XSF Communications Team - 2023-01-19

FYI Data Protection Commission announces conclusion of inquiry into WhatsApp https://community.nicfab.it/post/26166

A $5.5mil fine is "operational costs", nothing to see, carry on. Also... 4 years later Ireland?

> A $5.5mil fine is "operational costs", nothing to see, carry on. Also... 4 years later Ireland? It’s a hot topic for several reasons, among them: 1. DPC Ireland and the EDPB (administrative matters but relevant); 2. The phenomenon is increasing, and several EU DPAs are issuing measures with relevant fines to big players. 3. People should consider those measures to WA & co … XMPP is better 😉

Note: Many of the XMPP extensions have serious privacy implications as well…

> Note: Many of the XMPP extensions have serious privacy implications as well… I know

https://upload.convorb.im/7c370453f738f2c0c995eaee643e5e0aba76aeb0/0lcxCvR9vAKAtp3fr4b4l4AJmEd0vwwl2QecUYYY/xmppsucks.jpg

Peter Waher: ^^^

An alternative reaction would be to list these extensions & privacy concerns, so we can generate tasks to fix those

> An alternative reaction would be to list these extensions & privacy concerns, so we can generate tasks to fix those I agree with you, and I am at your disposal

Peter Waher: are these "known" by now, 24 years have passed already :)

Example: HTTP Upload need to allow the uploader to define life cycle (how long the file should be persisted on the broker) and delete uploaded files (but only the uploader should be abllowed this).

How is that a privacy issue?

Users should have control over their data

As long as they can request that their provider delete the data, and the provider complies, it's not necessarily an issue

Images may be sensitive

But it would be nice to have it supported directly in the protocol

According to the GDPR requires life cycle to be defined (i.e. lifetime) to sensitive and/or private information

meaning, you cannot store (process) it indefinitely

Which most servers already don't

so, you need to either define a time for all content, or allow the uploader to specify the time

for each file

(or allow the uploader to delete the file)

Could use DELETE and Expires header on the PUT endpoint for those. If the component wanted to implement them

yes

but it needs to be standardized

Needs to be implemented before it can be standardized :)

don't see why

... because standards always follow implementation? You can't specify something in abstract and then just hope an implementation appears. You need at least one, and ideally two

I have already an implementation in our broker, but it is not my point to standardize that solution.

it’s actually often the other way around. specification comes before implementation, at least if you want to think through things and allow different actors to come to an agreement, rather than standardize what one of the actors have already implemented ✏

Double the message double the fun?