So Your Startup Received the Nightmare GDPR Letter - <AUTHOR> https://jacquesmattheij.com/so-your-start-up-receive-the-nightmare-gdpr-letter <comment><USER2> We already received one of these for Riot.im; kinda depressing that despite all the GDPR work we've done for Matrix ([https://matrix.org/blog/2018/05/08/gdpr-compliance-in- matrix...](https://matrix.org/blog/2018/05/08/gdpr-compliance-in-matrix/) etc) folks think it's worth burning yet more of our time in proving it to them (but just to them). So much for writing software and actually making Matrix better...

<comment><USER3> The letters are FUD. Take a look at the process:

[https://ec.europa.eu/commission/sites/beta- political/files/d...](https://ec.europa.eu/commission/sites/beta- political/files/data-protection-factsheet-role-edpb_en.pdf)

<comment><USER4> The letters aren't even smart FUD. This sort of stuff gets made up by dumb people to validate the fears of other dumb people. It's a kind of self- propaganda. The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. The SARs have clear, well-defined limits [1] and the response can and should be automated (once identity has been verified).

[1] [https://ico.org.uk/media/for- organisations/documents/2014223...](https://ico.org.uk/media/for- organisations/documents/2014223..).

<comment><USER5> > The idea that rando customers can ask for arbitrary information like backup > policies and safe-guards or the location of your servers is just silly.

Why is this silly? Does the law explicitly forbid people from asking stuff like this?

<comment><USER6> > _Does the law explicitly forbid people from asking stuff like this?_

No. The expectation is each of the EU's twenty-eight national data regulators will be nice and reasonable into perpetuity.

</comment></comment></comment></comment></comment><comment><USER7> I think the ridiculous thing is every mom and pop site and blog and website needs to be gdpr compliant? insane. If the true intent was to make sure large players have their system in check then they should have simply said if you have 50,000 or more users giving you data a month or something to protect anyone interested in software from being afraid of having 2 users because now they need to read every international law. I know someone will fire back at this but what stop the United States from coming up with some law as well on the internet against how logins should be and then filing a lawsuit against every other country company that doesn't comply. A business should follow the laws of based on the owners location and if other countries don't like it then that's for allies to group up and ask that minority country for change. gdpr to me is of reaching on the internet in a scary way.

<comment><USER8> So how exactly it's O.K. for customers if their privacy is breached by mom&pop businesses but not O.K. if it's breached by businesses that have 50K or more users?

It's common theme here on HN to think that users are just some kind of resource and the regulations are anti-climactic things that slows down the party.

Seriosly, As a user, I don't want my information to be sold to random people that I have no information about even if the seller is a tiny business because my feelings are not against the business but against the practice. The size of the violator is irrelevant to me.

If not breaching my privacy and my rights makes your business unprofitable, then simply you don't have a business.

Users are people, not just pageviews or hits or goals - despite what your analytcs software says.

<comment><USER9> It's not just small businesses. The serious effort to fullfil this legislation and the constant threat that you still don't is simply too much for small non- profit organizations and personal websites. A lot of one person blogs that are inactive but a valueable source of information have been taken down because of that.

I also stopped hosting demos of my side-projects (just for github or cv links), because following this law for this kind of service is just unreasonable. And I do not even have to cause any kind of harm to be fineable in Germany.

<comment><USER10> If your demos required storing or using someone else's personal information, taking them down was the right thing to do (assuming you weren't going to put effort in to become compliant). If they didn't, you panicked and took down potentially valuable data of your own volition.

<comment><USER9> Just adding a legally correct data protection and privacy policy is often too much of a burden. Even for otherwise fully GDPR compliant websites. Especially as I can not be sure if it is legally correct without consulting a lawyer (that's one of the big pain points for non-profit and private websites).

One of my demos required multiple roles for the service and hence had authorization and authentication build in. I.e. it was storing email addresses (though I happily handed out prepared near full-admin accounts to everyone interested). It was on a subdomain with robots.txt set to disallow, so very little chance someone would find it by accident. Still making this GDPR compliant without consulting a lawyer was too much effort and risk for me.

I'm not even sure without consulting a lawyer, if a fully static pure html website would be DSGVO (the German GDPR) compliant without adding a privacy policy to it. After all I could still be tracking users by HTTP/TCP/cookies and would have to inform the visitor, if I do or don't.

<comment><USER11> The Information Commissioner's Office (the regulatory body in the UK) says:

 _Who needs to document their processing activities?

There is a limited exemption for small and medium-sized organisations. If you have fewer than 250 employees, you only need to document processing activities that: are not occasional; or could result in a risk to the rights and freedoms of individuals; or involve the processing of special categories of data or criminal conviction and offence data._

GDPR is designed to be easy for small organisations to adhere to. No documentation needed if you have only small, non-sensitive data flows. IANOL, of course.

</comment></comment></comment></comment></comment></comment><comment><USER12> I updated my web service (solo dev, side project) with a GDPR compliant terms and privacy policy, got this form letter already from a few of my users. I have to tell, it's seriously depressing and I was contemplating shutting the whole side project down over the weekend.

<comment><USER13> I have a tiny project in closed beta right now I've been working on in my spare time for 7 years I'm considering closing to the EU. The idea is even entirely privacy minded with all data save email address being client side encrypted so we never see it unencrypted.

I never intended to make real money off it except maybe covering server costs if I'm lucky, but the time it would take dealing with requests like this it enough to scare anyone off.

<comment><USER14> Broadly speaking, and noting that IANAL, _etc, etc, ..._

I'm not sure what the problem is.

Your obligation is to keep the data secure, and only keep data that you need. Then you need to respond to requests to (a) tell a person what data you hold on them, (b) tell them what you do with the data, and (c) delete it if asked, unless you have a legitimate reason to keep it.

So if someone has given you data for the purpose of you providing a service then all you need to do is treat that data with care, don't do anything your customer doesn't expect you to do, and be able to provide and/or delete it.

 _Fair do, someone disagrees and has down-voted me. Please, having read the actual regulations[0] several times, including the recitals[1], I 'd be pleased to see what's missing from that outline, so I can improve my understanding._

[0] [https://gdpr-info.eu/](https://gdpr-info.eu/)

[1] [https://gdpr-info.eu/recitals/](https://gdpr-info.eu/recitals/)

<comment><USER6> > _you need to respond to requests to (a) tell a person what data you hold on > them, (b) tell them what you do with the data, and (c) delete it if asked, > unless you have a legitimate reason to keep it_

Over the course of a few years, doing these things might take up as much time as it would to learn a new language. For a side project, I'm not sure that's a smart trade-off.

<comment><USER15> > might take up as much time as it would to learn a new language

How so? Just build yourself a tiny tool that takes an email address or username and sends them their database entries along with the standard explanations about why you need that data.

For my side projects that will be around two hours per project and then 2 minutes for every request.

Or am I missing something?

<comment><USER6> > _Just build yourself a tiny tool that takes an email address or username and > sends them their database entries along with the standard explanations about > why you need that data_

You're assuming automated responses will satisfy requestors and, for the unsatisfied, be seen favorably by each of the twenty-eight national regulators, today and into perpetuity.

In any case, I got curious about your 2 hours / project + 2 minutes / request metric. One can achieve "basic fluency" in a number of languages within 480 hours [1]. We thus find a trade-off hyperbola [2]. For 1 project, after 14,340 requests you could have learned a new language. For 5: 2,820 per project. For 10: 1,380. At one request per day, that's under 4 years. TL; DR, even with optimistic figures, a significant toll is extracted purely for administration.

[1] [https://blog.thelinguist.com/how-long-should-it-take-to- lear...](https://blog.thelinguist.com/how-long-should-it-take-to-learn-a- language)

[2] 2 * Projects + (1 / 30) * Projects * Requests = 480

<comment><USER16> I think most people pro-gdpr never had to run a website.

<comment><USER17> TBH I suspect most of them have never run _anything_. I did an info session for a team of consultants, and was careful to include a lot of information on the positive intentions of the law, and every single one realized quickly that most of the costs of compliance for the vast majority of businesses had nothing to do with improving the state of privacy, and that for many business models that aren't abusing data this law is still going to be incredibly expensive.

There's just a huge gap between people who viscerally understand making high- level business decisions and people who don't, and the vast majority of the writers and supporters of this law appear to be in the "don't" group.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> I think the GDPR is well intentioned and has provoked some important and useful conversations about how we make use of users' data.

But reading stuff like this makes me that much more inclined to use that Cloudflare option of IP blocking the whole continent. This feels like a very slippery and dangerous can of worms that's not worth opening.

<comment><USER19> There's already a tonne of laws every company has to comply with. The GDPR isn't any more onerous than any of those, it's just new. Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult for a company to comply with would be that their internal systems and processes were already horrifying - something which we have now collectively deemed that permitting is causing more harm than good.

<comment><USER18> What other laws do I have to comply with right now that are so vaguely defined and carry such horrifyingly punitive fees? I guess we'll have to wait and see how it's actually enforced but no other legal obligations I've had to consider so far when building products feel this threatening to smaller online businesses.

It's bad enough we have to deal with patent trolls. I'm not inclined to add this to my risk profile.

<comment><USER20> > What other laws (...)

You can't sell guns and drugs online.

If you're taking money, you have to make sure you know your customer (KYC).

I would also like to hear other examples.

<comment><USER18> I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence.

It seems like the smart thing for US startups to do right now is ignore EU customers until they've validated the business idea enough to justify the engineering and legal expenses of taking this on.

<comment><USER21> The alternative is to not collect personal information from your customers.

<comment><USER6> > _The alternative is to not collect personal information from your customers_

If that worked I'd embrace GDPR. Problem with "any consumer can make a complaint which requires expensive follow-up" regimes is one doesn't have to do anything wrong to incur costs. Someone can mis-interpret something and make a complaint. Now you have to interface with a regulator, which tends to be risky, expensive and time consuming.

