skysight-inc/HackerNews huggingface dataset:
To your post specifically, I think a cascade of "zero outs" or the like to blank out a user's data would be sufficient is it not? It could happen at most once for each user account so it shouldn't be ruinously inefficient unless a system was already on the verge of collapse.

But on the topic in general, could someone explain to me what the real world consequences are likely to be for a small business not based in the EU, of not complying? If I've never cared where my users were as long as their payments cleared (oh, is that where they get you? the payment processor?), and I'm selling handcrafted bobbins online in Canada without letting people delete their email address, what is likely to happen if someone complains to EU authorities?
Depends on the country though. Those mussels would be covered for accidental injury in New Zealand, regardless of accident mechanism or drug test result. Unless they had a preexisting condition or course, then they have a real problem.
Eric Ries one is the best
Anything it passed that had a delta-v of less than the escape velocity of the white dwarf will get hoovered up.

But most of what it passed would just scatter like bowling pins.
Interesting question. No if you mean aesthetics, yes if you mean techniques.
It wasn't my personal opinion. In the US, the use of cash is below half of personal transactions and has been declining for years; most countries are similar. I personally am more like the Germans here, but I recognize that I'm an outlier.

Regardless, your point doesn't make a lot of sense, because many Germans surveyed on this say they use cash because it gives them better control over spending and more clarity as to where their money goes. Bitcoin is in no way superior to a debit card in that regard.

The value of new possibility isn't really intrinsic; you measure it through seeing if people actually use it. With Bitcoin they mostly don't, which suggests that it is at best more useful to a small slice of people.
Extremely visible. You can create one yourself via many free web tools. Just Google it.
Right. So is 1+1=2 not a tautology then? Mrlieter seemed to be implying it could not be proven.
Someone says "delete me and my purchases", so you do

In many cases, that will be your mistake. The right to erasure is not absolute, and if you need to keep those records for a good reason -- for example, as evidence to support tax returns or defend chargebacks -- then you are entitled to refuse to delete them and to continue processing them for the necessary purposes. Otherwise mortgages would suddenly become a very fast way to send lenders under, since everyone could just demand they delete all identifiable records of who owes them money...
HN won’t let me go deeper, so here it goes:

> "you could easily not switch to a CASCADE, but instead set delete=1 and mark every sensitive field with a special value"

Emphasize on the part after “and”
American Indian will probably share more with Asian than european or african ear wax.
This app turns your mobile phone into a lie detector
Except it's now codified law, with real punishments based off the ambiguous "don't be a dick" directive. There are serious ambiguities here, and unfortunately no one knows how they'll be handled.
Ask HN: What needs to be done to make remote “work”?
1- Pick one or two of the most important things, in your opinion, that need to be done to enable remote work to take off.
2- Do you think enabling startups to hire full-time remote team members from all over the world, without the hassle of legislations and taxes,is a good place start? How helpful could it be (on a scale from 1 to 10)?
It's a difference in how much a business values their users' privacy and data.

Some value it until they hit XXXXXXXXX amount of extra cost. Some only value it until they hit XXXX amount of extra cost.

Most probably only value it as much as they're forced to.
Shopify vs. Magento
> Yes, a company worth over half a trillion dollars with access to the best legal teams around the world has authority on whether it is compliant or not.

No, it does not.
https://www.parentingscience.com/potty-training-age.html

>Infant potty training: 0-12 months

>It sounds bizarre to many Westerners. But for parents in places like India, China, and East Africa (deVries and deVries 1977; Boucke 2002), the traditional potty training age is early infancy. In these societies, parents learn to recognize their babies’ body signals and to use these signals to anticipate when their babies eliminate.

>When the infant is ready to go, the parent holds him over a sink, bowl, toilet, or the open ground. As the infant voids, the parent makes a characteristic sound or gesture. The baby learns to associate this parental sign with voiding, and, eventually, the parental sign becomes an invitation to void. When the baby feels the urge to go, he learns to hold back for a brief time until his parent gives him the “all clear."
Right, this white dwarf is moving at ~0.8% lightspeed.

