it would've been the same painless experience, just different flavor.

My server load was not the size I needed 20 dedicated servers, but far too much for Herkou. Just running a 120 core 24/7/365 on heroku is like.. all of my revenue. (Vs 1% on google cloud and maybe .1% on hertzer).

Tangential, but assuming you're talking about Listing Mirror? I considered working on a similar product a few years ago, but felt the market was too competitive. Interesting you were able to compete with the plethora of similar services.

Indeed.

Pros and cons to being in a crowded market.

From day 1, you KNOW there is demand for your product. You can look up Channel Advisor and see the revenue. And 20 smaller companies under fighting for the rest.

Cons of course being, you have to figue out how to compete with all of these guys ;)

I would say that looks at the state of things as they are today, which may not be the case as technology advances. If there's a service that provides a real competitive advantage that is only available outside of Europe, then this might exclude businesses in Europe to innovate and compete.

All Office docs contain a GUID that's closer to PII than an IP address.

Can't find any references to that except that each doc has a GUID. A GUID on its own is not PII - just some random number, so are you implying that MS collects every GUID along with author identifiable information?

I just got off the phone with a lawyer to talk about this exact issue.

If the GUID is related to the user (like user ID), then it is Personal Information - EVEN if the GUID is random. The distinction that is easy to miss is that a User ID GUID might be very low risk (compared to, say actual User Id or user name) - but is is still Personal Information.

If the GUID is for the document (and anyone can edit the document), then it is no longer PI.

Of course, all of this ignores things like the contents of the doc. If the doc is "SSNs of my customers", well... don't do that

Working on a consumer SaaS startup and I strongly disagree. A virtual machine on something like DigitalOcean does not provide any of the nice abstractions that something like a Google Cloud Run (or similar on AWS/Azure) provides. The amount of time a cloud provider can save you administratively is difficult to exaggerate. That is from day 1. Should your startup succeed, and you need to scale, the real savings start to kick in since scaling to a large degree is handled for you. Good luck re-architecting your app into a kubernetes cluster and handling load balancing manually while your competition gets all that with almost no effort.

I've worked on so many small teams where dealing with AWS/Azure etc was a huge part of their day, for very very simple products.

I still remember arguing about bloating a web app with a 1mb package from AWS so it could use their serverless authentication offering.

Common theme as using those lambda function - sometimes paying quite a lot of them - to serve requests that would be twice as fast on the proverbial $5 linux instance.

So yeah, looking from the sidelines it feels like a huge amount of added complexity for small teams, "just in case" they need to scale. Which given how fast modern hardware is way further off than they think.

(unless they use lambda functions for every API request. in which case they better learn to scale in a hurry)

I'm pretty sure Microsoft 365 is GDPR-compliant and is storing data in whatever jurisdiction you set it up to.

I know we've had a lot of issues with an European company we bought; we're both using Microsoft 365 but they're set up in France. I don't think the IT folks ever figured out how to merge them (even though we probably pay a shitton to MS for support), so those folks keep using their old domain (but we can share documents and whatnot, so at least that's set up).

Stockholm, Sweden begs to differ as they just dropped Office 365 due to Schrems II: https://www.version2.dk/artikel/microsoft-forsikrer-lovlige-... (Danish article)

The free credits are nice, but run out quickly. Azure is expensive, but has a lot of nice tools from key vaults, log analyzers, CDN, databases, pipelines, to firewalls. I mean, yeah, you can implement similar stuff on a DO platform but you're going to be wiring it all up yourself, taking on the liability for keeping it all secure, and providing the warranty for its availability and effectiveness. The value to AWS/GCP/Azure is far beyond free credits. They've commoditized services - it rarely makes sense to pay for in-house expertise in managing those services yourself.

Also, the offline version of Office is going away, to my knowledge. I think the current boxed version is the last boxed version they plan to sell.

> Maybe an unpopular opinion, but imho AWS, GCP and Azure are popular with startups because of their generous free credits, not because they are good tools for startups.

That’s a complete misunderstanding of the cloud’s value proposition. The point of the cloud is to have things “just work” so you can spend more time shipping features and innovating. When I see startups not using it and “rolling their own cloud” by being their own sysadmin I question the strategic decision. To me it’s generally a sign that they failed to raise the appropriate amount of capital and are therefore trading velocity and agility for cost savings.

> So I'm not really sure what part of the ecosystem we are missing here? European companies often have the smaller advertising budget and mindshare, but it isn't like they don't exist.

Also because they can’t scale within a mostly unified 300 million market like US companies can, they have to special case and deal with all special snowflake regulations in every small European country they want to serve.

Plus, that’s not even touching on the engineering talent gap.

> we fragment and destroy the entire Internet

I would call fragmenting these things rebuilding the internet. Not sure how consolidating everyone on a few Mailchimp type services is in anyone's interest.

Here here. Good riddance.

*Hear, hear

https://en.wikipedia.org/wiki/Hear,_hear

Thanks!

Exactly. If this make European startups build their own ecosystem and provides me with an alternative for the services I use but don't track me, I'm going to switch - simple as. I see this as a win for the internet.

Why limit it to the EU? Shouldn't every country have their own AWS, Azure and Google Cloud?

I think we underestimate just how difficult it is just to replicate existing services, let alone keep up with the innovation.

It's like the Argentinian effort to stimulate its own computer manufacturing by banning Apple products.

It'd help if the United States wasn't allowed to aggressively brain drain most of the rest of the world.

That's nice for countries and bad for people.

It’d help if the rest of the world tried to aggressively prevent brain drain by making the respective countries more attractive for work.

Or by making getting citizenship something that's attainable in my lifetime. Everyone complains about the US immigration system and of course it's not great but when I came here I kinda knew what the path forward was and how long stuff will take, for a lot of European countries there's no way to ever get citizenship and the path to permanent residency changes every three or four years.

Why are you importing New World thinking to the Old World?