<comment><USER22> If you're not collecting any information "interfacing with the regulator" means replying to their email by saying "we're not collecting any information". (Assuming they even got that far, given that they'd likely take a look at your website and notice you aren't collecting any information.)

I'm not sure what's risky, expensive or time consuming about that.

<comment><USER6> Consumer says "I think you're lying" and forwards to their national data regulator. (This is as simple as writing an e-mail.)

Data regulator now asks you questions. You must respond. Hopefully they agree with you. But maybe not! Twenty-eight regulators appointed by different political groups are a complex system. You will need to gain expertise on them or hire someone with it.

All I'm saying is that time and money might be better used elsewhere. Particularly by someone just making side projects.

<comment><USER22> > Twenty-eight regulators appointed by different political groups are a > complex system. You will need to gain expertise on them or hire someone with > it. All I'm saying is that time and money might be better used elsewhere. > Particularly by someone just making side projects.

If you're not collecting data, then all of this is irrelevant. You just say "I'm not collecting data". There's no nuance here.

<comment><USER6> > _There 's no nuance here_

This is your interpretation. Many prominent lawyers disagree.

In any case, convincing a regulator that you are not, in fact, collecting data could be harrowing, distracting and expensive. The risk of incurring those costs probably isn't a smart one to take for a hacker or very early-stage start-up.

<comment><USER22> So in this hypothetical scenario, for some reason the regulator looks at your website, which presumably has no personal information inputs, no tracking analytics etc. and which you have asserted collects no personal information, and they decide that you're still _somehow_ collecting information, and for some reason hounding your low traffic website is the best use of their limited resources.

<comment><USER6> Taking that risk (of a regulator mis-interpreting something and needing clarifications, again and again, or worse, mis-interpreting something and getting hostile) across the EU's twenty-eight members is a good one for Facebook. Probably not for a hobbyist.

<comment><USER22> What exactly is the risk to a hobbyist here?

Even if we assume a completely bizarre and pathologically incompetent regulator that somehow ends up zeroing in on some tiny website which exhibits no evidence of violation, the hobbyist _might_ have to... delete their website?

<comment><USER6> > _What exactly is the risk to a hobbyist here?_

Have you ever responded to a regulatory enquiry?

<comment><USER23> If you have then perhaps you could share your experience more explicitly. It would be helpful to clarify your point of view.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> What worries me most is how little is being said about private-operated sites. I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically. Should I sign data processing agreement with Google because I am using Gmail to send E-mails? Should I hire DPO? Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I've missed it because I don't delete user-posted content together with their account?

<comment><USER25> > What worries me most is how little is being said about private-operated > sites.

If you want I can research the matter in more detail, someone else came up with federated sites like Mastodon nodes and that's another pretty gray area.

> I am little Joe running internet forum about space battles with maybe 5 > active users right now and no more than 100 active members historically.

Ok.

> Should I sign data processing agreement with Google because I am using Gmail > to send E-mails?

No. You _could_ try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable.

> Should I hire DPO?

No, but you _are_ the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small.

> Am I risking my house being taken from me to cover multimilion fine because > user posted their photo or e-mail 5 years ago and I've missed it because I > don't delete user-posted content together with their account?

No.

But if a regulator should tell you that you should remove a users data (because you refused to for some reason or other) you probably should. The EU does not 'fine first and ask questions later', they will investigate first, warn and then when ignored they will fine. And for a small entity like yours which is more of a hobby than anything else I highly doubt regulators would even bother but you can't rule it out completely. Better increase you comet insurance as well if that's your main worry :)

<comment><USER24> Thanks for answers!

> You could try to stretch the law to include that particular example but from > my reading of it this is perfectly acceptable.

But I should still note about the fact in my privacy policy, shouldn't I?

Couple other things I've noted when working on GDPR compliance for my forum:

\- It may be good idea to write in your forum rules that you don't allow users to embed their data outside of forum profile. \- Forums accumulate tons of lurker accounts (users that register account but don't post or browse anything) that could be automatically deleted \- Forums like to log IP's used by users when they, say, post messages. Those could be overwritten to 0.0.0.0 for items older than X days.

I've also been working on privacy policy template for people in my position that I have on GitHub and would love to have any feedback:

[https://github.com/rafalp/misago-privacy-policy- examples/blo...](https://github.com/rafalp/misago-privacy-policy- examples/blob/master/PRIVACY-POLICY.md)

<comment><USER25> > But I should still note about the fact in my privacy policy, shouldn't I?

Yes, I would disclose any third party that sees all or part of the data, and I would also disclose what reason there is for me to make use of that service.

> I've also been working on privacy policy template for people in my position > that I have on GitHub and would love to have any feedback:

I will do that, but not right now, wildly busy today, but if you drop me a line (firstname.lastname@example.com) I promise I will do that within the next couple of days.

</comment></comment></comment></comment><comment><USER26> I have to confess, it's a guilty pleasure of mine to respond with a variant of the Nightmare GDPR letter to SOME companies who sent me the classic "we're sure that you want to access all the amazing benefits of our data processing so if you REALLY want to opt-out you'll need to click on this link and manually remove consent from a couple hundred 3rd party providers" email. I'd never do that to any company (big or small) with whom I have legitimately interacted, but a lot of this drivel has come from random recruitment companies that must have scraped my details from my CV or Linkedin or wherever.

<comment><USER25> If you're not legitimately concerned then you are actually devaluing the GDPR by abusing it. If you have a legitimate concern with a particular company I'd send them a custom letter rather than a form letter and I'd try to work with them in order to achieve the desired effect (for instance: for them to delete my data once and for all) rather than to get a bunch of information that I have no further use for.

<comment><USER27> Anywhere that has made my acceptance an "opt in" I have then sent a polite email asking for my details to be removed. I'm happy to continue to use any services that follow GDPR and use them with the minimum of fuss; but anywhere that feels like they're trying to worm their way around the law feels like the kind of organisation the GDPR is designed to protect us against.

Thankfully the responses I've had thus far have been equally amicable.

<comment><USER25> The most friction so far that I've seen are some news organizations that seem to do what they can do mis-interpret the law. I have no idea what made them think that's the right response but it is almost as if they are doing it willfully.

For the rest of it hardly any interaction to date other than that the spam volume seems to have dropped 50% or even more overnight.

<comment><USER27> I can't speak for news outlets outside of the UK but the ones here are largely anti-EU anyway.

</comment></comment></comment></comment></comment><comment><USER28> It seems like a lot of the comments are about one issue:

\- do you believe generally, even for an "upstanding" company you've done business with for a while, that commercial entities can be trusted with your data?

If yes, you'll see the template as overbearing and needlessly aggressive outside the context of some specific incident when a company proved to be untrustworthy. Especially if you operate a side project or business of your own, and believe you personally would not abuse consumer data collection, you'll see it as rude in the best case, trollish resource wasting in the worst case.

If you're a consumer with a general mistrust of all commercial entities, even "upstanding" ones, when it comes to data practices, or if you just happen to believe that the potential risks for data abuse or harm are too high to be offset by anyone's good intentions or past good behavior, then you'll see this as a reasonable template, perhaps needing a few modifications for differing contexts, and that jumping straight away to legalese boilerplate just has to be assumed necessary when dealing with self-interested commercial entities.

<comment><USER25> Sending boilerplate almost guarantees that a regulator will put your request at the bottom of the pile if you decide to take it to the next level unless the company responds in a way that shows their contempt for the law.

<comment><USER28> I think that will depend on how seriously GDPR non-compliance is treated.

I'm hopeful some big corps will be heavily fined to set precedent and to ease concerns that GDPR is a mild form of regulatory capture intended to be misused (regardless of its wording) to asymmetrically inhibit new entrants and small firms.

<comment><USER29> But that's what the big corps want. They'd gladly each cough up a billion for a permanent state where market entry is harder. Especially the easy to disrupt consumer services like Facebook and Snapchat.

</comment></comment></comment></comment><comment><USER30> I just want to note how non-obvious compliance with GDPR is. Two experts on GDPR and privacy in this thread (Jacquesm and Ainiriand) have been disagreeing throughout the thread on just the basis of whether one should reply to GDPR complaints like this. Imagine how much up for interpretation the more gritty parts of the law will be.

<comment><USER31> And Jacquesm is saying don't be alarmed in some comments while in other comments he admits there could be problems with people trolling with this letter. So I'm even more skeptical of allowing any EU users.

<comment><USER25> It's a very consistent position: no need to be alarmed, yes you will have to answer a letter like this, even if it is trolling. But if a letter like this alarms you then you probably have bigger problems.

<comment><USER32> It's alarming because you describe the letter as analogous to an "exploit toolkit" and we all know no patch is coming.

Perhaps proponents of GDPR should have considered this very obvious weaponization of the law...

<comment><USER25> They did consider it, there is a pretty extensive part written on what can go into a DSAR and from what I can see this letter skirts the edge and in some places goes over it but on the whole it is not an unreasonable burden to deal with it as it is.

Take into account the lengths to which companies will go to collect data, it stands to reason that in that context there is some balance to be found if a Data Subject makes a request about that collected data. If you don't collect data the request can be answered immediately and without further work.

</comment></comment></comment></comment></comment><comment><USER33> I've said it many times, GDPR is such a waste of time and resources for startups unless your market is really EU.

GDPR is super expensive to remain compliant, simply because of the broadness of the terms used, leading to undefined scope of liability.

The cheapest way to stay compliant with GDPR is to completely block access to EU customers. In fact, this is what I did with my business. I redirect to a generic text file (not even a HTML that could trigger a GDPR clause by itself) explaining my stance.

<comment><USER34> What? How does HTML trigger a GDPR while text file does not?

<comment><USER33> "Sorry, this site is for non-EU users only" something to that effect. A HTML can execute scripts (ie., collect data) while a text file does not, atleast that's my understanding.

