Conversation

Notices

1. Embed this notice
   Debacle (debacle@framapiaf.org)'s status on Wednesday, 12-Feb-2025 23:12:57 JST Debacle

   in reply to

   • kravietz 🦇

   @kravietz

   "And I don‘t know a single #sweatshop happy about #labour safety laws either."

   "And I don‘t know a single #pimp happy about #sexworkers rights either."

   "And I don‘t know a single chemical #waste dump happy about #environment protection rules either."

   If #JDVance criticises our #GDPR, the #EU did it right!

   #privacy #humanRights #EUpol

   • Embed this notice
     kravietz 🦇 (kravietz@agora.echelon.pl)'s status on Wednesday, 12-Feb-2025 23:12:59 JST kravietz 🦇

     As JD Vance delivered his speech about “European overregulation” and criticized “endless compliance costs imposed on the US companies by GDPR” I have seen some voices from Europe who said something to the effect “I don‘t know a single EU company happy about #GDPR either”.

     Well, it’s kind of obvious companies aren’t happy because GDPR was not made to make companies happy but to protect the privacy of consumers 😄

     This regulation is based on fundamental differences between US and EU legal systems. In EU, you own and control your personal data. In US it’s owned by whoever managed to extort it from you, and then aggregate, personalise and resell to any other entity anywhere.

     For example, if you want to pay higher insurance premium because you have genetic tendencies to diabetes or obesity - well, that’s the US way of doing business, but it’s not the only one, nor it’s somehow axiomatically “better”. And yes, high insurance premiums also have the effect of increasing overall country’s GDP, just as a house burnt and rebuilt also does this magic, yet somehow few people celebrate it 😉

     Then someone asked me if I really “feel that my data is better protected thanks to GDPR”. And yes, as a matter of fact the most invasive behavioural profiling aren’t being rolled out by companies like Twitter or Facebook to EU specifically because of GDPR, while in US they just roll them out without asking anyone.

     Anyone… of course except for the states which have regulations very similar or even more restrictive than GDPR, such as California. Yet, because California is “their”, these companies and their CEOs with high media presence simply shut up and make their apps compliant with CCPA without all this barking about “how GDPR kills out business”.

     It’s the same with EU VAT, about which Vance also whined, whereas US sales tax accounting rules are not even harmonized across states. But hey, you know what? An US business that has to emply a tax consulting company to get multi-state accounting right also increases overall GDP! 😄

     So effectively what in US is perceived as each state’s fundamental right, sign of their diversity and key part of their autonomy, in the EU is portrayed as something equivalent to Soviet Union style central planning. And when they post all the memes about “bottle caps” in EU, they of course never mention a gazillion of state-level archaic or absurd regulations which are nonetheless binding, especially if someone likes to build a class lawsuit around them.

     And now as Tesla opened a new factory in #China, I’ve never seen Musk make a single critical remark about the overregulation in China, even though it’s even more complex than EU and US taken together due to its vast geographic and administrative diversity.

     GreenSkyOverMe (Monika) and Aral Balkan repeated this.
   • Embed this notice
     7666 (7666@comp.lain.la)'s status on Thursday, 13-Feb-2025 01:08:43 JST 7666

     in reply to

     • kravietz 🦇
     • divVerent
     • SamuelJohnson
     @divVerent @kravietz @samueljohnson >run ssh scanbot on all IPs announced by an ASN
     >generate thousands of lines of logs on anything listening
     >ask for log lines to be removed under GDPR
     >network operator tells you to fuck off
     >sue for damages
     >rinse and repeat
     
     time to get rich off the backs of europeans bois
     ✙ dcc :pedomustdie: :phear_slackware: and Fish of Rage like this.
   • Embed this notice
     divVerent (divverent@blob.cat)'s status on Thursday, 13-Feb-2025 01:08:45 JST divVerent

     in reply to

     • kravietz 🦇
     • SamuelJohnson
     @samueljohnson @kravietz It's not been decided by a court, but:
     
     - SSH port is open to anyone.
     - Anyone who connects to it - and be it by entering http://ipaddress:22 in the browser address bar - will cause log lines to be written.
     - The logging includes the source IP address, which is generally considered PII.
     
     As such, it quite obviously falls into the scope of the GDPR.
     
     As for the logging of the IPs itself, that clearly falls under "legitimate interest" as per Article 6(1) GDPR - so that is fine per se.
     
     Art. 13 GDPR is the real problem with SSH - the right to be informed. The protocol doesn't even provide a _way_ for the connecting individual to be informed about these things.
     
     Clearly the authors of the GDPR did not _intend_ to place 20 million EUR penalties on private individuals who happen to run a vserver with SSH access. And I also presume it won't actually be _applied_ like that. But ultimately it depends on whether someone will file a GDPR compliant, and how the DPA will treat that report. I suppose unless a wild #Gravenreuth appears, people should be safe.
   • Embed this notice
     SamuelJohnson (samueljohnson@mstdn.social)'s status on Thursday, 13-Feb-2025 01:08:46 JST SamuelJohnson

     in reply to

     • kravietz 🦇
     • divVerent

     @divVerent @kravietz Running SSH on your own server is illegal? Got a credible citation for that?

   • Embed this notice
     divVerent (divverent@blob.cat)'s status on Thursday, 13-Feb-2025 01:08:47 JST divVerent

     in reply to

     • kravietz 🦇

     @kravietz My problem with GDPR is the opposite - namely how it harms big corporations least.

     For example, me running a SSH server on my personal vserver became technically illegal as the SSH protocol does not support the necessary disclosures, and happily logs every login attempt to the system log (where it tends to age out after 7 days as no one ever looks there anyway unless something is wrong).

     I am aware that this kind of log would be permitted under the GDPR if it were properly disclosed. I would also be required to disclose my home address to the entire world just because I run SSH.

     IMHO the very least GDPR should have done would be an exclusion so entities that do not use data in a way that requires explicit permission do not need to comply with the disclosure, legal entity etc. requirements. Maybe further conditioned by not making any profit.