In what European country specifically is there no way to ever get citizenship?

I guess Switzerland. Pretty much every other country offers you citizenship after a time.

Switzerland is 10 years and then you need to pass a language and general knowledge test. The contents of the test depend on the region you live. Honestly I don't see it as that ridiculous.

I heard stories that it's still nigh impossible because you need good references from your local commune, and those are really hard to get.

Note: I'm only spreading rumors :)

Well, the exact requirements depend on the canton and commune you happen to be in. If you're in a village in Appenzell Innerrhoden it's going to be more tricky than if you're in one of the more international cities like Basel, Zürich, Geneva etc.

Switzerland and some nordic countries make it impossible. Portugal wants me to marry a Citizen, otherwise it's only residency. Luxembourg and the Netherlands wants me to learn their language, which is not something I would need to work there and in my experience visiting neither to be able to live there. It's not great.

On the other hand Italy denied my application once already, after my great grandparents basically left the country because Italy was not defending their town from Germany. They rejected my application because they say my great grandparents were not Italian but Austro-Hungarians. The lady at the consulate was super racist to my grandmother about it, in my face. After that now there's another way I could get my Italian citizenship by birthright by suing the government because of another racist thing they use to do where women were not transferring citizenship.

Again the US is not great but a lot of this things make me feel whatever "racial tensions" I may be a victim of in the US are mostly the media blowing stuff out of proportion, when most of the "racial tensions" I felt dealing with the EU are actual racial violence or discrimination that either me or my family where victims of.

> Luxembourg and the Netherlands wants me to learn their language, which is not something I would need to work there and in my experience visiting neither to be able to live there. It's not great.

That seems like a very reasonable requirement. How can you expect to participate in society, especially elections, without a decent command of the local language?

Speaking as a US immigrant to Finland (a Nordic country), the citizenship requirements here seem quite reasonable to me. Minimal language proficiency, a civic knowledge exam, and at least 5 years drama-free residency.

> How can you expect to participate in society, especially elections, without a decent command of the local language?

By hiring a local accountant and paying a small fortune in taxes? If I learn the language then yeah cool maybe I'll get into their politics thing but it's not that if I don't vote I'm not going to be a productive citizen. A lot of countries let you become a citizen without learning their language, most notably the US.

> By hiring a local accountant and paying a small fortune in taxes? If I learn the language then yeah cool maybe I'll get into their politics thing but it's not that if I don't vote I'm not going to be a productive citizen.

Being a part of society is a lot more than working and paying your taxes.

> A lot of countries let you become a citizen without learning their language, most notably the US.

An English test is required to become a naturalized US citizen. https://www.uscis.gov/citizenship/learn-about-citizenship/th...

I emigrated to Canada pretty much on a whim (using a fiance visa) and have fared quite well there. We (my partner and I) are weighing the possibility of emigrating again to Portugal which offers a rather reasonable golden visa - with a wide variety of European countries offering "trial" visas for workers under 30 with the most bare of requirements.

As a US citizen I've contemplated getting my wife residency down there and it's simply ridiculous - as are the hoops I'd have to go through to relinquish my US citizenship and that only matters because the US feels entitled to own me even though I haven't resided there for nearly a decade at this point. US immigration, from the working visa angle, is extremely unpredictable and only really estimable if you've got a large corporation with a whole bunch of lawyers to get your back - spousal visas aren't terrible but most come with some seriously onerous lifetime costs to execute (like taking a year off working).

I know there are a bunch of European countries and they've all got their quirks to immigrate into but you can really trivially get an EU passport and then move around within the EU.

> It’d help if the rest of the world tried to aggressively prevent brain drain

What does that mean? Are you suggesting that countries should control where their citizens choose to work/live?

The rest of the world could also brain drain the US if it was easier to get into. The US -> EU/UK immigrants that I personally know have had a pretty hard time getting there permanently.

I moved from the US to the NL. Love it but I can’t get dual citizenship and getting permanent residence requires knowing the language well enough to pass a test, so why stay? It’s kind of a bummer because my son speaks native-fluent Dutch now. Next up will probably be Ireland.

> Love it but I can’t get dual citizenship and getting permanent residence requires knowing the language well enough to pass a test, so why stay?

Why did you move there in the first place, raising a kid there, when just learning the language is apparently a hurdle too big to take?

Learning the language isn’t the issue, learning the language well enough to pass a test when classes cost nearly €2k a pop is the issue.

To my knowledge to get naturalization in the Netherlands you must have stayed there for ~5 years and the required language level is A2, which is beginner level.

This doesn't sound like a crazy requirement to me. The giving up other nationalities would be a deal breaker for me thought.

Well, if you don't even bother to learn the language of the country you want to become a citizen of, then, yes, why stay indeed...

Learning the language to a conversational level as someone who speaks English is exceptionally hard. As soon as a Dutch person hears the accent, they switch to speaking English. Therefore you need very expensive classes to properly learn the vocabulary you’re expected to know for the test. We can stay here forever on our current visa, but I’d rather be a proper resident and be able to take advantage of the entire job market. I’d be happy to pay the money if the Netherlands would let me have a Dutch and American passport. Pre-COVID I didn’t really care, but post-COVID, having a passport to get to my sick family and be guaranteed re-entrance to the US is very important.

They think they are helping by switching to English. I’ve never had anyone refuse after politely asking to switch back because I’m learning.

The language test is incredibly easy, for what it’s worth. It is nowhere near fluent, or really even conversationally competent. It’s things like saying the correct words when buying an apple at a store.

Countries do not own their citizens. If they want their brainy citizens to stay, they should incentivize them.

The US is "allowed" to offer whatever it wants for people to move there.

> Why limit it to the EU? Shouldn't every country have their own AWS, Azure and Google Cloud?