<comment><USER23> If that's your understanding then you have bigger problems than the GDPR.

</comment></comment></comment></comment><comment><USER35> My approach for my startup is that if anyone sends me a Subject Access Letter that I thank them for being a customer, cancel their account, and delete their data. I note this in the terms of service up front to be transparent and totally comply with GDPR.

Sadly, I think this is the lowest cost approach to dealing with the law, and removes the ability of an insane customer from causing us millions in liability.

<comment><USER36> I did some quick searching, and my gut feeling would appear to be correct: It is _not_ legal to delete user data in order to avoid fulfilling a subject access request. It is okay if data has been routinely modified or deleted, but it must _not_ be a result of the access request.

Quoting the Information Commisioner's Office:

        Q: We have received a request but need to amend the data before sending out the
           response. Should we send out the "old" version?

        A: It is our view that a subject access request relates to the data held at the
           time the request was received. However, in many cases, routine use of the
           data may result in it being amended or even deleted while you are dealing with
           the request. So it would be reasonable for you to supply information you hold
           when you send out a response, even if this is different to that held when you
           received the request.

           However, it is not acceptable to amend or delete the data if you would not
           otherwise have done so. Under the DP Bill, it is an offence to make any
           amendment with the intention of preventing its disclosure.

</comment></comment><comment><USER37> I was having trouble visiting the article so I used a web archive link, in case it's useful to anyone else [https://web.archive.org/web/20180529120012/https://jacquesma...](https://web.archive.org/web/20180529120012/https://jacquesmattheij.com/so- your-start-up-receive-the-nightmare-gdpr-letter)

</comment><comment><USER38> I like how the article starts with "the nightmare letter is clearly a troll attempt we need to deal with"

and closes with "actually, those are are all valid and reasonable questions that you should have answers to if you were not breaking the law in the last five years. Answering them automatically should be easy

If you, no matter what company size, are not dependent on illegally and immorally profiting from personal data, then GDPR may even be good for you."

hehehehehehehe

<comment><USER25> The letter is clearly a troll attempt because it is engineered to inflict maximum damage even if the claimant has no use for a lot of the information they are requesting.

Even so, in isolation and moderation the questions make good sense and answering them properly using an automated system and an updated privacy policy should not be a huge burden.

<comment><USER39> The _law_ was engineered to inflict maximum damage.

Look, we all know that you think the GDPR is a great idea, but a law which can't be used to its full extent is IMHO _not_ a great law. I agree with the goals of the GDPR: they're laudable. But its details & its implementation are, quite simply, wrong.

You don't install a self-destruct mechanism which can be triggered by just pushing a single un-guarded button. Likewise, you don't pass a law which can inflict grave economic harm just by sending a letter.

<comment><USER40> Given the involved scale, corporate lobbying and stated goals, this was the best that could be done.

It's probably not even possible to create a great law. The industry that can't even agree on something as simple as coding guidelines is suddenly screaming that the law isn't good (enough).

</comment></comment></comment></comment><comment><USER41> I've described how I'm preparing for GDPR as a solo developer running commercial side projects without a legal team to back me up: [https://pawelurbanek.com/gdpr-compliance-blog- rails](https://pawelurbanek.com/gdpr-compliance-blog-rails)

</comment><comment><USER42> What's the worst that can happen if you reply to this letter with incomplete information?

I imagine the client will then send you another letter, to which you reply that you've already sent the information. And so on.

In the end, the client may sue you. But in that situation, you make the effort of deleting the information you said you didn't have, and you win the case.

<comment><USER43> Is there amy regulation about how the data has to be formatted? Say I send a json string like "this is LITERALLY the data we use", but the avergae Joe is left irritated and annoyed, am I in trouble?

<comment><USER25> JSON or XML would be an excellent way to answer, alternatively you could format it for easier human consumption.

Going out of your way to make the response useless is probably not a good idea.

<comment><USER44> CSV is also a viable choice here, for the simple reason that it can be imported directly into any spreadsheet software* for inspection and filtering.

* Ironically, people are using Google Drive to do this.

</comment></comment></comment></comment><comment><USER13> The vagueness of the meaning of "processing" PII is one of my handful of problems with GDPR. Is the mere act of having a unique index on an email address column a form of processing? I'd argue it is. It's can be construed really far.

<comment><USER45> Processing is defined in Article 4(2):

> 2\. 'processing' means any operation or set of operations which is performed > on personal data or on sets of personal data, whether or not by automated > means, such as _collection, recording, organisation, structuring, storage, > adaptation or alteration, retrieval, consultation, use, disclosure by > transmission, dissemination or otherwise making available, alignment or > combination, restriction, erasure or destruction_

[https://gdpr-info.eu/art-4-gdpr/](https://gdpr-info.eu/art-4-gdpr/)

\- BUT -

Article 2(1) limits the whole GDPR to personal data "processed" in the context of a filing system, whether electronic or physical.

In other words (in my non-lawyer reading): If I have your business card in my pocket, or I leave it on the table, or throw it away, I'm not "processing" your data in a covered way—even though I have it. If I put it in my stack of business cards or add you to my CRM, I am.

[https://gdpr-info.eu/art-2-gdpr/](https://gdpr-info.eu/art-2-gdpr/)

<comment><USER6> > _retrieval, consultation, use_

These three words can mean everything and nothing. It will take years to see how each of the EU's twenty-eight members' regulators take to interpreting them.

<comment><USER45> I read this part as being broad, but not vague. Processing personal data means doing anything with it in any way, including simply having it.

If the data takes part in a process you have, you're processing that data.

<comment><USER46> Exactly. The term could have been "storing", but that would have been potentially too narrow, as it could be argued that proxies are excluded. As such, "processing" is like a more complete term for "storing or handling".

</comment></comment></comment></comment></comment><comment><USER25> Apparently there is some BGP related issue, if you can't reach the site directly here is a google cache link:

[https://webcache.googleusercontent.com/search?q=cache:QSStS_...](https://webcache.googleusercontent.com/search?q=cache:QSStS_885I0J:https://jacquesmattheij.com/so- your-start-up-receive-the-nightmare-gdpr-letter+&cd=4&hl=en&ct=clnk&gl=nl)

</comment><comment><USER47> I'm beginning to highly doubt that anyone defending the GDPR has ever had any responsibilities that included:

1\. Running a tech company

2\. Funnels, conversions, and retentions

3\. Writing software

Either that or they just want to watch the world burn.

</comment><comment><USER48> I have a general question about this. If you have a privacy policy which discusses (amongst other things) the answers to these questions, would it be sufficient to just reply directing the customer to that privacy policy? i.e. let him dig out the answers he "needs" from there.

<comment><USER25> In part this form letter seems to assume that all the burden is on the company, whereas if the company has already answered these questions in a public medium you could (1) take that as a signal that the claimant is a troll (otherwise they would have read your privacy policy) and (2) that they probably don't care about the answer, they're just looking for a reason to stir the pot, so any deficient answer will be used to contact the regulator.

The best way to deal with that is to answer the request in detail (which makes it very unlikely that a regulator would follow up if there was a complaint) and to refer to public resources such as your privacy policy because that's something that indicates that the claimant didn't do their homework, which is something a regulator will use to weigh whether or not to follow up on the complaint.

<comment><USER48> > The best way to deal with that is to answer the request in detail

I keep hearing this but I think in reality the volume of troll requests will dictate whether that is practical or not for any given company. Small startups might have problems if that volume is not proportionately small.

<comment><USER25> The problem would be in answering just one of these, then the amount of effort would be disproportionately large. But to answer a whole bunch of them is a 'mere matter of programming' unless you've really made a mess of things.

<comment><USER48> That assumes the trolls will all use the same form letter with no variations, which might not be the case.

</comment></comment></comment></comment></comment><comment><USER49> Can someone tell me is it legal (or even viable) to just automatically completely remove all the information on the person sending those letters? Certainly beats banning whole EU by IP.

</comment><comment><USER3> Please folks, GDPR investigations are only undertaken by the EU. No single actor can try to 'sue' you for infringment. The maximum they can do is to complain to the GDPR office in your country. And then, maybe, the office is gonna undertake an investigation. This whole is process can be a matter of years. Don't be afraid, if you receive one of those letters just ignore it.

<comment> vertex-four If your failure to comply with the GDPR has cost someone damages, they can recover those damages in civil court by suing you, though.

<comment><USER50> But, unlike the US, in most (all?) of the EU, the most you can sue for damages is the total damages incurred (plus court expenses).

</comment></comment></comment><comment><USER51> Won't this DoS the regulators as well as the companies? Carpet-bombing everyone with DSARs is not just annoying but self-defeating. Even though the basic ideas behind GDPR seem pretty reasonable to me, the implementation so far is almost enough to make me join the "regulation is evil" crowd.

<comment><USER25> Yes it will, which is why if you are serious sending a form letter is a bad decisions.

</comment></comment><comment><USER52> I'm waiting for the first time a GDPR DSAR deletion/retrieval portal is breached. Mass exfiltration or mass deletion are both great attack vectors.

<comment><USER25> That's a legitimate concern.

</comment></comment><comment><USER5> So the lawyer provided a letter which demonstrates what would happen in the worst case due to the GDPR. How does that make him dumb?

<comment><USER25> Because people then use that letter to increase the burden on companies 'just for kicks', it creates an asymmetry that the law did not intend. It forces attention away from the positive effects of the law and gives companies reasons to say 'see, this is what you get'. It's irresponsible.

<comment><USER53> I know I've posted this before but the law does not intend anything. The law is written, and then stuff happens. People intend and make broad laws that then more precisely get to intent after legal battles / precedent.

This is allowed under the law! If you don't like it, change the law!

