Hacker Newsnew | past | comments | ask | show | jobs | submit | cstpdk's commentslogin

The content of that link sounds fine in terms of GDPR if one only uses the EU servers. Am I missing something?


I read it differently, especially in light of Schrems II. EU-datacenters from any of the big US-based providers does not automatically make you comply either.


As I read it the issue is that the American HQ can order their European subsidiary to provide the data.

Hetzner US does not have a European subsidary and therefore cannot violate GDPR (assuming US personal can't access EU customer data).

Hetzner HQ is in Germany and is not allowed to enforce the CLOUD Act outside the US


That could also be correct.

But if I was under legal/contractual obligations, with Hetzner as my hosting provider, I would have their legal department confirm this.

Since Hetzner found the need for appending the paragraph I referenced, they must have become aware of something.


True.

Now that they are entangled with US law there might be an incentive to be as a cooperative as possible.

Yet, Hetzner is still a "better" option (with regards to data protection) than any of the big US-based cloud providers.


Not sure I follow, in what way are they better?

Imho, as soon as you do business with the US or trade in US Dollars, you need to play nice with the relevant authorities.

If I understood it correctly, Hetzner is now "infected" in the same way as the three US cloud providers are. The Schrems II verdict and Cloud ACT basically concludes that no European company can exist in the US and vice versa without having to deal with the same pesky legislation.

An alternative could of course be that Hetzner created a new US based company where the EU parent Hetzner company only holds a minority ownership in the new US-based company. The EU based parent company in turn then "sells" its technology to the new US company. This way, the arrangement becomes more reminiscent of how IBM has sold its mainframe to European companies...


Why would it matter at all if it's a minority or majority stake in the ownership of the US subsidiary? As far as I understood it the combination of GDPR and CLOUD act only disallows the combination of US mother-company with EU subsidiary, but the inverse should be fine, since the US has no legal influence over the parent company?


The US-based cloud providers also have European subsidiaries. But that doesn't help because they are bound by US law. That is the root of the problem.

What makes you think that a European company operating within US jurisdiction would not be subject to the same laws?

If the European company receives a request from the US authorities for information, they need to follow the same legislation as the US companies do. Just because it's a subsidiary won't help. The authority will say "we want to know everything you know about the following person, please give us the information, otherwise...". The authority will not distinguish whether it is a subsidiary or the parent company.

Of course have the choice to just ignore the request from US authorities, but then you have to be aware of the consequences, i.e. quickly give up and shut down the subsidiary and stop trading with US dollars.

This is the root of the problem. CLOUD act has been ruled illegal in the EU just as you said, but it is also illegal not to comply with CLOUD act in the US. And companies operating on both continents in practice need to comply with both laws, regardless of whether it is a parent company or a subsidiary.

At least that's how I interpret it...


Are there any cases of the US nationalizing/seizing companies outside of sanction/war-related acts? Which would probably the only consequence the government can directly levy against the European company (the indirect ones they can also apply to pure European companies, so they don't really matter for this discussion).

But it really depends on how infectious just owning a company is, which I have no idea. But my gut-feeling is that it shouldn't be too infectious, since otherwise just buying a single share of a company operating in another country would put you into legal peril (who controls the subsidiary here is not really relevant, since the Cloud act wants to swim in the opposite direction in your scenario, therefore it shouldn't matter if it's 0.01% or 100%).


What's that tablet looking device your using in the video and why is it not the lisperati? :) Also, are you done with Common Lisp and more into Clojure now?


Lisperati is still happening

Definitely all in on clojure now (well, I also like zig)


You got the charges wrong. It's speculation on my part because it's kept secret, but all journalists in Denmark more or less agree that he is held for leaking information on the NSA partnership and two other stories involving the intelligence agencies (one about an agent being left in jail in Spain and one about a withheld security assesment of refugees held in camps in Syria). This is based on which journalists got interrogated and what stories they have brought to light


FTD = Frontotemporal demensia?


FTD: https://ftd.dev/language/. A DSL for creating "programmable prose". Markdown with data declaration, event handling and soon arbitrary computation.


There are many rendering issues on their landing pages.

Things like unreadable elements with near 0 contrast between font and background and a dark mode with pieces of widgets with a white background does not fill me with confidence for a UI focused technology.


Yeah this has to be some sort of joke, I can't even read what 80% of the sidebar on mobile, and it crashes my phone every other page.


Hey, can you tell me what phone you are using and what exactly do you mean by "crashes my phone"?

Thanks for the design feedback. The theme is new. The language itself is new. The static generator is new. Sidebar issue on mobile, and contrast issue we are aware of and are working on. Markdown styling is not a trivial issue to fix as we do not allow authors or theme builders to access CSS directly, [1] is the design we have come up with.

[1]: https://fpm.dev/journal/#markdown-styling


If anyone from FTD is here, the site has some text issues on dark mode:

https://i.imgur.com/CfI5lPC.jpg

It looks fine on light mode:

https://i.imgur.com/oJPMkUZ.jpg


Thanks vsareto for reporting the issue, we have made some improvements. Appreciate it.


Oh, THAT FTD. Right.


They are neither bribed or blackmailed, every danish government for the past 20 years have been informed about this agreement and has complied. It's absolutely a crime against the population (since innocent Danes are also being spied on). The reason the politicians are complying is that we are reliant on US for military support through Nato (which I guess you can call a bribe, of sorts)


It shouldn't. There's no political gain for any of the major parties. It also happens after several, relatively minor, cases of corruption and nepotism in the military and intelligence services (former high-ranking official just got 3months prison today). It stinks mostly of a corruption and several decades of lack of proper oversight


What kind of targets is he accused of targetting?


