Clint Eastwood Made Carmel Safe for Ice Cream | Hacker News Reader

Clint Eastwood Made Carmel Safe for Ice Cream

montereycountyweekly.com

25 pointsbrudgers49 comments

Anyone thwarted by the 451 message because of access from Europe - as mentioned in comments here - here's an archive link:

https://archive.ph/w3O9q

> a rule stating that all takeout food must be packaged or covered

> On May 6, 1986 Carmel City Council passed a resolution to enable a rewrite of the ordinance related to eating places and takeout food and make said ordinance more friendly toward ice cream parlors. The new language made eating establishments that “primarily serve frozen desserts” their own category

So they solved this inane takeout ordinance by exempting frozen desserts. I guess takeout hotdogs, pretzels, etc are still required to be sold with excessive packaging. Or perhaps a little paper dish for a hotdog is sufficient packaging? Could they have sold icecream cones if they put the cone into a paper sleeve?

Some of the things small towns see fit to regulate give an undue bad name to all government regulation.

There was an issue with trash at the beaches and all over. They resolved the issue, but also left a carveout for the joy that is eating ice cream because enough people supported it or its proponent. Seems like responsive government to me that made room for a little joy.

> They resolved the issue

I don't see anything in OP about there being a trash issue or about any trash issue being successfully resolved by this heavyhanded regulation.

Just going off my memory of it. I could be wrong, it was a while ago.

Why would requiring packaging for takeout food reduce trash at the beaches? I would expect it to have the exact opposite effect.

If I remember right it was to do away with things you eat immediately and then just throw away the wrapper (for my family we could no longer get focaccia in a little paper bag that we would eat while we walked, I guess a box was too wasteful/expensive?), while still allowing things you took back home/to hotel. So pizza slices on a sheet of wax paper bad, chinese food to go good.

> a rule stating that all takeout food must be packaged or covered

In some cultures the idea of "preserved food already supposed to be freshly confectioned" would cause civil unrest.

> "We recognize you are attempting to access this website from a country belonging to the European Economic Area (EEA) including the EU which enforces the General Data Protection Regulation (GDPR) and therefore access cannot be granted at this time."

Yes, because GDPR compliance potentially costs a lot to implement, most small town news sites in the US will just block the EU than even try to sort it out.

Disabling shady advertising networks for EU costs a lot to implement?

No, the legal costs of compliance, having a lawyer verify stuff, having a designated Data Protection Officer, etc, are a lot when your some small town newspaper.

Ok, well, I have no idea how all that works in the USA. But, hosting a plaintext news site requires you to get a lawyer involved if you want to serve EU visitors? Sorry but that makes very little sense to me.

Verify what? That the news are in fact written in English?

> Verify what?

...that can be an expensive question to answer if you're trying to be in compliance and don't know what compliance means.

Even an answer of "you need to do nothing" can be pretty expensive.

Show me one single instance of a US company that was fined by the EU for being out of compliance when that wasn't patently obvious and without them being warned time and again first. Just one. I'll wait.

I'm going to go out on a limb and guess that you aren't involved in much risk analysis?

Whether or not someone has already been fined (even within your constraints) influences the risk decision, but it does not remove the risk. Since there is still risk, it must be weighed against the organization's risk tolerance.

Evidently, the risk still exceeds the risk tolerance of several smaller websites.

> I'm going to go out on a limb and guess that you aren't involved in much risk analysis?

Try again.

I take it you have rock falling from the sky insurance as well? And don't forget about the crocodiles.

>Try again.

They say, without refuting anything.

>I take it you have rock falling from the sky insurance as well? And don't forget about the crocodiles.

I have life insurance, yep! Which includes accidents, etc. Not that either of those situations is remotely analogous to GDPR fines.

Edit: I should make it clear that I don't operate the sites, so if your upset about what conclusion these websites came to, take it up with them. I am just pointing out that there still is a risk, and it is obvious that this remaining risk matters to some of these sites as they choose not to serve EU visitors. Do I block EU citizens from my site? No, I don't.

It's not the risk analysis that drives these companies to shut down EU traffic, it is cost benefit analysis. Until the USA implements a similar law - hopefully without the warts, which the GDPR definitely has - this situation will persist. Note that parties that make money on their products rather than on their users have no problem with GDPR compliance at all.

If you are a US business and have no interest in reaching EU customers, why take the risk, even if it's very small?

The simple truth is: these companies are trampling the rights of their visitors, EU or otherwise, but in the case of the EU they have decided that if they can't do that that they'd rather not see them at all. Make of that what you will, but if I were living in the US and an entity would block the EU I would take that as a very bad sign regarding the stewardship of my data in the hands of that company.

here is how I imagine the tech-savvy people at the monterey county weekly handled the news of GDPR.

lawyer: so there's this new EU law that could get us in trouble if we keep using google analytics and an EU citizen tries to access our site

manager: do we have to comply?

lawyer: we could, but it would require work. we can also just block visitors from the EU and not have to worry about it at all

manager: ok moving on

Verify all of the following are compliance with GDPR:

* Logs, including firewall logs, web server logs, WAF logs, flow logs, etc. (Remember: Under a number of legal interpretations of GDPR, an IP address is a unique identifier.)

