Hacker Newsnew | past | comments | ask | show | jobs | submit | shoto_io's commentslogin

After reading this a couple of times I think this part stands out:

> When I needed medical attention, I was helpless to help myself survive.

A very strong and independent character came to realize we all need each other to survive. A good reminder to stay humble.


Lol most ppl figure this out pretty quickly especially the smart ones


Virtually everyone knows this. 2 year olds know this. I fail to see how this is profound.


[flagged]


Or perhaps he left in his own terms. Which is a happier ending than grueling chemotherapy


Jobs had a pancreatic cancer with a very good chance of complete cure via surgery and chemotherapy. I think that a cure would have been a happier ending than suffering and dying from pancreatic cancer.


Pancreatic cancer actually has one of the worst survival rates; in the UK around 25% of people diagnosed survive past a year, with 5% living more than five years after diagnosis [0]. Chemo in those circumstances often has the effect of prolonging life while significantly decreasing the quality of life, and as such many people choose not to go through with it.

[0] https://www.cancerresearchuk.org/about-cancer/pancreatic-can...


Right but Steve had a rare version of pancreatic cancer that was totally curable and had good odds of success. But he waited too long while wasting his time with at-home remedies (an all-fruit diet, which actually made things worse), and by the time he followed his doctor’s advice it was too late:

https://blogs.webmd.com/from-our-archives/20111006/steve-job...

> Once it was clear that Jobs had the rare islet-cell pancreatic cancer, there was an excellent chance of a cure. According to Cleveland Clinic gastroenterologist Maged Rizk, MD, there’s an overall 80% to 90% chance of 5-year survival. In the world of cancer survival, that’s a huge milestone.


Ah, TIL. Thanks for clearing that up!


A was struggling with one thought today, about my own resistance to medical therapy.

A healthy body does not need medication.

Yes or no? Or does medication make one healthy? There's not supposed to be an easy answer. I have some "heavy" duty ongoing medication I'm sad to depend on. (Let's not exaggerate though)


Medication can make one healthy. It can cure, prevent or control many diseases and conditions. Of course it's better to not need that medication, but when you need it it's better to take it than not.


IMO you're only fully healthy when you don't need medication anymore


Very interesting. Seems we are similar :D

What I didn't understand: How is the growing list of things stressing you out? Do you feel pressured to do something with the items?


It's pointless accumulation and hoarding, and eventually becomes disorganized, which can be some degree of.stressful to deal with.


This is it for me.

I'm a librarian, so I'm AWARE each time I look at my dumping grounds that I should organize them. Of course, that also feels like work, so then I don't do it.


I haven’t cut out caffeine but coffee instead.

I used to be a “heavy” drinker, 5-6 cups a day. Unfortunately, I started having really bad stomach problems. Constant acid burbs and heartburn so bad I couldn’t sleep some nights.

I tried everything. Changed coffee beans, the way I’d make it. Nothing helped.

So from one to another I switched to green tea, about a year ago. My Stich ach is great now. No more issues. I do miss the taste of coffee now and then. But overall I’m very happy to have made the switch.


Is this the equivalent to the “pre-mature scaling” phenomenon in tech?

In the early days of a startup, I agree with your statement. Once the company gets significantly bigger, these things start to matter a lot.


Yes I’d like to echo this.

Our SaaS is 16 years old now. In the early days it was all about product market fit, generating cash, basic survival. We were too busy focusing on the latter to worry about things like documentation systems at scale.

But there was definitely a threshold that we crossed where we knew things would likely work out - at this point we started paying attention to systems at scale.

And boy am I glad we did that! Had we not taken that crucial step, we’d be suffering today.

Point is, one can’t afford to skip over these things in the early days. But it’s a tricky balance, because doing it too early is also counter productive.


I agree with you, but don't think the issue is one of documentation. Rather, it is an issue of communication.

