skysight-inc/HackerNews huggingface dataset:
What worries me most is how little is being said about private-operated sites. I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically. Should I sign data processing agreement with Google because I am using Gmail to send E-mails? Should I hire DPO? Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account?
Creating Interactive PDF Forms in ReportLab with Python
I'd almost go as far as to say having the email address itself is processing. You validated the address right? Maybe sent it a confirm-you-exist email
The fact that you have to respond to an information request letter under the GDPR makes the legislation tyrannical.

The idea that information about someone belongs to that person, no matter where it is stored, is a philosophically flawed perspective that if fully implemented, would lead to total global tyranny, by obligating people to do the work of disclosure and information deletion on demand, and ironically, by eradicating all privacy in relation to information people have about other people.

You have no moral right to dictate what I remember about you, to compel me to disclose what I know about you, to compel me to disclose what steps I took to disremember you, or to restrict who I may relay the information I remember about you to. The GDPR empowers you to do all of these to me in the context of a web service.
Ha. And maybe the mass of the medicine ball is proportional to the size of the changes.
Isn't this true for literally all regulations and laws on the planet? Which bit is specific to GDPR?

If you're accused and you're unlucky enough that the regulators/police follow up on the accusation, you're going to have to answer to them.

Exercise some critical thinking please.
Parenthesis are paired and have their usual function of groupoing. You are correct about brackets and braces though. Personally I do think J is often hard to read, but not because of the unbalanced brackets and braces.
> what is the real difference in the EU, that you could fall back on if sued because of these letters?

This is the first part where your view of how things would likely play out and reality diverge. Under the GDPR a Data Subject whose request is not answered satisfactorily or timely could sue but that will likely go nowhere because they should direct their complaints towards the regulators, not towards the courts.

> You have to prepare for that if you want to be responsible, right?

No, to prepare you have to be 'in compliance', which is a different thing. Essentially you should read the law, decide which part of your operation is 'in scope' and adapt your business to reflect your understanding of the law.

In case of a complaint to a regulator they may (but not necessarily) investigate and if they find transgressions they will issue some guidance on how you should achieve compliance. If upon re-testing it appears that you have not followed the guidance you will most likely be hit with a fine. If the original investigation was because of a data breach or other serious issue they may decide to fine you immediately as well.

> Does the EU never enforce law by the letter, so the letters are unreliable and really more like a guideline? (If so, why bother with law?

The EU tries to achieve a certain effect with the law: to make it harder for companies to wipe breaches under the carpet, to give Data Subjects more control over their data and to stop the worst excesses in the world of data brokering.

So if you cross any of those you can expect enforcement.

> Lack of EU sovereignty over member states means it won't get enforced if it's really an inconvenience anyway?

All member states have automatically adopted the law when it went in force (April 2016).

> Something else?

That's up to you :)
in the gaming community, the NA zone is pretty cancer
The type of status/error matters. It's how your communicate, server to client.

Think about your normal interactions with problem solving as a team. What's more useful, a teammate who tells you when there's a problem what the problem is or a teammate who hides things, obfuscates, and makes random jokes?

400 tells you asked in a way that wasn't understood.

401 says you're unauthorized and 403 says you're not allowed (similar but potentially different implications, not my favorite nuance but it's a common example that might come up)

504 says there's a problem communicating between the two of you.

404 says that your data doesn't exist.

500 says the server is having problems doing the thing and it's completely out of your hands.

418 says "I'm a teapot"

What's more useful data?
I think it's too early to come to any conclusions about GDPR. It's going to take some time and some litigation before we really know the shape and location of the edges of the regulations.
This is actually something I've mocked up, but I'm not sure if it flies. I also wonder if blocking by IP actually counts as processing PII... Lol. So many questions.
Jan 23rd 2018: $10.87 for .com and $0.99 for whoisguard ($11.86 total)

29th May 2018: $10.98 (+0.11) for .com and 0.18 ICANN'T fee ($11.16 total).

So it's $0.71 cheaper without whoisguard. So that margin (increase in .com) probably covers the actual whoisguard cost, the $1 fee was pretty much pure profit.
I just wanted to say that Scotia's corporate accounts do have 2FA with a physical token generator, so they do have the technology they just don't enforce it for consumer accounts.
You’re spreading patently false information. After being corrected in one thread, you repeat it in another. I’ve read the law, myself and with a lawyer. This is complicated stuff. Ignoring letters is a bad idea.
I remember this from a recent discussion about cross-platform mobile stacks, so I now know it is built on React Native :) Great work!
Is the validation done using Javascript? I have used a credit union that used to do that until they merged with another credit union and switched to a new system. Password requirements were limited to 0-9, maximum of six digits. However, if you bypassed their client-side validation logic, you could use any password you wanted.
> even if you don't buy that it clearly can't be less than O(N^1/3)

Maybe I'm missing something, but why's that?

