cdjk

Nope. Look at article 37:

https://gdpr-info.eu/art-37-gdpr/

Are you a large scale data processor of special categories of data as defined in Article 9? That includes data that can be used to determine racial or ethnic origin, health data, and data about sexual activity and orientation.

Large scale is helpfully not defined anywhere.

So if you run a site around a health condition or that lets people specify their sexual orientation some place you might need a DPO.

Do you set cookies that are not functionally required for the site to operate? Have to allow opt-in and opt-out of those cookies. Adsense cookies almost certainly fall into this bucket.

Do you set cookies that are required? Need to identify them and inform the user.

Server logs? You probably have ip addresses. Despite what us nerds think the EU considers them personal data.

Affiliate links could be between the user and amazon. I’m not super familiar with affiliate marketing, but you’re right it probably depends on if the cookie is set when the page loads or when the user clicks on the link.

A reasonable approach that we're following is to have a documented backup retention policy and a procedure to re-delete data for any users who have asked to be deleted when those backups are restored. That retention policy can be longer than 30 days as it's impossible or infeasible to delete individual user data from all the backups.

One easy way to do this is with an expiration policy on s3 objects. You need to have an independent backup of those deletion requests though.

If you have a years-old tape archive you probably have a massive legal team who is much better equipped to answer this question.

It's more complicated than that.

Want to host the data on aws? You need a documented data processor agreement with them. Same thing with cloudflare and any other service you might want to use.

Want to use google analytics or some other javascript? Those cookies aren't required so you need a way to let users opt-in to using those cookies. And opt-out and delete any third party cookies. I'm still not clear on how the regulations expect you to delete third party cookies.

Amazon affiliate links also aren't necessary to use the service, and that sets cookies. Have to get consent before users can click on those links.

Don't forget that ip addresses are considered personal data.

And all of this might have to be written down and documented per Article 30 as well. The organization is smaller than 250 people, so that might be an out, but people are using the site daily so one could argue the processing is not occasional.

Most companies seem to be setting up GDPR portals to download/delete all your personal data. I'm waiting for the breach of one of these portals - that will lots of fun to watch.

What would have happened if PGLAF had just ignored the lawsuit? Since they have no presence in Germany what could the German courts have done to them?

Not in the volumes Buffett is interested in. And they are quite sketchy compare to regulated US financial markets.

I’m planning to set up a separate heavily filtered kids vlan/wireless network. I’ll leave some vulnerabilities in it so if they want unfiltered internet access they have to get it themselves.

I’ve seen three in the last few days and I haven’t spent much time driving.

They have one at the Compute History Museum, although it’s behind glass. It’s worth going here for everything else they have too - try to go when they have an IBM 1401 demo going.

I think the more interesting issue is the 2600 put options at $135 that were purchased on Aug 21:

https://www.cnbc.com/2017/09/08/suspect-trading-in-equifax-o...

I wonder if the 2600 number is significant or just a coincidence.

How many open PRs do you have targeting the branch you're merging into it? We heard through the grapevine that there are serious performance problems if you have more than 60-80 or so.

The solution for us was to decline those old PRs.

I've tried using commercial radios before, but the biggest annoyance is the difficulty in either 1) getting programming software and 2) actually using the software, which usually has an atrocious UI.

At least with a purpose-built ham radio you can enter frequencies directly on the handset, even if it's a pain. Although the programming software for them is almost as bad.

It's possible to make it a little shorter. There are at home sleep studies, and the modern machines are usually have an auto mode that automatically adjusts the pressure, which typically eliminates the need for the titration study.

Trying to get a CPAP covered by insurance is a pain, but if you have a prescription you can get one online and pay for it yourself - the same is true for supplies.

Also, there's tons of interesting data you can get off the machine, if you get one that's data capable (you really, really want one that. Take a look at the program sleepyhead:

http://www.sleepfiles.com/SH2/

Monitoring things yourself with your own data is really the way to go. It makes the sleep data you get from a jawbone/fitbit/etc look extremely minimal.