Danish citizens which is only allowed to be done by the police. And withholding of information to be reported.


Is it related to that Iranian kidnapping plot that led to Denmark being shut down for a while the other year? (Only because it's the most dramatic thing to happen there in a bunch of years, that would be related to the intelligence service.)


The grounds of accusation are kept secret as it is based on confidential information.


Are there "kinds" that are not covered by the law and are more okay to have their rights abused?


The intelligence agency involved here is the military intelligence as opposed to the police intelligence. Think CIA vs FBI.

The military intelligence are allowed to do whatever it takes to defend against foreign powers, but they are not allowed to gather intelligence on Danish citizens. If they uncover something that involved danish citizens or internal threats in the course of their work they are supposed to hand it over to the police intelligence service. As I understand part of the scandal is that this has not happened, compounded by active measures to cover things up towards the oversight committee.


I have no idea (I'm Swedish, not Danish) what all of this is about. That's why I'm asking. I don't like what you're implying.


Well, the article says that they are accused of spying on danish citizens and providing the results to foreign entities without authorization or legal base. You ask what were the targets implying that it matters and some "targets" are not as equal as others. Sorry if I've gotten you wrong.


I checked https://www.reddit.com/r/Denmark/comments/ifkfsi/tre_ledende... - seems like noone really understands what's going on. Internal drama?


If you can read Danish you see what information the public have been given here https://www.tet.dk/wp-content/uploads/2020/08/PRESSEMEDDELEL...

Here are the points I think are highlights:

> That FE has on several occasions since the Authority's establishment in 2014 and until the summer of 2020 - in connection with, among other things, the Authority's specific inspections and meetings with the head of FE - has withheld key and crucial information for the Authority and given the Authority incorrect information about the service's collection and disclosure.

> That there is an inappropriate culture of legality in FE's management and parts of the service, where the service's possible unjustified activities or inappropriate circumstances are shelved, including by failing to inform the supervisory authority of matters relevant to its control.

> The submitted material indicates that FE, prior to the establishment of the Authority in 2014, has initiated operational activities in violation of Danish law, including by obtaining and passing on a significant amount of information about Danish citizens.

> That FE has unjustifiably processed information about an employee in the supervision. (TET)


But, correct me if this has changed please, last i checked Cloud Run did not support private networks. So you SQL instance has to be exposed to the internet, correct?


Your Cloud SQL instance would have a public IP, but would not be exposed to the internet. All traffic is blocked by default. Only GCP service accounts with the right permissions can make connections to your SQL instance, or IPs added to a whitelist (not recommended).


Ah, thanks for clearing that up, I was unaware. How is the traffic blocked by default? Firewall layer?


Yes. There is a proxy in front of the database which only allows whitelisted traffic (dangerous) or traffic with a valid cert (safe).


Yes, Cloud Run requires your Cloud SQL instance to have a public IP address.


Copenhagen has about the same salary ranges as quoted in the article. Taxes are a higher, but healthcare is free and foreigners can get 3years of 25% flat tax rate if you get a tech job (based purely on income, I think). Living costs are lower than Switzerland, I rent 100sqm for about 1900EUR. Good cheese is more readily available in Switzerland though


What's your evidence that train journeys have gotten more expensive in Norway due to this?

FWIW i am Danish and almost all of our public IT projects are done in .NET, almost always the reasoning is "more developers, more mainstream, less lock-in". Our IT projects are always hilariously belated and more expensive than budgeted. More often than not the same contractor (one of 5ish big corporations) keeps getting the same contracts from the same departments because they have pre-existing knowledge of the system they previously built (hint: this is lock-in). Now, the last part is changing somewhat due to EU tender rules, which I think Norway also abides by (they are not in EU, but are committed to complying with most EU laws)


Isn't being locked to one of five big vendors that do .NET a bit better than being locked to the vendor that does Elm, though?


`For one I'm not really that interested in other people, and secondly I find it really boring`

I am totally with you on both points. The important thing to realize is that it is uninteresting and boring, but that is not the point. It is a skill like many others, if you want the benefits it brings, you have to learn it through practice and however else you normally learn skills


"Act as if others are interesting and you will eventually find them so." - Sarah Mei, quoted by Sandi Metz, when summarizing I believe Dale Carnegie's "How to Win Friends & Influence People"

Sandi's talk was called "You Are Insufficiently Persuasive" and she talks a good bit about this idea, starting with that the unhappiness of programmers primarily comes from other people, and that if only we could make them behave the way we want them to act, we would all be much happier. This is one of those Sandi talks I've listened to a few times more than once, and I recommend watching it all the way through, if this is an interesting idea for you.

But to spoil it just a bit, after the major arc of the talk it is suggested that the way to get people to act better is to first change your own behavior, and that it's also often helpful to question whether your way is actually right.

I haven't actually watched this particular talk in a while, so I'm interested to see if others who did have a different interpretation, and whether you think I got it right.


Hmm, this sounds a bit naive. I'm struggling with this for my entire life, and only a certain amount of alcohol helps me to do chit chat. But after the chit chat I always regret some things I've said, the whole thing is just rubbish. I simply don't like it to be forced to talk shit. I'm quite certain it's not a learned skill, it is pretty default for the most stupid people around us.


Concluding that something is not a learned skill because it comes easy to some is illogical. Human upbringing consist of a lot of social interaction (at least when done right), it is only fair that some people actually get good at it.

Anyway, I should probably have disclaimed my first comment more loudly: it's anecdotal. For me smalltalk is absolutely a learned skill. I used to suck at it, now I can get by, and it took a lot of conscious effort on my part. YMMV


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: