Firefish but for real

Bill Statler

US, Wed, 31 Jul 2024 01:31:02 +0200 from Bunny of Doom

And in local news, a fish started a wildfire.

500 acres burned after fish dropped on substation west of Paterson

BENTON COUNTY, Wash.-About 500 acres burned west of Paterson after a fire reportedly started by a fish landing on a substation.

Rollerball

Wed, 31 Jul 2024 01:38:50 +0200 from varanda.online

🫨

lotfi

Wed, 31 Jul 2024 05:07:47 +0200 from Cirtensis

Oups, I got this when clicking on the link.

Bill Statler

Wed, 31 Jul 2024 05:24:58 +0200 from Bunny of Doom

That is the correct link, so I don't know what you got. Ads? Article not accessible?

Anyway, here's the text:

Jul 30, 2024 -- BENTON COUNTY, Washington (US)

About 500 acres burned west of Paterson after a fire reportedly started by a fish landing on a substation.

Fire crews responded to the area of SR 14 around milepost 157 around 10 a.m.

According to Scott Hawley, with Benton County Fire District #6, the fire is believed to have been started by sparks when a fish was dropped on the substation by a bird.

There is currently no fire burning at this time and no structures are threatened.

There is what appears to be some parts of a fish on the substation, according to Hawley, who said that while it is uncommon, it does happen from time to time.

lotfi

Wed, 31 Jul 2024 05:37:30 +0200 last edited: Wed, 31 Jul 2024 05:42:42 +0200 from Cirtensis

Thanks.
Apparently the https://www.nbcrightnow.com/ website is not accessible in Europe, but I don't know for what reason (GDPR?).

phanisvara (streams)

Wed, 31 Jul 2024 07:49:02 +0200 from phani on streams

Exactly. This is what my error message says:

451: Unavailable due to legal reasons
We recognize you are attempting to access this website from a country belonging to the European Economic Area (EEA) including the EU which enforces the General Data Protection Regulation (GDPR) and therefore access cannot be granted at this time. For any issues, contact news@kndu.com or call 509-737-6725.

We are cutting ourselves off from much of the world because we insist on following the rules we make up to protect this or that industry, but want to put backdoors into encryption to make sure we can have a proper police state eventually.

Mike Macgirvin 🖥️

Wed, 31 Jul 2024 09:02:45 +0200 from Y

Worked fine from Australia, but we don't have that pesky gdpr.

Waitman Gobble

Wed, 31 Jul 2024 13:54:52 +0200 from Get Ready To Rumbly

The amusing thing is GDPR protects EU citizens regardless of geographical location, as I recall Facebook just decided it meant anyone in the boundaries of the EU and others followed suit. So really they need to ask a user if they are an EU citizen i think

Haakon Meland Eriksen (Els Mussols)

Wed, 31 Jul 2024 22:29:23 +0200 from Streams at els Mussols

No, the GDPR protects in its area only, Europe, minus those European countries that are not a part of the EU or EEA.

Waitman Gobble

Wed, 31 Jul 2024 23:12:38 +0200 from Get Ready To Rumbly

maybe but i think it depends on what they mean by "residence".. The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.

phanisvara (streams)

Wed, 31 Jul 2024 14:04:05 +0200 from phani on streams

in order to protect me if i connect via VPN, ssh -d -- tunnel, or the darknet they'll have to break the encryption of those; makes perfect sense

Bill Statler

Thu, 01 Aug 2024 00:07:30 +0200 from Bunny of Doom

Airborne fish causes international legal crisis

hosh

Thu, 01 Aug 2024 06:25:59 +0200 from hubzilla

The GDPR does apply outside Europe?Does the GDPR apply to companies outside of the EU? - GDPR.eu

Under certain conditions, the GDPR applies to companies that are not in Europe. In this article, we’ll explain when and how the GDPR applies outside the EU. The European...

Bill Statler

Thu, 01 Aug 2024 07:25:31 +0200 from Bunny of Doom

Good article, thanks. But I still haven't seen an explanation of -- what would it be, international law? -- that gives a government any legal power to regulate someone who is not under that government's authority.

I expect I have violated regulations of Iran and North Korea repeatedly online. And I also expect to be immune from their regulations. Why should the EU be any different?

phanisvara (streams)

Thu, 01 Aug 2024 07:42:19 +0200 from phani on streams

you're immune from their regulations until you visit those countries or do business with them. then they could bring up those violations and shoot you on sight, or fine you. i expect these regulations aim for the big fish that does lots of business inside their jurisdiction. but could be applied to you or me as well if that looks like a good idea.

Waitman Gobble

Fri, 02 Aug 2024 07:02:49 +0200 from Get Ready To Rumbly

AFAIK the intention of the GDPR is to protect EU citizens (regardless of residence) and not specifically to police and enforce rules on corporations, etc. As I understand it begins with a complaint by a citizen, which is then investigated and reviewed. So any business that keeps data about an EU citizen should be aware of the rules. Many entities just flat-out block EU traffic, however in my opinion they are not only overreacting they are also still exposed. But it depends on what the company is doing with the data and how responsive the company is to deleting the data on request.

Years ago we would sometimes rent our list to companies like Victoria Secret and Frankies of Hollywood (maybe i spelled that wrong) and we would rent their lists sometimes. If you see lists for sale online they are pretty much scraped worthless crap. Real companies rent to other real companies. So anyway we never wanted Europe in the list and the other companies neither, it just wasn't lucrative in the specific business. Way before GDPR. Every once in awhile someone would get torqued and flip out and threaten to 'report it'. But really who would they report it to. But one thing is certainly we didn't want to send to people who didn't want it, it's a total waste. Sending spam is not lucrative.

California has what's considered strict privacy law but if you read the text of the law it applies to a handful of companies (i think 40 million dollar+ companies and they have to make 'most' of their revenue from selling personal data)

The big wide gaping holes in the thing are merchant processors and shipping vendors, who know what a huge demographic is buying, have all the contact info, and don't have any specific agreement with the customer, the consumer buying the stuff.

GDPR is different, a citizen has a 'regional contact' they can easily complain to, and they can report the tiniest issue even with a single person, doesn't have to be a corporation and it will likely get some eyeballs on it scrutinizing to check it out.

Haakon Meland Eriksen (Els Mussols)

Thu, 01 Aug 2024 08:16:46 +0200 from Streams at els Mussols

As a citizen of the EU/EEA and personally identifiying data about you is registered by an entity offering services in the EU/EEA, then the GDPR is the legal framework that grants you legal rights regarding privacy. You then go by the role of the Registered.

The Data Controller is a legal entity that must have a legal reason to control your personally identifiable data before collecting it, e.g. a local authority.

The Data Processor is an external legal entity controlled by the Data Controller, e.g. a supplier/vendor company.

There can be a chain of known sub-Data Processors bound by the GDPR, i.e. sub-contractors.

The Data Controller is responsible for keeping your personally identifiable data safe. This is easier said than done.

A Data Processor in the EU/EEA owned by companies outside this area can become a legal headache for the Data Controller and you as the Registered, e.g. if the laws of the home country of the Data Controller allows its government to inspect the data in the company's EU/EEA data centres, in effect making the GDPR null and void in its own domain, e.g. USA's government vis-a-vis GAFAM data centres in the EU/EEA. The GDPR came after the US's NSA fucked up by spying on everyone rather than specific someones. USA needs to fix this to remain competive.

The Data Controller, its legal Data Processor and its legal sub-Data Controllers need to have their ducks in order, which applies to support, operations and development of the service offered in the EU/EEA. This is easier said than done too. Where is support coming from into the EU/EEA 24/7/365? Are all parts of the service offered in the EU/EEA hosted in the EU/EEA or are all or parts of it hosted outside and thus difficult for the Data Controller in the EU/EEA to comply with inspection rules of the GDPR? Does development only happen using dummy data or does it happen that live data must be seen to fix difficult problems and in both cases is development happening within the EU/EEA or outside the boundaries of the GDPR?

hosh

Thu, 01 Aug 2024 07:44:21 +0200 from hubzilla

I think we only hear of cases being brought against big companies like Google and Amazon. I don't know whether breaches have been prosecuted against smaller ones. Evidently it somehow is possible for the EU to win such case though, because those mega-companies pay-up. We all had similar questions about legal jurisdiction when the US brought charges against Julian Assange

https://indianexpress.com/article/technology/tech-news-technology/eu-list-of-tech-laws-with-brief-overview-9444281/

https://www.bbc.com/news/business-58024116

https://www.bbc.com/news/technology-57011639

phanisvara (streams)

Thu, 01 Aug 2024 07:50:05 +0200 last edited: Thu, 01 Aug 2024 07:50:26 +0200 from phani on streams

Evidently it somehow is possible for the EU to win such case though, because those mega-companies pay-up.

they pay because what they earn in the EU is much more than that. anyone who keeps sitting outside the EU, does no business with them, and does nothing that's illegal in his or her own country can't be in danger of being prosecuted.

phanisvara (streams)

Thu, 01 Aug 2024 07:59:11 +0200 from phani on streams

if you're not in the EU but cater to someone who is, i.e., a user of your server living there, you fall under that law according to what they say. they can fine you a trillion $$ if they like, but if what you're doing is not illegal in your own country there's no way they can get at that money, or at you -- unless you visit EU or start doing business there.

phanisvara (streams)

Thu, 01 Aug 2024 08:10:31 +0200 from phani on streams

...and then again: don't take what i say for granted. first of all i don't really know law, i'm approaching this from a common-sense perspective -- and politics, law, and international law rarely makes sense to me. in other words: i don't really konw what i'm talking

if it looks promising to whatever government is supposed to protect you, they'll hand you over to whoever is asking, to be put behind bars or shot. it's the government after all, they'll have to worry about everyone, last not least their own jobs, and can't worry about people like you or me.

hosh

Thu, 01 Aug 2024 08:04:45 +0200 last edited: Thu, 01 Aug 2024 08:13:17 +0200 from hubzilla

@phanisvara (streams) It may be so - but companies and organisations tend to comply, for legal reasons, so they evidently fear they have something to lose. They do so, even if there is no question of "business", but usually because of data collection. The discussion started with this comment about an NBC site not being available. Usually we just see requests to accept cookies (even by sites outside the EU and this is for the same reason. (I'm not arguing in favour of this or against it - it's just been my experience.)

hosh

Thu, 01 Aug 2024 08:06:54 +0200 from hubzilla

I edited the above to say "usually" because of data collection - there may be other potential breaches that I've forgotten.

hosh

Thu, 01 Aug 2024 08:17:07 +0200 from hubzilla

@phanisvara (streams) I'm not entirely unhappy about the GDPR - it's had the effect that other countries have tightened up their privacy laws too. It's just that the way we encounter it is by these constant requests to accept cookies (or sites being entirely unavailable as was @lotfi 's experience. Something feels broken with the system.

phanisvara (streams)

Thu, 01 Aug 2024 08:32:33 +0200 from phani on streams

it's broken no doubt; look at @Haakon Meland Eriksen (Els Mussols) 's comment further up. what one country or the EU does within their own borders barely makes sense, but how different entities' laws interact on an international level, and how that interacts with what their security agencies actually do, is a nightmare. it doesn't really make sense, but if they really want, they can hit you with something.

Haakon Meland Eriksen (Els Mussols)

Thu, 01 Aug 2024 08:42:47 +0200 from Streams at els Mussols

If the Data Controller is found guilty of privacy violations under the GDPR, it may be fined.

The less severe infringements could result in a fine of up to €10 million, or 2% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher.

The more serious infringements go against the very principles of the right to privacy and the right to be forgotten that are at the heart of the GDPR. These types of infringements could result in a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher.

The Data Controller will most likely pass some or most of this fine to its Data Processor, i.e. its supplier/vendor.

Source: https://gdpr.eu/fines/?cn-reloaded=1

phanisvara (streams)

Thu, 01 Aug 2024 09:36:41 +0200 last edited: Thu, 01 Aug 2024 09:37:02 +0200 from phani on streams

looks like running a website that even uses cookies would require a $ 20 mio deposit in the bank -- in case some regulator or supervisor doesn't like the cookie banner.