The reason people have been complaining about GDPR this whole time is exactly this. Things take on a whole new meaning when complied with at scale when all you need to send is an email. This seems worse than FOIA (the US Freedom of Information Act) and Europe placed it on their entire private sector.

EDIT: clarity.

<comment><USER25> This is a very US centric view of things, the EU and the US have a very different approach to legislation.

<comment><USER53> I admit that my view is somewhat US-centric but also has roots in Europe. I would challenge / I am asking: what is the real difference in the EU, that you could fall back on if sued because of these letters? You have to prepare for that if you want to be responsible, right?

Is it because this is not law, but rather, regulation which is only selectively enforced and suits cannot be brought by individuals but rather by central regulators that will never keep up with the avalanche?

Does the EU never enforce law by the letter, so the letters are unreliable and really more like a guideline? (If so, why bother with law?

Lack of EU sovereignty over member states means it won't get enforced if it's really an inconvenience anyway?

Something else?

<comment><USER25> > what is the real difference in the EU, that you could fall back on if sued > because of these letters?

This is the first part where your view of how things would likely play out and reality diverge. Under the GDPR a Data Subject whose request is not answered satisfactorily or timely _could_ sue but that will likely go nowhere because they _should_ direct their complaints towards the regulators, not towards the courts.

> You have to prepare for that if you want to be responsible, right?

No, to prepare you have to be 'in compliance', which is a different thing. Essentially you should read the law, decide which part of your operation is 'in scope' and adapt your business to reflect your understanding of the law.

In case of a complaint to a regulator they _may_ (but not necessarily) investigate and if they find transgressions they will issue some guidance on how you should achieve compliance. If upon re-testing it appears that you have not followed the guidance you will most likely be hit with a fine. If the original investigation was because of a data breach or other serious issue they may decide to fine you immediately as well.

> Does the EU never enforce law by the letter, so the letters are unreliable > and really more like a guideline? (If so, why bother with law?

The EU tries to achieve a certain effect with the law: to make it harder for companies to wipe breaches under the carpet, to give Data Subjects more control over their data and to stop the worst excesses in the world of data brokering.

So if you cross any of those you can expect enforcement.

> Lack of EU sovereignty over member states means it won't get enforced if > it's really an inconvenience anyway?

All member states have automatically adopted the law when it went in force (April 2016).

> Something else?

That's up to you :)

<comment><USER53> Thank you for the thoughtful responses! As someone with experience in regulation in the United States it makes sense to me that it is at the regulator's discretion to enforce these rules so there will (necessarily) be enforcement of intent, at least for the current regime. (might change in the next one)

All that said, it likely can and will be mis-used, and citizens will likely sue and cite the regulation if the regulator refuses to enforce the regulation so if I were Europe, I would try my best to prepare for such an eventuality as part of the law to reduce burden. I don't think it's alarmist to suggest this.

I also don't think it is alarmist to suggest that regulators will not always be rational actors, and there are politics at play. It will be interesting to see if any blatant cases of prosecution result from crossing an EU government or leader. Fingers crossed that never happens.

</comment></comment></comment></comment></comment></comment></comment><comment><USER54> Am I right that the only risk for a small, side project for non-compliance are the EU legal sanctions should they grow to a significant enough size as to open an EU office? Other than they, why shouldn't a US side project ignore the DSARs?

</comment><comment><USER55> How do I know someone didn't just steal someone's username and password? I assume I should be asking for personally identifying information such as a password or ID? There is some irony here.

</comment><comment><USER56> The lawyer who published the nightmare letter is not dumb at all, just ambitious and selfish. They're making a name for themselves and do not care about massive externalities.

</comment><comment><USER57> Jacques, thanks a million for your work on this topic. It makes me feel much more confident about being able to efficiently handle such a nightmare letter if it one day comes.

</comment><comment><USER58> The only response this would get is 'you have been confirmed in our systems and your right to be forgotten has been processed. Thank you.'

</comment><comment><USER59> If only non-Europeans could do these requests. There are a few companies I'd love to know what they are doing with my data.

</comment><comment><USER29> When you're doing shitty work to comply with this shitty law, perhaps you can find some comfort in the fact that people have suffered more from stupid government policies, and that misbehavior of foreign governments is a persistent risk of international business. This is one place where the EU is vexingly successful — if it was just, say, France doing this, most companies under $1 billion would have no trouble just giving France the finger and blocking their users.

</comment><comment><USER60> Here's an idea: how about charging more for European users to access your site. If it is a cost issue, how about reflect that cost in the price of your service. So, if your web app is free for North American users, put it behind a paywall for Europeans. It's not ideal, but maybe if enough sites/services did that, it would help reflect the reality of the situation. Consider it a European service tax.

</comment><comment><USER29> "GDPR is great and will cost nobody anything"

</comment><comment><USER61> Step 1: be an American company with no European offices or accounts.

Step 2: Ignore letters about GDPR.

Alternatively, set up a form response to autosend whenever you get an email with some of those keywords.

<comment><USER62> So anyone outside of US should ignore DMCA I believe? Just an example.

<comment><USER63> So you wouldn't have an issue implementing Chinese regulations?

<comment><USER62> I'm unaware of similar Chinese laws, can you please point me at them? To the official English translation I mean.

</comment></comment></comment></comment><comment><USER14> I feel like I'm missing something - the site/article/page hasn't loaded for me for the last 40 minutes or so, and yet people are upvoting it.

Am I missing something? Is it just me? "Is It Up"[0] says it's up ...

Maybe I'll try via a different IP address.

 _Edit: The number of upvotes (twelve and counting) shows it 's not just me. I've now changed my IP address and it loaded almost instantly._

Jacques - FWIW the IP address that's not working is 188.8.131.52 - it's been failing to load your site for at least the past hour, I have no data from before that.

[0] [https://isitup.org/jacquesmattheij.com](https://isitup.org/jacquesmattheij.com)

<comment><USER64> It is not just you. I had to access it from a proxy. I assume that means he is blocking certain parts of the US, if not the US in its entirety.

<comment><USER25> > I assume that means he is blocking certain parts of the US, if not the US in > its entirety.

On what basis do you make that assumption?

It is still the internet, routing issues can and do occur. There is absolutely nothing in the configuration of my server(s) that would block anybody from any nation.

I'll alert my hosting provider to make sure they know about it just in case it's a novel thing and their monitoring didn't pick it up yet but it could easily be further upstream.

<comment><USER64> Your site has been offline, at least for me, since Saturday.

<comment><USER25> Interesting. Ok. I have passed on the info, thank you for the heads up.

<comment><USER65> I experience the same, UK based.

<comment><USER66> I'm in the UK and had no problems accessing it (Sky)

<comment><USER67> datapoint++: UK, BT, cannot access

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER68> Hey @dang, the article was updated to remove the typo in the heading. Maybe edit the HN title too?

Receive => Received

<comment><USER69> Updated. Thank you!

<comment><USER68> Thanks Scott!

</comment></comment></comment><comment><USER70> Nobody expects the Spanish Inquisition

</comment><comment><USER71> Website is blocked for pretty much everyone but the US? Just accessed from Nepal, blocked.....oh dear...

Edit: apparently not blocked, but still can't connect apart from via VPN.

<comment><USER25> No, there appear to be some connectivity issues of the non-obvious kind (apparently BGP related), the hosting provider is working on it and there are several work-arounds posted in this thread.

</comment></comment><comment><USER72> The fact that you have to respond to an information request letter under the GDPR makes the legislation tyrannical.

The idea that information about someone belongs to that person, no matter where it is stored, is a philosophically flawed perspective that if fully implemented, would lead to total global tyranny, by obligating people to do the work of disclosure and information deletion on demand, and ironically, by eradicating all privacy in relation to information people have about other people.

You have no moral right to dictate what I remember about you, to compel me to disclose what I know about you, to compel me to disclose what steps I took to disremember you, or to restrict who I may relay the information I remember about you to. The GDPR empowers you to do all of these to me in the context of a web service.</comment>


Ask HN: Where can I find a white hat hacker - <AUTHOR> We run a small startup with very sensitive data. We've done a lot to secure it, but I'd love to get input from a white hat and do some deeper security testing. How do I find a white hat hacker / security expert I can trust and bring into the fold for a security audit? <comment><USER2> I run Breaking Bits Security ([https://breakingbits.com](https://breakingbits.com)). We work with a lot of the YC community. Our rates are also a lot more sane than most of the larger consulting shops since we have no sales, marketing or account management teams to support :).

We offer web application security assessments, mobile application security assessments and source code review. We also offer company training and reverse engineering services, but I'm assuming you are most interested in web app sec and source code review, correct?

Check us out if you're interested, my email is in my profile. Good luck with whatever you choose.

<comment><USER3> A heads up, the source code analysis link is broken.

<comment><USER2> On the front page? Thanks, just fixed that. It was working in the navigation bar, just didn't have the most recent link in that section. I appreciate the heads up :)

</comment></comment></comment><comment><USER4> Start a bug bounty and you'll get some attention from white hats. Or post the link here and with your permission I'll give it a quick look through.

</comment><comment><USER5> I am not sure a white hat is going to add value in most cases.

You have sensitive data and are worried about security. This is good (far too many people aren't). Bang for buck though, you are going to do better with a very security minded developer. A good developer with OS knowledge can make sure your code base is safe from all the common vulns and follows best practices. In general, that would be a lot more useful to you than someone that would come in and maybe find a hole somewhere.

Now if you did something very nich like invented your own crypto algo, and you need a white hat crypto guy to go test it - sure - get an outside set of eyes. But for someone to check for root access being disabled over ssh and no SQL injections? Seems overkill. Fortune 500 companies will throw millions at white hats, and only find a few vulns. As a startup I don't think you can do that (unless your funding rocks).

<comment><USER6> This seems like a poor approach if you are really serious about the security of your data. Proper pen testing encompasses more than a single app you may be developing.