To borrow a concept from Starcraft, what has worked well in my experience is for every member of a team/company to clearly understand their "macro loop". This involves being aware of the set of chat channels, email threads, code repositories, and documents that are most relevant to their work in the near term and in the medium term. Everyone on the team should be:

1. Checking these sources at a regular rate (once a day, once a week, once every two weeks).

2. Reflecting their work in these sources to the extent that it's relevant to their team mates.

Macro loops cannot be forced onto someone, but they can be reinforced by the rest of the team. For example, if you lead a weekly meeting and always have the meeting doc up on a shared screen, people will naturally start refer to it themselves when they need the context it contains. Or if a particular document is always linked in answers to a certain question, it will make its way onto indexes and bookmarks.

The particular systems you use to represent these things -- Slack vs. Discord vs. IRC vs. Google Hangouts for chat, GMail vs. custom servers for email, GitHub vs. GitLab vs. Bitbucket vs. self-hosted git for code, Docs vs. Quip vs. Dropbox Paper vs. Office 365 vs. Notion for docs -- really don't have a significant effect on how well a team runs its macro loops.


>There are three types of sales: team, team & tech, and team, tech, & traction. Each one is more valuable than the last, provided the company grows. The greater the revenue, the more likely the acquirer prices a target on a revenue multiple.

I have also seen team + traction and traction only.


Too bad when you're trending on HN and the link to the paid version at the end of the article returns 404...


Banksy would approve!

Curious to understand: what kind of machinery is this and why does the cutting happen in water?


It's a gantry type 3 axis CNC with what amounts to a stupendously high-pressure pressure washer attached to it. The cutting head has a hopper that feeds a dry cutting abrasive in fine granular form (sand like or finer) into the water jet. The extreme pressure accelerates the water and abrasive to high impact velocity which cleanly cuts many materials including ceramics, glasses and very hard metals. A nice bonus is there is little heat input so you wont get warping or worry about annealing hard metals. Just under the cutting bed is a bath of water the jet terminates into. They do generate a little water mist during punch through but surprisingly is pretty dry around the machine. They make really nice clean cuts but require a lot of upkeep and the abrasive is a consumable you have to keep buying.

Ive seen one operating next to a plasma cutter (same CNC setup) in a fab shop and it was a night and day comparison. The plasma cutter was shooting sparks and embers everywhere while belching noxious smoke and the machine was filthy and covered in soot. Its more akin to welding. The benefit is they have less upkeep and consumables. Though plasma can not handle the variety of materials a water jet can.


A water jet sends an extremely high pressure thin jet of water that can precisely cut many materials.

https://en.m.wikipedia.org/wiki/Water_jet_cutter


water + an abrasive in this case, water won't cut an iphone


The water is filled with sapphires.


Actually, the abrasive is garnet, but the orifice that forms the jet is a drilled sapphire.

Source: I own and operate a waterjet.


Banksy?


thanks, you're right


I agree 100%. I think from an investment perspective putting most of your time into marketing yields the highest return.

My biggest struggle so far is: How do I find those people to "sit and talk" to? Any advice on that?


I'll be honest, I don't have a ton of experience when it comes to finding investors, and other early stage enablers. However, when it comes to your market, I think the question is better asked, who is your audience?

Who do you expect to use this product day in and day out? And then make it even smaller and go look for those people on LinkedIn, Reddit, HackerNews, Twitter, etc.

Then just hit them up. You don't have to be selling necessarily, you can simply be asking about the problems they might have or looking for feedback on something.

Obviously this depends a lot on B2C or B2B, but there exists a community of people somewhere with the problem you're trying to solve or a company which is kind of a community :D.

If you can't find an audience, then I think that also answers your question.


Thanks!


By the way, I just learned the ABC rule in this thread (Always Be Selling) :)

So, you should go ahead and subscribe to my newsletter. It's pretty good:

https://www.shoto.io


No ABC thread is complete without this joke from my grade 8 science teacher.

What did one AAA battery say to the other?? Always be celling.


My approach has been to put out something as early as possible and then be very responsive when people ask questions, make suggestions or report bugs. And this has resulted in lots of useful feedback for all 3 products I have developed. It takes time though and you have to go the extra file with support.