That is completely unrelated though. The only thing this ruling confirms is that you can not process data of EU residents when you can not be adequately protect them due to local laws i.e. the CLOUD act. If your laws allow you to keep the data safe, you can offer your cloud services to the EU market as much as you want. If they wanted to, the US could easily allow companies to guarantee those protections too.

I would not be surprised when, if no solution is found, some of the major cloud providers in the EU end up being e.g. japanese, israeli or canadian.

> Why limit it to the EU? Shouldn't every country have their own AWS, Azure and Google Cloud?

Careful, there is such a thing as network effect for knowledge. More fractured systems mean more different approaches means less aftermarket documentation means less people being able to work for you.

I happen to be European but with that said, I also get the feeling that many western European HN-users here seem to fancy the idea of having many small local service providers that have challenges providing anything beyond basic hosting.

And that totally fine, if you think European companies have no competitive disadvantage on the global market to being forced to use traditional VPS providers or build and set up everything themselves. But I imagine it'd be very challenging if other companies outside the EU can go to market faster, deliver better services for lower cost, etc. than their European counterparts because they can use American cloud providers like GCP or AWS.

In all fairness, the faster, better, cheaper argument sounds too much like marketeese to me, and I have not yet seen that effect in real life. You can find dedicated people who are sufficiently good to manage some Linux server infrastructure relatively easily - all while AWS consultancies seem to pop up all over the place like mushrooms after a rain.

The EU as a block is pretty comparable to the US, so it wouldn't be that surprising if they came up with their own information infrastructure. I think you've answered your own question: why limit it to the EU? No moral reason, but it is a difficult project, you need a US/EU/China sized economy to have a good chance to pull it off.

Unfortunately, you will find that they'll "track" you just the same, but provide worse service due to smaller economies of scale.

Sounds like protectionism when they can't compete. The EU isn't exactly a shining star for tech development, probably because the culture there kneecaps it every step of the way.

I already get a lot of "We are sorry, but for legal reasons we are prevented from providing this service where you live" when I'm accessing American websites.

Recent European judgements seems to make it illegal to embed content from YouTube or Vimeo for example.

I don't see how dividing services up by region will help me anyway. I'd rather be able to choose from a few (I imagine there are more than a few at the moment) international Mailchimps than one in EU.

I feel that the whole point of this is to mimic China’s achievement of driving out foreign competition through legislation.

It’s similar to the UK’s pornography laws being more about surveillance and censorship rather than protecting children.

If you flip the scenario around in your mind.. how would you feel if virtually every site or service you visit scoops up your data and sends it to [China|Russia|...] and hosts all your private data on servers operated by the [Chinese|Russians|...] and are subject to [Chinese|Russian|...] rule and disregard whatever laws your country has enacted? How would you feel if you couldn't opt out without virtually opting out of the entire internet, including all the services your friends and family and local associations & companies use for messaging?

That's how the internet has been. That's how I feel about US tech giants getting all my data. They write their privacy policy, they dictate their terms, they follow US laws. I have absolutely no choice or voice or vote, unless one considers "yo dawg just build your own internet" a realistic choice.

I don't feel like the purpose is to drive out foreign competition. I feel like the purpose is to enforce privacy as a right, and I fully support it. I also fully support the right to transmit data across borders as long as the destination country also respects my privacy and rights instead of treating me as an alien and potential terrorist. Is that too much to ask for?

And in general, is following the rules of the country you offer a service in too much to ask for? Local laws apply to brick and mortar business; if Walmart wants to come to my neighborhood, sure go ahead, but please respect our laws. I don't see why internet companies should be above the law either.

GDPR is replacing rules dictated by US corporations with democratically established rules written by our representatives. It's unfortunate that there's now a clash between US laws and EU laws, but it's not the end of the world.

Simple. If you have a free market, I would just use competing services instead of the "Chinese" ones. No one is forced to use TikTok. If people really wanted a privacy focused service, a new one will arrive. DuckDuckGo's success is an example of that.

imo it's just a thinly veiled protectionist law that will fracture the internet all for the sake of propping up EU incumbents who can't innovate.

Yes it's simple in dreams and an economic theory stuck in an era where a potato is a potato and it doesn't matter much whose potato you buy. Unfortunately the free market tends to be a race to the bottom, for complicated reasons. The market is also not effective nor is it rational, nor is it good at displacing entrenched players and natural monopolies, least of all ones that don't give a crap about ethics. It's not effective against deliberate lock-in and network effects, nor against externalities and exploitation. It's not effective where effect requires individual sacrifice multiplied by millions.

If free market were effective, we wouldn't have needed labour laws to keep people from dying in factories where they work 16 hours a day, we wouldn't need laws to make vehicles safe, we wouldn't be desperately looking for agreements to curb pollution and climate change, we wouldn't need laws to protect minorities against discrimination.. hell, I don't think we'd need laws at all because everyone would just rationally and effectively choose good actors & displace bad actors.

It's a nice fantasy, but it's not one we live in.

The free market isn't perfect, but it's been historically better than centralized economic planning.

I'd like to think that there are gradients between opposite peaks.

I don’t believe your parent is arguing for centralized planning in any shape or form.

Even the US knows rules for markets - it’s never entirely free. European laws just set more rules and give the consumers more rights - something I consider useful where there’s a strong imbalance in knowledge and power between the consumers and the companies offering a service.

> I don’t believe your parent is arguing for centralized planning in any shape or form.

National regulation is a form of centralized economic planning. Is it always bad? No. Is it always good? No.

> No one is forced to use TikTok.

TikTok was nearly forced to sell parts of its operation so it could continue operating in the US, in India it's actually banned.

> DuckDuckGo's success is an example of that.

As good as DDG is, it's not that great of an example as all the background tech there still relies on Microsoft's Bing, which means there is very much a US-centric search engine monopoly in place.

> that will fracture the internet

Maybe the Internet needs fracturing, we've reached a point where a handful of US corporations control the vast majority of the web traffic [0], that kind of massive centralization is the absolute antithesis to what the web is supposed to be and presents a massive filter bubble in-itself.