1) A developer can only help secure your code base, not your entire infrastructure and company-wide security practices.

2) A single security-minded developer does not suddenly make the rest of your developers more security-minded (not to mention your non-developers).

3) Even the most security-minded developers may lack knowledge of specific security threats. They are primarily focused on development, not keeping up on every new vulnerability or attack technique.

I agree that cost may be an issue, but pretending that security needs can be solved by finding the right developers is pretty short-sighted.

<comment><USER5> I think it is a more likely path to success then hiring a pen tester and hoping he finds all your bugs!

Fortune 500 companies spend millions on pen testing and miss stuff. How much can you afford to spend for a startup, and what will your ROI be?

I have nothing against pen testing. But it should be like your 7th line of defense. Not sure most startups have the other 6 figured out....

</comment></comment></comment><comment><USER7> I would hire these guys[1]. I used be in the same "crew" with one of them back in 2003. I trust his skills. Some of them are Phrack authors (is this a thing these days? Can't tell).

Note that I have no affiliation with them.

[1] [http://census-labs.com/](http://census-labs.com/)

</comment><comment><USER8> Look for a company offering penetration testing services, there's quite a lot around, from one-person freelancers to large shops with 1000+ employees.

</comment><comment><USER9> If you need someone to look over your code and configuration to verify that you're secure, check out our work at [https://paragonie.com](https://paragonie.com) and feel free to send us an email.

</comment><comment><USER10> What is your motivation for having security testing done? Are you subject to regulatory requirements? Or are you just doing it for your own peace of mind?

What stage are you in the SDLC?

My email address is in my profile - happy to chat and help you figure out the best approach.</comment>


Show HN: Deep learning visual search and data analytics - <AUTHOR> https://github.com/AKSHAYUBHAT/DeepVideoAnalytics <comment><AUTHOR> Deep Video Analytics is an open source visual data analytics platform. The platform uses deep learning based indexing, detection and recognition models for visual search. Using Deep Video Analytics users can quickly load, annotate, index, images & videos. They can detect and recognize objects (such as faces) and seamlessly import and share processed datasets using Visual Data Network. Deep Video Analytics is developed using Django, Postgres, Tensor Flow & Docker to enable flexible deployment. You can find more information here: [https://deepvideoanalytics.com/](https://deepvideoanalytics.com/)

<comment><USER2> When you say video, are you talking just images, or also audio? I built a video search site ([https://www.findlectures.com](https://www.findlectures.com)) and I'm investigating options like this to feed more ranking factors into the system.

<comment><AUTHOR> Hi the system is under active development I am planning to add support for audio processing using

1\. [https://projects.csail.mit.edu/soundnet/](https://projects.csail.mit.edu/soundnet/)

2\. [https://github.com/aalireza/SimpleAudioIndexer](https://github.com/aalireza/SimpleAudioIndexer) (using PocketSphinx, NOT Watson)

<comment><USER2> Awesome, thanks!

</comment></comment></comment></comment><comment><USER3> This is phenomenal. Is the primary use case for this to:

\- Find similar looking frames?

Question:

\- Does it perform object detection on the frame? Similar to the video demo on Clarifai - [https://clarifai.com/demo](https://clarifai.com/demo) ?

<comment><AUTHOR> We have Visual Search as a primary interface. However the goal is to build an application agnostic visual data analytics platform. Similar to a relational database we have high level concepts of indexers (convert image/bounding box into a feature vector), clusterers (cluster feature vectors) and retrievers (retrieve similar images/objects/annotated-regions).

To answer second question we also detect objects (VOC, YOLO 9000, Faces etc.), detected objects are also indexed and retrieved when performing visual search. Further you can perform clustering on these set of "indexing" vectors for things such as fast retrieval and quick labeling/annotations. We use Flickr LOPQ to implement ANN but like all other things you can use custom algorithm. I am working on adding indexing over any set of annotations/detections/frames.

You can find more information about the design goals and vision behind the project in presentation at [https://deepvideoanalytics.com/](https://deepvideoanalytics.com/)

</comment></comment><comment><USER4> This looks awesome. I look forward to the usual hacker news banter of "yes this is awesome but this is awesomer, see xyz" :) yes awesomer is a word

</comment><comment><USER5> Is there a way to find other things besides faces, for example a blue car or a logo?

<comment><AUTHOR> All frames and detected objects are indexed using inception Pool3 features, which serves as a General purpose indexer. So yes you can search for arbitrary objects such as a blue car or a long or a particular "scene", at the same time when definition of "similarity" is more object-specific/fine-grained (such as in case of face) you can use a custom network (such as facenet for faces) to generate the embedding/indexing vector.

To summarize yes we provide two indexers out of the box a general purpose inception v3 and a facenet. We plan to add more indexers soon, e.g. trained on Open Images or other domain specific dataset.

</comment></comment><comment><USER6> Exactly whats needed now as part of growing dataset and deep learning models

<comment><AUTHOR> Yeah I am actively working on improving Visual Data Network, essentially the goals is to make sharing, downloading and configuration of datasets to be a single click operation.

Sharing visual data opens up a whole new set of opportunities for both businesses and researchers.

<comment><USER3> Can you please explain some real world use cases you're thinking about?

</comment></comment></comment><comment><USER7> Could this be used to power something similar to Google Photos?

<comment><AUTHOR> Yes we have entire pipeline (detection -> embedding -> clustering) for faces as well as ability to extract text tags using models such as Open Images.

</comment></comment><comment><USER8> is there a way to create an API which returns these features?

<comment><AUTHOR> The features are stored in .npy files. Currently there is a rest API but its only for django models (using amazing django rest framework), for search and feature retrieval creating API is straightforward and I will add one soon.</comment></comment>


Show HN: Zent – A set of high quality React components - <AUTHOR> https://www.youzanyun.com/zanui/zent/en/guides/install <comment><USER2> In the future front end devs will be like peripatetic workers of yore, carting around their component libraries like a salesman's sample case.

</comment><comment><USER3> This looks like a rip off of antd: [https://ant.design/docs/react/introduce](https://ant.design/docs/react/introduce)

<comment><AUTHOR> Antd is great, but all components in Zent are extracted from our product at youzan.com. I'm pretty sure we developed Zent to satisfy our business needs, but not to imitate something.

</comment></comment><comment><USER4> I wasn't able to use any of the components on my android phone, so mobile friendliness doesn't seem to be a priority here.

<comment><USER5> I'm pretty sure some of them are just images

<comment><AUTHOR> Yeah... But I'm sure all demos in the Components section are runnable code.

</comment></comment></comment><comment><USER6> Couldn't find the size of it, anyone found it?

<comment><AUTHOR> Maybe you can check here: [https://email@example.com/lib/](https://firstname.lastname@example.com/lib/).

The minified UMD bundle is about 598.75 kB in the current version.

</comment></comment><comment><USER7> Good! These components are really suitable to develope a e-commerce project.</comment>


MinuteFrame: Order a framed photo in 60 seconds for $20 - <AUTHOR> http://www.minuteframe.com/

<comment><USER2> This is neat; I like the focus on simplicity. As someone who would, from time to time, like a framed photo but have no interest in comparing 500 different frames in a store, this is pretty neat.</comment>


How Chronic, Prolonged Sitting Impacts Your Body - <AUTHOR> http://www.ericcressey.com/prolonged-sitting-posture

<comment><USER2> And Stanley Green a great British eccentric thought that to much sitting was one of the causes of the swinging sixties :-)

[http://en.wikipedia.org/wiki/Stanley_Green](http://en.wikipedia.org/wiki/Stanley_Green)</comment>


Chronic fatigue syndrome - <AUTHOR> http://www.economist.com/blogs/babbage/2011/07/chronic-fatigue-syndrome <comment><USER2> In March of last year I was in pretty good shape. I was running 1.8 miles three times a week -- not a lot of miles by hardcore runner standards, but more than most middle-aged men. The previous September I had competed in my first race, and had turned in a very respectable time, about the 64th percentile among the men. And I've always been active, running, cycling, and playing table tennis. It's very important to me.

Anyway, in the third week of that March I had a flu-like illness. It wasn't too different from the dozen or two other such illnesses I've had in my life, although it was perhaps among the more severe, lasting a full week.

After giving myself a couple of weeks to recover I attempted to resume my previous level of activity. But I was beset by a persistent malaise and severe headaches. After a few weeks it became clear that anytime I exercised, somewhere between 12 and 48 hours later I would have these symptoms.

To make a very long story short, I eventually figured out that these were common symptoms of CFS, a condition I had heard of (20 years ago I knew someone who had it) but had known next to nothing about. Further poking around on the Web led me to think that it was probably caused by an Epstein-Barr infection.

While I had originally hoped it would get better on its own, eventually it became clear that it was getting worse. I asked my doctor for a prescription for valacyclovir, an antiviral drug, and he agreed. I started taking it at the beginning of (this) March. It has helped quite a bit, though I'm not completely cured -- I've been exercising some, and I still get the symptoms afterwards, but they're not nearly as severe.

I'm relating all this to explain why I think it's ludicrous to suggest that this illness is hysterical. I was indeed under a lot of stress at the time I contracted it; I was between jobs, my previous job having ended in a particularly stressful way (it was a startup that ran out of money). If you wanted to say that my stress level was a factor in the etiology of the infection, I'd be the first to agree. But that's very different from saying it's a mental illness.

There is a certain institutionalized arrogance in the medical establishment. Some doctors -- not all! -- when faced with a patient whose symptoms they can't explain or treat can't stand to admit that modern medical science still doesn't know everything about the human body. So rather than admitting their ignorance and powerlessness, which would be hard on their egos, they say the disease doesn't exist. Now, which of us has the mental problem?

