Euro MPs back end-to-end encryption for all citizens - <AUTHOR> http://www.bbc.com/news/technology-40326544 <comment><USER4> Previous discussion: [https://news.ycombinator.com/item?id=14577828](https://news.ycombinator.com/item?id=14577828).

</comment><comment><USER5> Another big recent achievement of the European Parliament is the "General Data Protection Regulation" (GDPR) [1], which comes into effect in May 2018 and stipulates that companies can be fined up to 4% of their _worldwide turnover_ when they fail to protect/process the data of EU-based customers in a proper manner.

For example: say that LinkedIn was to experience a new data breach, and they fail to inform the authorities or their customers in time, then they can be fined for up to 120 million USD (based on a revenue of 5 billion USD)!

I'm surprised that it's so little known here, as the impact will be massive.

[1] [https://en.wikipedia.org/wiki/General_Data_Protection_Regula...](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation)

<comment><USER6> Yep, and it does much more than that: it forces companies to _actually_ wipeout your data when you ask them to (not just flip some bit and still keep that data, like facebook infamously does), and also set strict TTLs (Time To Live) for any derivative data that the user cannot explicitly delete.

<comment><USER7> How do I follow conflicting laws? One country says "keep all data for 90 days to aid law enforcement" the other says "delete it immediately" which is it?

<comment><USER8> _" How do I follow conflicting laws? One country says "keep all data for 90 days to aid law enforcement" the other says "delete it immediately" which is it?"_

GDPR is EU wide regulation that trumps national privacy laws. It doesn't even need to be approved by individual members, so when it goes into effect on 25 May 2018, it will be working EU-wide on the same day. Furthermore, it affects companies _all over the world_ that serves EU citizens. There's much skepticism on how EU will enforce this law worldwide, but for now it was quite successful dealing with big companies, remember: Microsoft vs EU (paid €561 million fine), multiple cases of Google vs EU (right to be forgotten, Ireland tax rulling, ongoing case vs Android), Facebook/WhatsApp vs EU (€110 million fine) etc. To answer your question: no, there will be no conflicting laws - <USER2> you serve EU citizens, you _must_ follow GDPR. From my personal perspective, GDPR is one of those not-so-often moments that I'm proud of EU.

<comment> wav-part > _Furthermore, it affects companies all over the world that serves EU > citizens._

No gdpr applies if companies _target_ EU citizens [1][2]. My personal opinion of the law is that its as useless as cookie law but way more costly and unpredictable.

[1] (122), Pg 22, [https://docs.google.com/viewer?url=http%3A%2F%2Fec.europa.eu...](https://docs.google.com/viewer?url=http%3A%2F%2Fec.europa.eu%2Fjustice%2Fdata- protection%2Freform%2Ffiles%2Fregulation_oj_en.pdf)

[2] Pg 13, [https://docs.google.com/viewer?url=http%3A%2F%2Fwww.linklate...](https://docs.google.com/viewer?url=http%3A%2F%2Fwww.linklaters.com%2Fpdfs%2Fmkt%2Flondon%2FTMT_DATA_Protection_Survival_Guide_Singles.pdf)

 _The mere accessibility of your website by individuals in the Union or use of the languages of one of the Member States in the Union (if the same as the language of your home state) should not by itself make you subject to the Regulation. However, the following factors are a strong indication that you are offering goods or services to individuals in the Union and so are subject to the Regulation:_

 _> Language - You are using the language of a Member State and that language is not relevant to customers in your home state (e.g. the use of Hungarian by a US website)._

 _> Currency - You are using the currency of a Member State, and that currency is not generally used in your home state (e.g. showing prices in Euros)._

 _> Domain name - Your website has a top level domain name of a Member State (e.g. use of the .de top level domain)._

 _> Delivery to the Union - You will deliver your physical goods to a Member State (e.g. sending products to a postal address in Spain)._

 _> Reference to citizens - You use references to individuals in a Member State to promote your goods and services (e.g. if your website talks about Swedish customers who use your products)._

 _> Customer base - You have a large proportion of customers based in the Union._

 _> Targeted advertising - You are targeting advertising at individuals in a Member State (e.g. paying for adverts in a newspaper)._

<comment><USER6> All the big (and smaller) players in tech are working hard to implement all the requirements of this law (control over what data is stored, TTLs, encryption).

How is this useless for end-users? It forces companies to encrypt this data at rest, and allow users to delete it when they want.

</comment></comment></comment></comment></comment></comment><comment><USER9> Careful with this stuff. It looks nice, but it may bite.

The "states shall not impose any obligations" is a great thing, but "shall ensure that ... guaranteed ..." isn't so much. Your Parliament basically tells you how to write your software, and while this particular cause may be good[1] - the general concept isn't healthy.

Granting governing bodies this level of control... that must require exceptional levels of trust in those bodies and _all_ future ones that could be their successors. I'd argue that it's better to have the very contrary thing - a ruling that no governing body may ever dictate how one can secure their communications and how they can't (or, in more general terms - how one can write their software). Oh, and keep the "states shall not impose" clause, of course.

Yes, that leaves data-miners with their messengers still vulnerable, but I think it's less important than a general non-interference principle. And I'm for having fines for calling non-E2E messengers "secure" if the wording may confuse user into thinking it's E2E - that's basically misadvertising. The issue is information gap and "clever" marketing - fix that and things will be good.

_____

[1] It may be a problem for early prototypes, if they had started with UI/UX and a simple insecure "TCP socket server"-level stub for the messaging layer. Mandatory implementations are always a barrier.

<comment><USER10> But isn't this the same issue with Net Neutrality regulations? We're asking the state to enforce net neutrality, but it opens a can of worms. Tomorrow it would be "all data should be treated equally, except for govt data which should be prioritized above all." "All data should be treated equally, except for terrorist data, which should be prioritized/blocked".

<comment><USER9> It is. And this is controversial statement but I'm really not sure how I feel about Net Neutrality.

Where I'm from (Russia), we had (and still have, to a some extent) a lot of competition in ISP space. This had happened just because government weren't particularly looking at that direction at the time (90s and early 2000s).

