Avatar
Éamonn
ef4079edb9fa123c676228afdb665f89ef0439aac65ba7dfb2b312b30f9196ff
I work on user interfaces for privacy at a large tech company

I and my team are actually responsible for one of those pop-ups that most people see, and I agree that consent pop-ups are a really unfortunate outcome of the regulations

I think the intent of the regulations back when they were written was good, but there were two problems:

(1) The unintended consequence of so many annoying pop-ups was not an anticipated

(2) GDPR applied to all providers, however small, and put a lot of burden on small companies and non-profits

The good news is that the upcoming DMA and DSA regulations are taking into account problem (2), as most of their regulatory burden falls only on very large companies (such as mine) which have the resources to handle the burden, and where most of the potential user harm is

For what its worth, I'm working internally in my company to greatly reduce the number of consent pop-ups that people are subjected to, while still remaining compliant

I think you are right that the "dumb pipe" architecture of Nostr probably makes it so that the relays would not count as "data controllers" (which have the largest compliance burden)

I suspect Nostr relays would legally be more like CDNs such as Cloudflare which are "data processors". These are still subject to regulations, but with fewer obligations than data controllers

Like it or not, that's what sets up Nnostr for conflict with EU law

While free speech, including freedom from censorship, is a legal right in EU countries, like it is in any real democracy, it is not absolute. It is balanced in EU law (as it is in other democracies) against other legal rights. And it is in those conflicts between conflicting rights that services like Nostr can run into problems with an absolutist freedom-of-speech approach

Nostr depends on real server hardware, running in particular countries, operated by particular people, all under the jurisdiction of particular countries

if a relay is put up by any organization or person who has any presence in the EU then that person or organization might have some legal exposure

Having said that, the Nostr architecture of having servers (relays) be mostly dumb replicated databases makes actual enforcement hard

[Given the personal insult in your last message, I'm assuming you are not actually interested in a reasonable discussion, so I'm now blocking you. Bye.]

I'm not a lawyer either, but I'm pretty sure the Nostr public key and any derived identifier would be subject to GDPR, along with most data in a user profile, and probably all Nostr posts. That's all data tied to an identified person

But on the other hand Nostr relays are pretty lightweight and "dumb", they are not really much more than databases with a Websocket API leaving most of the "business logic" to the clients

So from a GDPR compliance point of view, I wonder whether relays would even count as data controllers (which have the most onerous compliance burden). Maybe they are just data processors acting on behalf of the clients, which would reduce the compliance burden. But that would be a question for a lawyer.

It's great to hear that Nostr folks already have an opinion and approach to EU regulation

Other than the right to erasure, I imagine a Nostr relay would be automatically compliant with most other GDPR rights, assuming relays don't send any user's personal data directly to other relays (that's true, right)

And as regards the upcoming DMA and DSA regulations, most of those regulations only apply to big platforms above high threshold of users and revenue, so presumably would not be applicable to Nostr relays

So, what are the implication of European privacy regulation on Nostr?

Any relay which has any clients connecting to it from the EU is subject to GDPR

One that seems problematic is GDPR's right to erasure ("right to be forgotten"). As I understand it Nostr cannot really delete posts

One good reason for aiming for 2% is if the Fed aimed for zero percent there is a danger we would end up with negative inflation (deflation) and that is a very bad place for an economy to be

Deflation feeds on itself leading to a deflationary spiral, like in the Great depression or Japan's "lost decade"

So 2% seems like a reasonable buffer against the risk of deflation

One good reason for aiming for 2% is if the Fed aimed for zero percent there is a danger we would end up with negative inflation (deflation) and that is a very bad place for an economy to be

Deflation feeds on itself leading to a deflationary spiral, like in the Great depression or Japan's "lost decade"

So 2% seems like a reasonable buffer against the risk of deflation

Oh sorry I misread your question

It seems like the explanation for the inflation in the 1910s is World War 1.

Trying out nostr. Seems very crypto-y.

Are folks here going to be tolerant of a crypto skeptic like me?

Web apps are not necessarily slower than mobile apps.

True, there are a lot of bloated web apps, but skilled developers who care about performance can write web apps that you would not be able to distinguish from native apps in performance.