My stock advice for any rookie has always been the same:

- Buy S&P ETFs, most preferably by Vanguard, because they are a non-profit and thus have very low fees

- If you have a large sum of cash, go all-in immediately, don't wait for the perfect time

- Now, just wait, ideally 10+ years, before looking into your account again


> Buy S&P ETFs, most preferably by Vanguard, because they are a non-profit and thus have very low fees

Vanguard is certainly a for-profit organization [0]. What, I think you wanted to say, that many of the Vanguard funds are index funds that do not have exuberant management fees.

[0] https://en.wikipedia.org/wiki/The_Vanguard_Group


Yes, you're right, I was not precise. That's what they used to say about themselves:

“The Vanguard Group is truly a mutual mutual fund company. It is owned jointly by the funds it oversees and thus indirectly by the shareholders in those funds. Most other mutual funds are operated by management companies that may be owned by one person, by a private group of individuals, or by public investors. ... The management fees charged by these companies include a profit component over and above the companies’ cost of providing services. By contrast, Vanguard provides services to its member funds on an at-cost basis, with no profit component, which helps to keep the funds’ expenses low.”


He probably meant to say that Vanguard is owned by the funds themselves, not by some external private entity. That makes their incentives be more aligned with making the funds cheap and efficient.


But they did spend a long time saying that they were providing services "at cost", which was eventually removed.

https://www.inquirer.com/columnists/john-bogle-vanguard-scra...


> Now, just wait, ideally 10+ years, before looking into your account again

That might not be the best idea because of escheat. Here's a story about someone who didn't check on their stocks for years and the state claimed them. https://www.npr.org/transcripts/799345159


It is also wise to look at your accounts at least once a year because some of your investments might pay dividends that you have to report on your tax returns.


For most major ETFs there are accumulating versions that automatically re-invest any dividends into the ETF. A good choice for the lazy investor IMO.


You still have to pay taxes on those dividends in the year they are paid.


In America, yes. The person you're replying to seems to live in Europe. I believe in many European countries there's no tax on accumulating ETFs that reinvest dividends, until you sell them and realize the capital gain.

In a way this erases the tax efficiency difference between dividends and buybacks.


Good point... I meant don't touch them :)


The poster says buy S&P ETF and walk away not stocks.


ETFs do pay out dividends from the underlying stocks. This does not require you to look at the account (in the US you will get a form at the end of the year summarizing what you have to pay taxes on).


So stocks can be seized and ETFs can't..?


Agree in almost all ways:

- ETFs, Vanguard is a good choice for most. If you're older and might need a large percentage of the money fairly soon, consider getting some bonds as well.

- Don't try to time the market

- Don't think you're smart

The only personal difference is I prefer FTSE All World as it is diversified into over 4000 global stocks, while the S&P 500 is (obviously) 500 American stocks. That being said the S&P 500 has been outperforming the FTSE All World for a long time, and I certainly don't want to give anyone specific investment advice.


Many companies in the S&P500 source much of their revenue globally. They are registered as US companies but their business exposure covers the world, so you achieve much of the same diversification but in a US legal framework for business and securities.


Historically speaking, I think this has been one of the best things an average person could do within the context of a stable, safe, free, and productive society, but I don't think this kind of generic advice is really persuasive in the different and more turbulent world that exists right now.

Additionally, because of many societal conditions, right now many people think they need to hit on a moonshot to have a good life. And given the direction that inflation and many other things seem to be headed, it's harder to argue that they're wrong. Slightly increasing your financial floor matters little if the floor is still dirt.


Owning equities (through index funds) is one of the best ways to always beat inflation. They are the part of the economy that appreciates because of future returns, in future money, not past dollar amounts.

That said, most of current CPI "inflation" is not economy wide price increases, but comes from 1) car prices, because car manufacturers massively messed up and production is way down for the past two years, and 2) energy, which is from several global market issues. There's also housing, which is not in CPI, but that's also easily attributable to underproduction of housing since 2008 (and probably even for decades before that, honesty).

We are actually in incredibly good economic times, especially considering the massive destruction that the pandemic has wrought, and in the US, the lowered number of workers due to years of reducing immigration. I am glad people are not overly exuberant, but I with they were focused on the things that mattered more.


But most of all, the insane amount of money printing that went on during the pandemic.


If that were the case that too much money was printed, then one might expect broad economy wide price inflation, but instead it's really focused only in areas that have supply bottlenecks.