[0] https://staltz.com/the-web-began-dying-in-2014-heres-how.htm...

> TikTok was nearly forced to sell parts of its operation so it could continue operating in the US, in India it's actually banned.

Yes, that's a great example of protectionism that was reversed.

> As good as DDG is, it's not that great of an example as all the background tech there still relies on Microsoft's Bing, which means there is very much a US-centric search engine monopoly in place.

DDG is not the only privacy focused search service. There are others with their own homegrown search engines. I believe some of them are French. This also reflects consumer demand. DDG only able to evolve and grow based on how many people want to use the service.

As a counter point - I think it's fair to view the extreme lack of consumer protection laws in the US as protectionism for domestic tech companies. The US has been extremely resistant to roll out consumer protection laws and that's shifted it into being the equivalent of a pacific island nation with extremely lax tax laws - it's the wild west of the internet where all the sane laws don't exist that attracts all the companies that don't want to play by the rules.

The US could coordinate and work with the EU to try and craft laws that span both regions in a unified manner so that businesses can operate more freely but instead they're choosing to subsidize a protectionist agenda by levying a cost on the privacy information of its residents.

> The US could coordinate and work with the EU to try and craft laws that span both regions in a unified manner so that businesses can operate more freely

I love your wording. Regulation mixed with "operating more freely" is oxymoronic. The same can be said with your argument of "subsidizing a protectionist agenda" when you're referring to the lack of regulation and legislation.

> As a counter point - I think it's fair to view the extreme lack of consumer protection laws in the US as protectionism for domestic tech companies. T

The spat between US tech companies and France's ancient media companies is not new. It's very disingenuous to pretend that the purpose of these laws is just to protect consumers.

To be honest, it's really only oxymoronic in a very limited slice of America. It has come up a few times on HN that the definition of freedom varies wildly in different parts of the world. As an example, take healthcare: in the US market driven healthcare might be the freest freedom that ever freedomed - but elsewhere social safeties that allow residents to live the best quality of life they could are considered to be the highest freedom you can achieve. While health issues are a regrettable part of the human condition, a society might want to strive to minimize the amount of stress spent by individuals on particularly bad die rolls by their bodies and fate allowing individuals the freedom to spend their time more according to their wills. Even "free market" US healthcare comes with a number of regulations - I'm not certain if you were alive (and paying insurance) before pre-existing condition coverage was guaranteed but a lot of people ended up unable to even secure insurance in that world, it was awful.

Regulation is a firm requirement to a free market, without regulation of any kind you will pretty quickly descend into authoritarianism as whoever has the biggest stick will just take everyone else's stick. While there definitely are dangers at the other end of the spectrum if you're fanatically at either end you've got to ignore a whole bunch of pretty well known issues.

It’s oxymoronic everywhere based on the definition of the terms, and not just in “limited parts of the US”. It’s Orwellian doublspeak. No amount of mental gymnastics changes that.

> Regulation is a firm requirement to a free market, without regulation of any kind

I agree, but there are lines that when crossed either negates or greatly lessens the overall benefit for most people outside of vested interests.

> you will pretty quickly descend into authoritarianism

Moreover, historically speaking - centralized economic planning tends into devolve into tyranny vs systems with primarily free markets.

This is also much less about protecting consumers than it is about protecting old French incumbents who are unable to evolve.

> Regulation mixed with "operating more freely" is oxymoronic

Common regulation between jurisdictions allows businesses subjected to the regulatory oversight of multiple involve jurisdictions to operate more freely than if the jurisdictions did not coordinate and instead adopted regulations where it was impossible to comply with one without violating the other.

You shouldn't just pick one word from one part of a statement and a two-word phrase in another part and ignore the rest of the statement in order to create your own argument to respond to.

You’re just cherry picking an even worse example of regulation. The core definition of regulation is the limitation of what an entity can and cannot do ie operating less freely. Your argument doesn’t change that

> You’re just cherry picking an even worse example of regulation

No, I’m pointing to the exact subject of discussion, the suggestion that the US and EU, who currently do regulate and do so independently, could coordinate regulation.

Yes, that's the overall discussion, but that's not this specific sub-thread is about. This subthread was about addressing the strange, oxymoronic doublespeak being used by someone responding to one of my comments. Maybe you meant to respond to a different comment?

It actually isn't oxymoronic though - I like being alive and my freedom to remain alive relies on the regulations and laws that discourage people from murdering me. Regulations aren't the opposite of freedom except in an extremely narrow view - regulations often help to make free markets more free.

This isn't a case of doublespeak at all - it's just that the world isn't a simple place.

This is not a "all regulations are bad or all regulations are good" argument. This is about an oxymoronic statement. I feel that you and previous commenter have trouble differentiating the two.

> regulations often help to make free markets more free.

No. They do not. That's nonsensical. The whole point of regulation is to exert control over something for better or for worse, depending on the situation. That's the exact opposite of freedom regardless of the consequences.

Your analogy is poor because it doesn't mirror the original quote. A better analogy that mirrored the original quote would be, "We need to murder people in order to save their lives." It makes about as much Orwellian sense as saying, "There's freedom in slavery."

> Yes, that's the overall discussion, but that's not this specific sub-thread is about.

I’m specifically addressing how the statement which branched this sub thread off was, itself, a non-sequitur to the statement it pretended to rebut.

It’s not a non sequitur. It’s a response to a nonsensical argument ie “regulation makes markets more free” It’s oxymoronic.

There are many good arguments in favor of regulation, but that is not one of them, despite all the mental gymnastics being done to pretend that it’s a good argument.

"they follow US laws"

...when convenient.

Its not illegal, but it requires consent. Plenty of solutions to offer a video without loading third party code until the user clicks it.

