skysight-inc/HackerNews huggingface dataset:
> They can still target ads using the content of the page, assuming readers of the article will be interested in the subject.

Seems like a perfectly fair assumption to make given that the reader has actively chosen to read said content... Certainly moreso than repeatedly showing them ads for something they already bought weeks ago.
What would that be? In AWS everything is managed and the only time that you actually get near the OS are EC2 instances for some custom programs when you aren't using Docker/Fargate (serverless Docker) or Lambda and every now and then a few shell scripts.

Any complicated sceneries usually revolve around scripting AWS resources and for that I would use Python.
> Lot's of bars/beer gardens/shops can't take cards.

I suspect this allows many small businesses in Germany to simply under declare their income, along with avoiding the fees to the card companies.
Other legal requirements trump the GDPR data minimization. In that case you only need to provide that data when the user wants a data export.
I think the key to answering that question is derived in a supreme court case that is almost entirely unrelated to this.

>There is no basis in text, tradition, or even in contemporary practice (if that were enough), for finding in the Constitution a right to demand judicial consideration of newly discovered evidence of innocence brought forward after conviction.

Regardless of the merit of this claim in regards to what exists in text, tradition, or practice, it, in my opinion, shows that the legal system is effectively a huge game where the rules matter more than the concepts of which the game's existence is justified (such concepts are right and wrong, harm, guilt and innocence).

If you are about to be executed for a crime you were convicted of, but have evidence beyond a reasonable doubt of your innocence, that alone is not worth demanding judicial consideration.

If the rules by which we murder people in cold blood are less nonsensical than the most recent version of D&D, then what hopes does far more mundane and boring issues like patents have?
The grant is "sublicenseable and transferable".
But these regulations are not that complicated! Heck, in the EU we've been observing most of them in the last years already. Most things are really straightforward. Things get complicated when your core business is making users' data available to third parties. But it's not different from any other business: if you want to make money in catering for example, you need to read and adhere to relevant laws, too.
All devices with mics and cameras should come with physical switches to disable them. Even a couple of DIP switches on the back of the device would be fine.
Yes I believe that TOR will protect against state actors in the very similar way that leaks and investigative journalism protect against corruption and abuse. It increase costs where its too costly for the average case and for the super important and critical cases then the cheaper and more available methods are likely to bring results way before such costly attacks are even considered.

For example, if they want to know who owns a specific tor hidden service they could get the lawyers and higher ups to pressure amazon and microsoft to dump rams of all their customers (and manage all the secrecy so to not create bad PR), or they could just make a search on their vulnerability database and attack the website directly. They can also just put a well trained and experienced detective to find traces from the operators that they might accidentally make on facebook, stackoverflow and so on. They can have an agent go under cover or try recruit people close to the target. Each of those have costs and risk that is far cheaper than attacking the tor network, and having read a lot of stories in regard to the silk road, wikileaks and other users of tor it seems that this is indeed the primary way state actors operates.
Are you saying the free market doesn't apply to pricing for these services?
Web components are still trying to catch up with the components market that native apps enjoy since the 90's.

I guess we still need a few more years of catching up.
> but that won't stop people taking legal action against the website's operator.

The GDPR doesn't allow individuals to take legal action against non-compliant companies. It allows individuals to report companies to their local data protection agency.
Tough luck.

There is no fundamental right allowing tracking or advertising.

There is a fundamental right to privacy.
> I admit that things like server adminstration etc. have to become much easier, so that more "average" people are able to do that (and with this I do not mean: "drop another level of abstraction upon GNU/Linux").

Nah, they don't have to. Because the current setup works fine for regular users. It's principled, privacy-conscious/free-software-promoting power users like yourself that want them to care even though they really don't give a shit.

> But I know people who openly stop communicating with people who do not respect their privacy in terms of communication, since for example this means that these people are willing to extradite them to three latter agencies.

You must have some interesting associates, I've never met someone like this.
They can try, but there is specific language banning this in the GDPR.
Eric Schmidt says Elon Musk is ‘exactly wrong’ about AI
On my CentOS 7 system, there is no iproute2 package, but there is an iproute package. Neither 'man iproute' nor 'man iproute2' produce any man pages. The iproute package provides the contents of /etc/iproute2, among other things, so why is the package name just iproute? The man page for ip has the name iproute2 at the very bottom, where it is easily missed. It would never have occurred to me to look for either iproute or iproute2 for information on ip had I not come across this posting. A little consistency of naming, with better cross referencing, would sure be nice...
Yea, they cover that:

https://ico.org.uk/for-organisations/guide-to-the-general-da...
People have tried lots of other stuff in the last 10-15 years, it was not sustainable (micro-transactions never took off, subscription-based newspapers are the exception rather than the norm etc). I'm personally fine with newspapers like the LA Times collecting and selling my personal data as long as I can read articles for "free" on their website, I think it's a pretty fair deal.
I have no answer to this, but the targetted ad business has driven traditional news outlets/traditional ads out of the market almost completely, so I think it has no good standing to ask for protection. In fact, I think GDPR proponents will welcome the collateral damage to targetted advertising.
You are legally responsible for whatever your computer systems do, and you've always been.
Boaler work is all about children, so I interpreted it in that context. I mostly agree with you.
> Afaik Google announced last year that they stopped processing GSuite account emails to a large degree.