I gather that objects could be ejected from Sagittarius A* at even higher velocities.
On the contrary this is exactly why you do it on a holiday weekend. Minimal impact to the world as hopefully your users are yarn installing a beer instead of a package.
Fortune 500 in the Oscars/Emmys winning business. We have European partners and distributors for our stuff that Europeans are supposed to be using anyway. "This content is not available in your region" will probably become a lot more common. We'd prefer you pay for our content too.
Yeah, call side was fixed in 3.5 but I don't split hairs here. I consider it either 3.6+ or don't put trailing commas after neither signatures nor calls with stars.

BTW, your signature doesn't demonstrate a call with unpacking. What you meant to test was:

l = [1, 2, 3]
foo(0, *l,)

This works in 3.5+ but fails on 3.4 and before.
Age of Empires: 1500 Archers on a 28.8
I believe the confusion is around your statement "mark every sensitive field". I think you mean "overwrite every sensitive field", but that definitely took a re-reading to infer, and I'm still not 100% sure.
Better quality: https://i.imgur.com/bBJTGyE.png
you ignored "and mark every sensitive field with a special value", which is the key part. As long as all sensitive data has been essentially zero'd out (for some value of zero), all is fine.
It's no big deal because not everyone in here is in B2C marketplace. I have SaaS services aimed at businesses. I don't give a damn about GDPR. It mostly doesn't affect me. On the other hand as a EU citizen I wholeheartedly welcome it. Sure, it's a draconian law and given time it will get polished but let's just face reality. Online advertising and whatnot has gotten out of hand. You visit any given site and it loads two dozen trackers. Facebook tracks you even if you don't have a profile on them. Google collects shitloads of personal information and none knows what they're doing with it exactly.

Back in the days we used to say that the Internet self-regulates. Well guess what, that's not happening anymore. Companies like FB or Google are actually breaking the web as we know it because they exploit our trust. If GDPR means that their business model will break then so be it. I have huge appreciation for Google, and none for FB, but enough is enough. And they're just the low hanging fruits. There are countless other companies out there working in unethical ways. If anyone's business model is to invade user's privacy then fuck off and die. That's not entrepreneurship, that's greed and a total disregard for human rights.

And by the way, we're not just professionals. We're also users.
Ibuprofen decreases inflamation which passes the stone faster which increases the pain. Ibuprofen alone makes the pain worse. But, even with stones too large to pass, ibuprofen and acetaminophen works better than prescription pain medicine. I can’t say it works better for everyone. But it would for most if they tried it.
> So if you "sell" to EU residents, follow EU's rules.

Surely this will just result in the development of the reseller model?

As long as the reseller doesn't collect data, they're protected and as long as the US company doesn't maintain a presence or ideally market to the EU, they're untouchable due to the lack of any EU-US enforcement agreement for the GDPR.
Great, so now we get to spend money on lawyers and time in the courts to decide what information falls under “OK to keep for a good reason”
When you finish working at the end of the day, do you return your salary? When you leave college do you get your tuition back?
Ask HN: Have you been too embarrased to post in Show HN?
I just finished up a proof of concept I've been working on as my side project. It's a location based mini forum - you make a post and you pick a location for it, and there's tree style comments, simple.

It's a bit cringy because there's no content and I've just crossed the milestone that let me host it. I'll be using it as my personal blog posting about things I wanted to talk about in my area and others can too.

I almost don't want to press submit. Is the UI and concept too cringy?

http://www.zipbash.com/
You shouldn't mindlessly sacrifice the buoyancy of your lifeboat because of human rights -- if there are already 19 souls aboard and taking one more will sink it. Those aboard get priority.
It's that, plus a whole lot of unreasonable demands. Just take the requirement to have an EU representative[0]...even a 1-person US startup that processes data now needs to hire someone in the EU and designate a qualified DPO, which they'll likely need to hire as well. That's way more than not being a dick, it's a huge jobs program that will cost companies millions. One estimate I saw indicated that they expected there would be a need for more than 30,000 DPOs in the EU (and it's that low because a single person can act as a DPO for more than one company).

