debanqued

The two situations are kind of similar. Whether a friend is using an “Invite a friend” mechanism or they are syncing their address book, either way their shitty choice of controller is getting my personal data. And in both cases the data controller proactively implements code to facilitate the sharing.

Also seems to reinforce my previous conjecture: E-mail fundamentally incompatible with the GDPR

I suppose the difference is that invite-a-friend is purely a data share, whereas other cases are to facilitate the data subject’s use of the service.

cross-posted from: https://beehaw.org/post/23925690

the problem

The web is littered with enshitified Tor-hostile resources generally deployed with the naive idea that Tor users are criminals. The Tor community can barely function. The web is broken in countless ways and it’s not always obvious whether Tor users are targeted by the marginalisation because firewalls never state why they are blocking. Sometimes they block based on geolocation or user-agent strings, and sometimes a resource is simply down for everyone. Tor users are left assuming their exit node IP is the culprit.

Also a problem: some people actually have no Internet at home. For some it is temporary and for others it is a permanent way of living a mostly analog life.

the solution (for many cases)

Use the clearnet at a cafe with open access. Of course it’s unreasonable to haul a desktop computer into a cafe or to carry a laptop at all times, so it would be useful to send fetch orders from your PC to your phone. When the phone connects to public Wi-Fi, you tap to execute the queue of fetch orders. Then when back at your PC you download the fulfilled orders from the phone.

This could even be useful within the home, since the block or malfunction can be a number of things. A smartphone could try to execute fetch orders over Orbot, which may or may not fail. And if it fails, it remains an unfulfilled order to retry in a cafe.

Aria2 would be perfect for the underlying heavy lifting because it supports many protocols (HTTP, FTP, bittorrent), and it exists on both the PC and Android. The Android code is apparently just a backend. It’s broken or useless on its own and needs a controller such as the app proposed here.

insufficient alternatives

The usual workarounds have compromises. A VPN may or may not work but it’s still a bit far from anonimity. The VPN provider is essentially like another ISP who can snoop on you.

Download managers already exist on smartphones, but there is no seamless PC interoperability. And (AFAIK) they are just for simple files, not for webpages or Youtube videos.

There is Newpipe but it has no PC interoperability. You must search YT using the Newpipe UI.

cross-posted from: https://beehaw.org/post/23925690

the problem

The web is littered with enshitified Tor-hostile resources generally deployed with the naive idea that Tor users are criminals. The Tor community can barely function. The web is broken in countless ways and it’s not always obvious whether Tor users are targeted by the marginalisation because firewalls never state why they are blocking. Sometimes they block based on geolocation or user-agent strings, and sometimes a resource is simply down for everyone. Tor users are left assuming their exit node IP is the culprit.

Also a problem: some people actually have no Internet at home. For some it is temporary and for others it is a permanent way of living a mostly analog life.

the solution (for many cases)

Use the clearnet at a cafe with open access. Of course it’s unreasonable to haul a desktop computer into a cafe or to carry a laptop at all times, so it would be useful to send fetch orders from your PC to your phone. When the phone connects to public Wi-Fi, you tap to execute the queue of fetch orders. Then when back at your PC you download the fulfilled orders from the phone.

This could even be useful within the home, since the block or malfunction can be a number of things. A smartphone could try to execute fetch orders over Orbot, which may or may not fail. And if it fails, it remains an unfulfilled order to retry in a cafe.

Aria2 would be perfect for the underlying heavy lifting because it supports many protocols (HTTP, FTP, bittorrent), and it exists on both the PC and Android. The Android code is apparently just a backend. It’s broken or useless on its own and needs a controller such as the app proposed here.

insufficient alternatives

The usual workarounds have compromises. A VPN may or may not work but it’s still a bit far from anonimity. The VPN provider is essentially like another ISP who can snoop on you.

Download managers already exist on smartphones, but there is no seamless PC interoperability. And (AFAIK) they are just for simple files, not for webpages or Youtube videos.

There is Newpipe but it has no PC interoperability. You must search YT using the Newpipe UI.

cross-posted from: https://beehaw.org/post/23925690

the problem

The web is littered with enshitified Tor-hostile resources generally deployed with the naive idea that Tor users are criminals. The Tor community can barely function. The web is broken in countless ways and it’s not always obvious whether Tor users are targeted by the marginalisation because firewalls never state why they are blocking. Sometimes they block based on geolocation or user-agent strings, and sometimes a resource is simply down for everyone. Tor users are left assuming their exit node IP is the culprit.

Also a problem: some people actually have no Internet at home. For some it is temporary and for others it is a permanent way of living a mostly analog life.

the solution (for many cases)

Use the clearnet at a cafe with open access. Of course it’s unreasonable to haul a desktop computer into a cafe or to carry a laptop at all times, so it would be useful to send fetch orders from your PC to your phone. When the phone connects to public Wi-Fi, you tap to execute the queue of fetch orders. Then when back at your PC you download the fulfilled orders from the phone.

This could even be useful within the home, since the block or malfunction can be a number of things. A smartphone could try to execute fetch orders over Orbot, which may or may not fail. And if it fails, it remains an unfulfilled order to retry in a cafe.

Aria2 would be perfect for the underlying heavy lifting because it supports many protocols (HTTP, FTP, bittorrent), and it exists on both the PC and Android. The Android code is apparently just a backend. It’s broken or useless on its own and needs a controller such as the app proposed here.

insufficient alternatives

The usual workarounds have compromises. A VPN may or may not work but it’s still a bit far from anonimity. The VPN provider is essentially like another ISP who can snoop on you.

Download managers already exist on smartphones, but there is no seamless PC interoperability. And (AFAIK) they are just for simple files, not for webpages or Youtube videos.

There is Newpipe but it has no PC interoperability. You must search YT using the Newpipe UI.

Ireland has their own data protection act which largely mirrors the GDPR. I first have to wonder why. Why rewrite an EU regulation, if not to do something twisted? IIUC, Ireland is part of the EU thus automatically obligated to enforce the full GDPR as-is. (Unlike Great Britain, who left the union but decided voluntarily to keep the GDPR, so they had to mirror it and rewrite some parts that are irrelevant to an EU outsider). Or is Ireland somehow outside the EU too, yet with the Euro?

Art.18, the right to restriction of processing, has been expanded from a ½ page to several pages full of loopholes and exceptions watered down to the point of data subjects not really getting this right.

Art.21, the right to object, has been torn out completely (not mirrored at all), but there is a blurb about removing the right to object specifically giving policians an exemption on election matters, and postal service matters.

If they add a restriction on the right and say nothing more on it, then I suppose that implies the art.21 right is otherwise in force, correct? It’s bizarre because other GDPR sections have been redundantly rewritten to very similarly reflect the GDPR. So I’m trying to make sense of what it means when redundancy is in place sometimes and not others. And what happens when a redundant section of code has a silent omission with no language to explicitly state intent to dishonor the omitted part.

There are some peculiar omissions from the duty of data processors as well.

I have not read it completely but I did not notice any Irish law that strengthens data protection. I only see shenanigans that work against data subjects.

Is it fair to say that tech giants love Ireland and put their HQ there for tax purposes, where the EU’s version of Silicon Valley is expected to be established, which then effectively pressures Ireland to weaken the GDPR as much as possible to maintain that attraction?

cross-posted from: https://beehaw.org/post/21500261

If you’re not in Europe, move along. You’re stuffed and this thread can’t¹ help you.

European email self hosters--

Tech giants screw self-hosters over by crudely blocking email on the sole basis of IP address (e.g. if the IP is residential). Before 2016, we were as fucked as everyone (in fact worse b/c European ISPs tend to block² egress port 25).

Post 2016, we have the GDPR which has an Article 22 that gives us rights against Automated Individual Decision Making. It has become unlawful to profile people on a crude discriminatory basis without human intervention. The motherfuckers “predict” that you’re a baddy/spammer based on your personal information, which wholly consists of nothing more than your IP address. It’s as unsophisticated and prejudiced as it gets. They’re not using anything intelligent like spamassassin (as the cheap bastards want to save money for their greedy shareholders by reducing processing power at your expense).

Why let them get away with it? And unless you’re a boot-licker, you don’t dance for them either. Well, to some extent you may have to implement DKIM, SPF, DMARC, etc, but it’s debatable. Either way, you do you, and if in the end MS or Google or whatever imperial tech giant empire blocks you from sending email to their server on the blunt basis of your IP address, consider filing an Art.77 complaint to the relevant DPA citing Art.22 violations.

¹ Exceptionally, some non-EU regions have created their own variant of the GDPR like Brazil and some US states (e.g. CCPA in California). But AFAIK, they are all very watered down, weak and mostly useless. Just there for show. I don’t imagine that Art.22 sentiment has been adopted outside of Europe but plz correct me if I am wrong.
² If egress port 22 is blocked by your ISP, then you’re probably fucked anyway but there are some tricks to get the block disabled (free and non-free).

If you’re not in Europe, move along. You’re stuffed and this thread can’t¹ help you.

European email self hosters--

Tech giants screw self-hosters over by crudely blocking email on the sole basis of IP address (e.g. if the IP is residential). Before 2016, we were as fucked as everyone (in fact worse b/c European ISPs tend to block² egress port 25).

Post 2016, we have the GDPR which has an Article 22 that gives us rights against Automated Individual Decision Making. It has become unlawful to profile people on a crude discriminatory basis without human intervention. The motherfuckers “predict” that you’re a baddy/spammer based on your personal information, which wholly consists of nothing more than your IP address. It’s as unsophisticated and prejudiced as it gets. They’re not using anything intelligent like spamassassin (as the cheap bastards want to save money for their greedy shareholders by reducing processing power at your expense).

Why let them get away with it? And unless you’re a boot-licker, you don’t dance for them either. Well, to some extent you may have to implement DKIM, SPF, DMARC, etc, but it’s debatable. Either way, you do you, and if in the end MS or Google or whatever imperial tech giant empire blocks you from sending email to their server on the blunt basis of your IP address, consider filing an Art.77 complaint to the relevant DPA citing Art.22 violations.

¹ Exceptionally, some non-EU regions have created their own variant of the GDPR like Brazil and some US states (e.g. CCPA in California). But AFAIK, they are all very watered down, weak and mostly useless. Just there for show. I don’t imagine that Art.22 sentiment has been adopted outside of Europe but plz correct me if I am wrong.
² If egress port 22 is blocked by your ISP, then you’re probably fucked anyway but there are some tricks to get the block disabled (free and non-free).

Art.22 ¶1 declares:

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

without stating who is liable for infringements. Paragraph 3 says

the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

That assumes the data controller is aware of and in control of the AIDM. Often data processors implement AIDM without the data controller even knowing. Art.28 ¶1 says:

Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.

Of course what happens in reality is processors either make no guarantee or the guarantee is vague with no mention of AIDM. So controllers hire processors blindly. When the controller is some tiny company or agency and the processor is a tech giant like Microsoft or Amazon, it’s a bit rich to put accountability on the controller and not the processor. The DPAs don’t want to sink micro companies because of some shit Amazon did for which the controller was not even aware.

As a data subject I have little hope that a complaint of unlawful AIDM will play out. It’s like not even having protection from AIDM. Article 29 Working Party wrote AIDM guidelines in 2017, but they make no mention of processors.

cross-posted from !gdpr@sopuli.xyz : https://beehaw.org/post/21385410

As I mentioned in another post, many data protection authorities are deadbeats. Knowing that my Art.77 complaints are in vain, my question is how the complaints might be made useful. Suppose we just use the DPA as a prop. We file an Art.77 complaint and CC the data controller a copy of the complaint.

Normally it might be a bad strategy to show the data controller your hand. But when you essentially expect the DPA to be a dead-end anyway, perhaps our best move among shitty options is to use art.77 to get the data controller’s attention on the off chance that the data controller does not know the DPA is a deadbeat.

As I mentioned in another post, many data protection authorities are deadbeats. Knowing that my Art.77 complaints are in vain, my question is how the complaints might be made useful. Suppose we just use the DPA as a prop. We file an Art.77 complaint and CC the data controller a copy of the complaint.

Normally it might be a bad strategy to show the data controller your hand. But when you essentially expect the DPA to be a dead-end anyway, perhaps our best move among shitty options is to use art.77 to get the data controller’s attention on the off chance that the data controller does not know the DPA is a deadbeat.

cross-posted from !gdpr@sopuli.xyz : https://beehaw.org/post/21385256

Many data protection authorities are deadbeats. They do the legal minimum, which is to accept complaints, file them, and acknowledge them. Then do nothing. So stale cases just rot.

Data subjects have a right to complain (Art.77) at no cost, but they apparently do not have a right to a free appeal and the art.78 right to sue is not gratis either.

Unlawful inaction can legally be appealed but appeals are costly. DPAs know this, so they enjoy getting away with neglecting to act on Art.77 complaints.

So first I wonder if my legal theory is sound: If we have a right to complain under art.77 at no cost and the DPA neglects to investigate, then by extension we could argue that a right to complain at no cost implies a right to appeal inaction at no cost. Is that a weak argument? Do we need to ask EU lawmakers to specifically guarantee the right to a free appeal of DPA inaction?

Many data protection authorities are deadbeats. They do the legal minimum, which is to accept complaints, file them, and acknowledge them. Then do nothing. So stale cases just rot.

Data subjects have a right to complain (Art.77) at no cost, but they apparently do not have a right to a free appeal and the art.78 right to sue is not gratis either.

Unlawful inaction can legally be appealed but appeals are costly. DPAs know this, so they enjoy getting away with neglecting to act on Art.77 complaints.

So first I wonder if my legal theory is sound: If we have a right to complain under art.77 at no cost and the DPA neglects to investigate, then by extension we could argue that a right to complain at no cost implies a right to appeal inaction at no cost. Is that a weak argument? Do we need to ask EU lawmakers to specifically guarantee the right to a free appeal of DPA inaction?