You could also use something like 'embetty' [1] and proxy your users from YouTube, Twitter and the likes to ensure their privacy.

[1] https://github.com/heiseonline/embetty-server

Perhaps unpopular opinion, but I don't want a fragmented internet, where I have to remember 10 different options for every single service I need to run a startup. Is that really the hill we want to die on?

I have enough things to worry about, I don't want to consider 10 different cloud computing options, 10 different database options, 10 different analytics services. I want to just go with the big popular option.

Heck I'm willing to bet even if more options come up, the most popular option will be some aggregator site that tells you which one to use.

>I think we (in the EU) will soon realise the bizarre consequences of these regulations.

Could this not also be said about US regulations such as CLOUD act, Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333.

I don't think it's accurate to solely blame the EU when this is in response to legislation that gives/gave the US access to all types of personal data on European citizens.

> I don't think it's accurate to solely blame the EU when this is in response to legislation that gives/gave the US access to all types of personal data on European citizens.

I would argue that the Americans getting better privacy protections and working with other countries instead of forcing American companies to behave illegally abroad would be a much better solution than the Europeans watering down their privacy laws.

American companies will set up independent shell companies or subsidiaries to serve European customers anyway. Microsoft and Amazon are never going to voluntary leave a market of 400M customers. Doing so would leave too much room for a competitor to grow and then threaten them. So if fragmenting the web means that Europeans get the same services as Americans, but with better privacy, then I am all for it.

Europeans are to blame for the flaws in the GDPR, not for doing their thing without the blessing of the Americans.

The recent German judgment was also about subsidiaries. If 'Meta Europe ' falls under the cloud act it isn't GDPR compliant.

It’s a simple shell game. Meta US can very well become a subsidiary of Meta Bahamas, and still get licensing fees for its brands and IP from a nominally independent Meta EU.

Maybe that's true for the Microsofts and Google's of the world. But for smaller companies trying to provide SaaS or PaaS it totally keeps them from entering the market. So in the end it only increases the difficulty to compete in EU and increases the power of these mega corps.

I agree. Hopefully this is temporary and they can figure out a reasonable compromise. As a Swede I do feel that parts of the EU (with Germany and France) are heading in the wrong direction. Those are not countries famous for their entrepreneurship and it seems like their first instincts in relation to the US are usually protectionist.

I can tell you that there's a deep-seated suspicion in the US that for France, much of GDPR's purpose is about enabling protectionism.

The logic is understandable. Surely, if you just get rid of the abusive American monopolies the home-grown companies will take their rightful places... right?

That doesn't seem to be true though. There are multiple countries outside the EU that have an adequacy decisions regarding their privacy laws like: Japan, South Korea, Canada, UK, Isreal, etc. They can host EU data without issues.

The only reason the privacy shield agreement was thrown out was due to lack of safe guards from US intelligence.

Even without the privacy shield, US companies would still be able to store EU data in a country with an adequacy decision if it wasn't for the CLOUD act. This seems more to do with US law wanting access to EU data.

Critically, they want access for for free.

The US does not have to give anything in return to get all the private data from EU they want.

The EU in return gets...nothing.

If you are a politician this is not a great position, you get no money, no jobs and no data.

If they equalize data access, "data sharing" (on an intelligence and on a commerical level) could be a valuable component of future negotiations.

> The EU in return gets...nothing.

The EU gets the services they use....

Of course the users do (and pay for it)

However from a political standpoint that's as good as nothing.

Is there anything restricting US companies from first transferring EU data to a country `A` with an adequacy decision and then transferring that data to the US (assuming `A` allows this)?

I'm also European and I completely agree with you. They're basically taking the whole EU as a hostage to protect their own inefficient domestic companies =(

I wouldn’t worry too much about AWS or Azure. When AWS realised how much money the European Public Sector spends on the public cloud a good few years back they went from being behind Azure in terms of complaisance to now being ahead.

I’m Danish and as we’re a notorious Microsoft country I have the most experience with everything Azure, but the fact that Amazon was so quick to ensure that 100% of the workers who ever come near the services they sell within the EU are EU citizens is something that we still looks somewhat envious toward. It’s actually an area where Microsoft might eventually run into some trouble if they don’t work on their compliance but I can certainly understand how it’s hard when one of their key selling points to Enterprise is that we can call Redmund.

I don’t think the EU will get into much trouble over this, however, and I don’t think it will have too much of an impact on our tech industry. I do agree that it’s not likely to help European alternatives to Microsoft or Amazon, but that’s not exactly the point or the legalisation is it? It’s there to prevent EU citizens and our personal information from becoming the primary commodity that is sold between giant companies.

Advertisement companies like Google will no doubt struggle with this going forward, but is that really a loss for anyone?

> but the fact that Amazon was so quick to ensure that 100% of the workers who ever come near the services they sell within the EU are EU citizens

Uh not sure what you're referring to but that's not true. The only airgapped region w/ enforced citizenship was for US citizens in GovCloud.

Shaking up the current situation doesn't seem to be an entirely bad thing. As it stands, the majority of the internet is depending/residing on datacenters provided by a handful of companies. I'm not sure that's a good thing.

Building satisfactory alternatives to Office, Workspaces etc. isn't a monumental task by any stretch. With the sudden demand that you predict, they'll spring up like weeds.

This might be ham-fisted and crude, but in the end I see a lot of positives.

If replacing Office / Workspaces is not a monumental task, why are there only two good options? Workspaces is only just becoming a viable replacement for enterprise because pivot tables are hard.

A big reason is that competing with them on equal footing is a monumental task. You are working against network effects, heavy duty marketing, integrations into other products and a whole army of developers.

Developing the product itself isn't the reason.

But network effects and marketing are irrelevant for products that can't be used in your country because they violate local laws. If some Google product can't legally be used in the EU, then it has zero network effects there and Google wouldn't waste money marketing it there.

