fcbrooklyn

Yeah, I did all those things as well. They were essential. And yet I would say that at least 50% of the bugs we ran into were either buffer overflows, stack overflows, using freed pointers, not freeing pointers, or incorrect pointer indirection. At least we didn't have to worry about race conditions.

I don't think they mean "old" programmers exactly... more like "programmers back in the day". We just didn't have the quality of tools back then. Also, our machines were orders of magnitude less powerful, which meant we generally had to work with a lot less in the way of things like library support, frameworks, etc. I used to have an OS/2 box as my build machine. I think that box had 32k of RAM, and 4.7Mhz processor.

I was there. We had plenty of those kind of problems in those days. I also had the classical training of which you speak, but the industry was far ahead of academia in terms of actually dealing with that kind of thing. The reason pre-internet is relevant is that the penalty for a buffer overflow in 1995 might be a crashed app, or maybe a corrupted file. It was only later that the penalty became "getting pwned by some sophisticated bit of malware and needing to send monero to someone to get your compter back".

Other commenters have noted that businesses don't have the governments monopoly on the use of force, but also worth noting is that if a business chooses to treat you poorly, you can (usually) select a competing business. Not so with the TSA. They have a monopoly on security at all US airports (I think. Perhaps smaller airports are different?)

So, imagine you're running a free service as a side project. And the state of Idaho introduces a law, that has federal teeth, such that if a resident of Idaho might use your service, you must register with the state of Idaho. Would you be happy about that? Is there any possibility that you might decide to simply block Idaho rather than deal with the hassle?

A better solution would be a webpage, hosted by the state of Idaho saying "Here's what we're after, don't do these things, and you're in no danger." Followed, hopefully, by a list of things that you weren't planning on doing anyway because you're not a jerk, and that are crystal clear so you don't have to speculate about how selective the attorney general of the state of Idaho is in prosecuting these sorts of crimes.

Still in the dark mate. I'm sorry, maybe it's me, maybe it's you, but we seem to be speaking a different language.

In fairness, this story is consistent with my own (limited) experience dealing with EU law. A few years ago, I was trying to determine if an EU based company I was advising really needed to offer the now-ubiquitous cookie advisories. I met with some very high profile (and very expensive) lawyers, who told me that although I technically needed to include the various popups and advisories, I was not in any real danger, because of selective enforcement. Eventually, they changed their mind and we added the sliders anyway, but for a time, the law was stricter than the actual enforcement.

But I was an american being advised by a top tier british law firm. How is a random guy releasing free (or cheap) services on the internet supposed to deal with a situation like that? The arbitrary nature of the enforcement is exactly what makes this a problem. If there were strong penalties, but clear ways to remain in compliance, this developer might have made a different call.

If I know I'm technically out of compliance, and I don't have a high powered lawyer telling me it's not a big deal, then I'm not sleeping well. And if I can solve the problem once and for all by taking the unfortunate step of simply cutting EU residents off of the service, then I'm going to at least consider that option, and probably take it in the short term.

If the EU wants to reassure people that "The regulators send a letter asking you to come back into compliance unless you've been really bad. They only move to fines if you ignore them." then they would be well advised to make that very clear. If they don't, you're going to see more of this, and really, if it's true, why wouldn't they?

Actually, I'm pretty sure they still stick the toys inside the eggs everywhere except the US. Perhaps a European can correct me on this assumption.

EDIT: Turns out the US-style kinder eggs are indeed available outside the US.

Ah yes! That's the one. And he owned it but could never drive it on public roads. Thanks very much.

Apologies, I genuinely don't understand this critique.

I think you'll be fine, and I wouldn't worry too much about it, but technically, it's against the rules. (As a thought experiment, suppose I knew what apartment building you lived in, and I actively hustled up potential tenants, maybe I even posted ads. I'd send 'em over to you, and you and I could split the fee. At this point, I am acting exactly the way a licensed agent would act, and the whole reason for having the license would vanish.)

Yes. Rather a step back from the original offering isn't it? If I'm being honest, I couldn't give a damn about the kinder eggs prohibition, as I am not a child, and I do not have children. The Bovril issue is by far my biggest personal concern, although I'd really like to be able to buy raw milk cheese.

There will be a cost involved. And presumably there will be some benefits that result. Those are precisely the parameters of OP's decision.

Bovril could easily comply. They would simply have to open a manufacturing facility that did not use UK beef. The French cheese makers could sort of comply, by pasteurizing their milk. Kinder, I admit, has a more difficult problem, and has, in fact attempted to comply, by creating a completely different product with the same name.

Indeed. And the prohibition on raw milk does not ban cheese. Many cheeses from France are still available, because they do not involve raw milk. The EU has passed a law, perhaps it is a worthwhile law. This is one of the consequences. The ban on raw milk in cheese making exists thanks to (presumably) the best intentions, and the end result is that there are many cheeses I would like to buy, that I cannot. An American (unlike me) who supports such a ban rejoices in the fact that we are protected from these dangerous french cheeses. Perhaps you rejoice that you are protected from the dangerous GDPR non-compliant Monal.

It is impossible to sell raw-milk cheese in the United States. Are French cheese makers overreacting by simply choosing not to do business here rather than change their centuries-old production techniques? It is illegal to sell kinder eggs in the US, because of some law that involves children accidentally swallowing toys. Is Kinder overreacting by refusing to sell those candies here? You cannot buy Bovril in the US, because of a panic about mad cow disease from 20 years ago. Are the manufacturers of bovril overreacting by refusing to create a separate production facility that uses only beef sourced from outside the UK? Compliance with laws outside your primary market has a cost, and potentially a benefit. Every business, large or small, is going to do that cost-benefit analysis, and make their own decisions. As an american I can hardly blame the Kinder people for failing to provide me with convenient access to chocolate eggs containing plastic toys. It's my government, and the laws they've put in place that have had that effect.

They vary wildly. Some states (washington used to be this way when I lived there) don't require insurance for motorcycles at all. But yeah, private companies can often make their own rules.

Yeah, for "specially constructed vehicles" that safety inspection is extremely minimal. For a production vehicle, the requirements are much more extreme, and cost millions to comply with.

Yep. You could totally sell it, and in fact that's exactly what Boss Hoss motorcycles does. I believe each vehicle has to be unique, or something. Not sure where the line is between these custom vehicles and "production" cars, but it involves the scale of the production. Exactly the kind of exemption people are suggesting for the GDPR.

You have pointed me to the entire content of the GDPR. It's 11 chapters, with 99 articles. I'm unashamed to admit that I don't consider even skimming such a document "easy". I was imagining something more along the lines of a one pager with 4-8 bullet points, each of which was easy to address.

The indicators are a tiny subset of the actual requirements involved in a production vehicle. In fact, there are examples of European production cars that can't be street legal in the US, and the companies involved chose to simply not sell them here. Smart cars were impacted by this for awhile (no crumple zones), they eventually dealt with the problem though, and as I recall there was a production ferrari that couldn't be driven here because ferrari chose to simply not sell in the US rather than conduct two crash tests or something like that. Can't recall the details.

TIL in some states they do emissions checks (although in a lot of states motorcycles are totally exempt from those anyway). And no, they don't do safety inspections of "specially constructed vehicles". And based on the ones I've seen, I can't imagine a world in which they'd pass. [1]

[1] http://bosshoss.com/supersport-bike/

Your first two examples are cute, but your third has the unfortunate side effect of undercutting your argument. A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights). There's a crazy subculture around building bikes that would never in a million years pass muster as production vehicles. (let's drop a chevy small block into a harley).

Interesting, and a sensible exception. Like I say, the rules on this are sure to vary substantially from state to state.

Typically (but not always) the complaints about this kind of thing come from people who believe they've been discriminated against, but in fact pretty much anyone can complain. In NYS, you can call the DOS and register a complaint for pretty much any reason you like, and they are pretty consistent about investigating all of them.

Actually, it might be more subtle than that. Simply referring someone to your landlord might be ok, but if you discussed anything at all about the property with that person, I think you'd definitely be in violation the moment you cashed the check.

Probably, yes, although as I said it would probably never be enforced. To be clear, your landlord is not the one breaking the law. Anyone taking them up on the offer would be though.

IANAL, but I was a licensed real estate agent in NYS about 15 years ago, and this was covered in the course materials.

Every time something like this comes up, we see similar objections. They normally take one of three forms:

1) You are overreacting. The EU isn't going to come after some small fry operation, or some non-business entity.

This is an easy thing to say when you're not personally exposed to the risk. Would advocates of this position be willing to personally indemnify open source projects / side projects against GDPR enforcement? I suspect not, but perhaps there's a business opportunity in giving them the opportunity to do so. Sort of a GoFundMe for peer-to-peer insurance.

2) The GDPR is all about not being a jerk with your users' data. As long as you don't do that, and do relatively minor things X, Y and Z, you're totally fine.

This flavor of argument might actually be true, but if I'm assuming the risk I'm probably going to want to hear it from someone with skin in the game, like a lawyer, who I can point to if it turns out to be false. Even if I had the desire to read through the law (I don't) and understand the specific implications for my project (I wouldn't), the very act of doing this represents a cost that I could more simply avoid by excluding EU residents from my service. I'd choose the latter path every time, and put "support EU residents, check into the legal implications of GDPR" on the roadmap, for "someday".

3) You're exposed to millions of risks anytime you do anything. This is just one more and you're making a big deal of it.

Often this accusation comes with a subtext that you're trying to prove some political point, suggesting that you're making a decision in bad faith to "punish" the EU. Well, I personally think something like the GDPR is needed, and have no particular axe to grind, but I also have no idea if the legal exposure is serious, and no particular desire to put in the work to find out.

Yes, business, or really any activity, involves legal risk. In this case though, the risk is pretty serious, first of all because the penalties (20M Euros max) are serious, and secondly because it will be very difficult to claim that you've never heard of the GDPR. If Tonga creates some law impacting side hustles on the internet, at a minimum I can credibly claim to be unaware of that law. The GDPR on the other hand has been all over the news for weeks. I've clearly heard of it (especially now that I've commented on a discussion of it on HN).

My feeling is there's a real risk that this law will lead to a general practice of non-EU individuals, and non-EU startups launching MVPs to at least temporarily block the EU to avoid unnecessary risk. That's not the intended purpose of the law, but laws have unintended consequences all the time. If the EU wants to avoid this unintended consequence they should provide a clear, objective, and cheap (in terms of both time and money), set of instructions that will allow projects like monal to continue operating there. If such a set of instructions exists, I haven't seen it.

I'm not sure if it would matter, if you were just doing this as an individual once or twice, but it's worth noting that in New York State, at least, this would be an illegal transaction, unless the tenant referring you to their landlord happened to be a licensed real estate agent. The definition of brokering a transaction according to state law, for which you must be licensed is that you're facilitating the transaction "for another" and "for a fee". The $250 dollar reward, therefore makes this an illegal act on the part of the existing tenant. Laws might well be different in other states obviously.

He said the _site_ doesn't make money. He might make or have money from any number of other sources.