There's a lot in the GDPR that I like, but having just been through a massive compliance effort, there's a lot in there that overreaches and is just there to leech money out of the companies that make an effort to comply.

[0] https://gdpr-info.eu/art-27-gdpr/
This seems to be true of many social media sites now, with Digg being the old example. They don't so much lose to competitors doing better so much as the services shooting themselves in the foot with poorly thought changes and bad moderation.
What about all the comments on those memes? Do those go too? What about the people who hot-linked to those memes? Do you just nuke the images and break all the content people linked to?

You sign up for a website and upload and share a bunch of memes.... honestly... the shit isn't really your data anymore. It is the publics. You shared it and yanking it back is kind of a dick move.

It really isn't as "simple" as a DELETE statement that some people argue it is.
People write for lots of different reasons. For a good many of those people, “publish everything” is heinous advice.
Being poor in rural America is a choice.
GDPR Compliance: What You Need to Know [video]
Growing the Data Visualization Community with Deck.gl v5
> If only we could say things are "clearly beneficial."

Personally, I'm quite comfortable describing "keeping children from going blind or dying outright" as "clearly beneficial".

> However we still don't understand allergies, autoimmune disorders, or nutrition well. On top of that, there's the whole field of gut bacteria that we're just starting to take seriously.

That "argument" would prevent us from ever introducing a new plant variety of any kind.
Thanks, the processs reminded me of the “redaction” process, so I used mark. That’s definitely on me. Clarified.
Many people view The EU's recent actions (GDPR, Vestager's crusade, etc) as a blatant attempt to weaken the dominant US tech sector so that Europe can try to compete.
Marking a field sounds to me like labeling and not zeroing it out.
I'm surprised with the law being around for 2 years nobody has received the official guidance needed.
What about if you need to report any payouts made to an individual as required by a tax authority? How are you also supposed to delete all their information and be in compliance with tax law? You can't say, "I paid <ANONYMOUS> 12,152.00" in 2018.

Edit:

Ok, looks like there is a clause for these scenarios:

"However, the further retention of the personal data
should be lawful where it is necessary, for exercising the right of freedom of expression and information, for
COMPLIANCE WITH A LEGAL OBLIGATION, for the performance of a task carried out in the public interest or in the
exercise of official authority vested in the controller, on the grounds of public interest in the area of public
health, for archiving purposes in the public interest, scientific or historical research purposes or statistical
purposes, or for the establishment, exercise or defence of legal claims."

Then there's:

"It should not
apply where processing is based on a legal ground other than consent or contract. By its very nature, that right
should not be exercised against controllers processing personal data in the exercise of their public duties. It
should therefore not apply where the processing of the personal data is necessary for compliance with a legal
obligation to which the controller is subject or for the performance of a task carried out in the public interest or
in the exercise of an official authority vested in the controller."

And, in terms of technical burden at least it seems like they try to alleviate it somewhat...

"The data subject's right to transmit or receive
personal data concerning him or her should not create an obligation for the controllers to adopt or maintain
processing systems which are technically compatible"
Modern C++14 library for the development of real-time graphical applications
Facebook's use of software is completely different than a product of Facebook that targets programmers. Companies release open-source libraries because they benefit the companies.
That's not entirely true. Article 2 defines the scope in various respects, and categories such as "by a natural person in the course of a purely personal or household activity" are specifically not within that scope.
That is absolutely meaningless and opens up every business to constant unrelenting litigation. Your definition of obvious is not the same as someone else.
> Because consent must be "freely given"

But you do have a choice. Don't use the site if you don't consent to its rules. Pretty straightforward choice.
Pretty sure at this point it's "commit global war crimes" or "cure aging". Anything short of that and your odds diminish significantly. Even if you create an art-defining advancement in some field and name it for yourself, anything about you will be lost.
Wouldn't it be possible to just delete the 'idetifiabel' parts in the database in order to be GDPR compliant?