I don't begin to condone death threats. There's no excuse for such behavior. But there's also now plenty of evidence for an organic cause of many cases of CFS. The working hypothesis, as I understand it, is that it's a viral infection of the brain, where the virus is a member of the herpes family, usually either Epstein-Barr or human herpesvirus 6. Hence the use of valacyclovir or valgancyclovir, which were invented to treat herpes infections.

BTW, before trying valacyclovir (and indeed before realizing that I had CFS) I did try other medications, which did nothing. I seriously doubt my improvement can be attributed to the placebo effect.

So although, again, I don't condone death threats, I also have very little patience with those who, in 2011, are still putting forth what by now is a discredited theory, one that doctors should have been too ashamed to advance in the first place.

(Someone is going to point out that some patients have felt somewhat better when given antidepressants. Let me tell you, this is a depressing disease, so I understand how that might happen. I have not heard of anyone being cured solely by antidepressants.)

<comment><USER3> 1) You diagnosed yourself with CFS

2) Your condition matches a number of viral and post-viral conditions which would explain why your chosen treatment worked

Sorry, but your post is in no way, shape or form an argument that CFS is not a mental disorder.

I've been diagnosed with CFS. It sucks. A lot. I still think it's a mental illness. The difference between me and most people is that I don't think that makes it "fake" or "not real" in any sense at all, but I'm sure if you told your boss you were too tired to get out of bed because of a mental illness, you'd be laughed at. So what? The same could apply with major depression, less people would argue that depression doesn't exist.

People like you are holding us back, people using reasoning similar to yours are justifying this campaign of harrassment upon researchers that are just trying to find the _truth_. They're not trying to prove people with CFS are lazy, or making it up, or even that it's all in the head - they want what everyone who has the disease _should_ want - to find out what it is.

An additional warning to anyone wanting to compare anecdotes: CFS is a "diagnosis of exclusion". This is a fancy way of saying that actually, we don't have a definition for this disease. It's entirely possible that multiple poorly-understood diseases with similar symptoms are leading to a single diagnosis ("CFS") at present, which complicates any effort to share experiences.

On the front of these people sending in death threats... I know quite a few people that claim to have CFS. Some of them quite clearly do not have the same thing as me, were not diagnosed by doctors, and would resist quite violently any attempts to re-classify them. They enjoy having a label they can hide behind, I guess.

Lastly I want to say: This is a real thing, or at least, there are things we don't understand and this is the label that gets put on it. I don't know for sure what I had, I don't know if it was physical or mental, but it was real. I've encountered many people, including licensed doctors, that mock and denigrate people with this condition, and if you are one of those people I would implore you to rethink your position. We know very little about the connection between our physical and mental well-being, but at this point it's incredibly clear that there is a very strong link, and that mental issues can cause very real, physically observable and empirically testable problems.

<comment><USER4> "I still think it's a mental illness."

Why? What does "mental illness" mean to you? You go on to say it's a diagnosis of exclusion, and you don't know for sure what you had/have -- isn't that the point?

I guess we need to be careful with our definitions of "mental" in "mental illness". For example, major depression responds rapidly to ketamine ([http://www.newscientist.com/article/dn9696-ketamine- relieves...](http://www.newscientist.com/article/dn9696-ketamine-relieves- depression-within-hours.html)), and other NMDA antagonists may prove clinically useful in treating that "mental" illness.

However, there's also the "maladaptive beliefs" side of "mental illness" which may be applicable to depression -- change how you think, change how you feel emotionally -- but their application to CFS as anything other than a mild management technique is absurd and has been proven time and again to be a dead end. Nevertheless, the implication from the psycho-social CFS school is that if you change how you think about your illness, you can think yourself out of your condition. That's absurd. They talk in terms of validation, needing respect, and saving face by coming up with symptoms; i.e. that you, the patient, are neurotic. It's pernicious nonsense.

The focus on viral aspects is far from a dead-end - see the work of Dr Martin Lerner and his use of valacyclovir and valgancyclovir, for example.

There was also research done in Australia that CFS may be a "hit and run" brain injury cause by a virus or viruses -- is a physically damaged brain a case of mental illness or just plain illness? Either way, it's not something that changing "maladaptive beliefs" will solve.

<comment><USER3> In my case I mean, what I had was almost certainly mental.

I strongly agree with you that mental illnesses have a very strong physical component, if not being completely physical. I think it's incorrect that they are sometimes thought of as being "imaginary" or "in your head". You don't tell someone their heart disease is "just in your heart", and you certainly wouldn't tell someone with a brain tumour to buck their ideas up!

> their application to CFS as anything other than a mild management technique > is absurd and has been proven time and again to be a dead end

Given that CFS is not defined, I would strongly challenge anyone claiming that such-and-such is "proven" with regards to it.

I know the viral aspects are a big thing, at one point my doctor suspected I had post-viral fatigue syndrome (which affects people who had mono that just.. sticks around a bit after?)

Another interesting anecdote of mine is that one of my friends "had CFS" and was "cured"... she had anaemia. Like, basic, common-or-garden iron defeciency. You would not believe how many health officials she went through before a chance conversation with an ex-nurse led to the correct diagnosis. So I do wonder how many poor souls out there are suffering from crippling fatigue that could be quite simply solved!

<comment><USER2> > one of my friends "had CFS" and was "cured"... she had anaemia

Just so we're clear, this point is not in debate at all. There are indeed many possible causes of fatigue which need to be looked into. I'm sure many of them get lumped into the catch-all category of CFS before someone realizes there is a less obscure cause than EBV/HHV-6 infection.

On the other hand, my case was characterized by two phenomena which, AFAIK, are quite specific for EBV/HHV-6. (And yes, I mean "specific" in the statistical sense: they are rarely associated with any other condition, and thus, as diagnostic cues, would generate few false positives.) The first is the fact that my symptoms began after a flu-like illness, and were clearly not present before that illness. The second is that I would have the symptoms as much as 48 hours _after_ exercise. I'm not a doctor or medical researcher, but I have yet to hear of another disease with that property. Many illnesses make exercise unpleasant, but they tend to do so at the time the exercise is taking place, or right afterwards. A 48-hour delay is bizarre. (My SWAG(†) is that it has to do with the release of growth hormone during the post-exercise recovery process. Growth hormone triggers neurogenesis, among other things, and I suspect that the virus is somehow taking advantage of or interfering with neurogenesis. Just a thought.)

(† SWAG = Scientific Wild-Assed Guess)

> Given that CFS is not defined, I would strongly challenge anyone claiming > that such-and-such is "proven" with regards to it.

Fair enough, but cfshacker also has a point: some doctors have tried for years to treat CFS as a "mental illness", with very limited success.

Now to the main point:

> I strongly agree with you that mental illnesses have a very strong physical > component, if not being completely physical.

Well, if that's where you're coming from, why even use the term "mental"? If you think that your condition was rooted in a neurotransmitter imbalance or something like that, why not just say that? Then we're not debating whether it had an organic cause, we're just debating what _kind_ of organic cause.

The irony is, I absolutely do believe in psychosomatic illness. But I believe its causes are _emotional_. If the cause is actually physical, it seems to me this contradicts the very definition of "psychosomatic".

EDIT: formatting.

</comment></comment></comment></comment></comment><comment><USER4> Psychological theories for CFS have been around for decades and have yielded very little by way of testable hypotheses or treatment, despite millions of dollars spent on research.

Wessley's highly controversial views and work have been subject to much criticism -- absolutely none of which is reflected in this disappointing puff piece. There's plenty of more news-worthy stuff that's been happening in the CFS world (both good and bad) in recent times than years-old revelation that people don't much like Simon Wessley.

The core problem is simply that this conclusion isn't true: "But a psychiatric explanation would not delegitimise CFS. And it might improve treatment and help patients get better, at last." Wessley's theories have been studied. They offer very little to very sick people. They don't get better. It does delegitimise the extremely severe nature of the illness. If they did legitimise, and -- far more importantly -- cure sick patients, great! That would be wonderful. But they don't. We know they don't. Shame on the Economist for not saying so.

Psycho-social explanations of CFS seem to be nothing more than "hysteria" rebadged for more modern times. It's easier to say "Well, maybe it's your fault!" than to accept the hopelessness of not knowing what's going on.

Actually, that's not true, there has been (and is) plenty of work on the physical abnormalities. For those interested in current happenings in the CFS world, it's worth following: <http://phoenixrising.me/> .

<comment><USER5> Your other objections are interesting and I want to research them further. But I wonder how this comment doesn't prove the editorial's point:

> It does delegitimise the extremely severe nature of the illness.

How does merely positing a psychosomatic origin for the syndrome "delegitimise" its "extreme severity"? Or is it you thinking that mental health is somehow less important than physical health, which doesn't even make sense considering the brain is an organ too?

> Psycho-social explanations of CFS seem to be nothing more than "hysteria" > rebadged for more modern times. It's easier to say "Well, maybe it's your > fault!" than to accept the hopelessness of not knowing what's going on.

Uh huh. And it's easier to take the idea of mental health being relevant as a personal insult, like people are saying it's one's own fault, than to accept the hopelessness of not knowing there's a magical cure as soon as the doctors discover the sole physical cause.

Again, I really want to read further on research being done on CFS and other subjective and idiopathic syndromes. It's interesting from a medical and social standpoint and I'm close with several people who suffer with such issues. But I've also seen their blind spots related to the issue. I'd like to hear more on the work that's disproven psychiatric origins of the syndrome, since while the editorial touched on Wessley it seemed more to be talking about the need to explore all possible causes and solutions of a problem affecting many.

<comment><USER4> Thanks! Generally speaking, I think you have to understand the nature of "mental" illness that's being discussed. Depression, for example, is taken seriously as a "mental" illness but is quite comfortably discussed in medical terms (hence SSRI's, NDMA antagonists, etc); as well as Cognitive Behavior Therapy where it's been reasonably demonstrated that improving your thought patterns can improve your emotional wellbeing. I'd describe this as the modern form of "mental illness".