* Any comment sections, feedback forms, contact forms, etc.

* WAF, Anti-Bot, DDoS protection.

* Any third party vendors used in serving the site, and the specific integrations.

* Advertisements, which the side probably depends on for a lot of its income.

> hosting a plaintext news site requires you to get a lawyer involved if you want to serve EU visitors?

you clearly have not dealt with GDPR. you have 3 options:

1. you do it properly. it will cost a lot of time and money. you will need to hire or sub contract. sometime subcontracting costs even more than hiring.

2. you completely ignore the problem. you hope some activist won’t notify the european authorities.

3. you put up a firewall.

the cheapest and safest route is 3.

> 2. you completely ignore the problem. you hope some activist won’t notify the european authorities.

has that ever happened?

I especially appreciated I was shown a captcha before being told I can't read the article.

Maybe it was from Cloudflare?

You mean that stopping abusing just a subset of visitors costs a lot to implement. Stopping abusing everyone is easy, but of course they don't want to do that.

When a website is below a certain size, it's likely that they don't think it's worth the resources required to even determine whether they're abusing visitors.

It's not "we're abusing people so we're banning the people it's illegal to abuse", it's "we don't know if what we're doing falls under the definition of what's considered abuse, and the people it's illegal to abuse are not part of our market, so this is the shortest-path to guaranteeing we don't accidentally do anything illegal".

If it were some very large international website, it could more reasonably considered an admission of guilt, but for a small regional newspaper I don't think it is.

Can you inform me how this site is abusing people who it allows to access it?

And what's your knowledge of their code stack and backends?

Either:

1) They aren't collecting personally identifiable information, and therefore don't fall within the scope of the GDPR, and therefore the cost of compliance is virtually nil

or:

2) They are collecting personally identifiable information. For just visiting their site, that's abuse.

> And what's your knowledge of their code stack and backends?

Not relevant.

I don't think there is an agreed upon definition of "personally identifiable information" at the edges, therefore I doubt that the GDPR got it right.

For example, when the RIAA was suing everyone for pirating music...it was claimed by the tech community that an IP address is not enough to personally identify someone for a lawsuit. But the GDPR claims that IP addresses are PII. Which is correct? Our choices are live in a world where website operators can't log an IP address, but the RIAA or anybody can use an IP address to target someone for a lawsuit? Or we can live in a world where website operators can log an IP address, but the RIAA can't use an IP address to target someone for a lawsuit.

And your knowledge of their backend is relevant, because you made a claim about its behavior - specifically that it would be easy to stop abuse for everyone. But what if parts of their system rely on, say, a logged IP address to aggregate some statistic that is important for the business folk? It might require reworking a large portion of their backend if they need to derive this non-abusive information in a different manner.

Ok, what’s the easy solution for this ad-supported, free website for a local newspaper to stop “abusing” everyone?

Local newspapers don't need cookies to sell ads.

Going through the hassle of ensuring compliance, even if you’re 99% sure you’re fully compliant, isn’t worth it if none of your target market is European. Blocking is the rational move. (The alternative is ignoring GDPR, which most sites in this position do.)

No it doesn't. Just don't store unnecessary data of your visitors. Mostly just means turning off tracking

Right. And how do you determine that data? Are you 100% sure you haven't missed anything? Remember there was some issue with fonts hosted by Google.

Is it so hard for them to host the data themselves? No third party domains, no problems.

Clearly the site doesn't see the data/tracking as unnecessary and have opted for the path of least liability, which is very rational if their advertisers aren't trying to reach EU customers

The expense comes from the uncertainty. How do you know if you did everything exactly right? You have to hire an expert. This comes up in a lot of domains. People say just read document X, Y, and Z; but when you go to do that it's not always clear exactly what they documents mean.

Isn't this a good thing? It's quite easy to accidentally go to a site that does something evil with your private data, like log an ip address. At least here you've been spared the pain.

evil doers don’t block. on the contrary. they let you in.

sites like this paper just don’t want the hassle. if the site is small, and the EU visitor numbers are tiny why should they deal with gdpr? for the 2 monthly visitors that ended up on their website by mistake? easier and cheaper to firewall.

I believe that statement was sarcastic.

I really do not understand this.

I am in the EU. If I had a website for my local city and Australia had a law telling me to make it blue I would say fuck off and do not do it.

If the US wanted me to log if women got there I would say fuck off.

If China ... fuck off.

So many fucks off and zero effort from my side.

Why bother??

Of course if I had a foot in Australia, US, China etc. then I would do something.

Reply on news.ycombinator.com