Also, the competing EU-based service might be strong competitors to the ones in the U.S., among people like me who are privacy conscious. I don't use Google services, but I'd be happy to consider using GDPR-compliant services based in Europe.

I think you misread the comment thread. You are just restating my point. I agree with you. I was talking about the current (previous?) situation, where US and EU companies are on equal footing on the european market.

The big companies buy the little companies as soon as they look like they may be a threat. It’s not monumental or hard to compete with them.

I think you are underestimating the effort required to produce an suite of office products.

Libre office is a third option, but does it have much usage? Why or why not?

Could you sustain a development team capable of creating this with a limited market and revenue stream?

Sorry I wasn’t clear. The reason there are no competing products isn’t because it is hard. It’s because they keep getting bought as soon as someone does “good enough”

They don't have to sell to them though, right?

Would you turn down a "name your price or we'll run your business into the ground wink wink" (by disabling app store, never getting on the first page to results, etc). Not saying that is what is going on or anything...

In most cases the underdog is running on investment funds, and has handed over a significant amount of the company control to investors. When a buy is proposed, those investors have to weigh the really quick (probably really large) profit of selling versus playing the long game fighting an uphill battle against the giant.

This is how promising companies are swallowed by the market leaders.

> Could you sustain a development team capable of creating this with a limited market and revenue stream?

Market wouldn't be limited and potential revenue streams would be huge. So yeah. Just as a reminder, this is still assuming that there is a significant window where the big options aren't available for Europeans.

> There must be some reasonable middle ground before we fragment and destroy the entire Internet.

Elsewhere "fragmentation" is called diversity and competition. It's sad that it has to come about due to regulation, but it's a good outcome nonetheless.

The familiarity and precedence of current offerings becomes a kind of Stockholm syndrome for people. More options mean more chance of valuable improvements, and geographical diversity means different mentalities and points of view, instead of more "me too" options.

> No cloud services, no Office 365 or Google Workspace

I'm so looking forward to that.

What is the alternative? We are going to go back to 2005 where we send docs over email? Files end up being too large, nobody knows what the latest copy is, etc.

You can host this on-site :)

No need to go cloud everything. I think you can even buy the whole azure pack to run on-site.

The EU is big enough that companies like Microsoft will find a way to offer their services legally, and if they wouldn't, it would be a huge opportunity to EU based competitors. It's not like we don't have any software companies in the EU.

Also, there's no reason that collaboration tools must be hosted on a US cloud. Especially Microsoft traditionally provided tools for their customers to host their own infrastructure -- it's only a recent phenomenon that everything is hosted by the vendor themselves.

I think you’re right. Microsoft is perfectly able to split its operations. They’re doing it now in China in a much more drastic fashion, and they seem to have been preparing to do it in Europe for a few years now.

The fact that US companies may need to treat Europe like China speaks volumes about the road the EU is headed on.

Just that two ships are departing from a location does not mean they heading in the same direction.

It is true that both the EU and China are swiftly heading away from this unprecedented era of technology companies being able to act as they please abroad without impunity. It is an era that the US, which benefits from this arrangement greatly, understandably does not want to leave.

But what matters is why they are doing this, not that they are doing it. And in that regard it is much harder to find similarities.

It says quite a lot about American imperialism, actually. These developments were basically guaranteed the moment the CLOUD act passed, and after the adventures Microsoft had with the DoE.

Do you genuinely think they're the only office products providers in the world?

No, do you think they were going to list every single office product? They said "Cloud services" which encompasses more than just those two.

Or people get fed up with cloud companies like Google (already happening) and people realize self hosting is becoming more and more simple (also happening) to the point where anyone can do it. IPFS and other tooling could push a decent portion of users to this. We can already see some of that effect with things like mastadon.

If European startups end up starting companies in the US, and the US companies can't operate in EU, there will either be a massive vacuum to serve the European market ($15 trillion in estimated GDP), or there will be companies that like profits and want to earn some money by providing products in EU.

We can create a middle ground. When ever information about a EU citizen that get transferred to the US, a similar information about a US citizen get transferred to the EU as hostage in case there is a data violation. A list of IP-addresses accessing usa.gov in return for a list of IP-addresses that accessed europa.eu. Surely a deal can be made that give both sides equal power.

I think we are already dealing with the "bizarre consequences" of having our personal information uploaded to servers in a foreign country without consent.

Privacy abuse on such a massive scale, never before seen in human history, requires action.

And it does not matter how normalised this has become for the people in the valley of the clueless.

We already had a good sneak peek in Germany, when schools closed last year for some weeks due to the pandemic.

Popular video conferencing solutions weren't allowed due to privacy issues. The official "Lernraum" platform that have been used for this did not work most of the time.

I understand where these laws come from, but it's sad that there often is no European alternative

That’s okay.

The EU can build it itself when the US player are not able to not send data to their US data centres.

I don't think it can. Maybe they can buy yandex, but i think europe has drained its talent tothe US. And even if they build it, how will they monetize it?

I don't belive that to be true at all - EU have a lot of great SaaS/tech companies that emply a lot of really talented people. What EU need more of however is vc money.

Europe isn't drained of talent by a long shot. It has surely been tapped to some extent by the bay area exodus, but there's plenty of tech success stories and talented people here still.

Yeah the talented people are getting paid 3x as much to work for US companies with like two or three exceptions.

That's just ridiculous. It's a miniscule portion of the total talent that has left to US, and Europe draws many people in constantly as immigration is easier.

Why would EU building it themselves going to happen? Either it could be profitable for company to operate in EU or it is not. Assuming current US companies are efficient enough and if they couldn't be profitable, why could be a same thing built by EU is profitable there. In fact it is opposite as they couldn't track as much as American companies even outside EU.

Because US companies are hamstrung by US laws that prevent them from complying with EU law (i.e. US govt says you must give private data to us and EU says you can't give private data to non EU govt). Other companies not based out of the US can guarantee privacy that meets EU spec if they don't have local laws compelling data access. So it might not be EU companies that capatilize on it but there can be a market opportunity that US companies can't fill.

Because the US companies are bloat with their bureaucracy and structures. A Google is not able to pull a startup thing. See Stadia or the other short-lived projects, they all suffer from a lack of skin in the game - so to say.

There are more startups in US than EU. Also I think bureaucracy is worse in EU than in US.

Why is it on Europeans to weaken their privacy regulations and not on Americans to strengthen theirs? Why should we bend to the lowest common denominator instead of lifting everyone up?

> No cloud services, no Office 365 or Google Workspace.

I think you are overestimating the problem. Before Facebook decided that it wanted the European market we had hundreds of similar services. We will have local replacements the moment these US companies with their near unlimited war chests finally fuck off and give European companies room to breathe again.

AWS has always had a very clear region system which let's you decide the location where you store your data and run your services. Most popular region here in the EU being eu-west-1 (Ireland), which usually gets new features and updates first. Once you choose a region for your application, it takes some effort to store data outside of it.

It's sad but predictable that the top response amounts to "Forcing companies to act ethically and legally would just push them into the USA".

That's not exactly a great argument here, given that this French court has objectively made the right legal decision here in terms of EU privacy law, and the rights of their citizens.

Microsoft will be storing EU users' data in the EU: https://blogs.microsoft.com/eupolicy/2021/05/06/eu-data-boun...

Will this enable them to comply with the requirements?

Microsoft has done the leg work for this already. They currently have a completely contained Azure environment in Germany. I think it was deployed to ensure compliance with german/EU health data protocols.

I have first hand experience of this, migrating between their global PaaS and the contained German one. The bulkheads are quite air-tight (much to my personal detriment).

They also had a completely separate o365 offering called Microsoft Cloud Germany that failed due to lack of interest (and the fact that it was years behind the global platform, I say), which was finally shut down last year, with everyone who renewed their contract automatically being migrated off.

They're working on it, but still not everything is entirely regional.

https://docs.microsoft.com/en-us/microsoft-365/enterprise/o3...

Not if they have to provide this data under the cloud act.

Europe's future internet without web3 sounds wonderful.

These tools have EU versions of their services with servers in Ireland or other places so that the data does not leave the territory. There will be absolutely no consequence to these regulations.

The server locations does not seem to matter as long as American government agencies are able to make the company provide the information.

But, companies like AWS claim that they voluntarily bind them selves to to provide much stricter privacy safeguards than the US law requires[0].

[0] https://aws.amazon.com/blogs/security/aws-and-eu-data-transf...

> No cloud services, no Office 365 or Google Workspace.

For quite a lot of business data, the "do not export data out of region" thing is nothing new. Which is why it is not actually unusual to be able to select where the servers are located.

That being said, if this made Microsoft Teams impossible to use, it would made a lot of us happy. That thing is crap.

It’s justified to keep that in mind. The EU is absolutely capable of myopically binding itself in red tape and stumbling in to second order problems.

It is also silly to tolerate techs incessant fuckery.

> I think most successful European entrepreneurs will just end up starting companies in the US instead.

If these companies end up banned in Europe, that's not really a problem from Europe's PoV. Europe may end up deciding that US companies not coming is a problem in itself, but that is already the case imo.

Honestly, if this policy is actually enforced, it's very hard to imagine how the landscape would shift. Maybe Europe would be brought to its heels, and be forced to remove the law. On the other hand, maybe the US would be forced to renounce their cloud act, which is a large part of Europe's privacy issues with US companies. A third path could be companies reverse-incorporating in some place that would let them keep in business.

It's a bit hard to predict honestly.

The UK market for digital products won't stop existing just because a few UK entrepreneurs move to the US.

These regulations are the only way to dismantle US big tech monopolies. The US government won't do anything about it on its own accord because it's too profitable. Other countries need to neuter the influence of US big tech first. Then the US can police their own better to encourage intl competition if they want to.

You can use all these, but you cannot send your own visitors' data to M365.

Nah, the tools will be adjusted to comply.

The EU combined is the largest economic region in the world. With backdrop the other huge one China where doing business has become increasingly difficult and volatile.

Tech giants cannot afford to pull out of the EU. Call their bluff, they won't. They can't even if they wanted to, as shareholders will skin them alive.

>The EU combined is the largest economic region in the world.

It's not 2011 anymore. The GDP of the US has surpassed the GDP of the EU.

Is this with or without money printing?

I'm teasing. I accept your new data, but I don't think it fundamentally changes my point.

If we don't count money printing, europe would probably be in an even worse shape. Remember that the interest rates in the big Western European countries have been negative for years with still almost no economic growth, and that was pre-covid! Even the FED isn't technically directly buying US bonds from the market like the ECB does to prop up the debt sales of its weaker members. Even the historically low current FED rates, I think are still higher than the peak of most European central banks rates of the past 5 years. Again, all of that did very little to prop up their economy (which usually indicates it's pretty zombified) so they couldn't even start hiking the rates back in 2018-2019 like the FED did. That means they are now stuck with very few "easy" ways to recover from 2020.

I know you are just joking, but the sheer irony of a money printer joke in this context was just too much for me to not react :')

Being the number 2 (or three if China overtakes) is still not exactly a weak position to be in...

Companies will bend to the whims of regulators in the countries they do business in. Look at US companies in China.

AFAIK, Microsoft moves most of it's cloud services to Europe by the end of this year for their European clients [1] So I guess where's a will there's a way - they just need a "little" nudge. Should be good for datacenter redundancy anyway, no? But: some datacenters are in fact crappier/slower than others - German datacenters take way longer to implement some new features compared to US datacenters or even those in Holland/Irland. But that's due to slower german regulatory processes

[1] https://blogs.microsoft.com/eupolicy/2021/12/16/eu-data-boun...

