Hacker News Reader

Comment by beardyw | Hacker News Reader

With disparate laws in every legislation, it will I think become increasingly burdensome to own a website. If you can't reliably determine where your user is, you must satisfy all of the laws simultaneously - until even that becomes impossible.

View on HN

I have a website to host some basic static content and maybe a few pieces of text. I don't feel like this makes my life any more burdensome. Do you maybe mean that it will become increasingly burdensome to own a website that collects analytics on users, or something similar?

An enthusiast web forum that captures IP address, often used for helping to enforce troll bans.

They're also not businesses, usually. I didn't read the entirety of the bill, but does an IP address alone constitute PII here?

Yes, IPs are PII given they can be linked across websites. In addition, many ISPs in the US do dynamic IP assignment but will let you keep your ipv4 for years if you don't go offline for too long (i've gone 24 hours without the router connected to the internet on ATT without losing my IP).

And the 'business' requirement is more about "doing business" in the state and not "the service provider is a legally registered business", so individuals also must comply.

> Do you maybe mean that it will become increasingly burdensome to own a website that collects analytics on users, or something similar?

I think you are underestimating the impact. Anything that stores account names or emails (forms, comment sections, commerce sites, ...) is a very broad list.

Even if none of this is true and you ONLY serve static content without analytics delivered to the user you are not guaranteed to be safe. Apache by default logs IP addresses [1].

[1] https://www.ptr.co.uk/blog/which-ip-addresses-have-accessed-...

Does your static webserver log IP addresses of requests? Most do by default.

My static site sits behind cloudflare and logs to /dev/null. It's possible (actually pretty easy) to configure things like this.

It does look like you'd be required to perform a data protection impact assessment every two years and submit a report on it. Likely your report won't be complicated because there will be very little impact, but you'll still have to file the paperwork and maintain records to be able to prove that you did the work and that the required updates were performed on schedule without fail.

Only if you do business in that jurisdiction.

I'm pretty sure some of the websites I'm running are breaking laws in about fifty countries, but I don't care because I don't live or do business there.

The technocrat champions of wrapping the Internet up in the nanny state and its regulatory requirements, will inevitably be the ones lamenting the burden in 10-15 years as the Internet (as we used to know it) is fully choked off. To be clear, the Internet barely exists as it is, the Western Europeans (along with China and Russia) are way out in front when it comes to destroying it - however the US, starting primarily from California, will mimic their authoritarian spirit as always.

But but but, we gotta protect the children.

But but but, we gotta stop people from saying bad things that could hurt the feelings. Free speech bad. Must regulate speech.

Cycle forward a decade: the government is going too far! This is outrageous! Too much surveillance! Muh privacy. Who gave them all of this power?!?

Yeah, gee, who indeed.

I have a solution for my websites: I don't track people. They are just platforms for text and links. The desire to do tons of invasive tracking is what got us into this situation in the first place, and states like California (and the EU for that matter) want to throw the baby out with the bathwater. There's a lot of bathwater, so I can't say I blame them.

This reminds me of a conversation I had with an owner of a bbq restaurant who said he was struggling to meet new laws required stainless steel tables for food preparation, which was going to cost him $25,000 to install. This legislation, according to him, was heavily pushed by McDonalds corporation with the intention of driving out small business competition.

Whether this is accurate or not, I think it's clear the deluge of privacy legislation will have the opposite of the intended effect in terms of empowering the facebooks, googles, etc who can afford an army of lawyers, privacy engineers, privacy ops people, etc.

Have you built a website lately? Forget an alt tag on some graphic on your homepage that has nothing to do with your content like to some stock photos. You're going to get an accessibility lawsuit threat. Page could be simple one pager of your restaurant with all the important content in text like location and hours but forget one alt tag on a photo of you restaurant.

Not to mention all the patent trolls. Have login functionality, there's another lawsuit threat you're going to have to settle for $10k.

My gut reaction is that this should be up to each country to enforce in its borders. If someone in CountryA wants to send a request to my web server in CountryB, in some sense that’s similar to someone buying something in CountryB and bringing it into CountryA. That’s obviously up to CountryA’s customs authority to enforce, not whatever shop in CountryB the item was purchased from.

But at the same time I’m very much not into great firewalls.

I've never heard someone argue that a packet crossing a border is considered an "import" but it makes a lot of sense to me!

At some point it'll be easier to run it as TOR hidden service, on Freenet or I2P and stop caring about the bullshit legislation.

Shortly thereafter (if not before), governments will make it illegal to go online with a device that doesn't do a remote attestation with Secure Boot, and they'll require that the OS has a system like Gatekeeper[0] which checks a centrally-managed blacklist every time you try to run an application.

[0] https://www.howtogeek.com/701176/does-apple-track-every-mac-...

Most of us will have illegal, unregistered phones then, running hacked firmware. Just look at Russia, China or all the illegal satellite dishes on Saudi rooftops.

It's an arms race all the way to the collapse of the system (or revolution). Rinse, repeat.

> Most of us will have illegal, unregistered phones then, running hacked firmware.

How easy is it to hack an iPhone to make it run unsigned code, which reports to a remote server that it is running the latest iOS version (with the correct cryptographic proofs)?

Maybe other phones are more hackable right now, but I'm sure Apple wouldn't mind lobbying for a law that requires phones to meet the same standard as them, and that makes ISPs / mobile networks refuse access to any device whose Secure Boot implementation has been circumvented by "independent researchers".

Five years from now, the only people inconvenienced by such a draconian law will be 1) those whose phones run on completely Free Software, and 2) those who illegally import devices that use unpublished zero-days in order to commit highly profitable crimes online. Both groups will probably end up paying thousands of dollars per device, but governments will not care about the desires of either of them.

Reply on news.ycombinator.com