Hacker News Reader

Comment by shadowgovt | Hacker News Reader

I've long been of the opinion that the GDPR was a misstep when the plaintext read of it put default apache logging into the legally-ambiguous space.

When you make basic bedrock ages-old web behavior illegal, the web's gonna win, not the law. In most places, anyway. Good luck fairly and successfully policing every single neophyte admin not knowing that the first software every tutorial suggests you use is now illegally-configured in Europe out of the box.

(The result is, of course, that the law ends up unfairly enforced, which could be considered worse depending on one's legal philosophy.)

View on HN

The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.

Is it not incumbent upon the admin to prove they didn't use the data for analytics? If so, that makes the data default-radioactive where before GDPR it was legally harmless.

And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?

> If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?

Yes.

However enforcement is intentionally discretionary and selective and hence sensitive / prone to political, protectionist and sentimental whims. Your 1 person outfit in Europe is less likely to suffer in actual court, or the court of public opinion, than a big bad American tech company will.

Maybe it's just personal preference, but I find "This criminalizes a very common behavior, but don't worry, prosecutors will use broad discretion while enforcing it and only enforce it on the right sort of people" to be very, very disquieting.

It's how you get war-on-drugs-level legal atrocities.

Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.

And those defaults must be changed. GDPR rightly forces businesses to reconsider hoarding data because it “might be useful sometime in the future”.

With GDPR most businesses still hoard as much data as they can, then work backwards to find a plausible excuse like debugging or customer support.

That's technically an enforcement problem though. Hopefully one day regulators get the skills they need to see through this bullshit.

Logrotate is part of a lot of defaults (eg: Debian) and keeps only a few weeks of logs.

Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted.

GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights regardless.

Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff.

(Cookie banners are the most obvious example of this. The businesses say “our hands are tied, the EU told us to do this”, whereas in actual fact the EU more told them to stop doing the storing and collecting. And very few cookie banners and such actually comply, and they made them a much bigger deal than they should have legally. All up there was very clear intent to poison perception in many cases.)

I agree with all your observations. Enforcement actions will slowly nudge businesses into compliance, but this will easily take another decade. It takes a long time for the law to solidify in the courts.

If you're trying to regulate a bunch of bad actors, and you don't anticipate that they will try to game whatever regulations you come up with, you are not doing your job well.

Sure they should have and probably did expect that there would be bad actors. But should they have expected that pretty much all businesses and even individuals would rather make their users miserable than give up tracking them? Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected?

Also, a lot of the problems are not bad actors finding ways around the law but straight up violating it. The most prominent example is the consent bannes that try to discourage the deny option in various ways. The lawmakers did anticipate that kind of maliciousness and made sure to disallow it. What is lacking is mostly enforcement, and that is not something the lawmakers control.

> Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected?

Yes, emphatically. It's a one-time change for the admin that allows them to maintain the status quo, and they don't visit the site as often as users do.

They always were liable. But of course, people would have to show they were actually harmed in some way by being “tracked”. GDPR makes it illegal to collect data that doesn’t cause any demonstrable harm to anyone.

What I miss the most, and where the most damage to the net has been done so far, is in terms of whois. Without WHOIS it's become near impossible to contact people. Before you'd find an interesting domain, whois, email 'em up. Now that GDPR has made whois illegal, or a high enough legal risk that registrars are chosing to turn it off, there's no way to contact any arbitrary domain. It's made the web a lot more impersonal and corporate.

Eh, I never had much success with at least corporate whois email addresses even before they started being effectively removed (by registrars masking them, years before GDPR). Even addresses like postmaster@ which are mandated by the SMTP spec (RFC 5321 §4.5.1 and other places) don’t tend to work.

WHOIS was next to useless for getting contact information prior to GDPR thanks to every domain register defaulting to 'free privacy protection'.

I don't consider it a loss that there's one less place my phone number and address is posted online.

This is wrong. Look how whois works on .eu domain.

Reply on news.ycombinator.com