If one ISP did some weird stuff that upset customers, the market had actually worked and they lost profits, making them reconsider. This may sound weird, but that really was like that - "power" users were vocal, and word of mouth did spread fast. And absence of NN allowed ISPs to do things that were actually beneficial to the customers, like routing specific traffic differently so e.g. gaming would be smoother and files would download faster. Just because content customers meant good reputation - a stable userbase with steady growth. So I don't believe NN is a good idea if the market's right. It only makes sense if it's bad, with a few giant telcos and no competition.

[Edit: ignore this paragraph, please. I'm keeping it, but indeed it's a long stretch.] When the government decided they're going to get a grip on the tubes, things immediately got worse. No NN here, though, just censorship - <USER3> great pile of unsound kludges with mandatory monitoring and automatic fines if something goes through. But NN here would've killed tiniest ISPs just as well.

That's just how I see things. It very well could be that I'm mistaken here.

<comment> bjelkeman-again I don't think it is easy to compare how censorship works in Russia with how Net Neutrality would work in the US (or some other country) it is comparing apples to eggs.

<comment><USER9> Of course. Where they're comparable is that both are government-mandated interventions. Censorship... Yes, now I think I shouldn't have mentioned that, and omitted previous-to-last paragraph. Sorry about this.

My overall point was unrelated to what the current government does, though - it was that absence of NN can be beneficial - but only if there is a lot of competition, so when not being neutral doesn't help customers but hurts them, there is a proper feedback loop that makes ISP either have losses or reconsider.

</comment></comment></comment></comment></comment><comment><USER11> Here's a quote from the draft that I particularly like:

> The providers of electronic communications services shall ensure that there > is sufficient protection in place against unauthorised access or alterations > to the electronic communications data, and that the confidentiality and > safety of the transmission are also guaranteed by the nature of the means of > transmission used or by state-of-the-art end-to-end encryption of the > electronic communications data. Furthermore, when encryption of electronic > communications data is used, decryption, reverse engineering or monitoring > of such communications shall be prohibited. Member States shall not impose > any obligations on electronic communications service providers that would > result in the weakening of the security and encryption of their networks and > services.

<comment><USER12> > Furthermore, when encryption of electronic communications data is used, > decryption, _reverse engineering or monitoring of such communications shall > be prohibited_. Member States shall not impose any obligations on electronic > communications service providers that would result in the weakening of the > security and encryption of their networks and services.

If I'm going to play devil's advocate, this sounds like a European DMCA in the sense that it will prohibit removal of DRM, and tools which assist such removal.

<comment><USER13> Given that the next sentence is about "Member States", I think the sentence before it is as well—it's the _member state_ ['s government, or any contractor acting on its behalf] who is "prohibited" here from "reverse engineering or monitoring" encrypted communications.

In other words, this would constitute a ban on domestic SIGINT operations ala PRISM.

<comment><USER14> Also, "when encryption of electronic communications data" would have to be interpreted in a _very_ twisted way to apply to DRM of IP content (be it software or art)

<comment><USER13> It would need to be twisted indeed to apply to DRMed games, sure. On the other hand, I could see streaming video from Netflix being "encrypted communication", where the "recipient" is your HDCP television, and breaking the trusted media path between the two would count as "reverse engineering or monitoring" the signal. If, of course, these lines were meant to apply to something other than the Member States themselves. :)

<comment><USER15> It would depend on the legal definition of _recipient_ used. If I — as a natural person — am the recipient, than decrypting that stream would not be unlawful. Even if my TV is the 'recipient', I, as its legal owner, am probably still in the clear.

<comment><USER13> Actually, yeah, given that TVs are clearly private property. How about the set-top box you're renting from your cable company, though?

<comment><USER16> My guess is value. A set top box being the recipient is of no value to me, it, or anyone else. If I (a person in meatspace) cannot see whatever was encrypted, what's the point, even? Why would I pay money for it?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Why is it that European governments seem to act in the interests of their citizens and just about all other governments default policy positions is to act against the interests of the citizens?

<comment><USER18> Parliamentary systems in general are more responsive than Presidential ones.

Also, most of us EU nationals don't see EU structures as very democratically responsive. Fairly sure most of us only send the B Team to the EU parliament. E.g retired national politicians, or people who couldn't get elected for national parliaments. Also, it gets a lot less coverage than national parliaments, so members are free to vote on random things without the same amount of scrutiny.

<comment><USER19> > Fairly sure most of us only send the B Team to the EU parliament. E.g > retired national politicians, or people who couldn't get elected for > national parliaments.

I wouldn't call 'retired national politicians' the 'B' team, those are more likely the 'A' team, no longer worried about their career they are much freer to operate than their national counterparts, besides that they have lots of experience.

A Dutch example:

[https://en.wikipedia.org/wiki/Neelie_Kroes](https://en.wikipedia.org/wiki/Neelie_Kroes)

<comment><USER20> The current president of the European Council, Donald Tusk, used to be the Polish Prime minister before he took the position in Brussels. Definitely not B team.

<comment><USER18> Yes the European Council and European Commission tend to get the more experienced and capable former national politicians but the Parliament generally doesn't...Certainly not in the European countries that I have lived, worked and studied in/about.

<comment><USER21> MPs in national parliaments aren't all that great either. And some MEPs are really good. Just not the backbenchers.

But the Europarliament does seem to get used as a training ground for national MPs.

<comment><USER18> Agreed

</comment></comment></comment></comment></comment></comment></comment><comment> another-dave This is welcome, but moves like this will only make a difference if the legislation has teeth — will there be some ombudsman that I can appeal to, who will investigate that a firm is using encryption (correctly), and issue a hefty fine for breaches?

Or will it turn out like the cookie legislation: potentially good in theory — that you should have an opt out to non-essential tracking cookies — but because of vague hand-waving around implicit opt-ins and not forcing firms to distinguish between essential & non-essential cookies, means the only outcome is an annoying banner on every website and no real effect on end-user privacy.

</comment><comment><USER22> Serious question:

If we had perfect encryption on all devices and no government would be able to listen in on anything (spoken conversation, mails, whatever) we would be pretty much back to where we were a couple of decades ago. I suppose the government would need to employee more real people to monitor other real people.

Is there any way we could have encryption / security with a state actor still being able to decrypt the data if needed?

I'm not saying that I personally am for the state actor, but I'm just imagining a scenario where all communications of bad actors would be via encrypted channels. No possibility to gather chatter, no possibility for rumors, everything encrypted and hidden. I mean this is the scenario state actors are afraid of, and frankly I would be too.

How would we live in a world with perfect encryption? More anonymous, sure. But safer? I'm really trying to see "the other side" (state) right now. Help me out and tell me how we can have perfect encryption, but don't undermine security / possibility of investigation.

<comment><USER23> This is an honest fear to have, but it hides the real causes many of the recent "bad actors" did what they did.

Most of the recent terrorist acts can be traced to different organizations that only exist because of military/economical interventions that happened a few years, or even decades ago. In a broader sense, many can even be traced to the aftermath of the first world war and how the Ottoman empire was split, and the interventions that followed.

What I'm trying to say is that this is not a "inherent" problem in western society. They were created by misguided actions of the past (and current) generations. The techniques and methods used by these actors are just details. You could theoretically spy in everyone like the US or UK governments want, but ultimately the criminals can easily be one step ahead of them if they want and try just hard enough. They can switch to other method or just pay some hacker group to create software for them if they were really organized.

Think of the prohibition in the US. Did it really stop alcohol consumption? Not at all. And a few years later everyone realized how stupid that idea was and the whole prohibition was scraped.

<comment><USER24> I strongly disagree. You can't just blame terrorism on poor decision making by Western powers. The world is complex and every country has to make difficult decisions that will make winners of some and losers of others.

Ultra-conservative strains of Islam are big losers to the West's cultural influence, even in the absence of Western military and diplomatic intervention in the Muslim world. Western economic and cultural might is a threat to their value system and way of life, and some are willing to kill to defend it. Within the United States there has been left-wing terrorism (e.g. anarchists in the early 20th century or the Weather Underground) and right-wing terrorism (e.g. the Oklahoma City bombing).

We cannot always avoid arousing the ire of hardcore radicals.

> _but ultimately the criminals can easily be one step ahead of them if they > want and try just hard enough. They can switch to other method or just pay > some hacker group to create software for them if they were really > organized._

They _can_ , but thankfully most people seeking to do us harm (and most people in general) are incompetent. Even the most seasoned computer criminals get careless and make mistakes.

<comment> k-mcgrady >> They can, but thankfully most people seeking to do us harm (and most people in general) are incompetent. Even the most seasoned computer criminals get careless and make mistakes.

People wishing to do us harm don't need computers at all. Just look at the 3 attacks in London in the last few months (Westminster, London Bridge, Finsbury Park). All that is required is a driving license to rent a van and the want to drive it at people at speed. Any person willing to do harm can go out and do it this afternoon without any planning. If we give up our freedoms so that the government can spy more effectively the terrorists will just do more of the above style of attacks.

</comment></comment></comment></comment><comment><USER25> Yeah, and now many UK citizens will regret leaving the EU even more...

<comment><USER26> I think (at least a lot of) those of us that voted remain knew there would be a massive watering down of civil liberties and protections should we leave the EU.

The UK has never suffered occupation under National Socialism or Soviet Union like most of Europe did so we don't have the same fear of authority creep, which is unfortunate because it absolutely is happening here.

People in the UK are infuriatingly trusting of their rulers.

<comment><USER27> That's an interesting read -- wasn't the main "leave" argument pretty much to avoid Socialism, the new Soviet Union and creepy external authority (EU)? Preserve freedom?

From the outside, hilariously, it looks like both sides claim the same ultimate goal.

<comment><USER28> Quite the opposite actually.

The UK is a mixed economy, we have both Capitalism and Socialism and we like it - our safety-net welfare state and the NHS save lives everyday.

EU membership is a shield for former soviet satellite states to join the West and escape Russian influence.

The main leave "argument" was £350,000,000 was being given to the EU and could save the beloved NHS - this turned out to be a downright lie.

Many of the other popular arguments were equally false and fearmongery about out of control EUrocrats legislating on the curvature of bannanas and attacks on the British sausage and that farmers would be better off outside the common market - all very jingoistic.

It has emerged that there was a lot of carefully crafted individually targeted Facebook adverts that played on voters fears derived from personal data held outside the UK (and outside UK data laws), sadly these went undocumented so we may never know the extent of the falsehoods or their level of influence.

The UK electoral commission has expressed concern over this type of campaigning as no-one knows what is being promised or how much was spent on it.

There has been an effort to try to document these dark ads for the recent election where they seem to have been much less effective.

Many Brits feel conned as the referendum was pitched as being only advisory but is now being taken as iron-clad and a 4% majority of those who offered an opinion is very little mandate to enact such major constitutional change.

As the realities for science funding, farming subsidies have kicked polls are reporting many Brexiters have changed their tune. Goldman Sax's relocation to Europe is a bellweather for the realities for the financial industry which is close enough to Tory hearts that one hopes they'll snap out of their dreams of Empire and Commonwealth.

Hopefully the staggering level of incompetence so far demonstrated by David Davis' negotiating team will be the rope that hangs them and we'll get a second real referendum.

The alternative Red White and Blue Hard Brexit promised by Teresa May is not good for anyone in the UK unless they are shorting the pound.

<comment><USER29> I agree with a lot of what you said. But it's simply not true that "Many Brits feel conned". The majority still wants to leave EU. That's why both Labour and Conservative MPs are pro brexit. Only LibDems are pro-remain, and they only got a handful of seats in the last general election. The brexiteers won, unfortunately. The only question now is how bad it will be.

<comment><USER26> > The majority still wants to leave EU. That's why both Labour and > Conservative MPs are pro brexit.

This is not really accurate.