To the rest of your comment: all good points.
I think this is an interesting line of thought. I'm almost 50, reasonably accomplished in my career, financially successful, respected by my peers, but whenever I'm around my older sisters, I'm right back in that annoying, barely tolerated little brother reality. I don't much care for it, which is why I don't have much of a relationship with them, haven't for years.

Anyway I've thought this for years, is there a name for it, or some other deeper meaning? Familiarity breeds contempt, maybe?
That is exactly how I interpreted "social listening" at first.
"all data save email address being client side encrypted"

If its client side encrypted its not Personaly identifiable information.
Can whole playlists be added to the queue? If not, have you planned to add the possibility to do so?
Last September, my fiance and I made a rule: no more phones in the bedroom. That small decision has been life-changing. Right away it had a couple interesting effects; I ended up reading (novels) about 3x more, we chatted more, there was more sex, and I stopped starting my day out with the news.

That last point has had the largest impact on my life.

By not starting my day with what inevitably ends up being something negative (Oh Joy, what industry am I as a millennial ruining today and how many times has the president tweeted about it?), I quickly noticed that my morning mood had improved. First I started reading the news once I got out of my room making breakfast, then that became reading it after breakfast and eventually that became catching up on the news after lunch.

About 3 months later, I was catching up on the world around me later on in the day, and in smaller bits. I was also noticeably happier. While I'm all for carefully examining causul vs correlation, and am keenly aware of the biases, it didn't take a lot of reading a couple papers to see that, surprise surprise, the news is depressing.

Then I had a realization when hanging out with my grandpa, who frankly, is all out of fucks to give. While extremely well read, he gets all of his news from the few magazines he is subscribed to (The Economist, Bloomberg and Maclean’s) and therefore only hears things sometimes two weeks after they happen. And it didn't matter. He's just as well read on world events, he's not living in a cave or under a rock, he just isn't stuck in this cycle of fear of missing out on being in the know. He doesn't care.

So three months ago, I quit reading the news. I set a couple of redirects on my computer so that whenever I tried to visit a few of the places I used to frequent, I was redirected to either here, HN, where I enjoy the comments, or to Pocket. Every Sunday since then, I take the time to sit down in the morning, and read through The Economist, which I am a subscriber to.

That's it.

That is my only source of news - well, that and what I read on here or twitter. Sure I still hear about major events (and unfortunately, school shootings tend to make their rounds on twitter). I am keenly aware that like all news sources, the economist is biased. I try to balance that out by following a few tweet-happy people with opposing views. But let me tell you, being unplugged from the Breaking News! cycle and the continuous back and forth between the talking heads is the most refreshing thing I've ever done for my mental health. It may not be for everyone, and I may not do it forever, but for now, I have no intentions on going back to reading the news.
HSBC is the only bank I've seen do this properly with a dedicated device. In the US at least you can log on a do a few basic things without the device.

https://www.hsbc.com.hk/help/security-centre/device/
Does this justify hashing user identification for later correlation with other products?

https://github.com/dotnet/cli/blob/b45f1fb439b36872c249b07f1...
Won't this DoS the regulators as well as the companies? Carpet-bombing everyone with DSARs is not just annoying but self-defeating. Even though the basic ideas behind GDPR seem pretty reasonable to me, the implementation so far is almost enough to make me join the "regulation is evil" crowd.
https://en.wikipedia.org/wiki/Noid#Kenneth_Lamar_Noid
It's what it says, for some extensions, whois information is managed by the registry. Namecheap is legally obliged to provide the registrant information to the registry and they publish the whois information.

The same restriction also applies to other name registrars like Gandi: https://wiki.gandi.net/en/domains/private-registration
Thanks!

Mobile is React native, Mac Desktop app is electron + react and website is react. For anyone else wondering.
This annotated JavaScript describes the approach:

https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c39...
Is It Effective (CPaaS) Communication Platform as a Service, Play Videos Using
Thanks, this is summarizes my position really nicely.

The most fundamental point is that a smartphone with voice-control disabled is still a useful tool, but an Echo with voice-control disabled is an LED rolling pin.

And beyond that, yes to the rest - I don't want to add an attack channel, I trust my knowledge of phones more than that of an always-on black box, and I object to voice control as a more open-ended threat than location tracking.
And how are they planning to "study" the effect of not having FB? this looks dubious to me. Probably there is other political intention behind.
That depends on how you contract your name in research papers.
Unless your middle name is "Lee", in which case stick with First Last because you're gonna sound like a "quiet guy who keeps to himself" any other way.
Yes, but now it's free in non-Google service, that's a pron for some.
I can think of a few value-adds for people who practice moderate opsec:

1. If one of your passwords is suddenly rejected, it may be a great moment to refer you to HIBP.

2. Traditional password complexity estimations may be overestimating your passwords complexity, e.g. the pass phrase "My house is blue" is fairly long and will likely be flagged as complex enough. But it's within the realm of a password-phrase aware tool.
Thanks- I'll start changing the language, had no idea. What would you call something like this though? Curious what might convey the idea better.
Presumably they (a) don't have a genset of sufficient power (b) don't have the required hookups to disconnect from the mains and plug the generator in and maybe (c) aren't keen on running a generator next to the "switch off engine" signs.

(The nearest petrol station to me is automated, so there would be nobody to do this anyway!)
> What worries me most is how little is being said about private-operated sites.

If you want I can research the matter in more detail, someone else came up with federated sites like Mastodon nodes and that's another pretty gray area.

> I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically.

Ok.

> Should I sign data processing agreement with Google because I am using Gmail to send E-mails?

No. You could try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable.

> Should I hire DPO?

No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small.

> Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account?

No.

But if a regulator should tell you that you should remove a users data (because you refused to for some reason or other) you probably should. The EU does not 'fine first and ask questions later', they will investigate first, warn and then when ignored they will fine. And for a small entity like yours which is more of a hobby than anything else I highly doubt regulators would even bother but you can't rule it out completely. Better increase you comet insurance as well if that's your main worry :)
I'm doing well now. Thank you! Hope you are too.
Find a counselor/therapist. I do not say this flippantly or dismissively. If you find yourself experiencing fear/anxiety to the extent that it's impacting your life, they can really help.

For me, my social anxiety started to end after a bit of therapy, but also exposure as nso95 suggests. Like, if you put me in a crowded room with mostly people I didn't know I'd experience tunnel vision, couldn't make sense of all the sounds around me, and would be clinging to a wall. Starting with smaller groups (this was not entirely deliberate, it's just how it worked out), I got better at being around groups of people that I was unfamiliar with and interacting with them. Then some practice (forced by school) in public speaking helped me some more (small groups, just a class of 20-30 people, not hundreds).

For foreign language speaking, you just have to dive in at some point. You will say things wrong. You will find that you don't have the words. And this is fine! A major lesson for me was that everyone experiences this. No one is perfect (no matter how they seem), and if the fear is really fear of judgement, then they're jerks or bullies and you can ignore them. It's hard to internalize that, it was a long slog for me, but it's achievable. Practice, first, with people you trust or know, or with someone you find/hire online (there are services, but I don't recall any of them at the moment, that matchmake people with the language speakers they want).
I appreciate it, thank you!
A primer on fentanyl(s)
Because chances are, if you are using a password that is in the list, it's because either it's an exceedingly common password (and you really shouldn't be using it) or you've used it before multiple times and are probably the reason it is in the list (because it was breached on another site).

From experience, most attacks we see now are credential stuffing attacks rather than pure brute force attacks using something like Sentry MBA, with a huge number of IP addresses (the last attack we saw was using over 6 million IP addresses). So throttling sign in attempts at the IP level is almost useless as is throttling at the email level, as the attacker can attempt at least 6 million known email/password combinations to see if those accounts exist on your site.

The only real defence against that is all your users using 2 factor, or creating a psuedo 2nd factor (email them if the attempt is from an unrecognised IP).

Edit: Of course the other helpful defence is to ensure your users aren't reusing passwords, which is where Pwned Passwords comes in.
If more than half their sample wasn't just psych students they'd be coming out on top!
Awesome! It is nice for those who need some visual guidance. I think this would make a wonderful resource.
This is awesome lol. We have a cloud CI system that builds deployables. Maybe the build priority on your branches is proportional to the RPM of your crank.
So you wouldn't have an issue implementing Chinese regulations?
JangoSteve's responses cover most of my thoughts - I don't think remotely enabling recording is harder on a phone than an Echo, I just think the base state of the devices is different.