Or Wizard's Bane by Rick Cook, where a programmer gets summoned to a fantasy world and writes a magic compiler in forth.

So isn't that a criticism of domain-validated certificates? This is a serious question. I haven't heard a compelling argument for how DNSSEC/DANE gives governments any more power than existing DNS delegation.

Why would they be removed? If the CA correctly follows all of their procedures and approves a domain-validated cert, why punish them for approving what is a legitimate request?

If the CA is coerced into issuing a cert, however, I agree with you.

I've never understood the criticism that DNSSEC places control of TLS keys with governments - it seems like they already have that control. For example, Libya could change the dns records for bit.ly and get a certificate. I suppose an EV certificate with offline verification might help that, but you could use those with DANE, but DANE doesn't seem any worse than domain or email validated certificates.

I'm disappointed the Pixel Qi screens haven't become more popular. Sol Computer (http://www.solcomputer.com/) makes a few devices with them, but they're overpriced and underpowered from what I can tell. Otherwise their sunlight performance would be great.

I tend to put /usr/local/bin ahead of /usr/bin on my $PATH, which nicely solves that problem.

Unless you have enough income to be over the Roth IRA contribution limits and want to make yearly backdoor Roth IRA contributions (non-deductible traditional contribution followed by a rollover to a Roth IRA). If you have a traditional IRA there can be some tax complications due to the pro-rata rule. If any traditional contributions are instead in a 401k the conversion is a lot simpler, and tax-free.

The other way around it is to open an individual 401k if you have any self-employment income, but that involves a bit more paperwork than an IRA.

The book "A Random Walk Down Wall Street" by Burton Malkiel is an excellent place to start.

There's a question I've had about the citizenship for "investment" programs. It's frequently framed as an investment, not a sale [1]. That seems to imply that there is a chance of getting your money back. So could one "invest" the required amount and then sell the investment a few years later, keeping the citizenship? Or are the investments things that are not particularly liquid, so you're stuck with it?

[1] Although it looks like St. Kitts has a donation option as well.

They already have with the neo-n:

https://www.yubico.com/products/yubikey-hardware/

It does cost a bit more than the U2F-only version, however.

The sensitivity analysis being displayed automatically is a nice feature, as it immediately shows the effects of changes. That's a clever bit of UI that most similar apps don't have.

I like bacon, but it's not my favorite food. It's also never triggered what I think of as a smell, like coffee does sometimes, and oranges have done a couple times. So I don't think I'm getting any of the aroma.

I'm the opposite - I'm a very non-picky eater, and always have been. Mixed flavors don't bother me either.

It's not impolite to ask - I don't mind answering questions about it. "Congenital Anosmia" is the correct term. It's fairly serious when someone loses their sense of smell, and can cause weight loss and depression. It can also be a symptom of some fairly serious conditions (e.g. Parkinson's).

For food - I prefer strong flavors (smoked salmon, capers, onions). Subtle flavors like spices are lost on me - basil, spinach, and mint all taste the same. Cheeses can be strong - I think I could tell the difference between blue cheese and provolone, but I haven't done an experiment. I'll have to try that sometime.

It is possible I have a very week sense of smell. I can kind of smell coffee, and there are a few times I've smelled an orange, but that hasn't been reproducible. My dog got sprayed by a skunk one time, and I couldn't smell that, so I think it's accurate to say I don't have a sense of smell.

I can "smell" things like vinegar and bleach, but I think that's the trigeminal nerve. I can't tell the difference between white vinegar and balsamic vinegar, however.

My mom can't smell either - nor could her dad.

Interesting - I don't have a sense of smell (and never have). I don't think I'm at risk of dying from that, however, barring an undetected gas leak.

Loss of sense of smell is fairly serious, though, so this isn't too surprising.