Firstly, the majority that initially voted to leave was 37% of the population. As far as I am aware that number has slightly decreased in terms of supporters, but even if the opposite were true it is still less than half of the population that actively support leaving.

Secondly, these MP's are only 'pro-Brexit' insofar as they know it has to happen regardless of their own beliefs and coming out against it now would be political suicide. No matter what you think here, in this last General Election people did not vote for parties based on their Brexit stance. They voted based on whether they wanted 5 more years of Tory rule. Tht issue was a far higher priority than Brexit.

<comment><USER30> You're quite correct. The proper phrase "The majority of people that could be bothered to vote still wants to leave the EU".

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> Ever since Brexit, I feel like the EU suddenly has plenty of good news for EU citizens (myself included, which makes me happy). No backdoors, free roaming and privacy law in 2018 most notably.

Anything else I might have missed that EU is doing to improve itself for citizens lately ?

<comment><USER32> Part of me wonders whether that's deliberate. They realised there was a growing discontent with the union, Brexit brought about the realisation that countries would want to leave and now the MEPs and EU government officials and what not have realised that making the EU a positive thing to be part of is crucial to its future success.

<comment> k-mcgrady With the exception of this news the other things OP mentioned have been being worked on for several years. It's just that anytime this stuff is passed member states are given a couple of years to implement it. Completely unrelated to Brexit.

</comment></comment></comment><comment><USER33> I for one will be glad when we free ourselves of the yoke of EU tyranny and can move Britain forward by banning crypto.</sarcasm>

Seriously, my country's going backwards. Is there a way to reboot it and see if that fixes it?

<comment><USER34> "I'm not saying that we need a revolution driven by the left, but..." :D

<comment><USER33> The problem is that the left seem to be just as supportive of a hard brexit as the right. Labour have pledged to end free movement in their manifesto, which is one of the EU's fundamental four freedoms.

 _le sigh_

</comment></comment></comment><comment><USER35> This is just a proposal, from the European Parliament's Committee on Civil Liberties, Justice, and Home Affairs.

It's not a law, and (unfortunately) I can't imagine the proposal will get passed in it's current form.

<comment><USER36> Agreed. As the article states, this would have to be approved by the European Council, i.e. all EU heads of state. They may not have such a positive view of encryption and privacy.

<comment><USER37> The UK will never approve that, so that's at least 2 years before it can even pass let alone be implemented.

</comment></comment></comment><comment><USER38> Here's some irony for you: a significant result of Brexit is that the U.K will have a censored, tightly monitored Internet without encryption and Europe will have data privacy and end-to-end encryption. The pro-freedom crowd will benefit, but in the opposite way of what they were expecting: the control freak British government is removed from EU politics. Nigel Farage is going to be really confused.

<comment><USER39> Oh, Nigel Farage never cared about any of that freedom stuff. He's fairly transparently using it as respectable cover for ethno-nationalism.

<comment><USER40> How does that fit with having a family with an Irish wife, and later a German wife. That would appear to limit the ethnicity to "European", which doesn't fit well with his anti-European actions.

He comes across in the press, to me, as an English imperialist.

<comment> bjelkeman-again To me there is no logic to it. Just someone who wants to be breaking down rather than building up. Building is a lot harder.

</comment></comment></comment></comment><comment><USER41> I wish this forced Apple to move EU developer apps to an EU App Store and EU iTunesConnect, so that those won't have to deal with the US export classification nonsense anymore just for using the built-in HTTPS support in NSURLSession.

</comment><comment><USER42> Why enforced? Why can't they just let it be? Next they're going to tell you that you have to use _their_ ciphers and protocols to be in compliance.

</comment><comment><USER43> Contrast this to the UK (now out of the EU)'s approach to internet encryption: [http://www.independent.co.uk/life-style/gadgets-and- tech/new...](http://www.independent.co.uk/life-style/gadgets-and- tech/news/theresa-may-regulating-internet-anti-terror-measures-extremism- snoopers-charter-a7775566.html)

<comment><USER34> >now out of the EU

You still have a little less than two years left! Until then you can step back any time you want from this silly idea.

</comment></comment><comment><USER44> It must be nice to live in a country where the politicians care about the public.

</comment><comment><USER45> But how are companies like Google and Facebook going to mine the data then? Or are they mostly interested in the metadata anyway?

<comment><USER11> To be honest, Facebook is the owner of WhatsApp (Signal's end-to-end encryption) and they've incorporated end-to-end encryption in their core product too (Messenger's "secret conversations"), albeit not by default.

If I didn't know any better, I would say that Facebook did make a line between private and mining data, but there are countless examples beating that theory: their experiments with crashing the apps, showing only sad news, mining data from messages, WhatsApp and Messenger making web requests as you're _typing_ the URL...

<comment><USER45> Facebook has not finished integrating WhatsApp yet. Right now they have both Messenger and WhatsApp, which is confusing. I guess we'll see what happens to privacy once Facebook has made up their mind about the exact business model.

</comment></comment></comment><comment><USER46> "End-to-end encryption means the company providing the service does not have access to the key, meaning it cannot "listen in" to what is being shared - giving the sender and recipient added confidence in the privacy of their conversation.

"The principle of confidentiality should apply to current and future means of communication, including calls, internet access, instant messaging applications, email, internet phone calls and personal messaging provided through social media," said a draft proposal from the European Parliament's Committee on Civil Liberties, Justice, and Home Affairs."

How would this work in practice? Would any web service that includes a private messaging feature need to ensure it is end-to-end encrypted? Would there be fines or penalties for startups that included an unencrypted messaging feature in their product?

<comment><USER29> The same as any other similar legislation, like requiring cookies notification on every website, or the data protection requirements.

<comment><USER47> Every site with the cookie notification violates the original cookie regulation. The original regulation is clear, you only need to ask the user if you want to track them, no matter how, but they have to be able to opt out of tracking.

\- Login cookies? No notification required.

\- Tracking via fingerprinting? You need to ask.

\- User says no to the tracking? You have to allow them to continue using your service.

