You don't need to spend all that much money.
Just buy a Raspberry, install some HTTP server and forward port 80 to it, then use some free dynamic DNS provider:
$100 + $10/year.
Everyone should do this.
Just buy a Raspberry, install some HTTP server and forward port 80 to it, then use some free dynamic DNS provider:
$100 + $10/year.
Everyone should do this.
> Just as moving VPS companies kicked the can to the next VPS company. Just as getting my own IPs kicked the can to upstream. Just as getting a stable upstream kicked the can to DDoS mitigation.
My point is if everyone hosts all their production from home they can't control it, you cannot DDoS all IPs at the same time.
There is also the issue of it being super slow.
Notably, keeping javascript enabled during "Tor mode" even if the user has explicitly disabled javascript.
https://community.brave.com/t/tor-mode-always-has-javascript...
I recommend using Tor browser and using about:config to set javascript.enabled to "false".
Also: I really want to do this, but I have no idea how. The technical aspect is straight forward, the legal aspect is far beyond me. I have no Idea how I could legally host a website in my country.
What personal Information do I need to include, are real name+address+email enough? How do they need to be included? Do I have a legal requirement to respond to communications over that address, in what time frame?
Surely there are more things to consider here. Do I need to register this website, do I need to register it under a buisiness? I really do not know. But to be honest the obligation to dox myself is pretty much enough for me not to give it a try.
This is before putting anything on the website. The concerns about speech restrictions are a completely different topic.
https://gdpr.eu/Recital-18-Not-applicable-to-personal-or-hou...
I fail to see how I would be exempt. And even if, at what point am I not? If I am taking donations? If I have a comment section? If I have accounts?
I don't know where you live but maybe just knowing of the concepts should be helpful. I think you should be totally fine to start a non-commercial website without consequence, but of course this isn't legal advice.
That was very much in my mind when making LokiList.
https://lokilist.com/about.php
Since I made LokiList after FOSTA killed Craigslist personals, I also made sure that all user interactions occur offsite on a decentralized, end-to-end encrypted network to minimize reliance on Section 230 protections.
I can say something more sensible wrt your GDPR and "cookie" questions:
The GDPR has one overarching principle: "data minimalisation".
There are no requirements to preserve things like access logs, but rather the opposite: you should only retain personal information for as long as you _need_ it - and then once you no longer need it, you should remove it. And while you have the information, you should take meaningful steps to secure it, where the definition of that changes based on best practices over time.
The important thing here is that you think about what information you need, for what purpose (so something specific like "prevent abuse" rather than "it could come in handy at some point"), and then consider the tradeoff between privacy of your users and your own need for the information (and document this thinking in some way, so that you can later prove that you've done so).
So for those access logs, write down that you log e.g. ip address, timestamp, UA string, referer, visited page (possibly including querystring with search terms), that you retain this information for 2 weeks, maybe that you then aggregate it in some ways, and that you'll delete the information after this time. Your purposes for doing this are probably insight into usage patterns and detecting and fighting abuse. You're explicitly not connecting these logs to other data sources to identify specific visitors, nor sharing this information with any third party, so you believe the privacy impact for your visitors is minimal.
On your website, have a page (accessible from anywhere, so e.g. linked in the footer) that says the same. Specific wording effectively doesn't matter, but what does matter is that it's understandable by your average visitor.
As for cookies: "Functional cookies" (shopping cart, "remember me" function etc) you can set without any permission. "Tracking cookies" (advertising, analytics, etc), you can only set based on explicit and voluntary permission (visitors need to be able to say "no" as easily as you say "yes", without negative consequences, and if they say give permission, they need to be able to withdraw it just as easily at a later date, so one-click in the footer or somesuch - they also need complete and understandable information what they give permission for, so put that in the question, and link to a similar page as above for the GDPR).
I appreciate the effort. Clearly there is quite a bit of effort involved to comply with just EU law. To me the legal aspect is the largest hurdle, it turns a fun weekend project into wading through unbearable legal requirements and in the end I still will not know if I am actually in compliance.
These are all questions that are VERY easy to answer. You do not need consent to place strictly necessary cookies (think a session id that identifies a shopping cart). Other cookies you do need consent for.
Access logs, don't 'probably count', they only count if they include information that could be used to identify a person, like an email address or ip address. Pretty easy to not log that info.
Do you need to 'register' a website as a business with your local authorities? Likely not, but I don't know where you live.
My take is distributed if not decentralized network.
The attack on kiwifarms has shown the internet is no longer free.