Well, that's surely reassuring.
What? You can setup log rotation in 1 minute. In 3 minutes you can write a small paragraph that explains you only use IP addresses for security reasons and only store them for a few weeks.

Also, the claim that you immediately get the maximum fine of 20 million euro for every small detail that you get wrong, is false: https://www.joyfulbikeshedding.com/blog/2018-04-17-should-no... (claim backed up by a book written by an IT lawyer)
So far I have received over 300 GDPR emails. When I am supposed to read all this? How do I track it? How can I track what each company stores about me?
Do I feel this in any way improved safety of my data? I don't think so.
Well we still have HN, even if non-compliant.
Ask HN: What kind of GDPR service are you most looking forward to?
GDPR has arrived and now we see websites going down citing concerns. So, which service you use on a daily basis is most affected by GDPR? And what are the biggest pain points for GDPR, which make you go - Hmm, someone should build an app for this?
Show HN: Online destination for Product Enthusiasts
I am looking forward to WebAssembly as the Flash revival.
Ever heard of FB start?
It also puts users in the mindset of starting to consider if their time on Facebook is worth $X/mo.
Who Is at Fault When a 4-Wheeler Hits a Truck? $90m Verdict Says the Truck
> What are people using them for?

In my case, keepalived VRRP floating addresses.
How is cash inconvenient?

Well:

- instead of just going to a shop, I now need to go to a bank, and then to a shop - I mean that's pretty obviously and undeniably less convenient for a start

- I have to carry a lot of little bits of valuable paper around with me - enough for an entire month of expenses in your opinion!

- when I pay I have to wait for them to count the money, gather up the change, return the change, which I then have to count, compared to just tapping my card and going

- I get no protections such as insurance for my purchases

I can't how understand how anyone can argue cash is more convenient!

And how can you possibly argue cash is faster? Paying by card takes 0.5 seconds - I don't have to even look at what I'm doing I just wave my card and go.

Your articles talks about arcane things like inserting your card, paper printouts, signing with a pen - you haven't needed to do that with cards for a decade or more.
A non-developer who has access to developers. A developer can be paid to write the widget, which would likely be cheaper, easier, and faster than paying a developer for every minor change. It really depends on context. In a larger organization, for example, the user might have access to plenty of developers but need to open a ticket and wait forever every time they need something.
Where is google and apple in all this don't they have the biggest mass surveillance programs on the planet?
Why would the customers use it? Because they get cashback/airmiles/... . Why would merchants accept it? Because high-value customers demand it (Amex is very deliberately positioned as a premium card for high spenders).
Tracking which doesn't result in any visible effect to the users is fairly harmless. The more concerning stuff involves handing the data to third parties like direct marketers and political campaigns. Those commercial relationships are a lot harder to hide and generate a paper trail.

"Why did this company pay you $x million?"

".. stuff?"
>> "offering goods or services"

IANAL but it would seem pretty obvious that any content a visitor might seek on a website would fall under the rubric of "services." It seems like a tough position to argue that since e.g. the Chicago Tribune doesn't offer subscriptions denominated in Euros, that it isn't offering services ("news") globally.

The only thing that today makes clear is that this law is a mess, and it will take a lot of litigation before anybody really knows what it means.
Hm, they must have changed how the site works. A while ago, I decided to simply skip any medium.com link posted to HN, because a) it was a crap experience reading on mobile, b) it was a crap experience reading with javascript disabled and c) with javascript enabled, the site was too annoying
Good luck downloading apps though. I can't see how it's necessary for Google to track all your stuff, just to permit you to download an app.
Ask HN: Assuming you have previous lives, what would you pay to know about them?
Let's assume that you've lived previously and have now been reincarnated, what would you pay to know and how much?
Turns out I'm very fond of the selection algorithm. I feel a weird satisfaction of becoming the hunter after years of being prey.
Creating the container or the image? All existing images continue to work and tools like docker build will continue to be used to build containers.

This replaces `docker run`.
The US Military Has Released a Mysterious Report on 'Warp Drives'
Hi so here is something to chew on . If the “new” system is so great why do I still need the old route command to deal with multicast routes ? Also the motivation to use the “new” bsd-ish style of poking the kernel is just half baked . It’s neither new nor well planned .
the certbot program for doesnt have a revert back. It seems to keep reverting everyone to https.

problem is not in .htaccess

I kinda want to know the lesson for the future? I upgraded from php 4 to php 7 without a problem.
One of the more pointless arguments I’ve gotten into on reddit was one where a guy in an investing subreddit was absolutely positive that as soon as oracle and ibm decided to take cloud seriously, aws would collapse as IT managers around the world would switch to what they know and love.