But as for "AHAHAHAHAHAHA, see for example: https://www.google.com/maps/timeline The vast majority of Android users I've met unknowingly had this enabled"?

I do have Timeline turned off. I know most people don't, but I'm not sure why "many people make this mistake" is supposed to be a rebuttal to "I'm more privacy conscious than many people".
Yes it will, which is why if you are serious sending a form letter is a bad decisions.
Very cool. Where’s the patreon link!
Notice how they don't compare against Gandi which provided the same service for free for a long time already.

https://wiki.gandi.net/en/domains/private-registration
Where's the best place to be a full stack developer?
Is it better to be a full stack developer in San Francisco or New York?
> Isn't this true for literally all regulations and laws on the planet?

No, it’s not. Comparable statutes in the U.S. are HIPAA or the Securities Act is 1933. Most laws require, to kick off an expensive process, someone to (a) pony up to start a lawsuit or (b) convince a public prosecutor to take on the case. Dedicated regulators are established where (a) and (b) aren’t working.

Most dedicated regulators consider consumer complaints. But the response rates are reasonably low and not mandated by law. (The best complain-and-investigate regulatory regimes avoid their incumbency-promoting effects by limiting oversight of new entrants. This incumbency bias was not taken into account in the GDPR’s drafting.)

If GDPR looks identical to other laws, in the EU or U.S., to you, you may want to speak with your lawyer about it.
sudo rm -rf *
compound initials that will really make you stand out.
This is from the API docs, you are not allowed to pick the number of digits.

https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR...
> The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly.

Why is this silly? Does the law explicitly forbid people from asking stuff like this?
A hangboard is also great for an office if you're into climbing.
Having an index though is additional processing. If you could simply note 'in a database' and not have to note processing the database is doing, you could do all your processing with stored procedure.
I've been a fan and user for over a year. JQBX is a great replacement for turntable.fm
I don't know man ppl work to make money and feed and their family( mostly). 'Expert in sockets' is not something on the resume that would get them a job.
What did you use to make the static diagrams, for example on the Newton's Laws page?

https://landgreen.github.io/physics/notes/force/1-intro/inde...
I imagine you could apply this same logic is applied to taxes, employee rights, not discriminating while hiring or firing, and hundreds of other similar laws under which your company must operate? What makes the GDPR so much worse?
Thanks! We moved down here for the adventure of it, its been a rewarding experience for sure.

Yep, I work part time for a couple of clients. Its a weird mix of data pipelining, systems architecture, orchestration, and site reliability work. I wouldn't have guessed I'd be working on this type of stuff 5 years ago, but I really enjoy it.

And yeah, it's funny, I don't really participate in Hacker News or Reddit (except in rare occasions like this, when someone points out my post is on here. vanity, I guess?). I've never included social news aggregators in my mental model of social media... but now that I think about it I can't really exclude it either.

I'm going to have to think about how I feel about this.
The Advantages of Outstaffing as an IT Employee Retention Strategy
If Jimmy uses the same password everywhere, and his password has gotten out in a prior leak, then it's likely that his favorite username is associated with that password.

If he comes to my site and signs up with that password, an "evil person" doesn't need 5 guesses to get into his account - they just need one, because they already have it.

If, however, I check Jimmy's password when he registers, and block him from using it: (1) I keep him from immediately losing control of his account on my service, and (2) I provide Jimmy with the knowledge that his favorite password was leaked and he needs to do something about it.
How about people with non-breaking spaces in their name, how do they fare in life?

Tech support: "Was that John Doe?"

JD: "No, I said John Doe!"
The user made no request to access backup data, I don't know where you got that but it was not in the letter.

The user requested to know if there were backups and if so how they are handled, which is a perfectly legitimate question, if only because quite a few breaches start with 'we've lost a backup and it wasn't encrypted'.

This could - but does not necessarily - fall under 'other supplementary information' but would require more context.

see:

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Now, some of the requests in the letter are over the top but there is no harm in answering them. Not answering the whole letter is extremely dumb because you can't ignore a legitimate request because it asks for one thing that is not legitimate. Then you should just answer the remainder and lay out your reasons for not wanting to answer the questions you feel are not within the scope of such a request.
Would be interested to learn more about how you share components/code between RN and React!
There once was a man from Nantucket, he had a brain so big he could pop it...
How do I import my already created play list from my account. I can't seem to see the playlists I'd like to play as a DJ.