I run multiple organizations just fine without any third party proprietary SaaS like those provided by Salesforce, Google, Apple, etc.

It is crazy to me so few realize it is really not much, if at all, harder to run a business without involving US surveillance capitalism corporations.

Tools like Nextcloud, Matrix, Jitsi, have turn-key SaaS providers or you can self-host them easily as well. Same for many many analytics solutions.

I honestly think every company would be better off having more sovereignty in their tech stacks and data, and it is much better for consumers who may not realize they are -also- sharing their data with third parties like Google who use it sell targeted behavior changes to the highest bidder.

We knew those consequences from the start, they are just being realized veeery slowly

> European startups will not be able to use standard SaaS or PaaS tools (like AWS, Azure, Mailchimp, PayPal etc) if they are based in the US

PaaS and IaaS providers all have a presence in the EU or is that still not good enough to pass the regulation that's in place?

SaaS I get it, they'd have to create a presence in the EU but I don't think that's a bad thing. They will, at least the big ones you mentioned. And if that's a problem for smaller SaaS providers then the market will have a solution for that emerge over time.

> I think we (in the EU) will soon realise the bizarre consequences of these regulations.

Wait until you see the result of the green revolution: you'll pay your energy 3 times more than now.

We'll need decades to recover (if we recover) from this ideological move from people that lives in la la land and have no idea of the consequences of their acts.

It already has started with natural gas prices skyrocketing. The Russians are holding us by the balls and our politicians are spitting at their faces...

Out of curiosity, where did you get that 3x claim on green energy? And how is that related to Gas?

It was inspired by natural gas prices that went 3x this winter and an article that said we (French citizen) pay our electricity much more than what it cost us to produce because our production is sold on the markets then sold back to us at an inflated price (deepl should offer an OK translation even if it might lose a bit of the humor : https://institutdeslibertes.org/nous-avons-la-meilleure-fonc... ). I don't have data to say how much more will it be expensive, but I know it will be bad enough that we certainly will have protests.

You can't just delete nuclear, coal and natural gas power plants and think the invisible hand will provide. There is no secret plan behind: we're gonna crash then our politicians will blame the Russians and / or COVID but certainly not their incompetence.

Don't get me wrong, I don't want to live in a polluted world more than anybody else, but I also want to take a hot shower daily without it being a luxury expense. We needed to think the transition and do it progressively before. Too late.

> European startups will not be able to use standard SaaS or PaaS tools

I wish!

I don't think Google analytics is that essential. It has privacy problems and there are alternatives around. It is just often the lazy choice of developers. They would have to adjust a bit, comes with the job anyway. Not using it doesn't "fragment the internet".

I still don't think laws against specific software is helpful though.

Or... Or... these co's stop mining/saving data on all EU folks altogether. If they could prove to regulators that the tracking and mining and selling of data does not happen at all for EU folks perhaps these cloud players could still sell services to the EU market.

> most successful European entrepreneurs will just end up starting companies in the US instead.

And then they will not be able to serve the european market, nor profit off the european economy. Good luck competing with each other for that US market.

More like they build successful companies in the US which then enter the European markets with a massive warchest and dominate any domestic EU startup in the space.

> It will take forever to build up a similar ecosystem in Europe

And even then it seems risky the EU will deem the business model entirely in violation of privacy laws. It's very chilling

When the EU finally completes their utopian/dystopian ideas of privacy from foreign Internet services, the great firewall of Europe, perhaps then EU regulators will look inward and do the same things?

But for now it all has the appearance of disfavoring International Internet services, as if to encourage regional tech companies to advance.

Which seems reasonable, Europe seems to have lost most of it's Tech companies, and that's a problem that needs to be fixed. It's just weird to go about the problem by claiming International companies are in violation.

What's funny is I don't think of the EU was that high on the privacy list? Doesn't govt slurp up data on its citizens in terms of national health care systems, databases on identity, easy access to online records etc? Is there even a trial by jury in the EU? I thought they had a type of prosecutor / judge that could go rooting around anywhere they want pretty much unchecked.

It’s not about what you collect. It’s about consent and transparency. I can log into my government website and literally see anything about myself that is known to the government. If you get arrested, your name isn’t released to the press so you can continue your life afterwards. If you go to jail, and apply for a job afterwards, they do a background check. If the job has nothing to do with what you got arrested for, it comes back clean. These are all sensible things. When I grew up in the US, I had absolutely no privacy or expectation of privacy with the digital world. I don’t miss it.

The point is though that a EU citizen has zero privacy rights when data is transferred to the US. Zero. Not US level protection, not EU level protection - just fair game.

For that simple reason the EU has to step in. There is no other way.

> the great firewall of Europe

It's not Europe who blocks anybody, but plenty of US websites just blanket-block EU visitors because they can't be arsed to create a GDPR compliant website.

Which, as a European, in practice feels like running into a great American firewall.

This is entirely untrue. AWS and Azure are most definitely able to offer GDPR-compliant in-region hosting options and I'm sure GCP can to (I just don't know their offering as well).

>It will take forever to build up a similar ecosystem in Europe and I think most successful European entrepreneurs will just end up starting companies in the US instead.

This is what you are wrong about. It would be true if you were from a small country like Sri Lanka or similar but for EU many European companies will smell an opportunity to fill the void.

An alternative is to push USA to get similar laws making it equal on both sides.

Sounds like a whole new market opened up for the EU.

The activist MEPs in the EU who have pushed for these regulations are overwhelmingly (German) socialists.

I support their work to protect the privacy of EU citizens. But I'm also aware that their goal is to replace Microsoft, Google, Facebook etc. with state-owned European enterprises.

European state enterprises can be surprisingly efficient. However keep the Germans out of it. German government IT is still in the Middle Ages. Let countries like Denmark and Estonia build the future of European IT.

Danish governmental IT has more than its fair share of scandals.

Reply on news.ycombinator.com