If you for instance save all the user data like user preferences under a random userId, and then delete the personal data (such as email address, name etc.) associated with the userId I would expect this to be GDPR complaint without having to do a cascading delete.
How do you handle developer computers with possible client data on them, even semi-anonymized? Or when communicating issues on the live server, you might transfer client information to other stake holders to debug issue. Are you tracking that communication. Where does the communication data reside, perhaps on a server outside of the EU?

There is a lot of complications that arise if you think about the second order/third order consequences of the law.
If you don't do any business in the EU, while you may technically fall under the law, it would be nearly impossible to prosecute you for it.

But the moment you try to access the EU market....
Or take them back to a pharmacy - when I have asked I’ve been provided a receipt too.
I didn't see a complaint.
The entire point of GDPR is that it creates a set of requirements, and allows you to make decisions in your professional judgement to fill those requirements. This is no different to how management in any software company will present business requirements for the software you are to make, and request that you decide the technical implementation. That's your job if you're a developer.

As long as you're confident enough in your PII solution to be willing to present it in front of other software developers who have been called as expert witnesses and declare that it meets the GDPR requirements, you can pick any "right way" you like to meet those requirements.

If you think it's an unreasonable burden to have to make PII handling solutions that are robust enough that you can honestly defend them in court if challenged, maybe you shouldn't be handling PII. Like, at all.
> In China, a country that still requires documents for internal travel ...

I did not know about this. Can someone shed some light on limits to internal travel in China?
My wife is literally at Whole Foods right now, picking up an item she bought from their Treasure Box today. She will most likely walk inside since she's "already there" and pick up some stuff at Whole Foods.
mixing acetaminophen with ibuprofen
It's a well-documented (in scientific literature) phenomenon that the mix of a standard dose of both acetaminophen and ibuprofen provides the same or better pain relief as opioids

If you had said some types of pain, I would agree, but your statement as-is is not accurate.

If just had a leg amputated or some other major surgery, I doubt you'd be ok with just Tylenol and ibuprofen.

The only info could find concluded it better for dental pain.
Upthread we have the claim that "most early-stage startups use the... best practice of 'delete=1'," pretending to delete user data while actually retaining it. So, the exact opposite of the rule.
Like, say, a personality quiz on Facebook?
> What (I think) we need is a regulated system where every drone uses a standard transponder and negotiates airspace either with a controller (e.g. IFR) or other aircraft (e.g. VFR).

Before that happens, a good first step is to require all drones to transmit an ID linked to a person. I suspect that just that step would help to curb the worst excesses of amateur drone pilots.
They might not be "views", just "listens" from people leaving on autoplay for hours.
This good idea does not go far enough.

There's a clear need to crowdsource judgment. The judgment could be much more expressive than "this is true". A hypergraph database would allow collection of arbitrary metadata -- "this helped me understand plate tectonics", "this contradicts that", etc. And it would enable more targeted search: not just "show me true things", but, say, "show me articles about voting that are highly discussed among the economic faculty at Michigan State".

I've written about this here: https://github.com/synchrony/smsn-why/blob/master/noise-vs-s...

I also wrote a language -- very, very close to natural language, but machine-readable -- designed to facilitate such higher-order queries: https://github.com/JeffreyBenjaminBrown/digraphs-with-text/b...
I run a simple personal blog. I make a meager $200 a year or so from targetted ads on that blog. I have Adsense and Analytics collecting what they collect. My stats have IP's, countries, browsers, OS's, list of pages a visitor looked at, etc. I look through the info on occassion to decide which random rambling I wrote that I should improve or update on the site. This is a hobby but it has expenses and income so it's effectively a business.

