XMPP Service Operators - 2024-06-30

> hardware upgrades include a proper UPS you were running a server without UPS? ↺

Polarian: what is wrong with that(?

> Polarian: what is wrong with that(? If you are running a server, a UPS is a requirement ↺

Don't tell the server police please. But I don't

you wouldn't be GDPR compliant without it as data could easily be lost with a power outage

> Don't tell the server police please. But I don't wait what? ↺

GDPR is like a magic word, justify everything, 🙂

Jep ups free Since 15 yesrs, and still living

> GDPR is like a magic word, justify everything, 🙂 nah its that person who keeps following you and you can't escape, constantly trying to get you when you trip 😮‍💨 ↺

I doubt the GDPR says anything about UPS. It's really not that bad. People are a bit too afraid of it. Some profit from it sounding like it would be impossible to comply

> I doubt the GDPR says anything about UPS. It's really not that bad. People are a bit too afraid of it. > Some profit from it sounding like it would be impossible to comply if you lose data you have broken GDPR ↺

if a server loses power suddenly data will be lost as the kernel hasn't synced the data to disk

this also causes corruption

Well. People and companies loose data all the time. And no, I'm not required to do magic to have everything

And also I have a modern file system not corrupting on a bit power loss

GDPR myths

» [16:13:33] <Polarian> you wouldn't be GDPR compliant without it as data could easily be lost with a power outage Imagine operating in Europe. I couldn't.

USA! USA! USA!

> And also I have a modern file system not corrupting on a bit power loss what? ↺

you can't slap a software layer on hardware and say "I'm now immune to data loss"

worlio.com: these are myths... It's just nothing that exists in reality and nobody requires that

>> [16:13:33] <Polarian> you wouldn't be GDPR compliant without it as data could easily be lost with a power outage > Imagine operating in Europe. I couldn't. I can. ↺

» [16:29:04] <Menel> And also I have a modern file system not corrupting on a bit power loss Most modern file systems don't corrupt on power loss. I don't know why lacking a UPS is suddenly grounds for power loss.

As I said. People just say GDPR and people just believe it

>> [16:29:04] <Menel> And also I have a modern file system not corrupting on a bit power loss > Most modern file systems don't corrupt on power loss. I don't know why lacking a UPS is suddenly grounds for power loss. what will provide power if you lose power,? ↺

> As I said. People just say GDPR and people just believe it untrue ↺

the legislation is evil when it comes to the implications

the same reason I won't run a public xmpp server

» [16:31:09] <Polarian> >> [16:29:04] <Menel> And also I have a modern file system not corrupting on a bit power loss » > Most modern file systems don't corrupt on power loss. I don't know why lacking a UPS is suddenly grounds for power loss. » what will provide power if you lose power,? Nothing. You turn it back on when you get power and everything is fine.

Well show me the Court rulings on these cases. Otherwise I don't believe anything

>> [16:31:09] <Polarian> >> [16:29:04] <Menel> And also I have a modern file system not corrupting on a bit power loss >> what will provide power if you lose power,? > Nothing. You turn it back on when you get power and everything is fine. say you have data in memory, if ac is lost before or during this being written to disk, ITS GONE! ↺

> Well show me the Court rulings on these cases. Otherwise I don't believe anything you want to roll the dice? ↺

Why would data loss matter in the context of gdpr?

And? What is bad about that? Perhaps an issue for stability or reliability to the user, but nothing to do with GDPR.

I do, I think you're too afraid there ✏

> Why would data loss matter in the context of gdpr? there is a clause on data integrity... data must not be lost of damaged while being stored... ↺

Host in the USA. GDPR is a european regulation.

Also most people here run their servers without any SLA to their users so who cares if a UPS is used or not

There you go, no need to be crazy about "data integrity".

> Host in the USA. GDPR is a european regulation. I wouldn't put my data in America if you paid me to ↺

Why not?