As if AWS was a mere experiment, and any day now the big boys would come in and show how it’s done.
IANAL

You do need explicit consent if you're trying to sneak something in the user wouldn't expect. So if you sign up for cat pictures but the service sells off your data to a dating service, that's surprising and requires explicit consent because the user can't be expected to give informed consent to that by just skimming your privacy policy.
What if someone else registered using his email (some websites for example don't send confirmation email if you change it in your profile or add additional email) or leaked data is fake? How that protects him?
I’m pretty sure Facebook can’t do that. The point of the GDPR, as I understand it, is to make control of your data a right which can’t be bargained away, much like employers can’t try to bargain away your right to sick leave.
I possibly would too; I wouldn't begrudge the more innocent revenue generation tbh, provided ads were sufficiently unobjectionable!
I agree Elon Musk is wrong. a corporate dis-utopia is way more likely than a robot takeover.
I stand everyday in a line waiting for Germans finishing their electronic transaction.

Cashless may have its virtues but speed is not one of them.
Is blocking a legal way to comply with gdpr? Surely you can’t identify all Eu-ians? Does the law just care that you made an effort to block them?
Ask HN: What can you do today that will be significant in 1000 years?
What about a million years?
I was chatting with my wife about something the other day and my android phone, from my pocket, randomly added to the conversation "That's good to know". O_O
Discrimination based on national origin in the Civil Rights Act pertains to US citizens and legal immigrants who are subject to the purview of US courts, not to foreign nationals living on foreign soil. The Civil Rights Act of 1964 pertains to employer and employee rights and obligations. It does not have anything to do with international trade and business relations.

US based businesses are free to discontinue services to foreign countries due to onerous legislation.
Facebook, Raise the Minimum Age to 16 as GDPR Goes into Effect Today
Estonia is using its citizens’ genes to predict disease
Have you reported it to authorities?
This is ridiculous. I would love to know their justification for using single dash for long options. When did that become the "old way"?? Very old X11 commands and many Solaris commands use a single dash, but nearly all modern commands use double dash. And I agree that this syntax makes it hard to combine single-character options. They must have had a very compelling reason to use a non-standard option syntax.
Germans keep wanting to say that it's not that Germany sucks at consumer technology, but that Germany is more privacy-aware or more principled or something like that.

But if that's true, where are the major German tech companies that simply follow those values?

They don't exist. Look at the Fortune Global 500: the US has tech companies for days on there, Germany only has car or manufacturing companies. Because Germany just isn't very good at consumer-facing software and services. The whole culture is minimum moderately skeptical of innovation in that area.
Also when ip tools decided to implement socket filters for icmp packets . I wanted to know what’s the crazy idea was . But then someone shows me ip . Wow !
WRT Dropbox, Google has their cloud platform. It got off to a bit of rocky start but, today, it's clearly one of the handful of big public cloud platforms which is nothing to sneeze at. I'd argue that being a major public cloud is ultimately more important than having a relatively niche storage offering like Dropbox.

Google's big failure has been in social pretty much across the board. It's tried a bunch of things beginning with Orkut and it's all amounted to pretty much zilch. I suspect that there's some fundamental mindset mismatch going on.

GSuite/Gmail has been pretty successful (as has maps). Being very competitive with a company (Microsoft) that had a huge incumbent's advantage has to count for something.

We'll see if projects like Waymo ever amount to something. IMO commercial applications are further out than many think and it's unclear the degree to which it will be Goggle who makes a lot of money from it.
No, if a company gets reported, the DPA is supposed to investigate, and help the company get compliant if it finds that it isn't.

If the company is willfully refusing to become compliant, the DPA can slap the company with a proportional fine to make non-compliance more expensive than complying.

And if the company is fined, the company can probably sue the DPA in question if they think the fine was unreasonable or unapplicable or no good very bad and unfair.
Terrible for the environment. Lets apply rules with common sense [1]. As much I am for privacy this kind of interpretation is very bad.

1. https://study.com/academy/answer/summarize-all-about-a-dog-b...
I can take "mtu 1500" part, and sort-of "qdisc", but what's up with repeating obscure parameters at their default values, for each and IP address:

valid_lft forever preferred_lft forever
Fair enough... but somehow your system knew of failed attempts and the need to retry, correct? I'm sure I'm trivializing a rather complicated workflow, but if there's a way to detect failed attempts, there should be a way to remove them from the billing. (perhaps a separate S3 file that can be used to reduce the number of charged attempts, or split the ones you have into 'success' and 'fail' versions?)