But too much money printing wouldn't cause the major auto manufacturers to majorly underproduce less than they typically do, and it wouldn't cause energy to go up. Of the 5.5% "excess" points of inlfation, the breakdown of cost areas is:

2.1 vehicles (of which 1.6 is used cars)

1.8 energy

0.7 food

0.6 housing

And except for food, there are clear supply bottlenecks there. For food, beef farmers have been complaining about monopsony from meat processing plants for more than a decade. There's likely a small amount of rentierism going on there. As there is for the housing crunch. (Though housing also takes a long time to respond to changes in demand patterns, such as the one induced by the pandemic)


That's the story for many decades now. It turned out wrong every time.

See for example: https://ritholtz.com/2019/08/death-of-equities-40th-annivers...


Very true. On the other hand, it was previously believed that the real estate market could never go down, which led to highly leveraged positions in that market from homeowners to banks.


Seems like the solution to the turbulent world we are in certainly isn't pick your own stocks or YOLO on crypto.


What does a broke person who will not be able to pay off their student loans for decades and who will never be able to afford a house care about being slightly less broke? Your life is a painful grind either way where you're just barely staying afloat. If you're stuck in poverty barring a risky long-shot hitting, then it's entirely logical and rational to take big risks with the little you do have.

The real problem isn't that stocks or crypto or any other financial tools exist, it's that so many Americans lack reasonable hope and opportunities for a better future outside of seeking out things that seem unthinkably risky to many people here.


Why not go to Vegas and play roulette then? At least there you know exactly what your odds and payouts are and there isn't a massive information asymmetry.

I just don't think saying "Don't put your money in ETFs where you can get returns of ~10% a year for 40 years barring mass catastrophe" is particularly valuable. Even someone putting 83$ a month into an SP500 index can expect to make almost 400K over 40 years. Whereas I would expect a person yolo'ing 1000 a year on random shitcoins and memestocks to lose $40K over 40 years.

Maybe I'm crazy but I think if you can find 1000 a year to throw away on pure gambles surely its a far better choice to invest that in something that's virtually a sure thing on long time scales?

Everyone is looking for get rich quick schemes which frankly short of starting the next Instagram in your basement simply don't exist.


This is great advice for a young rookie, Bogle would be proud. Folks later on in life may not have the timeline to stomach that risk, however.


But if those who are older need even less risk, the good option still isn't picking individual stock.


Yeah, right. Older rookies should follow this advice only if they want to invest that money for later generations.


Why S&P 500 specifically? Is it just because they have the lowest fees you've found? There are many index funds all over the world to choose from. What if I could find a fund with with even lower fees than VTSAX somewhere? I often hear "don't pick stocks, just buy 'the index'" - but you're still picking an index, aren't you?


> Buy S&P ETFs

Nitpicking but S&P has multiple indexes. And you probably mean just a total stock market indexes; not necessary S&P.


Yes absolutely… my fault, should have been more specific. I was referring to the S&P500 index.


This is such a bad advice. Buying an index is what they want you to do. They want you to buy and hold until you retire. Do you not see the problem with that logic?


And the sickest part of their whole plan is the part when you get to withdraw more money than you put in. Luckily, crypto solves this problem.


Of course you get to withdraw more money than you put in, because you owned productive assets.

Stocks are the middle class's ticket into the ownership class.


I think the previous post was sarcasm.


Ah thanks, that flew over my pre-coffee head. :)


One person's hodl is another person's holup.


The stock market is not a zero-sum game. Money-now is worth more than money-later to companies offering stocks, who know how to earn more money with that money. Long-term strategies simply take advantage of this fact to make long-term gains. Investments are just codified strategies on what ways you can put your idle money to work in someone else's hand.

Buying an index fund full of stocks at their current market price is no more illogical than running code you didn't write yourself. It's way way less work, it probably works better.

Better yet, trusting someone else's market price is much easier than trusting someone else's code because of the thousands of black-hat investors searching for profitable vulnerabilities in the market prices.


I don’t see the logic, can you explain this more?


Who is “they”?


