HN user

stevetrewick

1,286 karma

Former dark matter programmer, analyst, startups to large multinationals. Currently indy Mac/iOS dev and part time tennis coach. Occasionally take interesting consulting gigs (reverse engineering, legacy system hacking). Cat person.

Posts11
Comments313
View on HN

No. This is a fundamental misunderstanding of the law. IP addresses are considered PII if and only if they can actually be legally used to identify an individual. And even where they can be, what on earth are you doing with them that you imagine is non compliance?

IP addresses are only PII if you are able to actually use them identify an individual.

The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if:

there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual. [1]

So once the account info is deleted, that link is broken. This another piece of DP legislation that has been subject to a great deal of FUD since most of the headlines just went with ‘court confirms IP address are PII’ and omitted ‘in some cases’. TBH, this was already pretty explicitly obvious from the legislation defining Personally Identifiable Information (hint: clue’s in the name).

[1] https://www.whitecase.com/publications/alert/court-confirms-...

You make this assertion elsewhere in the thread. It is incorrect. The entirety of the legislation is 88 pages long and it is really quite straightforward (full link preserved) [1].

Here is a set of (easily available) interactive tools, explainers and guidelines from ICO in the UK which explicitly outline what compliance looks like and what steps you can take to achieve and demonstrate it [2]. It’s available as a 162 page PDF, if you insist on counting pages, but much of it relates to the processing of sensitive data or data relating to children which the majority or orgs can skip.

[1] http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...

[2] https://ico.org.uk/for-organisations/guide-to-the-general-da...

I think everyone can understand why it's been done. Because parliamentarians have looked at the legislation and come to the conclusion that it would infringe on what they believe to be their legitimate privileges.

It's just that they don't believe those same privileges should extend to everyone else.

Note the use of the word 'privileges' rather than rights, because once parliament starts making that distinction between groups that have them and groups that don't that's exactly what they become.

Guess we're about to find out. The current government (albeit with a different (arguably more liberal) PM) has already revealed it has a desire to criminalise any crypto it can't decrypt. Because paedos and terrorists. That kind of legislation seems a natural outgrowth of this, once they find a 'think of the children' case to use as leverage. That's why we worry about the 'thin end of the wedge'.

To make you censor yourself so they don't have to. Same deal with the porn one. There was a piece by Alec Muffet not so long ago discussing the consultation process for age verification. All those involved knew that the headline group (teenagers) the law was supposed to protect were by far the most likely to circumvent the measures, so any such system is essentially not fit for its stated purpose.

Even if the intent is to play well with the authoritarian and/or socially conservative portions of the electorate, the effect will still be self censorship.

My SO and I both have to undergo enhanced disclosure and barring service checks on a regular basis for our jobs, one of which is in education. The UK Department of Education just effectively prevented Milo from speaking at his old school 'because extremism'. So how should I be feeling right now about following links from Reddit or other forums discussing US electoral politics that might lead to Breitbart? What if there's another situation like Sad Puppies vs the Hugos and I'm trying to get a picture of what's going on and I click on a link to find a Vox Day equivalent? Did I just endanger one of our prospects for future employment? Hard to say. Will using a VPN service get us tagged as 'something to hide' and affect our eligibility to work with children and vulnerable adults? Don't know. Worth betting someone's career on?

"To ensure they do not succeed, we do not comment publicly on the methods or capabilities available to the security and intelligence agencies."

Oh but you don't need to, because it's obvious. All my encrypted traffic to my overseas based VPN will be logged (legal). Then you'll demand my keys so that you can decrypt it. If I don't or can't comply then I will be - by definition - a criminal and potentially a terror suspect.

Which is why 'just use a VPN' is not really a satisfactory response to this kind of legislative landscape. Just doing so paints a target on you.

Which is not to say I don't appreciate the VPN providers stepping up, the more VPN users there are the more expensive it is to persecute them individually.

Yeah, we got that part from the original. To qualify as a joke I would have thought there needs to be a punchline that allows it to transcend lazy stereotyping. "Ha he means gold diggers" isn't adding that.

The HN audience likely sees a number of potential readings in context and is interested in which particular one you and GP have chosen to reify. It's unlikely (as shown by negative comments) that the community approves or agrees with all of them.

I imagine that when the very first computing systems were being built, some humans were still on parity / better than the new systems.

I mean I guess it depends on how far back you want to go. The early electronic systems (Collosus, ENIAC, the crazy relay boards and bedsteads in the Newmanry at Bletchley) were all pretty much built expressly to solve practical and immediate problems (breaking ciphers, calculating parameters for nuclear weapons) that would take too long or contain too many errors if done by hand. Babbage got his freak on because of error rates in (IIRC) log tables. My Mesopotamian history is a little rusty, but it's easy to imagine a similar development story for the abacus. (In the sense of 'tool to surpass unaugmented human in speed and accuracy of computation' rather than 'hacking crypto and nuke yields'). But I dunno. Maybe.

London, frequently. Try getting a cab from Hammersmith out to Roehampton and you'll get a stream of "I'm not going that way" responses. Simple economic reason is that the driver is unlikely to pick up a return fare (source: talked about it with a taxi driver)

But I don't want to hear sounds generated by the web audio API. So this behaviour seems entirely correct to me.

"In fact, the result still needs significant guesswork to decrypt."

I have never heard anyone other than the author of this piece suggest otherwise. Ironically, this result is trivial. That said, I have a pretty serious classical crypto habit, so my conception of what constitutes 'crypto folklore' may be poorly calibrated.

You could have no security and just get lucky and never get hacked.

It's been a decade and more since that was even remotely true (if it ever was). Back in 2008 the average survival time of an unpatched internet facing XP box was around 4 minutes [0]. Pwning an unpatched XP box was (very marginally) harder than pwning a system with no security at all. The Morris worm (Edit: which is heavily mentioned in TFA, my bad) [1] got loose in 1998. There's some interesting stuff regarding whether such risks are comparable with things we use insurance to hedge at [2].

[0] https://isc.sans.edu/diary/Survival+Time+on+the+Internet/472...

[1] https://en.m.wikipedia.org/wiki/Morris_worm

[2] http://limn.it/the-morris-worm/

The main source of your confusion stems from misinterpretation of the phrase "Tesla's solar roof" which is solar roofing material produced by Tesla for buildings rather than a solar roof for a Tesla automobile.

I'm a 'comments first' reader myself but TFAs are generally a must read for context and disambiguation before actually wading in.

pick one song and repeat it for the entire day

I also do this, one or a very short playlist of very similar stuff. Seems to help keep my mind locked into a particular state all day/work period. Currently long Daft Punk tracks are doing it for me.