Oh, and Cassandra is great... used it for years. Just beware of over-sized results. I've seen run-away queries crash the instance(s) running the query; ugly stuff.

Glad you found a solution that works!
I think Facebook's lawyers have determined that they can use the 'legitimate interest' basis for showing targeted ads to their users [0]. This basis does not require consent from users except as part of the take-it-or-leave-it initial terms of service.

Here are the parts of the 'legitimate interest' basis which are most useful to Facebook:

The GDPR does not define what factors to take into account when deciding if your purpose is a legitimate interest. It could be as simple as it being legitimate to start up a new business activity, or to grow your business.

So Facebook's lawyers can simply say, "It's in our legitimate interest to maximise advertising revenue".

You need to demonstrate that the processing is necessary for the purposes of the legitimate interests you have identified. This doesn’t mean that it has to be absolutely essential, but it must be a targeted and proportionate way of achieving your purpose.

Facebook's lawyers can say, "It is necessary for us to use personal information about our users, such as their age and location, in order to maximise our advertising revenue".

The GDPR is clear that the interests of the individual could in particular override your legitimate interests if you intend to process personal data in ways the individual does not reasonably expect.

Facebook's lawyers can say, "People expect that we use their personal information such as age and location to determine what ads to show them, so the interest of the user does not override our legitimate interest of maximising advertising revenue."

[0] https://ico.org.uk/for-organisations/guide-to-the-general-da...
Yes. They don't quite define how the hash works in the post, but assuming it's something like SHA256(email), that's easy to enumerate.

There are ways to do this better. Let's say that it's 1 party and you're trying to figure out if you've seen en email address before. (That's the case in the article, there are also schemes where you and another entity can figure out if you both saw any email addresses -- but that's not what we're discussing here.)

We already know how to take relatively low entropy things and store them securely to see if you've seen them before, for password storage! However, password storage works a little differently. You _know_ which entry you're checking against because you have a secret (password) but also an identifier (user name) -- so you can recompute against the same random key. This randomization means attackers need to try every password for every user. This doesn't work for us, because we just have an email, but it's close.

Three parts worth considering: KDF, PRF and truncation. Firstly, your (deterministic, for reasons mentioned above) PRF turns your low-entropy input into a higher-entropy key. But (again, for reasons mentioned above) attackers still just have to try every email should they compromise your database. You can fix that problem by also adding a PRF (pseudorandom function) that you rate-limit vigorously. Think of a PRF as a keyed hash -- the usual example is HMAC-SHA256. If you're capable of keeping PRF key material safe but might leak a database dump (not unreasonable), the PRF forces the attack to be online: an attacker can only validate guesses as long as they have access to the PRF, and the PRF comes with audit trails and rate limits.

Finally, you can choose to truncate the output. Because the output space of your PRF will be much, much larger than the input space of email addresses, a match out of the PRF gives you almost perfect certainty that you've seen the email address before. That goes for you, and an attacker. If, let's say, you have another way to validate if you've seen the user before (but it's expensive, say, you have an encrypted offline dataset but it's AES-GCM'd and you can't afford to decrypt the entire thing every time), truncation gives you a neat way to _probabilistically_ say if you've seen an address before.
Wouldn't then a hash of your email also identify you as a person? The companies can still build a profile of you if they just agree to use the same hashing function :/
Is that acfeynman reference?
I haven't tried to write extensions for Edge or anything like that, but have you recently developed for Edge or even IE11? I've run into a few minor warts (minor as in a 5-minutes fix) with IE11, but it's been smooth sailing with Edge. Mobile FireFox has comparatively been a nightmare in spite of MDN's wonderful docs.
OpenBSD's ifconfig did not stagnate. It handles aliases, bridges, wifi, etc.

No, the issue is that no one at GNU or Linux cares about correct, simple tools (2 APIs for networking in the kernel?! What happened to manpages?! WTF info?). And thanks to that it runs on anything.

Pick your poison

https://man.openbsd.org/ifconfig.8
Exactly - traditional advertising has long been about product and brand awareness and giving people the warm fuzzies about their logos, slogans, imagery etc. Treat online as exactly that with clickthroughs as a bonus!
If you're in the US, it's often not a bad bet to backburner compliance with ill-conceived, fuzzily-defined law that is going into effect 2+ years in the future. Chance are good that a new crop of House of Representatives members will have been voted in during the intervening time, possibly flopping the majority, and the provisions of the statute in question will either be reversed, endlessly delayed, or mangled out of all recognition from their original form.

From that perspective, this whole trainwreck makes considerably more sense.
Not exactly, because he always gets explicit permission from the original artists to parody a song.

A great example would be someone who doesn't get such permission.
Ask HN: Why Is Kubernetes Coming Out on Top vs. Apache Mesos and Docker Swarm?