Haakon Meland Eriksen (Els Mussols)

Thu, 01 Aug 2024 16:32:37 +0200 from Streams at els Mussols

If the Data Controller made 1 dollar last year, then the maximum fine of 4 cents. However, if the violation is large, then the fine could be upwards to 20 million euros after a case in court.

phanisvara (streams)

Thu, 01 Aug 2024 17:31:28 +0200 from phani on streams

of course, "...whichever is higher." and how much they want to hurt you, for whatever reason.

Bill Statler

Thu, 01 Aug 2024 18:45:21 +0200 from Bunny of Doom

I remember an incident a few years ago -- and this is from my unreliable old brain, so the details may be wrong. A person in the US was accepting Patreon donations through his US-hosted website. But because Patreon accepted donations in Euros as well as US Dollars, a European court ruled that he was doing business in the EU, and was therefore subject to EU laws. I don't remember whether this was a GDPR violation or something else, but he had to pay a very large fine. I also don't remember how they enforced this ruling or collected the fine.

Haakon Meland Eriksen (Els Mussols)

Thu, 01 Aug 2024 20:02:33 +0200 from Streams at els Mussols

Sounds like something else, maybe not paying taxes for income?

phanisvara (streams)

Thu, 01 Aug 2024 19:51:13 +0200 from phani on streams

i'm afraid courts in the US, or most places in the so-called civilized world, will be forthcoming and enforce such fines, finding that somehow or other, whatever the person did was not allowed according to their own laws and therefore act on behalf of the government in question.

phanisvara (streams)

Thu, 01 Aug 2024 19:53:39 +0200 from phani on streams

i doubt they'll do that with all tiny patreon-donations or similar. they probably didn't like what that person was doing or saying for some other reason.

Haakon Meland Eriksen (Els Mussols)

Thu, 01 Aug 2024 20:40:33 +0200 from Streams at els Mussols

The GDPR is quite simple.

Describe why the service require personally identifiable information and what it is.
Have a legal reason for collecting it before it is done.
Keep it safe and delete it when it is not required any longer.

These three are quite doable.

Most of those who fail, fail on 1. They do not describe any purpose, they change the purpose later and do something that is not agreed, and they change what they collect.

Those who fail on 1 usually also fail on 2, but passing 1 they fail on 2 by forgetting to know and have one of several legal reasons that are easy to aquire, e.g. an informed concent from the Registered before starting the collection.

Most do not fail on 3, many techies are good at 3.

However, most techies suck at 1. It is often very doable to create a digital service that is completely anonymous because it really does not require a login to offer a useful service they get paid for. Their default mode is that "logins are required", even in the cases when that is not true. There are also slightly more advanced methods in the form of Zero Knowledge Proofs, but many do not know them and thus do not think of applying them when creating their service. "Everone uses logins" is not a good argument on its own. Techies are supposed to inform clueless management, but cannot through incompetence.

Techies also often suck at 2, and unfortunately management most places are also largely clueless and just "assume" they have a right "because", like some 12 year old idiot.

Suckerberg comes to mind failing all three, "why of course it is okay to not have a purpose and no legal right to do whatever with your data and give to people undermining our society because I will get rich".

Bill Statler

Fri, 02 Aug 2024 02:29:23 +0200 from Bunny of Doom

I'm not sure that the GDPR is simple for amateurs. For example, there's the Google Fonts ruling from January 2022:

Google Fonts lands website privacy fine by German court

Earlier this month, a German court fined an unidentified website €100 ($110, £84) for violating EU privacy law by importing a Google-hosted web font.

The decision, by Landgericht München's third civil chamber in Munich, found that the website, by including Google-Fonts-hosted font on its pages, passed the unidentified plaintiff's IP address to Google without authorization and without a legitimate reason for doing so. And that violates Europe's General Data Protection Regulation (GDPR). ...

"The defendant violated the plaintiff's right to informational self-determination by forwarding the dynamic IP address to Google when the plaintiff accessed the defendant's website," the ruling says.

The ruling directs the website to stop providing IP addresses to Google and threatens the site operator with a fine of €250,000 for each violation, or up to six months in prison, for continued improper use of Google Fonts. ...

The problem here is that many websites are created by people with just enough technical knowledge to run Wordpress and select a nice-looking theme. They don't know how Google Fonts work, and may not even know that their website is using them.