> Also most people here run their servers without any SLA to their users so who cares if a UPS is used or not its not about SLA ↺

its about data integrity

when a user asks for a copy of their data you can't say "oops we lost it"

You see, America isn't insane like that.

It's insane in other ways that are manageable.

Europe isn't either. This is a misunderstanding on the law on Polarians side. But whatever. I'm to sleep

I generally find it hard to believe that lost data is against the GDPR. If you don't have the data and it no longer exists, what is the problem?

» [16:35:28] <Menel> This is a misunderstanding on the law on Polarians side. Which is often the case.

> Europe isn't either. This is a misunderstanding on the law on Polarians side. But whatever. I'm to sleep Misunderstanding? ↺

Lets drop this as it's off topic.

https://www.gov.uk/data-protection

Ch2, Article 5, 1f: Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). Question for a lawyer as to how much is “appropriate technical or organizational measures.” Is a UPS the minimum or is just having a redundant filesystem enough?

> handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage

ah unix.dog was faster

I imagine defining "unathorised or unlawful" would mean under intention, not from accident.

did you read the part where it says “against accidental loss, destruction, or damage"

Are you really gonna get beat by the GDPR if say your entire datacenter gets burned to the ground?

unix.dog: No because I really don't care to because I'm American.

> Are you really gonna get beat by the GDPR if say your entire datacenter gets burned to the ground? but yeah, it’s my personal opinion that it is not that deep and if someone wants to go after you they will go after you anyway

> Are you really gonna get beat by the GDPR if say your entire datacenter gets burned to the ground? YES ↺

they would

Polarian: Then that proves hosting a server in America is like several times better than in Europe.

And that I will never host anything in Europe.

There are way too many insane regulations in Europe that make the task harder than it should be.

let's not compare countries here...

its meant to be productive not "haha shit law*

You're the one being off topic. ✏

I was productive. Anyone with atleast an inkling of sanity shouldn't be hosting in Europe.

Will make your life a trillion times easier.

if you can't or don't want to fulfil these very minimal standards, you should not be hosting a public service. and if you are not hosting a public service, then the GDPR doesn't apply.

European data regulation and Internet standards are far from minimal. GDPR is only a fraction of the problems, and I'm only just now hearing about how ridiculous it is. I can freely delete user data older than a day without any issues and without any legal requirement to share that deleted user data with the user. If you even so dare suffer server troubles in Europe, it seems it won't be the only trouble you'll face.

well, good to know which server to warn people against 🤷‍♂️️

> if you can't or don't want to fulfil these very minimal standards, you should not be hosting a public service. and if you are not hosting a public service, then the GDPR doesn't apply. +1 ↺

> European data regulation and Internet standards are far from minimal. GDPR is only a fraction of the problems, and I'm only just now hearing about how ridiculous it is. I can freely delete user data older than a day without any issues and without any legal requirement to share that deleted user data with the user. If you even so dare suffer server troubles in Europe, it seems it won't be the only trouble you'll face. I am not for legislation to force, but what you just said makes me worried if worlio.com was a public server... you NEVER even joke about abusing your power as a provider... NEVER... ↺

It is a public server.

Never once have I joked about abusing powers. I don't know what you're on about.

> I can freely delete user data older than a day without any issues and without any legal requirement to share that deleted user data with the user. If you even so dare suffer server troubles in Europe, it seems it won't be the only trouble you'll face.

Where is the joke and abuse of power?

you are entrusted with a responsibility which obviously you aren't capable

I am perfectly capable.

> Where is the joke and abuse of power? so you weren't joking? you would just delete data without informing the user? ↺

Thats even more concerning

All logs on my server are deleted after 7 days. I imagine GDPR would not have such a small limit.

> All logs on my server are deleted after 7 days. I imagine GDPR would not have such a small limit. GDPR doesn't prevent or force deletion of logs ↺

It does contain user data, does it not?

only that they are kept secure

> It does contain user data, does it not? there's get outs with it ↺

That was an example. The fact you cannot tell the different is a further demonstration of your character.

its useful information used against potential security threats...

thus you can justify storing it

Why store it unless you're actually going to analyze it?

^^^

You should just purge it after a week

Even purge mam after a reasonable period

And http uploads

You're not their file storage clpud

they are all good considerations ✏

but the issue has been lost

My server also purged MAM and Http Uploads after a week too. Is that a violation of the GDPR?

data legally needs to be kept without damage or destruction unless requested

Bs

> My server also purged MAM and Http Uploads after a week too. Is that a violation of the GDPR? no because the user acknowledges this ↺

GDPR further proves Europe has no care for the privacy and security of its online users.

> GDPR further proves Europe has no care for the privacy and security of its online users. instead of making this into an argument of nationalism and patriotism, let's keep it on point ↺

It is on point.

the point was... data must be kept with integrity by law by UK/EU GDPR

Yes, and my point is that it is ridiculous.

disproving Menel's comment on it

> Yes, and my point is that it is ridiculous. well keep your point to yourself ↺

Okay, then keep yours too.

no because mine is productive to the conversation and to other providers who must ensure these laws

your point of "fuck Europe" is NOT helpful

It is.

You don't even need full logs, just let your siem parse out special events

Clearly the GDPR is against the privacy and security of users, requiring data retention.

worlio.com: please take your political views elsewhere

This isn't political.

Otherwise, you may also take your political views elsewhere and we can cease this off topic conversation continued on by the man who often complains about off topic conversations.

the GDPR doesn't require data retention, it requires data to be sufficiently protected against accidential loss etc.

And if data is lost, why is that a problem?

because the data isn't yours, it belongs to the users

That is ridiculous.

no it is not. But for example if you write in your terms of service that the data is automatically deleted after 7 days, that is perfectly fine with the GDPR

This is not how it works in the US and for many reasons I can think of. ✏

worlio.com: USA has requirements that some data be kept for 7 years

yes, because the US regulation is significantly worse for user privacy

praskovia: Source?

Kris: I'd also love to see your reasonsing for this.

privacy advocates in the US are litterally asking for a GDPR like law

And to clarify, I'm meaning as a operator hosting a public server.

I don't care what privacy advocates want in the US. I'm asking for what exists right now.

sorry, I don't know what else to tell you, but you seem highly mis-informed about the GDPR.

If I am highly misinformed about the GDPR, you have failed to inform me of anything.

I did not care an ounce about the GDPR until it was mentioned and talked about here. All I know about the GDPR is what the people for it here have said about it.

worlio.com: it seems your server is like a 14 year old school project, which is concerning

if you haven't got the capabilities to secure user data, you shouldn't be entrusted with it

no need for personal attacks

I have the capabilities but it should not be my complete responsibility to do so.

> no need for personal attacks apologies ↺

I mean are you out here with HA servers on redundant drives with dual sas cables & backplanes and redundant power supplies and redundant uplinks?

You shouldn't be entrusting services with your own user data if you do not feel they are adequate.

> I mean are you out here with HA servers on redundant drives with dual sas cables & backplanes and redundant power supplies and redundant uplinks? no... but I'm not a public provider... but I do have a UPS, and I do have integrity in mind... ↺

a UPS is not necessary, some areas have very very reliable power

» [17:45:05] <Kris> yes, because the US regulation is significantly worse for user privacy I've been informed of something coming up in the EU legislation called Chat Control that completely contradicts this statement. I've only read a small portion so far and it is absolutely insane. You cannot claim the US is significantly worse for user privacy when you have this being pushed.

> a UPS is not necessary, some areas have very very reliable power oh right... I put my laptop into a very secure bag, I don't need full disk encryption ↺

>> [17:45:05] <Kris> yes, because the US regulation is significantly worse for user privacy > I've been informed of something coming up in the EU legislation called Chat Control that completely contradicts this statement. I've only read a small portion so far and it is absolutely insane. You cannot claim the US is significantly worse for user privacy when you have this being pushed. US have similar ideas ↺

Polarian: No they don't.

this is way too political

chat control is entirely unrelated to the GDPR or even running a server, as it is solely client side. And it is anyways not law yet and might never be. ✏

I'm done, solution don't use worlio.com

wake up one morning to your account deleted

You aren't even aware of my ToS and Privacy Policy.