Owners of the index funds, like Vanguard. And Vanguard, in turn, is owned by... wait a minute... oh no... I'm realizing I can't say anymore.


thanks. got it. I have no clue why you're being downvoted...


I’m not the biggest fan of Ben Evans, but he’s right on “privacy fanatism”:

> At a certain point EU privacy regulators will realise: When an EU citizen requests a US internet resource, they provide a US server with their IP address; An IP address is PII; The CIA could record that; Therefore it is illegal to provide any internet resource to anyone in the EU

Source: https://twitter.com/benedictevans/status/1492102034409066504

PS: saying this a German citizen…


Extraterritorial jurisdiction + global nature of the internet causes these problems. We've already seen lots of the reverse: it's illegal to provide gambling to Americans. https://en.wikipedia.org/wiki/United_States_v._Scheinberg

It's also legally difficult to provide bank accounts to Americans: https://www.thelocal.fr/20210924/why-americans-are-finding-i...

Then there was the whole incompatible court orders in re Azure: https://www.theverge.com/2018/4/5/17203630/us-v-microsoft-sc...

Really the only workable outcomes are a global agreement on internet-touching governance (which the US will never accept on principle) or Balkanization. Or I suppose an eternal chasing into new as yet unbanned services.


Thanks, that’s was really insightful. I wonder if global agreements are really unimaginable. There have been quite a few from the old days, e.g. international marine conventions. What do you think?


The last two data exchange agreements between US/EU were overturned. I think it's unlikely at this point unless the USA adjusts some of its surveillance laws.


That gets to the heart of it. Europeans are increasingly uncomfortable using US based services due to how the data is used. It is not inconceivable that there will be multiple Internets based on legal jurisdiction, we already see this with China.


Do you imagine the EU blocking EU citizens from accessing US services? I find that hard to believe. "We're blocking your access to the outside world for your protection" must ring pretty hollow to the people who vote. It works in China because nobody gets a vote.


Extra-territorial laws are one way of achieving the same effect. A logical next-step would be blocking websites from jurisdictions where such extra-territorial laws are unenforceable.

"This website is in a territory not subject to EU regulations governing privacy, security, and content. Do you wish to proceed?"


This would amount to a even worse cookie banner. I hope the EU has learned something from the embarrassment that is cookie banners.


Yes

> Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies that improve internet experience, such as cookies to remember shopping-cart history or to count the number of website visitors.

https://digital-strategy.ec.europa.eu/en/policies/eprivacy-r...


Nope. They are blaming the banners on the "greedy" websites. Not on the broken law.

Kind of like the current US government blaming inflation on... also the companies. Not the money printing.


My website has no banner, and is completely legal. I just use cookies for what they were meant for: As login cookie and to store preferences such as dark mode.

It’s not the EU law that’s broken. It’s intentional that if you want to sell someone’s firstborn you need actual approval and not a clause hidden in the ToS


> the embarrassment that is cookie banners

The idea is great, but shady websites make it so you hate it, so that you hate privacy laws instead of the shady companies tracking your children.


Its a responsibility that should never have been put on websites in the first place. The browser should handle it.

Cookie banners is akin to letting browser extensions create their own permission requests.


It is already a reality that you can't access certain US websites as a European. They block you out because they don't want/don't know if they comply with GDPR. Same effect.


This just demonstrates a level of cowardice on the part of those US-based companies. The extraterritoriality of the GPDR has not been tested.


I remember when the Great Firewall was considered the manifestation of evil by old-time internet users.

It'll be hilarious if European nations decide pursuing GDPR cases is intractable when so many services Europeans use are fully outside the country (and beyond EU enforcement of jurisdiction) and they decide a firewall is necessary to protect their citizens from American surveillance. It would prove China was just ahead of the curve.


Do we then also finally get some of our own internet giants that won't get bought out immediately?


Yup, Section 702 of the FISA act needs to be repealed in order for these judgements to not be relevant.

That's not to mention all of the other, non-legally justified analytics performed by the NSA/CIA etc.


I suspect there's a third outcome within crypto many are quietly pursuing. Looked through the lens of "what if the internet were its own country" a lot of web3 makes a bit more sense.

Or maybe I've read too many Neal Stephenson novels.


That was my "eternal chasing into new as yet unbanned services". The ban wave has largely caught up with big ICOs, but not with "governance tokens" or "NFT based communities".

There's going to be a cycle of "web3 gets big money", "big money fraud in web3", "SEC enforcement against web3", and then the launch of "web4" in 2030.


Crypto can never manage that because the infrastructure running it, the power needed to do that and all the people using it are in countries already.


There’s no issue with that. If a person manually takes their information and mails it to the CIA, that’s also fine.

The issue is if a person visits a resource from a company in the EU, they should be able to expect that that information won’t be passed along to any third party that’s not absolutely necessary. Especially not to foreign governments.

You wouldn’t expect a visit to latimes.com to leak your information to the Chinese Party either.


Maybe I'm just old-school, but I expect when I visit a site I'm leaking some PII (my IP address) to every router between my client and latimes.com to do with as they will.

I wouldn't necessarily expect the CCP to be involved unless Internet routing is having a very bad day, but I'd expect the American government to be involved when hitting an American server.


> Maybe I'm just old-school, but I expect when I visit a site I'm leaking some PII (my IP address) to every router between my client and latimes.com to do with as they will.

Presumably you don't expect the american government to get involved after your request has reached latimes.com though?


Technically, the only thing stopping them is SSH, and that can be handled (as Snowden publicized) by tapping latimes.com's systems on the other side of decryption.

Old-school me would not have expected that to happen. Post-Snowden? It's a definite possibility.


> Old-school me would not have expected that to happen. Post-Snowden? It's a definite possibility.

And... Is that a "favorable" (hope that's the right word, non-native here) thing?


It's neither favorable not disfavorable to me; it just is. Something I file away in the back of my head about how the Internet works right now. Individual uses can be favorable or disfavorable.

If I walk into a store and buy some gum, my face is on their security camera. If the cops are hunting for a murderer, they can pull that camera feed. Is this favorable? shrug. I like my privacy but I also like catching murderers. And I have no expectation of privacy when I step in someone's store; similarly, once I've shipped 1s and 0s to someone else, my expectation is they'll use them as they will, and if I don't like it I'll stop shipping 1s and 0s to them.

This is probably just my American sensibilities talking, but growing up in a culture where I was building a credit score before I knew what that was, I'm not surprised services like Google Analytics are e-gossiping on my preferences (any more than I'd have been surprised if two BBS owners, back in the day, gossiped about their users).


> The issue is if a person visits a resource from a company in the EU

Does it have to be a company in the EU? I thought the GDPR covered any website an EU citizen, resident, or visitor might use, in which case US-based websites might have contradictory obligations to the GDPR and US law.


It depends on Art 3.

https://gdpr-info.eu/art-3-gdpr/

Just because a website exists and may be visited by a EU resident, does not mean that the site automatically has to comply.


It will be hard for a lot of US media making deals with European advertisers to claim they’re not intended for use by European residents, though.


Is that not what 2(a) says- if a service is being provided to an EU data subject, that the regulation applies? At least, that is clearly what the EU seems to be claiming? Sure, if no EU data subject actually accesses the site, it doesn't apply, but the moment one does...


Well I mean think of a store which doesn't accept EU payment or ship to EU addresses, nor target EU residents with Advertising. You'd be hard pressed to say they service EU residents even if the site was able to be visited by EU residents.


No where in Article 3 does it say anything about "targeting" them- it only says if the "service" is "offered", whether or not payment is required. So in broad interpretation, simply serving a webpage to an EU data subject is an act of processing personal data (IP address) of an EU data subject related to offering them a service (the web page itself). That is as long as it doesn't fall into one of the carve outs in Article 2- https://gdpr-info.eu/art-2-gdpr/

It could be argued that such an act "falls outside the scope of Union law;" but that seems to be a matter of contention.


I think we have to look at Recital 23 through 31 they clarify what 'goods and services' mean.

https://gdpr-info.eu/recitals/no-23/


Thank you, that does seem to alleviate some of my concerns as above. I'm not as familiar with EU law, it seems that recitals aren't legally binding equally with the "operative" text. But given the context, it seems unlikely a small blog or web shop that doesn't target EU customers would be in scope.


Recitals play two roles in EU law:

1. They are the legal justification for legislating; The EU is not sovereign, so it cannot legislate of its own accord, the EU must show that the legal powers flow from the treaties. So recitals set out which provisions of the treaties apply, and why the legislators think the law is necessary under them.

2. They are an aid to interpretation; the main body of the law should be read "in the light of" the recitals to understand the legislators' intent and to help ensure there is a consistent application of the law between all of the different courts and tribunals in the EU. These recitals are, of course, not part of the actual legal text and are thus not binding, but they're not inoperative.


They're not legally binding since they're written to be understood as clarifications for the lay-person. Ie, not written in the strict language that courts understand and hence, you might hit edge cases the courts might interprete in ways that you don't expect.


It seems somewhat strange that a company selling a service to EU customers might be in trouble for using Google Fonts in a jurisdiction (e.g. Germany) where there are ways to identify a user by means of IP address [0]; but a weblog that was using Google Fonts might not be, since it's a blog and not a goods-and-services site. Google ends up with the IP address equally in both cases.

[0] https://news.ycombinator.com/item?id=30135264


The US isn't going to enforce GDPR violations, so why does it matter?


Do they have a TikTok?


Well, the obvious responses here are that (1) the law does no such thing, and (2) even if it did, the right target for public concern should be the CIA and the government theoretically controlling its behavior, not the EU.

Even if it came to a point where the EU decided that the only for to keep its citizens safe from US intelligence monitoring were to cut out all access between EU and USA internets, the problem would be the US intelligence framework, not the EU.


Nope. Because legitimate interest kicks in there - you can’t provide the requested service without the IP address. At all.

Turn off Google analytics and you can still provide the service.


Really you should just stop using Google analytics. I know all the data is really fun to look at and can even be useful but it’s a bit like poisoning people just for walking into your business.


> I know all the data is really fun to look at

bit of voyeurism as well


You most definitely can provide a service without having a US IP address. Many services have IPs and servers in the EU instead of the US.


He is not right. Does anyone really think that EU regulators don't know that every request provides the server with an IP address?

Will they start sueing every US company that doesn't comply with GDPR? Of course not. The EU is doing this to build pressure against the US and their surveillance fetish. And it's good that they are, because otherwise, who will?

The US government has proven time and over again that they do not care about their citizens' privacy and straight up lie to their faces. And then there is the CLOUD act, which now starts to affect non-US citizens, too.


IP address by itself is not considered PII (at least not yet).

Context matters. IP address along with other information could be considered PII.


There were rulings finding IP addresses by themselves are already PII[0], because an IP address might be tracked back to a person. E.g. an IP address can potentially be used to go to an ISP and request the subscriber information, and the subscriber information potentially identifies the user of the IP address at a given time, if the subscriber cannot name anybody else who could have reasonably used used the IP address at a given time. Courts found that this abstract risk is enough to qualify IP addresses as PII, as they can potentially identify people indirectly.

The recent German ruling about loading Google Fonts without prior consent explicitly mentioned these rulings and made them a core part of their own conclusions.

[0] The most important ruling is the Breyer ruling (C‑582/14), that found, answering question one, that "dynamic" IP addresses are PII. Further rulings have regularly found that "static" IP addresses are PII, and that you cannot really know what is a "dynamic" and a "static" IP address with reasonable certainty anyway.

"Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person."

https://curia.europa.eu/juris/document/document.jsf?text=&do...


These rulings are about personal data, not PII. Please don't confuse the two; it's extremely relevant for IPs.

They are personal data because they are a fact about an identifiable person and thus fall under the GDPR's processing requirements esp. relevantly when transferring to third-parties; but they are not per se PII.


Do we have a ruling that IP address alone isn't PII? I thought the opposite was true.

https://www.fieldfisher.com/en/services/privacy-security-and...


Exactly right.


Yes, taking it literally at the extreme case, the rule is unreasonable.

But Google Analytics is the kind of thing the Law was created to stop, it's not an unreasonable unintended effect.


> ... When an EU citizen requests a US internet resource, they provide a US server with their IP address; An IP address is PII; The CIA could record that; Therefore it is illegal to provide any internet resource to anyone in the EU

Forget that. An EU user visiting an EU site might have their packets routed through an entity outside the EU anyway, without their intent and certainly without their explicit consent.


An IP address is personal data, it’s only PII in combination with other data. Don’t collect the other data if you don’t need to.


> it’s only PII in combination with other data

It’s always PII for static IPs, and together with a timestamp it’s also PII for dynamic IPs...


I think you're confusing personal data and PII.


An IP address can legally identify a person, e.g. in the industry of lawyers sending cease & desist notices (and taking you to court) if you torrent something.

There’s a whole bunch of legal precedent for that in the EU.


Providing the IP address for the communication channel is quite obviously necessary and does not require explicit consent.

https://gdpr-text.com/read/article-49/#para_gdpr-a-49_1_1b

> In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, [...] a transfer [...] of personal data to a third country or an international organisation shall take place only on one of the following conditions:

> [...]

> (b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request

> [...]

GDPR does not forbid providing internet resources to EU users, that is simply a lie. All it requires is that data handling happens in the best interest of the user.


True, but storing the IP address server-side for purposes other than serving the HTTP request doesn't fall under (b).

Diagnostic logging (e.g. apache logs) is probably okay as long as the organization can show that these logs are destroyed in a reasonable timeframe, but FAFAIK even that is legally a gray area (in the sense that it isn't explicitly forbidden nor allowed).


Diagnostic logging is ok as long as you have a sane retention policy.


Recent court orders in Germany and France beg to differ.


Opening a communications channel to a third party, e.g. a shady spyware company like Google, requires content, which makes sense.


I don’t remember any case related to accessing first party resources, can you give a link ?



That case is not about accessing first party resources. It was about a German website which (effectively) shared data with a third party provider from a country with no adequate privacy protection.


Well, the other side of the coin is US intelligence agencies monitoring and collecting all traffic, far outside its jurisdiction.


What's next, Twitter geniuses realizing it's also not legal for the CIA to poison people in foreign countries? Supply weapons to militias? Trade narcotics?


That seems a ridiculous interpretation. US companies liable for actions performed by the CIA? Forget GDPR, the entire population of the USA is guilty of war crimes.

If the CIA required web sites to explicitly include a privacy invading snippet, even then it is dubious since it is under duress. And in any case, exactly the sort of stuff you would want laws like GDPR to hinder.


That is false. Businesses outside EU are not bound by GDPR.

The problem is when websites in EU, which are expected to follow GDPR, randomly leak information to businesses outside EU.


> Businesses outside EU are not bound by GDPR.

Business outside the EU, interacting with users in the EU are bound by the GDPR. There might not really be a way (currently) to impose penalties on those businesses for violations, but they are certainly bound by them.


This is such a weird argument. Let's say those things are true (and I think they are reasonably true).

- When an EU citizen requests a US internet resource, they provide a US server with their IP address

- An IP address is PII (well, personal data as far GDPR is concerned, but that's a nitpick)

- The CIA could record that

I don't think how you would go to a conclusion from those that "it is illegal to provide any internet resource to anyone in the EU".

First, it's worth noting that GDPR only applies to companies that specifically target its services at individuals in the EU. Targeting means having an EU office, using an EU domain, providing EU languages such as Polish or allowing payments in EU currencies. If your service makes no effort to provide service specifically for European users there is no need to worry about GDPR - even if you are in the US.

Second, while US services targeting individuals in the EU are legally problematic, this doesn't affect other countries - so I see no reason to say "any" here. For example, a Japanese server is free to provide services at individuals in the EU provided they comply with GDPR as EU has an adequacy decision for Japan.

Also, I would like to point out you can replace US with North Korea in this argument. I think it would be ridiculous to say that if European Union were to disallow sending personal data to North Korea (including IP address) then it would mean that it's illegal to provide any internet resource to anyone in the EU.


> Targeting means having an EU office, using an EU domain, providing EU languages such as Polish or allowing payments in EU currencies.

Nope. There's only a single requirement: having EU users.


GDPR recital 23 says the following:

> In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: