skysight-inc/HackerNews huggingface dataset:
Dont panic. Panic when you get something like this.

https://www.linkedin.com/pulse/nightmare-letter-subject-acce...

Bottom line, DONT store/sell/mangle with personal data of your users unless you are able to fulfill this. I was thinking a bit about having an online store:

- make login as it is on Hacker News, you dont need email

- once user has selected and payed the goods, request sending address and contact (phone/email/whatever)

- ship it, print the requested / store into cold store (it is not that hard, you do it for bitcoins, right?), delete everything except username and password (and maybe the attached goods) from server

The described process will pass the GDPR Nightmare Letter in 10 minutes (to write a general reply) that you sent to everyone requesting.

This is what traditional "physical" stores do, not the large chains, the traditional, one employee, family store. And it works.

For everything else require consent, including tracking, but think very hard if you need anything else as it will complicate your business progressively.

I really dont understand all the fuss about the GDPR, if you explain (and prove) this to ICO, I would really like to see who will punish you for that.
Yes, common law and civil law systems have been converging to some extent. In common law systems you have increasing reliance on statutory law while civil law systems increasingly make use of precedents. Still, the basic principles remain.
Thx! Perfect succinct explanation, including 'so why is the disc of dust flat' question that immediately followed!
No, but legal compliance in most of the EU doesn't work by slapping huge fines on people either - first you are told there is a problem and you'll be given a chance and maybe assistance to become compliant.
The GDPR is not completely new, though; it's a reformulation and extension of the existing Data Protection Directive, which was implemented back in 1995.
> this particular one has the interesting side effect of causing mass hysteria in the otherwise rational tech sector.

* Y2K

* Dot Com hysteria

* Dot Com crash hysteria

* AWS outages

* Will robots replace us ?

* Will Microsoft crush me ?

* Will Google crush me ?

* I just raised £30M series A, where my Aeron at

* Nosql means I can throw away everything I knew about databases

* Web first

* Mobile first

* XML everywhere

* OO everywhere

* Javascript everywhere

* AI everywhere

Where is the evidence for rational behaviour ?
manager (verb): becoming a java class
Yes. Just came here to say that the linked to site appears to be a content aggregator and that the original article is here: https://www.timeshighereducation.com/news/sweden-cancels-els...

Superb news though, couldn't happen to a nicer company.
As per the article, GDPR does not enable you to sue the company.

> What the GDPR allows private individuals to do is to contact their regulators and to complain if you decide to ignore their requests.

The individual will not receive a payout from a GDPR violation.
It's an existing, rarely-used feature. You can try it in your browser!
Monal is an XMPP client running on user's iOS devices. Is that person even running an XMPP server for those users?
Facebook is alive and well, at least for everyone who uses it on a daily basis. The mass users of Facebook are not the least worried about the negative effect of social networks and those who actually left after recent events are not enough to affect those statistics.

Probably what's hurting it the most is the new users count, as I think that nowadays new users pick other social networks to hang out with their friends, such as Snapchat or Instagram.
Maybe this is not a security vulnerability, but a feature, intentionally put here as a backdoor. This would not be the first time such behaviours are observed.
Brthet
You wouldn't download a car...
Suit yourself. But as mentioned elsewhere, the equivalent of GDPR has been law in Germany for over a decade, and small businesses have had no problem complying.
> in the spirit of the good natured enforcers at the various data protection agencies in Europe

Is this serious? Why would we assume enforcers to be good natured if they benefit from fines. Or to assume they would stay good natured, even if you have the most perfect humans there now.

It's far more likely that the EU is creating tools to prevent disruption and manipulate markets. The template will likely be followed elsewhere, effectively elevating the state's data collection abilities over all other organizations.

Note, Bitcoin does not seem compatible with their laws.
https://pawelurbanek.com/gdpr-compliance-blog-rails

My take on GDPR compliance from a solo developer perspective without a legal team to back him up.
The onyl change you need to make is to be able to delete information about criminal offences when those convictions become spent. Arguably that's not a new requirement, but GDPR does make it clearer.

> I have argued above that I legitimately need interview notes for the operation of my business.

That's the point. You're keeping data to comply with a law (Equality laws) or for legitimate reasons, and so you don't need permission and you don't need to delete it when asked.

https://gdpr-info.eu/art-6-gdpr/

> Processing shall be lawful only if and to the extent that at least one of the following applies:

> processing is necessary for compliance with a legal obligation to which the controller is subject;

> processing is necessary in order to protect the vital interests of the data subject or of another natural person;

> processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

> processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Any of these would suit.

https://gdpr-info.eu/art-17-gdpr/
Printing is significantly cheaper than a subscription to an Elsevier journal.
Digisexuals: Number of People Who Prefer Sex with Robots to Surge, Find Experts
The EC2 User Guide includes documentation on how to avoid these issues:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nvme-ebs...

No need for a kernel with the default set - just put it in your kernel cmdline options in grub. Make an AMI with the change after that, and you're good to go.

Edit: My apologies. I didn't read your comment carefully enough, and didn't realize you had specifically called out needing to make these changes, and that older kernel versions had the 255 maximum. Leaving the above for posterity, and so people can notice I'm a bad reader :)

Did you see these issues even with it set to 255? That seems like it should have been enough timeout if everything is working normally. Perhaps small GP2 volumes that are out of credits with a large queue depth might see this? I can't say I've run into it yet.
I could not agree more
Wasn't the main selling point of Facebook originally that you couldn't do flashing animated geocities crap? I remember that being the reason I signed up, most of my HS friends had no business doing web design. Once they opened it up beyond ivy-league, it didn't seem to have any particular status, having a Gmail account was arguably harder (I had to get lucky getting an invite off /.).
Some entity runs a webserver. This entity has a legitimate business purpose in retaining access logs for e.g. 3 months for e.g. spam and security reasons. This entity just has to document that.

This entity can allow a 3rd party service to access these logs so that 3rd party can do whatever needs to be done if it is within the reasons the entity gave for having the data.

What neither can do is go use that data for anything other than the said purposes.

And if the given reasons are gratuitous and somehow the regulators notice, expect to get a nastygram and have to comply or face fines.

Basically what you can't do is collect data for longer than you have a legitimate need for, or cash-in and sell data you've collected. Basically, all said and done, just don't be sleezy and you'll be ok.
You are trying to justify a coup. A coup by a minority of the population that has a distorted view of history as a result of years of astroturfing.

So if applying the law is "crushing a political movement", let's crush it all the way. Nobody is above the law.
Yes I'm sure enforcers are looking to fine Bitcoin.
Adderall too
I signed up for ghost when it was at its kickstarter phase.
I was very excited by the promise. A year later there were still long winded discussions taking place on their github issues on how they should tackle responsive images.
There were alot of JS hacks around to overcome their missing features. I lost interest over time
I think this is a common misinterpretation though because of the lanauge - that the maximum fine is actually the minimum, because the figures that are talked about are "€20m or 4% of global turnover, whichever is the greatest." It's the emphasis on "the greatest" that has an undercurrent of "we're going to fine you the maximum of these two numbers."
You don't wake up suddenly in a totalitarian state. Total surveillance is one step away and once the infrastructure is in place it will be used. Commitment to basic values of privacy and human rights has been reduced to posturing against others and denial about what is happening at home.

Untill there are proper protests and pushback the creep will continue and the useful idiots and the ignorant will continue to muddy the waters and dilute the threat only to slink back into the woodwork once the real consequences become visible.

And with all encompassing surveillance even organizing protests and dissent will become difficult without the kind of sacrifices most people are unwilling to make. Just today there is story of a guy getting a knock on the door from the police [1] a few hours after posting about eating mushrooms on facebook.

[1] https://munchies.vice.com/en_uk/article/gykbe3/cops-show-up-...
,ghfdg
I'm sure there are plenty of bad actors who will keep spamming regardless. Thankfully those ones seldom get through my spam filter - so barely trouble my consciousness.
Many companies fell despite having many smart people working for them.

I would say every semi-big company probably has many smart people working for them. That does not prevent them from doing very stupid/bad/evil things, and sometimes disappearing.

The fact that they anticipated the move does not mean anything regarding their future, just like Kodak with digital photography for instance.

Taken differently, maybe you see a tsunami coming from very far away and are able to even calculate how strong it is and when it will come, but that does not mean you will be able to save your house in the seafront ;)
Authoritarianism is the only way to protect the people from runaway capitalism. Juncker is a good leader - I never understood why Americans/Anglos think that "Authoritarianism = BAD".
This is how I understand the GDPR:

You cannot store a users personal data like IP
or cookie id unless you have consent from the user.

I expect that nobody will comply with this.

Smaller companies seem to think GDPR is something they can fix by changing the legalese in their impressum and privacy policy. "Yet another trip to the impressum generator".

Bigger companies seem to pretend they misunderstand the GDPR. I got emails and popups from Facebook, Twitter, Instagram etc informing me about all kinds of nonsense about how they changed their policies and asking me all kinds of unrelated questions about what kind of ads I want to see.

Not a single company asked me for permission to store my personal data.
I still hear 'yanny' even with the slider all the way to 'laurel'
ECJ rejects US request to intervene in Apple State aid case against Commission
What an absurd straw-man argument. Nobody ever claimed fluoride solves all dental problems. Or even half of them.
1) Respond to requests about removal of personal data, do not sell data, inform about data leaks and handle them, if outsourcing, check compliance.