At $200 a year there's no point spending even a few hours to figure out if I need to ensure GDPR compliance in the first place much less to do so. No point in figureing out how to erase users if I should ever be asked to, etc.

Last night I tried to log into AdSense and turn off targetted ads because I figure that handles most of my risk and is one of the evils people seem to be trying to kill. I couldn't find the option, only found old articles about it "coming soon" on Google, and got nowhere in a half hour or so.

Are there any limits to the sizes of companies that have to deal with this? Blocking EU might be the only real option I have (although some say that's not even enough).
Not to mention all the backups of said databases. Imagine sitautions where you’ve got tape backups stored in vaults or places like AWS Glacier. It’s the stuff of ops nightmares.
Yes, and the Bitcoin network ITSELF can be attacked with a faction of the total hashpower on the Bitcoin network.

Specifically, the fraction is 51/100, or 51 percent of the network. This is for the main Bitcoin network.

The fraction for Bitcoin cash would be around 15%, or 15/100, expressed as a fraction.

The Bitcoin cash network would require a smaller fraction, yes. But this still isn't a huge concern.

If it is 3 times easier to attack bitcoin cash, that is still extremely difficult.

Fractional hashpower attacks, (51% attacks) are all explained quite clearly in the white paper.
> Regular rice is absolutely not "naturally occurring".

Definitely not. Its genome differs from its wild ancestor in many respects. To name just one, like most domestic grains it's resistant to "shattering" (i.e., the seeds tend to remain attached to the plant, rather than falling off and/or being scattered when the plant is blown by the wind). That is a great feature for farmers, but means that the plant would likely go extinct in short order if left to itself (because the seeds wouldn't be scattered on the ground).
well, you can look at it at both ways, if yarn just used npm's registry then there wouldn't be a problem. I am not sure what's their reason to add a registry (a mirror at that) if they don't plan to make their own.
Urea is also an ingredient in a lot of lotions and other skin products.
Then you have a legal obligation to keep the data, which counts as one of the valid reasons for keeping it, AFAICT.
It's fine.

I don't think it's about how pretty the thing looks but the concept that you'd be showing.

If something looks super ugly but there are some new/substantial ideas behind it people can look over that and still discuss the idea.

Beyond a certain point if something is too early stage or there's nothing to show it's not very useful to do show HN.
>A huge point in favor of macOS is the quality of its ecosystem.

A huge point in favor of Windows is the diversity of its ecosystem.

And what's wrong with Win32 per se that you'd discount it as crap? Not everything needs to be 64-bit (and since on Windows the only compelling reason is >4GB RAM usage - it shouldn't).
Maybe not:
You need to have a "Legal Basis" and only 1 of them is the "subject has given consent" one.

There's another:

"The processing is
NECESSARY FOR THE PERFORMANCE OF A CONTRACT
to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;"
It's curious how these "basic, fundamental" rights only apply to select industries, while others are free to completely ignore them (art. 85). What kind of basic, fundamental right is that?
It's not really a bluff; they can cut off any European business that deals with Iran easily. Someone else will play ball. This wouldn't be the first time they did it either.
It would get stuck trying to decide whether lease or purchase it outright.
The tents aren't owned by a company that rents them out, and the scooters aren't used as a last-resort shelter for homeless folks.
Has anyone rolled this out to an existing codebase? What's the best practice? A single commit that reformats the whole codebase? How do you avoid creating merge hell?
Thanks for the explanation. With a couple more content it could have be an article on its one, I think.
Not at all. He hasn't addressed my point which is that for individuals travelling alone the train will be dramatically cheaper than driving over long distances.
GDPR just says that if you are keeping data, you have to have a good reason for it.

If you have to retain certain data for eg tax purposes, then that sounds like a good reason to me.
According to the AdBlock Plus page not all features work without root.