The kind of "mental illness" we're talking about here with CFS & the Wessely/UK psychiatry school of though though is old school _neurosis_. You're not sick, you're neurotic. You want to save face by coming up with symptoms. You need validation from a doctor. You remain sick because of the 'secondary gain' you receive in terms of attention. You need to avoid personal responsibility and blame, and so on.

It's horrible stuff. For quotes from the horse's mouth, see: [http://www.cfsinfo.be/Documentatie/AA%20%20Strijd%20classifi...](http://www.cfsinfo.be/Documentatie/AA%20%20Strijd%20classificatie%20ME/Views%20of%20Simon%20Wesseley.htm) , and hopefully you can see why his views have been so controversial.

It's true that CFS is something of a catch-all for a variety of illnesses, from post-viral syndromes (see Dr Lerner), hypothyroid problems, diet and gut- related illnesses (undiagnosed coeliac patients, for example), neurological syndroms (some people are helped by neurofeedback, and Jay Goldstein wrote some fascinating books on the neuroscience of CFS/ME), hormone disorders (e.g. adrenal, but also others), possible retroviruses (XMRV looks 95% unlikely, but a handful of people did well on antiretrovirals), possible hit-and-run viral brain injury (as Australian research has indicated) and on and on. Hell, I recently came across a guy who recovered almost immediately and totally after 30 years of debilitating fatigue by taking a relatively recent IGE-binding drug (Xolair). Plus, there's the potential of an underlying viral or other cause that in turn causes a differing array of symptoms.

The problem is not just that we don't know what CFS/ME is (to the extent that it's a uniform thing), but we're pretty lousy at dealing with all the other surrounding illnesses as well. (Hypothyroid is a great case in point, IGE is relatively new, etc etc,.)

What's pretty clear, however, is the vast, vast majority of these patients, whether suffering CFS for known or unknown reasons, are not neurotic, and for The Economist, or anyone, to insist that "neurosis" should be taken seriously as a basis for medical diagnosis and treatment in 2011 is simply appalling.

edit: ugh, Wessely, not Wessley. my bad.

<comment><USER2> Wow -- those quotes are astonishing. Well, it doesn't surprise me that nutcases like Wessely are out there. But how does he get taken seriously???

</comment></comment></comment></comment><comment><USER6> Am I the only one who finds the writing in the economist to be about as deep as a 9th-grader's book report? I mean I basically learned nothing from this article.

<comment><USER7> No, I totally don't get the Economist. People always tell me to read it. Smart people. Then I read it, and it's like a 9th grader's book report, as you say. It's a hair better than Time magazine or Newsweek.

<comment><USER8> Well, it _is_ called _The Economist_. If you expect to read intelligent analysis of medical conditions, I suggest you look elsewhere. _The Economist_ is good at providing analysis of economical and business matters. I read it for those components and ignore the rest.

<comment><USER9> Their coverage of world politics and other topics is also very good. Only the Science and Technology section is appallingly and depressingly bad.

<comment><USER8> Then again, that may just be a result of us knowing a lot about Science and Technology. I wonder if those who are experts in economics and those other fields _The Economist_ supposedly covers with skill think the same things about it covers their area of expertise.

<comment><USER9> I wonder the same, but from people I trust and what I do know, it seems that they are better than pretty much anything else being published this days. Their Science and Tech section is clearly not better than alternatives, and in many ways much worse.

</comment></comment></comment></comment></comment></comment><comment><USER10> The problem is not this researcher doing his research. The scientific process can deal with several opinions on a topic, since the better theory will eventually yield better results, more publications and more acceptance in the global scientific community. Everything should be fine.

But he's not just a part of the global scientific community, but also a researcher at a prestigeous university in the UK, where the poltical climate of the last few years has happily called everything off mainstream antisocial. The UK is a country where there was a serious discussion about not calling obese people obese anymore, because it is not insulting enough, but that one should call them fat. In such an environment, a theory among many, stating that CFS is caused by mental illness, can easily be spun into CFS sufferers just being lazy folks who don't want to work, because science says so. (Ignoring that mental illnes, like a physical illness, is actual illness and not a bad character trait)

This is a problem with the UK, not with this researcher.

<comment><USER3> I've had CFS and I still find many of the "sufferers" completely insufferable. I don't know if this is a UK phenomenon, a western phenomenon, or just a thing that people do, but the majority of people _who choose to disclose to me_ that they have a mental illness are self-diagnosed. CFS is one of those things (like ADHD and Asperger's) that is very appealing to people who have certain problems. I don't think this disease will be taken seriously until we actually have diagnostic criteria, proper names, proper understanding... Overall, acceptance of mental issues as real problems is definitely growing in this country.

</comment></comment><comment><USER11> This is my current diagnosis, for those who might have been following my story from over a year ago (<http://news.ycombinator.com/item?id=1399450>). I've been wanting to publish an update to this story on HN, but I'd been hoping for better news first.

My last doctor (a very good, well-known Rheumatologist in my area) spent a long time working with me. After months of trying everything he knew, he put it to me like this:

* You have Chronic Fatigue Syndrome. Name sucks, but that's what it's called right now.

* What you have is real, it's not "in your head".

* A typical outcome is that you will start to feel better when you turn 50 or 60. In other words, my best outcome is to hang on for another _ten to twenty years_ and hope that I feel better then.

I've been dealing with this since college, but this is the year that I finally had to admit I was failing, and had to quit my job.

<comment><USER2> You don't mention looking into the EBV/HHV-6 possibility. I urge you to investigate it immediately. Here's Dr. Martin Lerner's Web site:

<http://www.treatmentcenterforcfs.com/>

He recommends a collection of tests which could confirm a diagnosis of EBV or HHV-6. (My doctor and I agreed to skip the tests because my symptoms were not nearly as severe as yours and the tests are not quite as reliable as one would like; it seemed simpler just to start me on valacyclovir and see what happened. But for a more severe case like yours, the tests are probably a good idea, I would think.)

</comment></comment><comment><USER12> When I was 9 years old I developed a low-grade fever for several (9 - 12) months. During that time I was frequently in the Dr.'s office trying to find a reason. None was found. After that year, I always called myself chronically exhausted. Nothing seems to help. I've tried blue/green algae, homeopathic stuff, essential oils, fast food diets, regular exercise, full vegan diet, and so on. Nothing has helped. I've been to several doctors since, with no apparent cause ("take a multivitamin", or "take vitamin D"). I'm heartened to see I might not be alone.

</comment><comment><USER13> Why can't something be medical AND psychological? Stress, bad diet, lack of social interaction, etc. Our bodies and minds are legacy material thanks to the technology we created. What I don't like about the medical profession is how they jump to definitive conclusions to many things and fail to question so-called established wisdom.

Symptoms are as real as the patient feels it. It's not over until they feel cured. Anybody who's struggled with something outside their power knows that strength of will can work miracles but only get you so far.

<comment><USER4> Well, you wouldn't say someone with AIDS had problems with "Stress, bad diet, lack of social interaction", for example. Yet Dr. Nancy Klimas got interested in CFS patients when she found they were sicker than her AIDS patients. (Of course, outcomes for AIDS patients are far worse!)

</comment></comment><comment><USER14> I think one of the major problems with "CFS" is that it's an umbrella term. Seriously. If you have persistent fatigue and they can't diagnose you with anything else, you have "chronic fatigue syndrome". It's no wonder research is inconclusive and hard to come by.

My brother and I both got CFS at the same time, with similar initial-diagnoses (tested positive for Mono), and we've been fighting off the effects for quite a few years now. For myself, I went from soccer-playing high-energy kid to going between bed and the couch for about a year and a half, in the span of a few days.

What changed after a year and a half was that I was getting ever-deeper in a depressive cycle, and managed to recognize it and escape - I realized it was literally a lethal path if I didn't fix something. Very good motivation, that. From then, I basically spent 5 years wasting a little more energy in everything I did, and very very slowly got some stamina back - it took me about 5 years from the start of it all to get to the point where I could go back to school for a couple hours a day. The remaining year and a half got me back to almost regular hours.

I still have some problems, but am able to get around most of them now because I have very acutely learned the difference between being _fatigued_ and literal physical exhaustion. And I've become extremely patient / stubborn in my progress - a few years to make a small improvement isn't all that long any more. I still waste energy left and right, but it's no longer a necessity.

I am a rare exception, and I count myself _lucky_ , not strong-willed. Getting to where I am now hasn't been entirely my doing - it has faded on its own to a fair degree.

\---

So, throughout all this, I've kept watching the research a bit, and one thing sticks out like a sore thumb - the umbrella term. Studies have a hard time finding individuals, and a hard time finding ones with possibly-similar causes, because it manifests so many different ways (my brother had and has severe migraines, I've had digestive and muscle pains). And if it doesn't help _everyone_ , it's not a cure. It's disorganized and counter-productive, and the same thing happens to almost every umbrella term in every field.

And due to all of this, we've had tons of blood tests, left several doctors who take the stance that it doesn't exist, and found a surprising amount of people with similar experiences. Doctors who can't accept things they didn't learn in school disgust me - I'm very glad we've found a couple that don't. They've been wonderful.

For my brother and I, I can say this: we don't know how to manifest positive tests for Mono using our minds. The rest of it is possible, but I find it unlikely, and neither of us were under odd stresses prior - both good at school, had friends, no real family troubles, etc. No doubt some of it is psychosomatic, but it varies by person, and there are _definitely_ other factors in play in many cases. I very highly doubt many (most?) CFS cases are entirely psychosomatic. I have no problem with it _being_ psychosomatic (really, it wouldn't bother me - it'd mean less wasted on tests and more on attempts), I just doubt it's the main cause.

<comment><USER15> For those unfamiliar with medical terminology: the trailing 'S' for 'syndrome' gives away that something is a set of symptoms. They may or may not have a single cause, and we may or may not know the causes.

If we find the cause or a partial cause of a syndrome, it will get a new label. That is why "AIDS" has given way for "HIV infection", "Scurvy" for "Vitamin C deficiency", etc. CFS, being a syndrome, may Or may not have a single cause. We simply do not know.

A (IMO) problem with such vague syndromes is that, in general, it pays of to claim to be part of a a larger group. It is more accepted to say your son has ADHD than to say he cannot concentrate well, or that one has CFS than that one is lethargic., does not feel like doing much, etc.

Net effect is that, even if there is a group of true patients with well- defined symptoms with a common cause, it is hard to separate them from "me too" persons (a group that may include persons that have a different unknown ailment with similar symptoms)

</comment></comment><comment><USER16> The problem is that some people have a vested interest in seeing CFS as an organic problem. These proponents of CFS are notorious for mounting hate campaigns against mainstream researchers. That is one of the reasons why CFS has been delegated to the shadowlands of fringe medicine.

<comment><USER4> Rubbish. The reason CFS hasn't seen more mainstream research is a chicken-and- egg problem of having no specific angle to research, therefore research isn't done, therefore there's no specific angle to research. When the XMRV stuff broke the research community did swing into action. Scientists haven't decided not to study CFS because someone on the internet hurt their feelings. Medicine isn't omniscient. Blaming extremely sick people for the lack of research into their predicament is absurd.

<comment><USER17> > When the XMRV stuff broke the research community did swing into action.

Yes. And did prove conclusively that XMRV is not the cause for CFS.

> Scientists haven't decided not to study CFS because someone on the internet > hurt their feelings.

No. Funding for research is what makes scientists study anything. Direct your anger to raise more funding for CFS research and you will get closer to knowing the patho-physiological cause (whether you like the answer or not means absolutely nothing).

>Medicine isn't omniscient.

Just like any other human endeavor.

> Blaming extremely sick people for the lack of research into their > predicament is absurd.

The blame is very justified when you start receiving death threats.

Talk of biting the hand that feeds. Jeez!

<comment><USER18> Shiven, it's not been proven "conclusively" that XMRV is involved in CFS. I'm not aware of any serious scientists stating as a fact it was the "cause". It remains controversial, and research continues. Ian Lipkin's study should yield results within 12months and that seems likely to provide more solid answers.

CFS, in the UK, is a wastebasket diagnosis based on very loose and broad criteria. It's absurd for anyone to suggest it is one condition. I know of people who have been diagnosed with CFS, but then subsequently diagnosed with MS, bone disorder, and other conditions. ME, however, looks to be a specific subset. CFS and ME are not the same - ME is a smaller sub section of the patient population.

In the absence of a biomarker and test, we are however reliant on diagnosis based on symptoms, and so I'm pleased to see the new ME International Consensus Criteria published this month. These diagnostic criteria were created by 26 researchers and doctors from thirteen countries, with 400 years of professional experience, who have treated 50,000 ME/CFS patients. Their view is that the correct diagnosis for many patients is ME, not CFS, and that ME is a very specific illness involving multiple systems. There's a copy hosted here: [http://www.wpinstitute.org/news/docs/me-international- consen...](http://www.wpinstitute.org/news/docs/me-international-consensus- criteria.pdf)

Shiven, no sensible person is condoning attacks, but you have completely misunderstood what is happening. The reason people are so angry with the likes of Wessely is that in recent years ALL of the very small amounts of UK gov money going into ME/CFS research has gone to psychiatrists, when there's plentiful research showing (when patients are properly classified using proper criteria) they are physically very sick indeed with significant dysfunction in the immune system amongst others. It's indefensible. The majority of sensible patients are saying that they want biomedical research. It's absurd to suggest, as you are, that all ME/CFS patients are being self-destructive and stopping research by attacking researchers when it's a tiny minority. That kind of stereotyping is offensive, in any context. Let's not, as the press have blindly done this week, tar all patients with the same brush.

The poor results shown by The PACE Trial, even despite its sizeable cost, show the limits of what psychiatrists are able to do to treat ME patients (or even CFS patients). The psychiatrists are not succeeding in treating these conditions, and so clearly more work is needed.

If Prof Wesseley was threatened in the way he says (I've seen no evidence or heard of prosecutions) then those responsible must be prosecuted and if necessary jailed. However this drama created by Wesseley apparently putting out a press release (why?) is distracting us from the real question, when will the UK gov start putting funding in place to (additionally) look at biomedical causes of ME, which is a quietly devastating disease?

</comment></comment></comment></comment><comment><USER19> I was going set up a startup to serve the Chronic Fatigue Syndrome community but, somehow, I never got around to it.

<comment><USER20> at least tell a weed joke.</comment></comment>


Ask HN: How is your company storing secrets in EC2? - <AUTHOR> What services/encryption/etc is your company using to store things like API keys and other secrets (strings that cant be hashed)? I see services like these:
https://aws.amazon.com/kms/
https://aws.amazon.com/secrets-manager/
https://medium.com/@nqbao/how-to-use-aws-ssm-parameter-store-easily-in-python-94fda04fea84
Just wondering what the best practices is in 2019 <comment><USER2> You're confusing services and their intentions.

KMS provides encryption. Yes it can store small values for you, but that's it - encrypt this, decrypt that, rotate this key. Everything else is your job. This is the low level service.

Secrets manager builds upon this. More access controls, some built in logic for rotation of secrets, etc.

Which is correct for you depends upon what kind of secret you're storing, what you do with it, how often and how you need to rotate or regenerate it... dozens of factors.

Basically, KMS is the key master. It manages the keys to the data and will begrudgingly hang on to small bits of paper you've asked it to encrypt, but it does nothing else. Data in, encryption, data out, decryption.

If an API key is one of those bits of data that's fine. It knows not and cares not. Need to rotate it? Pull it out, decrypt it, rotate it, encrypt it, and shove it back in - all that is your business.

Secrets Manager is the gate keeper. It needs the key master but it knows more about who and what is passing through and will help you out from time to time. Stored your most recent allegiance to Zuul but you haven't reaffirmed it recently? He'll be a bro and go ahead and send it back in for you and store the new allegiance until you need it again.

</comment><comment><USER3> We've been using SSM parameter store to store our secrets (as secure strings). To manage access in a more granular manner we use a namespace approach where the parameters are prefixed with the service or API they're attached to, or "global" if they're meant for everyone. Each service has read rights for <service>-* and global-* parameters. We use a python library called SSM-cache to cache values locally and avoid the cost of a look-up each time.

I've recently seen secret manager and I first thought it was a rebranding of SSM PS. A quick google search seems to indicate that this is more or less the case at the moment, but the service will probably pick up new features as it matures.

<comment><USER4> There is no additional charge for SSM parameter store but rate limits apply (and I can't find out what they are). I have read accounts from people on HN who work on large AWS accounts who have been bitten by this.

The secret manager bills per request, so presumably that means they'll happily serve as many requests as you want. It also has some nice tooling around cycling secrets.

It's an important distinction when choosing which one to work with.

To contribute an additional idea not seen in this topic yet - my application predates both these services so it just reads from a JSON file in an s3 bucket that is encrypted at rest. It works just as well as all the above.

<comment><USER5> You should look into getParamtersByPath instead of getParameters. You should be able to get past the rate limits for quite some time (we haven't hit the getParamtersByPath limits yet)

</comment></comment></comment><comment><USER5> Similar to laurentl we use AWS SSM parameter store in combination with Chamber[1] to injects our secrets as environment variables to our application code.

For services running on ECS, each task definition has an IAM Role attached that has permissions to use secrets stored in parameter store with a prefix unique for that service (each service encrypts its secrets with its own KMS key). For example, serviceA will use the prefix serviceA and have a secret under serviceA/DB_PASSWORD and serviceB will have its own secret under serviceB/DB_PASSWORD. Each service cannot access each others secrets and even if they could, they also need access to use the corresponding KMS key before they're able to read the secrets. Since secrets are added as environment variables we can inject them during startup with chamber. The entry point for your docker container might look as following `CMD ["chamber", "exec", "serviceA", "\--", "./executable"]`. Chamber will inject the secrets store in SSM before starting the executable which reads the secrets from the env variables.

For other services such as Lambda we do not use environment variables, instead we use the AWS SDK to fetch secrets during cold starts and cache them for the duration of the Lambda container. If you're using Node.js lambda functions this is a little bit trickier to do than Go or python lambdas but it's still possible. The Lambda function also has an IAM access to only fetch the secrets under its own prefix.

For adding, removing or editing secrets we can use the chamber CLI with each individual devs AWS access keys. For example: `chamber write serviceA PASSWORD hunter2` to write a new secret or `chamber list serviceA` to list set secrets.

[1] [https://github.com/segmentio/chamber](https://github.com/segmentio/chamber)</comment>


SAW – Software Analysis Workbench Open-Sourced - <AUTHOR> http://saw.galois.com/index.html

<comment><USER2> Would formal verification work for a more involved, "entreprise-level", code bases?

Also I imagine it would be fairly hard to verify code that depends on external state (e.g. reads from a DB).</comment>


Ten years of Grml - <AUTHOR> http://michael-prokop.at/blog/2014/12/22/ten-years-of-grml/

<comment><USER2> Grml is a bit of an unorthodox rescue/live distro, as - if I recall correctly - it offers i3 wm as an option. It also uses zsh instead of bash. Its zsh config is quite nice, so much so, that it was included in the Arch Linux live media (at least in the past).

</comment><comment><USER3> I've alternately used Grml (debian-based) and SystemRescueCd (gentoo-based) for general-purpose system recovery, network booting to run an imaging process, and several other projects. Thanks to everyone who maintains a "live cd", as we used to call them!

<comment><USER4> I used it as a desktop for a year or two maybe about 6-8 years back.. Blazingly fast.</comment></comment>