2) Any item that is not legal there will be just void in court. You cannot be sued about an invalid legal policy, but only after breaking the law. The policies do not subsume law.

About the only thing you need to publish is which data is collected, how it is processed (and by whom if outsourced), for how long (if applicable) and how to remove it.

3) Uh, as usual complying to the law for PII handling?

4) Yes, if they are GDPR compliant. Make sure to put them in you privacy policy.

5) Yes, if the source is GDPR compliant.
I don't see anything imitating this website.. other than a technology based news feed and a similarly used name.

I used to browse a website called "hacker news" back in the late 90s / early 2000s, but I wouldn't go as far as to call News YC a copy of that.
+6+5rw6r
Found this with the same error message, would be interested in others experiences. An old forum posts suggests malware: https://support.mozilla.org/en-US/questions/1024043 but I have done a complete scan with Malware Bytes with nothing found.

* OS: Mac OS 10.13.4
* Browser: Firefox 59.0.2
* Network: Various from work, VPN, domestic internet in Switzerland

So far I haven't found any way to reproduce this error but it does happen sporadically and seemingly randomly - will try and keep a list of sites this appears on below:

* news.ycombinator.com
How he thinks this house of bureaucrats will be able to judge that John Does complaint has any merit?

The same way judges can throw out a case without going to trial. Checking if the complaint makes sense, if it represents an actual violation as described, etc. Anyone dealing with the public knows that a huge chunk of the complaints don't even pass that bar.
Mobile OS have much better isolation between apps than Debian has. In default Debian configuration any app can access all of your data, microphone, webcam, Internet, GPS sensors etc. While the maintainers do a good job reviewing all of the software, having isolation on OS level provides better security.

For example, Chrome has process sandboxing. It might seem unnecessary because the code is written by highly professional developers, but it helps Chrome to be the most difficult to exploit browser. I am sure that if Debian could adopt something similar to Android permission system, it would make it even more secure.
I liked the functionality but found it hard to implement. Not a good sign.

Successful features are those that surprise in the easy direction (arrrow functions) rather than in the hard direction (proxies).
EBS is exposed as nvme devices on c5 and m5 as well, which is what I assume otterley is talking about.

Presumably the same applies to i3.metal as well, though I have not yet personally checked.
Because it is not a future feature, it exists for years now (I first used it in 2016).
That's not how it works. They don't send a guy to look at your databases.
Generally you wouldn't need any type of messaging to the handset for this. As the phone periodically reports the signal strengths of surrounding cells for the purposes of handover just taking a glimpse of this is enough to triangulate well.

As long as your phone is on your broadcasting. Indeed I think there are cases of tracing where the phone is switched off too, though not sure if they used historical cell data to guess at its location or there is some secret sauce.

But - as you mention, you require to have connections into an operator to do all this.
The Stuxnet worm may be the most sophisticated software ever written
How is the beep local root different from jail breaks in the past? Seems both are local privilege exploit, and I recall seeing that iphone has had a long list of those in the past.
The value is in forcing you to keep it in mind. You don’t forget about things you have to do every 3 months as easily as something you have to do every 10 years.
Clearly an emotional topic. The fact remains, GDPR is a well-meaning but fuzzy law, with implications that cannot be foreseen at this point in time.

To remove some of the uncertainty and automate some of the compliance steps, we built a data discovery AI tech that scans corporate data to answer:

* "Do we even store personal information?"

* "Where do we keep it?"

* "How do we make sure PII is consistently stored only in the designated places?"

This may seem trivial to a micro-business that runs on a handful of database tables, which I think is where the author is coming from. But for larger companies, even understanding what's where and why (backups? emails? cloud storages?) is a highly non-trivial—if ultimately rewarding—endeavour.
The past submission example is not very good. There are no screenshots in it. Also, if you're emailing people you could just BCC the guy who ordered the package.
The less you know, the more likely all those things seem. People who know nothing about chemistry believe you can make a car that uses water or air as fuel (but big oil is suppressing it). Children wouldn't be the least bit surprised to learn that momentum was not conserved in space or in nuclear reactions or in aeroplanes because they didn't even know it was supposed to be conserved in the first place or that those things were known to follow the same laws as their toys.

So I think being skeptical of accepted physics in any specific way isn't something a layman has much business doing. Of course there will be things we think we know that turn out to be wrong, but a layman can see such things everywhere, not just the places they will actually appear.
For people and businesses in the EEA, the GDPR is much less of a change, because we already had to comply with data protection law. The rest of the world may be less prepared.
> I don't really see what's special about this law

The key change is the fairly explicit punishments and apparent intent to hand them out for non-compliance. A lot of older regulations get considered by companies but the issues relegated, officially or otherwise, to "yeah, we'll apologise and fix that when someone notices" which might not be a good way to manage the risk management after next Friday.

> ... might feel like "I run a small site on a Digital Ocean droplet and I'm at risk of a €2m fine out of the blue." But that doesn't make it true.

Exactly. A lot of the unhelpful hysteria is being drummed up by consulting companies trying to sell there services to help others assess and/or manage their GDPR compliance: they are stoking the fears to improve sales.

The rest is coming from people who don't want to lose control of some of what they consider to be _their_ data. From a business perspective this is usually "I've collected it or pad for it, I should be able to keep it / sell it / use it, this is unfair, wa waa waaaaaa" and from a technical perspective many of us data people have flinch reactions to any idea of hard-delete or un-rollback-able update operations (they are not really impossible to rollback of course, anyone sensible is building considerations for backup retention policies into their procedures, but rolling back is less likely to be simple and can only be done during that retention window).
What were your problems? I on the other hand found it very intuitive.
Top Movies for Programmers
Please actually read the law before you try to argue with “as a...“. The fine scales with the violation and it does -surprise- not mean that arbitrary Github projects will have to pay 20m€...
You're misunderstanding my post, so I'll try to put it another way. Suppose I tell you I have proof I created a perpetual motion machine. You'd probably laugh me off as a crank, or at least demand an extremely high level of evidence, to even listen to me.

The EMDrive breaks the known laws of physics as much as any potential perpetual motion machine would, so for it to be correct would imply as much is wrong as our knowledge of physics as the existence of a perpetual motion machine would.
I am concerned that the effect of this legislation on the private individual is the opposite of the stated intention.

People are being forced to sign agreements which jeopardise the natural rights to their data which they would otherwise have.

One example: a friend who has a very pretty daughter was asked by her school to give them the right to film her and to use any and all such recordings as they see fit for 50 years even after she leaves the school.

This feels very wrong on just about all the conceivable levels.
>A programmer's job is to get the computer to do what you want, not somehow model the world

This so exactly mirrors an ongoing debate in cognitive science. Programmers and philosophers should be talking about representation versus affordances and situated cognition. Actually I suppose the same thing goes back to Chomsky vs Skinner.
Alan Watts – Silence Is Key
Nice post.

Typo: "food safety laws" is listed twice in the bullet points for the lemonade stand.
You mean request to be forgotten? Are you seriously lacking an automated removal process if you have more than a thousand users and also can't keep it in a three month deadline?
Oor is it collecting so much data that you cannot just send it all to the requestee?

If it would take a decade, then it is a broken business that should cease to exist as it is doing something illegal with the collected data.
What kind of business is it?
There is no such thing as a “non-identifiable” email.
You cannot use ToU to bypass GDPR.
Yes, same here. BUt there is an obvious bias for one of the sounds. I can head yanny all the way to the left side if I step through it slowly. I can only hear laurel until 1/2 of the yanny side. A cool effect happened when getting at an "edge point" where I could hear both laurel AND yanny at the same time.
Cost of maintaining my pictures and videos is tiny, as is cost of maintaining Wikipedia (relative to its users). Simple VPS for $1/month is enough for me, and with economies of scale, I'm sure that it's few cents per user at most. Wikipedia has no problem getting enough donation to continue its work.

I like the idea of P2P social network, but honestly I think that there's no problem to solve in the first place. While distribution of huge video files and music files is a problem and torrents solve it, that's why they are popular. It's not easy to host terabytes of video with thousands of downloads. But it's trivially solved with torrents.
For record "personal data harvesting not yet disrupted with blockchain" constitutes a clearly defined problem in this instance.
Link-Building Checklist
No, there's nothing in the law about EU citizens. It's only about people in the EU.
Worst case is he really is selling personal data to third parties, and does not want to risk any fines from the EU because of it.
From a German perspective not much has changed: The core concepts "as minimal data collection as possible" & opt-in for more, the right to ask which data a company has about you and the right to make them delete it are established law in Germany since at least 2009 if not 1983.
Thanks for this post. I appreciate that you took the time to write this guide.
If the penalties were exact and written into the law then companies could simply make more from your privacy data than the fine they would have to pay. That would have the opposite effect of the law. Adding a clause that the fine is discretionary gives the enforcer the ability to adapt to this sort of behavior.
Good article, but please fix the site.

The stars for certain text will cover text in the article making some things "hard" to read.
Please read my comment above. In my own field, none of our respected journals are produced by Elsevier (or a similar for-profit publisher). The non-profit learned societies that do publish our journals provide the PDFs free of charge, and for the paper copies they charge libraries only the cost of production – which also makes it possible for even individual scholars to often buy their own bound hardcopies.