> You aren't even aware of my ToS and Privacy Policy. according to you it doesn't matter... if you delete data that's ok ↺

Polarian: Are you just going to over-exaggerate and insult my services because I operate them better than you ever could?

Because I don't delete real users on a whim, and I don't protect user data because my laws require me to, and I don't keep logs for a long time because I have to.

> Polarian: Are you just going to over-exaggerate and insult my services because I operate them better than you ever could? Whether you can run it or not is not up for debate, your attitude for user data is concerning, I would rather use any big company than trust you with my data... ↺

I do it because I actually give a damn about my users, their security, and their privacy.

at least they don't brag about how they can delete data with the click of their fingers

I never bragged.

Infact, I don't do it with a click of a button.

You know what I do? A big investigation on if that user has broken ToS and depending on the severity, they'll be notified.

I'm not going to email every spammer using temporary email addresses "because it is the right thing to do". ✏

imma reiterate the point that has been lost... GDPR DOES require data integrity by law... and thus if you are in the EU or UK and handling other peoples data, redundant storage, backups and UPS is *MANDATORY*

And requiring that at all is ridiculous.

it is not mandatory in these specific technical systems, but yes those are good suggestions to be in complicance with the required data-integrity.

And you continue to state the US is worse for user privacy.

because it is

It isn't. ✏

you seem to misunderstand what data-integrity means

The point is being lost, this isn't about privacy this is about complying with data integrity laws, which is covered within the GDPR in both the EU and UK

And being forced to keep your users' data is ridiculous. ✏

you are not forced to keep user data

You've told me a million ways you are with GDPR.

you are required to keep data that belongs to other people sufficiently safe from accidential loss

> You've told me a million ways you are with GDPR. No, you are forced to keep their data safe, both security wise, and ensuring it does not get damaged or destroyed ↺

» [18:18:33] <Kris> you are required to keep data that belongs to other people sufficiently safe from accidential loss Data that is stored on a server should not belong directly to the user, it should be stored with permission by the server without warranty.

It should only be destroyed when requested by the end user, or in accordance with your privacy policy

data should never be deleted without warning

> » [18:18:33] <Kris> you are required to keep data that belongs to other people sufficiently safe from accidential loss > Data that is stored on a server should not belong directly to the user, it should be stored with permission by the server without warranty. at this point you are just trolling... ↺

you can't own personal data of other people.

it's a legal impossibility

So are we suddenly talking about "personal data"?

XMPP is personal data

Because personal data is a whole 'nother story.

No..

Everything you process as a chat provider on XMPP is personal

*everything*

» [18:19:19] <Polarian> at this point you are just trolling... I could've easily said the same about you but I'm giving you the benefit of the doubt.

» [18:20:02] <Polarian> Everything you process as a chat provider on XMPP is personal This could be argued.

how can it be argued

» [18:08:13] <Kris> chat control is entirely unrelated to the GDPR or even running a server, as it is solely client side. And it is anyways not law yet and might never be. I'm late to this but Chat Control says otherwise, mentioning several times the requirement for "services" to search contents of personal information.

you are storing messages between users conversations, who they talk to... how is that *not* personal?

» [18:23:00] <Polarian> how can it be argued I'm taking in a public room right now. Is this chat personal?

it can personally identify them

it can incriminate them

> » [18:08:13] <Kris> chat control is entirely unrelated to the GDPR or even running a server, as it is solely client side. And it is anyways not law yet and might never be. > I'm late to this but Chat Control says otherwise, mentioning several times the requirement for "services" to search contents of personal information. this refers to service providers that provide clients to users. it has absolutely nothing to do with servers ↺

And you think that is a good thing to keep that data for the user?

» [18:23:54] <Kris> > » [18:08:13] <Kris> chat control is entirely unrelated to the GDPR or even running a server, as it is solely client side. And it is anyways not law yet and might never be. » > I'm late to this but Chat Control says otherwise, mentioning several times the requirement for "services" to search contents of personal information. » this refers to service providers that provide clients to users. it has absolutely nothing to do with servers "Services that are likely to be used for illegal material or for child grooming are obliged to search the content of personal communication and stored data (chat control) without suspicion and indiscriminately"

> » [18:23:00] <Polarian> how can it be argued > I'm taking in a public room right now. Is this chat personal? By joining the room you agree that the information is public, you give permission for it to be shared... (no different to clicking "I agree for my data to be shared with third parties" box on websites) ↺

> And you think that is a good thing to keep that data for the user? Yes... ↺

to some extent

Not for the user, but to be REQUIRED BY LAW to keep it?

You can't take a binary point of view, its not all data or no data... the sweet spot is in the middle, enough data that the end user gets a good experience, not too much data where their privacy is completely violated

Polarian, are you european?

Yes.

Then I don't care to discuss this with you further since you seem completely blinded by your own laws and regulations that fully intend to make life difficult for those hosting their own instances, and to completely violate your user privacy and security.

sorry, but you are just highly misinformed. the exact opposite is true

I will repeat that don't run my server secure, for user privacy, and reliable because the law requires me to, but because I care.

so why do you complain about a law that just asks others to do the same as you are apparently doing anyways?

Because being required to do it by law means the law intends to use it as a way to violate user privacy.

it doesn't

> Then I don't care to discuss this with you further since you seem completely blinded by your own laws and regulations that fully intend to make life difficult for those hosting their own instances, and to completely violate your user privacy and security. One, I am from UK... thus your complaints about the EU are invalid towards me, secondly, I do not agree with GDPR... so how would I be blinded by it? ↺

I abide by the laws I live under...

Thats the way of life...

Your laws suck.

Simple as.

Good to know, and how does this help anything?

it doesn't...

Have a good day. I actually have a server to run and I'm not being forced at baton-point.

the GDPR is litterally a law that protects user-privacy from unscrupulous service providers

> the GDPR is litterally a law that protects user-privacy from unscrupulous service providers I find it too restrictive but its my personal point of view, I am not arguing for or against GDPR, I was pointing out data integrity was important ↺

Kris: I no longer care about the GDPR since we clearly cannot agree on it.

worlio.com would stand up in court and argue "This law is stupid" as they get fined millions for losing data

because you are misinformed about it

No, you're misinformed on it.

So I am genuinely glad you are in US, I wish you luck with your server and I hope you are abiding by US regulations

no you 🙄️

if not... I wish you luck in court

I'm surprised you're defending the EU regulations and "user privacy" when they want servers to scan users personal information. Very user privacy.

they don't

Please actually read up on Chat Control rather than lying. The fact that I, an American, am actually reading this and know more than you is absolutely disappointing.

> they don't well they do... but their point is invalid ↺

and if you mean chat-control, that is about client side scanning and not anywhere close to law yet

> Please actually read up on Chat Control rather than lying. The fact that I, an American, am actually reading this and know more than you is absolutely disappointing. You are using chat control to invalidate a genuinely point... ↺

Kris: It's being pushed to law and it is not client-side.

The legislation clearly states this.

sorry, but you are misinformed

I'm literally reading the legislation. Is the european government the one misinforming me?

Is that the only rebuttle you can muster up because you don't actually know?

worlio.com, that doesn't matter... how does this change the point of data integrity for server providers within the UK/EU is *mandatory*

apparently you are not able to understand legal texts then

Kris: Okay, you are definitely a troll. Polarian is just a confused individual.

I'll leave you both to it. Have a good day.

I must have misread, I thought I was in XMPP service operators, not worlio's moan about EU regulations

apologies, could someone redirect me to the correct room?