I mean that as just one example. I have better technical knowledge than the average person, but I don't really know what my streams instance is doing. Does it use Google Fonts? Well, I know Mike, and I'm sure the answer is HELL NO, but how would I find out if I didn't know? It's buried in the code somewhere. What other details would I need to understand, if I wanted to comply with GDPR?

Mike Macgirvin 🖥️

Fri, 02 Aug 2024 03:31:22 +0200 from Y

For the streams source itself - HELL NO.

For what it's worth - if you're a developer and run Codeception test suites, the codeception library will try to use a google font. You will also find google links all over some of the vendor packages we import. For instance there are a couple of usages in the bootstrap package examples. I don't think any of it gets touched directly by streams, but it's there.

Haakon Meland Eriksen (Els Mussols)

Fri, 02 Aug 2024 07:37:00 +0200 last edited: Fri, 02 Aug 2024 07:45:13 +0200 from Streams at els Mussols

The relevant bit is

without authorization and without a legitimate reason for doing so.

In other words, there were neither an agreement between the plaintiff (user) and defendant (commercial service provider) to do so - no concent, nor some of the many other legal reasons for doing it - just mindlessly doing it.

Exactly what I wrote as reasons 1 and 2 for failing the GDPR.

You do not need the code.

All users of any web site on the planet can easily inspect their own interaction by hitting CTRL + Shift + I to open the web developer tool and then look at their own traffic on the Network tab or their own storage and cookies on the Application tab.

If the clueless user in their own browser so easily can check if out of EU/EEA is happening, it stands to reason a professional and commercial service provider could have and should have been able to do the same and be aware of and fix the problem before offering the service given the regulation was announced years before it became law for all countries in 2016 for the EU countries and added to countries in the EEA like Norway in 2018.

A court will be hard pressed to not accept this kind of argument, and given the regulation rule in favour of the plaintiff.

I find it interesting there are plaintiffs. It is not the police nor the court complaining and dragging the service provider to court. Why is there a plaintiff for a dynamic IP address? Who or what kind of person is willing to go through all the trouble of being the plaintiff for a dynamic IP address as personally identifiable information? It takes a special kind of person to do that, and I am not sure if the motivation is healthy even though they get to be right by argument.

phanisvara (streams)

Thu, 01 Aug 2024 21:00:31 +0200 from phani on streams

never looked at it this way, because...full stop.

because it's from those bastards forcing me to put nasty banners on websites, because it's the government that can't do anything right anyway, because it's a hassle i'd rather do without.

i guess i should get more 'into it,' find out who gets caught, for what reasons. because the idea isn't so bad but implementation sucks, mostly.

hosh

Fri, 02 Aug 2024 06:21:48 +0200 from hubzilla

For some time now, website development hasn't really been for amateurs, or even for former "professionals" who struggle to keep abreast of the ongoing changes (like me).

However, I think it is possible to see if Google fonts are active by checking the page source (Ctrl - U in the browser): for Google fonts, there would be a line like:
https://fonts.googleapis.com/css?family=Lora:400,700,400italic,700italic

After the GDPR came in, one of the WP themes made it possible to self-host the Google fonts used in the theme, which is an example of one of the good changes that came in thanks to the GDPR (and why I said that I'm not totally against it).

As we know, there are other potential pitfalls besides fonts: analytics is obviously be one of them.

Bill Statler

Fri, 02 Aug 2024 19:39:13 +0200 from Bunny of Doom

For some time now, website development hasn't really been for amateurs, or even for former "professionals" who struggle to keep abreast of the ongoing changes (like me).

That makes me sad, because it means that individuals are increasingly dependent on professionals or corporations if they want to speak on the Internet.

Years ago I blogged by writing HTML in a text editor. Maybe I should go back to that.

hosh

Fri, 02 Aug 2024 21:35:56 +0200 from hubzilla

@Bill Statler

Years ago I blogged by writing HTML in a text editor. Maybe I should go back to that.

The wonderful thing about the web is that we can still actually do that.

It's one of the reasons Dave Winer insists on keeping his blog in http without SSL:

This blog began in 1994, long before there was HTTPS.
I don't have the time to jump through hoops that Google and the EFF want to force me to jump through.
Google is a guest on the web, as we all are. Guests don't make the rules.