It's pure bullshit what most sites do, based on the UK interpretation of the cookie law. Luckily, that's gone soon (both due to the EU GDPR, and due to Brexit)

</comment></comment></comment><comment> adam-fn Do we need to have a discussion on so many of the media outlets, including ones which host pro-encryption / pro-user-privacy articles, either failing to provide SSL, providing SSL but the certificate is from their hosting provider or other affiliated company, or having it setup just to redirect users to their http endpoint with prejudice, as is the case here?

      $ curl -I https://www.bbc.com/news/technology-40326544
      HTTP/1.1 301 Moved Permanently
      Content-Type: text/html
      Location: http://www.bbc.com/news/technology-40326544

</comment><comment> mike-cardwell So end to end encryption of email within the EU is going to become common? Facebook messages? Sure.

Is there anybody here who actually believes that 1, this will happen, and 2, will be effective?

<comment><USER48> 1\. I'm not so sure. Due to the threat of terrorism and tax fraud Governments would most probably not want, National Parliaments — if not controlled by a governmental majority — however most probably would, as this would help paint the acting government in a negative '1984' like light.

2\. Massive fines would hopefully act as a deterrent.

</comment></comment><comment><USER49> Maybe they are just testing the ground... It sounds "too good to be true"... although I would like to live in such legislation...

</comment><comment><USER50> Is it too late to vote remain?

<comment><USER51> You can always move and apply for residence in an EU country of your choice.

<comment><USER52> This is actually my exit plan at the moment.

<comment><USER53> It's unfortunate that various European countries have similar limitations on our freedom of expression and their attitude toward privacy isn't that much better.

<comment><USER52> I have a spreadsheet going - there are a few serious options available still. I will publish it on here at some point.

<comment><USER54> Would you mind sharing that? That would be super useful to me as well.

<comment><USER52> I will share it in a couple of weeks if I get some time to finish it. It aggregates a lot of info from climate, financial market status, things of cultural interest, native languages, recruitment etc.

</comment></comment></comment></comment></comment></comment></comment><comment><USER55> > Data subjects have a right to receive a copy of their personal data in a > commonly used machine-readable format.

Hopefully, this will work out better than the shit Facebook produces in its data export. While their HTML is technically machine-readable, the intention clearly was "here's your data, and fuck you for thinking of leaving, btw". Little to no metadata for the wall posts, for example, makes it almost useless.

</comment><comment><USER56> What do laws like these for partner but not member states to the EU like Turkey mean?

<comment><USER19> Turkey will never be part of the EU proper. 'Never' as in: not in a couple of life times. Turkey has been given the runaround for the last 30 years or so not because there ever was a serious push to integrate them into the EU but because of the fear that Turkey would align with Russia.

So Turkey is as much out of the EU as they ever were and the EU laws will not influence Turkey, _especially_ not laws that would make it harder for Erdogan and his cabal to repress the intelligentsia of Turkey.

<comment><USER57> > Turkey will never be part of the EU proper. 'Never' as in: not in a couple > of life times. Turkey has been given the runaround for the last 30 years or > so not because there ever was a serious push to integrate them into the EU > but because of the fear that Turkey would align with Russia.

Yeah, even with a secular democratic party in power they would not have a chance (a 80 million people country, mostly Muslim, at the time where there is an islamist terrorist attack every month in Europe? Never mind the number of terrorists with a Turkish background, nobody would agree to that, and that's not even talking about its own stability problem and the neighbours Europe would acquire). With a proto-islamic dictator like Erdogan, forget about it.

</comment></comment></comment><comment><USER58> And once again, Britain is going a different, worse, direction on its own.

</comment><comment><USER59> this only apply to citizens.. they will just revoke this status from you and call you a criminal if it comes to it..

<comment><USER60> Unlikely. For example the Estonian constitution explicitly forbids revoking citizenship obtained via birth. There may be ways to revoke some other rights like encryption, but my citizenship can't be lawfully removed, unless the constitution is changed, which is extremely unlikely.

</comment></comment><comment><USER61> Guarantee this, prohibit that. Meanwhile, no one gives a crap since the state/EU/CIA, whatever you want to call them; have already proven beyond doubt where they stand on these issues. You either encrypt everything yourself or you're potentially in trouble.

[https://github.com/andreas-gone-wild/snackis](https://github.com/andreas- gone-wild/snackis)</comment>


Astronomers Confirm Water on Young Gas Giant HR 8799c - <AUTHOR> http://www.sci-news.com/astronomy/astronomers-confirm-water-on-young-gas-giant-hr-8799c.html <comment><AUTHOR> The star is in the constellation Pegasus between Alpha and Beta Pegasi. The star is magnitude 6 so it is bright enough to be seen easily in any size telescope or a pair of binoculars. This link will give you the star's details and its coordinates: [http://simbad.u-strasbg.fr/simbad/sim- id?protocol=html&Ident...](http://simbad.u-strasbg.fr/simbad/sim- id?protocol=html&Ident=HR%208799)</comment>


Chiu proposes integrating Bay Area transit (AB-2057) - <AUTHOR> https://www.sfchronicle.com/bayarea/article/One-Clipper-Card-to-rule-them-all-Chiu-proposes-15027474.php <comment><AUTHOR> Text of AB-2057 (California Legislature, 2019-2020 regular session):

[https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201920200AB2057)

Context (2018) for those not familiar with Clipper's non-modernity:

[https://sf.curbed.com/2018/9/24/17897210/clipper-transit- car...](https://sf.curbed.com/2018/9/24/17897210/clipper-transit-card- transportation-fare-system-payment-tech)</comment>


Visionary: Stack Overflow for Computer Vision - <AUTHOR> http://vision.stackexchange.com/ <comment><USER2> I'm curious as to how much demand there are for these overly focused Stack Overflow clones. I mean, I enjoy learning about CV, but to have its own dedicated domain?

What we should have instead is a Computer Science board that has a more general focus, perhaps "algorithms and theory in Computer Science," or perhaps a narrower "Artificial Intelligence".

<comment><USER3> I'm surprised you would say it is overly focused, because I am worried it is too broad to cover all of computer vision -- it is a huge topic with many different areas (e.g. 3d reconstruction, image processing, object recognition...).

I started it because I always have questions about computer vision implementation or "best practices" and I didn't find any other suitable forums. I also like the Stack Overflow model. I hope that in time the site will help people to share CV knowledge!

</comment></comment><comment><USER4> you should get your own domain name if you want people to take you seriously.

<comment><USER3> that's probably true...but i need people to take me seriously before i can get donations to pay for the domain name...

</comment></comment><comment><USER3> thanks!</comment>


Show HN: Funded.io rapid prototype - <AUTHOR> http://funded.io <comment><AUTHOR> Struggling with maintaining 25 versions of financial projection spreadsheets for a tiered SKU based SaaS startup. I decided to spin this up as quickly as possible (and learn a little AngularJS along the way).

The result - after ~30 hours it's usable enough to show. Obviously needs more flexibility around the variety of revenue models and expense categories. But really it's just for rough estimates at this point.

<comment><USER2> As a piece of technology, this is really cool. But I guess I don't get how it's different from a nice Excel model. How is it that this allows you to capture 25 different use cases in a way that the a spreadsheet can't?

<comment><AUTHOR> A few things I was thinking:

\- Spreadsheets are prone to fat-fingering and messing up formulas. For example, if you built a spreadsheet with three product SKU's and wanted to add a fourth, it's not so easy. Especially if you have visualizations tied to specific ranges of cells, etc. With this app I can validate data once and not worry about some random missing formula screwing it up down the road.

\- When creating models for comparison the typical pattern is Save As -> New. Before you know it, you've got 8 or 10 different spreadsheets with different variations on the numbers. Now add a new expense category to the model in spreadsheet #10. If you want to compare backwards to the rest you'll need to do that work over and over (this is the pattern I was stuck in).

\- Longer-term I wanted to be able to overlay models - sort of an A/B test given different configuration

\- During the past few months I've met with countless entrepreneurs trying to launch startups pre-money. Most of them are trying to build models from scratch (or a template they found) and it's been a clear pain point for them

\- I can share models in a service like this easily. I've already used it several times when someone's asked me to help validate their business model. I create the model in the app and send them a link. They can tweak it and show me their ideas. It's crude right now, but collaboration between founders on something like this might be worthwhile.

\- Even longer-term I'd like to add in more templates to support startups beyond the initial financial model. Basically I looked at my last several years' worth of operational spreadsheets from helping run SaaS companies and thought "there ought to be an app for this".

<comment><USER3> From quickly scanning the comments, it seems that (i) many people would use a tool like this, despite its lack of flexibility, because it's easy to use and it works, (ii) very few had the same reaction as I did: it looks nice, but why not just use Excel.

Perhaps it's because I've spent many, many hours using Excel (although less so these days), but those problems you state don't seem like problems:

1) Fat-fingering is a problem only if you mix the task of coding (setting up the structure and formulae in Excel) with the task of using (changing the parameters). You don't code your web site at the same time as using it (except for manual testing), and it can be the same with Excel. Highlight all input cells with a yellow background and blue font, unset their 'Protected' property, and then lock the workbook. You/anyone can then play to your heart's content without worrying about messing up formulae.

2) When you are creating new versions of a spreadsheet, it's either because you are changing the structure (e.g. changing formulae, adding columns) or because you are changing the input data. If the latter then, yes, you can have several different versions. I've managed this in the past (when fundraising and doing regular reviews with investors) by having an 'Assumptions' tab which contains _all_ inputs. Each scenario (set of assumptions) has a name/number and a column of its own. The calculations and output dynamically reference just one scenario at a time depending on the scenario chosen from a drop-down. Not only that, but Excel's 'Data tables' feature (which explicitly supports only one-variable or two-variable scenarios) works with this, even if you have 10s of variables: just set the scenario number as your variable.

3) Using a 'template they found' is clearly a bad idea. They wouldn't just copy-paste some 'code they found' without studying it and the tests. In fact, for something simple, they'd probably just re-create their own after studying someone else's code for something similar. It's the same with Excel files.

4) Can't argue with this one :)

5) This last point intrigues me: until now I thought you were focused on business plans, and that you wouldn't overwrite the historical data with actuals. However, you mention operational data, suggesting you are talking about combining planning and tracking into one tool. Is this correct?

<comment><AUTHOR> All good points. Sharing models without emailing spreadsheets around (now you have your version and I have mine) has probably been the best thing I've gotten out of it so far.

I've already had a few people email me links to their model with questions about implementation. Since posting on HN there have been more than 2,000 models created. If someone finds a serious bug in a formula or better yet, a new feature is added then they all get the benefit. There's not very clear path(s) to upgrading an Excel workbook.

And my straw man argument: I could make a case for building a lot of stuff in Excel that currently exist as successful hosted applications. Lowering the barrier to entry is one way to differentiate.

</comment></comment></comment></comment></comment><comment><USER4> I have spent more hours than I'm comfortable contemplating slaving over Excel spreadsheets creating projections. I went into one funding round with perfect eyesight and came out needing reading glasses.

This tool is fantastic.

I'd love to be able to modify it for non-MRR companies though. What license are you releasing the code under?

<comment><AUTHOR> Hadn't thought about open-sourcing the project yet. Initially just something to remove the pain I was feeling in my current role. It allows me to share models with founders and collaborate as well. Data is persisted (MongoDB) and the unique Url for each model created will work if you navigate directly back to it.

<comment><USER5> Don't release it, turn it into a business!

<comment><USER6> Or do both.

</comment></comment></comment></comment><comment><USER7> Would be cool if you could export to Excel. That way you could lay the fundamentals in place here and do custom things offline.

<comment><AUTHOR> Plan to do this eventually. However, this fundamentally doesn't solve the core problem (for me at least). Versioning nightmares happen when you've got one model that you customized to have three products and your new model has four. To compare to your previous model(s) you've got to keep updating all spreadsheets.

An app like this would hopefully remove some of that rework and eventually allow A/B testing of different fundraising scenarios, or different revenue models with similar fundraising, etc.

</comment></comment><comment><USER8> I'll add a vote for the "bootstrappers" version of this. Although I was able to make it work for my situation. Great work though. Definitely a useful tool!

</comment><comment><USER9> This is absolutely fantastic. I would pay real money for something similar tailored to product sales model (vs recurring SaaS).

<comment><USER10> Out of curiosity, what would be the major changes required?

<comment><USER11> Definitely unit economics and everything that needs to go above the line. Would be KILLER to have those.

<comment><AUTHOR> If you have an example worksheet I'd love to see it. I've spent my last 7 years in B2B SaaS so have plenty of the tiered SKU models for reference.

</comment></comment></comment></comment><comment><USER12> That's awesome. Can you make one thats for 'lifestyle' businesses, i.e. bootstrapped startups with a sustainable model?

For starters, with my business model, the monthly expenses depend on the number of customers directly. Every time I get a customer, I automatically deploy a VM. And I am charging them a few more bucks than the VM costs, so my revenue is directly tied to the number of customers also.

Maybe I just need a spreadsheet. But really its pretty simple. I plan to launch something that I can support alone. Within a month or so, I need to have enough profit to hire a guy from oDesk to help with support.

The other part is charging for support, which I plan to make separate from the servers. So you can pay as low as $5 if you want minimal support, up to $500 if you are a business and want to prepay for up to half a day of consulting each month.

So what I want is a spreadsheet that I can change that has a projection chart off to the side that is automatically connected to the spreadsheet.

With template spreadsheets/charts that I can configure.

Maybe use something like Google Spreadsheets or [http://stoic.com/formula/index.html](http://stoic.com/formula/index.html)

<comment><AUTHOR> Great suggestions. This initial pass was meant to solve one specific use case I happened to have, but I'd love to add more modeling capabilities.

The addition of one-time costs or revenue based on customer acquisition is important and something that will be there eventually (training is a good example in Saas).

</comment></comment><comment><USER13> Love it. The only issue I have is the SKU slider is a little bit "fuzzy". Would be great to actually be able to plug some real sales estimates.

Also the slider seems to be capped out at some really low number (like 30 new customers a month or something?)... not sure if I'm doing something wrong?

<comment><AUTHOR> True, for lower priced products the SKU slider is limited. I struggled with this on my Excel worksheets as well. In mid-market SaaS ($200-$1500 MRR range) growth tends to slow down the higher the price goes. In addition, growth increases over time as the company grows, but the higher priced SKU's grow slower.

The sliders are only one possible solution to visualizing the rate of growth per price tier. Most other things I've tried involve math fiddling that I haven't managed to translate well to a user experience.

Open to suggestions or examples if you have ideas!

<comment><USER13> The difficulty possibly stems from starting at 0 and trying to get a growth function to suit over 1-5 years (ideally it's exponential in the early days, but likely logarithmic over a longer period of time). Problem is if you're going to investors, you don't want a chart that shows growth slowing down over time (certainly not in the first 24 months anyway).

Early on you have an idea of what sort of traffic you're able to generate and a likely conversion rate, and therefore estimate a sign up rate using real(ish) numbers. It's only the growth beyond that that you're really guessing at.

You may just want a text box with a gross # of new customers/month based on what you think you can bring in, and then have the slider work on top of that, in effect creating an adjustable polynomial function for growth? Just spitballing here...

</comment></comment></comment><comment><USER14> I did a quick model with this tonight after a full day of investor pitches, and even though I'm exhausted I got about a 70% accurate model done in about 5 minutes. I know how to use Excel, but I just wouldn't have gotten that done in 5 minutes with Excel. It was helpful, that's the best thing I can say about anything.

</comment><comment><USER15> I will use this extensively tonight(spend about 1-2 hrs beta testing) and come back with suggestions/comments and input, IF you can add ways to save the data and/or export to CSV/excel after. On a brief look, it looks great, well done.

<comment><AUTHOR> The data is actually being persisted (MongoDB). Notice a unique Url is created when you click through the initial landing page. If you save that Url somewhere and come back to it your data will be there.

Thanks for taking some time on it - feedback is most welcome as I'll continue to hack on it over the next few months - time permitting.

<comment><USER15> Yes noticed that. Well done. It does still seem that A LOT if not most of the comments here are as well asking for a download/export feature. Everyone wants to know they are covered after investing a few hrs into working on something. No one really knows how long that URL would be active for. Anyway, I am a founder and have some real number so will dive in tonight. Export would still be welcome. Again, great job. Looks tight.

</comment></comment></comment><comment><USER16> What's your current pain in dealing with financial projections? What kind of help could benefit you from a finance controller expert remotely? Would you be willing to share finance/spreadsheet knowledge with some coding mentoring?

</comment><comment><USER17> Impressive! Are you going to develop this further for the community? I'd love to use it and be able to save, print, export, etc...

<comment><AUTHOR> Yep, planning to keep rolling with it if there's interest. I mentioned this in previous responses, but the data is actually being saved. The unique Url generated when you first start will get you back to the settings for the model you're working on.

It's a stop-gap feature so that I didn't need to implement a login/authorization system in the MVP.

</comment></comment><comment><USER18> Awesome work! Export to Excel please

</comment><comment><USER19> This is definitely useful. Export/import to/from excel could be a great feature.

</comment><comment><USER20> Very cool! Add some secure features and exporting tools and you're onto something.

</comment><comment><USER21> Fantastic tool! Like aktary, I'd love to see a save, print and export options.

</comment><comment><USER22> Check: App.budgetyzer.com Similar tool more advanced.

</comment><comment><USER23> cool , please add export to excel or google docs..

</comment><comment><USER24> for those who can't use excel...

<comment><AUTHOR> As posted higher up, the spreadsheet I created and based the application on:

[https://drive.google.com/file/d/0Bxgh-9Z9zd40ZExtRnYyZVhWU2s...](https://drive.google.com/file/d/0Bxgh-9Z9zd40ZExtRnYyZVhWU2s/edit?usp=sharing)

Feature development on the app will be faster (and reach a broader audience) than the spreadsheet, however. And I wanted to learn AngularJS ;)

<comment><USER22> Hi all, i created a similar tool a wile ago. You can take a look at: app.budgetyzer.com

It could load a bit slow. You can only log in with your Google account ATM.

Currious If you all like it...

Tim

</comment></comment></comment><comment><USER25> half of those accounting terms scare me. I'm more than happy to just keep selling software and not leverage myself to appease some rich guy who doesn't respect the art of software and just wants a ridiculous return.</comment>


Ask HN: What are the *dynamic* needs for a static site these days? - <AUTHOR> Static sites are getting more popular by the day. What are the <i>dynamic</i> needs of a site that are holding you back from using a static site generator? Things like comments, search are covered by tools like disqus and algolia. I'd love to see some examples. <comment><USER2> Always wanted to build a SaaS around services meant for static sites. Feel free to take these ideas and run with them since I don't believe I'll have the time to follow through with these anymore.

1\. A content suggestion tool where based off of the current content and past content you'd build an interest profile so you can populate suggestion widgets on the page, while also not recommending articles they have already read before.

2\. A user option to hide read content. When they read content, the link will be hidden from the site so they don't waste time sorting through old content to get to new content. I was planning on pairing this with the option to hide a story that's not of interest for the same reasons. All these articles can be viewed again either by turning off this option(provided the developers integrate it) or by viewing a page with all the content that has been hidden(or however the site developers integrate the api to access hidden content).

3\. A favorites/history tool for users on a site. What I had in mind is being able to allow users to favorite content and this will be saved and accessible by the site developers through API to integrate, such as the obvious favorite's page.

Had a few others but don't remember off the top of my head.

</comment><comment><USER3> I built a service last year that provided a SQL database over CORS, access control (user login, registration with email confirmation, and password reset via email). Security was over https and user controlled authentication tokens. The idea was to provide toolkit for building dynamic services for static sites. The archetypical use case was comments for static blogs. I built a simple forum that supported user signup, posting topics etc... as a single page app. Excercised the whole thing.

I had some interest but acquired no regular users. Email me if you'd like more info, I'll not promote it here.

<comment><AUTHOR> I saw the link to it from your profile. Interesting concept. There are variations of this available: [https://fieldbook.com/](https://fieldbook.com/), Airtable, etc. I'll send you an email :)

</comment></comment><comment><USER4> I have some completely static sites and some completely dynamic ones.

Most of my sites are served from my solar-powered RPi2 with boring old Apache 2.2 and various site checkers plaster them with As for technical performance. Very little need for JS. You may of course not like my content, but for me for those sites the answer to your question is "none".

You should see the rant about AMP, trending on the HN front page, to see an example of why more JS is not more bettererorz UX... B^>

Declaratory and static for me, where possible.

</comment><comment><USER5> Some of the dynamic needs also could be static some day. Comments are easy to generate a json everytime, search is a little more difficult.

</comment><comment><USER6> Depends on the usecase. Sites for local stores need opening hours. Having those information as plain html is enough but that can be extended via ajax to show if store is currently open... So no need for dynamically rendered pages serverside.

<comment><USER7> No need for ajax/fetch. You can calculate that in the browser with the data in your plain, static HTML.

<comment><USER6> Sure, but can we trust the date and time of the client?

<comment><USER8> 99% of the time, yes, I'd say.

Having time/date wrong on your device - particularly a phone, which a lot of people use instead of a watch - is sufficiently annoying that it usually gets fixed.

<comment><USER6> Good point! I'll have a look into this, thanks!

Edit: Great advice! Works like a charm! I've never really worked with dates in JS. Should have read the docs earlier ;-)

</comment></comment></comment></comment></comment><comment><USER9> I would say blogging, whitepapers, product updates are the dynamic things which one can update regular on static sites.

</comment><comment><USER10> sites that are used for adverting may want to show different content based on a users past behavior (new vs returning visitor, for example) it is hard to achieve this in front end javascript without content flashing as one piece of content is replaced with another

</comment><comment><USER11> A contact form.

<comment><AUTHOR> There are a lot of options available for forms in a static site. A few from a quick google search are: [https://www.jotform.com/](https://www.jotform.com/) , [https://liveformhq.com/](https://liveformhq.com/), [https://www.google.com/forms/about/](https://www.google.com/forms/about/) .

</comment></comment><comment><USER12> Access control (login).

<comment><AUTHOR> There is auth0 ([https://auth0.com/](https://auth0.com/)) for authentication, and many hosts which support basic auth. What kind of use cases are you thinking when you say access control?

<comment><USER12> Static site hosted on GitHub Pages, or S3. I can't figure out whether auth0 supports that.

<comment><AUTHOR> I don't think GitHub Pages or S3 can support authentication using auth0 for static pages. This could be an interesting service, which allows you to put your website behind authentication from auth0. What use cases would need this kind of a setup?

</comment></comment></comment></comment><comment><USER13> the LIKE button

<comment><AUTHOR> You can use the Like button on static websites. Or did you mean something else?</comment></comment>


Show HN: RocketClub – Startup Stock for Everyone - <AUTHOR> http://rocketclub.co

<comment><USER2> Interesting idea, although not new (been done in different ways before).

Let me put it to you this way:

Imagine Zuckerberg screwing over Savarin amplified by 10,000.

Giving people value in anything will just drive them to become greedy.

Also, giving stock over a certain threshold of users should possibly classify these startups as public companies.

Review the JOBS Act and make sure you are legally on the right side of the law.

I personally wouldn't support this because those valuations of Uber, AirBnB, etc. are driven by VCs who pump big amounts of cash into these companies with big stock taken in return.

If my small startup is giving away 5-10% of stock to 10,000 people, my valuation will already never reach the values that those billion dollar companies have reached.

I do hope I am wrong though, as I would like to see some type of equity- sharing work (there was some other company similar to yours, but it gave equity in exchange for work put-in).

</comment><comment><AUTHOR> Trying to get feedback for my site... most importantly, does it make sense?

People seem to confuse it with investing.</comment>