Top all-time · #5599
Varonis Blog
Company blog · blog.varonis.comsecuritydata
Varonis Blog is the company blog at blog.varonis.com, writing about security and data. Since 2011, 14 different Hacker News readers have linked it 126 times, most often “GDPR in Plain English”. It is still writing: the last post was on 2026-10-26, and you can follow it by feed.
Too few sampled comments (18) to say how often HN recommends it.?
Why HN links it
HN readers link Varonis's plain-English GDPR requirements list as a readable translation of the regulation. Other posts linked include a US state data breach definitions map and a ransomware payment article.
Summarised by Claude from a sample of 18 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Insights and analysis on cybersecurity from the leaders in data security.
Most-linked posts?
- GDPR in Plain English4 people · 11 mentions · first linked 2018-03-23
- Adventures in Malware-Free Hacking2 people · 2 mentions · first linked 2018-01-18
- Guide to the GDPR Breach Notification Rule2 people · 2 mentions · first linked 2017-11-07
- The Right to Be Forgotten and AI2 people · 2 mentions · first linked 2017-10-17
What Hacker News says?
For those of you understandably intimidated by the GDPR regulations themselves, here's a good summary in plain English: https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... The UK's ICO also has a good structured summary: https://ico.org.uk/for-organisations/guide-to-the-general-da... In general I agree with the sentiments in this article. I've probably spent a total of three to four days reading around t…
Comment linking /gdpr-requirements-list-in-plain-english/
on “GDPR: Don't Panic”Submitted HIPAA’s New Rules Reach Far Beyond Healthcare Providers as a story · 63 points
HN discussionGDPR articles seem to be getting some traction on HN as everyone is trying to figure out: "Do I need to do something for this? Is so, what?" For a recent project I read (and translated to plain english) [1] every single article in the GDPR legislation and for our purposes it can be summed up as: "Treat user data like names and emails as if they were credit card numbers" AKA: be paranoid about keeping them, encrypt t…
Comment linking /gdpr-requirements-list-in-plain-english/
on “Publishers Haven't Realized How Big a Deal GDPR Is”Submitted Cryptography May Not Be Dead, But It Is on Life Support as a story · 57 points
HN discussionAs of right now there is not a Federal law describing exactly what is PII data (which would be a prerequisite for this). There are many (48) different state laws that do define what PII is and how organizations (commercial and governmental) are to handle data breach notifications. If you want to see what a crazy patchwork map of laws this is checkout: https://blog.varonis.com/us-state-data-breach-definitions/ These…
Comment linking /us-state-data-breach-definitions/
on “Inside the Largest US Voter Data Leak”Submitted GDPR in Plain English as a story · 45 points
HN discussionOk, so you're describing (IMO) exactly what's in the text of the GDPR. Here is a "plain english" translation of the GDPR that makes much of this more evident: https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... If you dig into it, I think you'll find it lines up nicely with what you are suggesting.
Comment linking /gdpr-requirements-list-in-plain-english/
on “Side-channel attacking browsers through CSS3 features”Submitted Marco Arment on Dropbox: Don't use it for anything valuable as a story · 43 points
HN discussionThe regulation's big but it's probably not larger than a sprawling API documentation, etc. and you approach it the same way: just read what you need. IIRC almost _half_ of the actual regulation is about what and how the member countries should set up their internal supervisory authorities and the rest is similarly specific. There are innumerable checklists, summaries and guides on how to deal with GDPR as well. The…
Comment linking /gdpr-requirements-list-in-plain-english/
on “Google and Facebook accused of breaking GDPR laws”Submitted PenTesting Active Directory Environments (2016) as a story · 40 points
HN discussionThis is a part of the GDPR - the language is so generic that I think much of this will come out in future court cases, but check out Article 21 and 22 of the GDPR which I think addresses this (but IANAL) https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... People can object to be profiled and can ask a person for help like: "Why am I seeing this? Please stop"
Comment linking /gdpr-requirements-list-in-plain-english/
on “It’s time for a digital protection agency”Submitted Peak Security as a story · 10 points
HN discussionIf you haven't already, you might enjoy reading the EU's forthcoming GDPR regulations [1] they cover all of this and much, much more including things like: - data should be exportable in digital formats - you can request what information a company has about you regardless if you're a full "user/customer" (think of things like how FB tracks anyone who visits a webpage with a Like button). - you have the right to requ…
Comment linking /gdpr-requirements-list-in-plain-english
on “It’s time for a digital protection agency”Submitted Football player hacked live during draft, agent blames Silicon Valley as a story · 8 points
HN discussionIn digital security there is the concept of "defense in depth", that no one product, feature, approach or safeguard is going to magically make you protected from attacks. What's required are multiple overlapping layers of protection that collectively work together to create a more protected whole. We're seeing more of this with privacy and user data. The author very correctly points out some issues with hashing and…
Comment linking /gdpr-requirements-list-in-plain-english/
on “The False Allure of Hashing for Anonymization”Submitted The Definitive Guide to Cryptographic Hash Functions (Part II) | Varonis as a story · 8 points
HN discussionThis is being done under the Illinois Biometric Privacy Act (2008), but Illinois and a number of other states also have some similar (and pretty forward thinking) rules in place regarding data breaches of biometric data [1] If facial recognition becomes legally recognized as a "biometric marker" (no reason it shouldn't) - I think we'll see all sorts of other suits come out of this. 1 - https://blog.varonis.com/us-st…
Comment linking /us-state-data-breach-definitions/
on “Facebook photo-scanning lawsuit could cost it billions”Submitted List of Penetration Testing Resources as a story · 7 points
HN discussionThis is actually a recommended approach within the GDPR legislation itself Article 25: "Pseudonymization" https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...
Comment linking /gdpr-requirements-list-in-plain-english/
on “Kafka, GDPR and Event Sourcing”Submitted Introduction to OAuth (in Plain English) as a story · 6 points
HN discussionTL;DR: It's a spreadsheet to help you list out what personal data you keep in your organization, who has access to it, how it's secured, how long you plan on keeping it and what you intend to do with it. MORE: I'm not trying to be dismissive, it's great! And whether or not you're going full-on trying to get GDPR compliant or not, it's _really_ hard to think of a scenario where taking the time to think and document y…
Comment linking /gdpr-requirements-list-in-plain-english/
on “Open-Sourcing our GDPR Compliance Preparation For Articles 30, 32, and 35”Submitted Adventures in Malware-Free Hacking as a story · 5 points
HN discussionGreat site that summarises GDRP in plain english: https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...
Comment linking /gdpr-requirements-list-in-plain-english/
on “2018 reform of EU data protection rules”Submitted Internal Data Loss: Riskier Than You Think as a story · 5 points
HN discussionI did some poking around as to what this actually is (and it's probably not for the average site). It's the specifications for how the IAB (Internet Advertising Board), which consists of of every organization blocked by your ad blocker, would like publishers to gather consent from people landing on their site. It's a very optimized setup as who they are targeting using this are the big sites that do Real Time Biddin…
Comment linking /gdpr-requirements-list-in-plain-english/
on “GDPR Transparency and Consent Framework”Submitted Is DNA Really Personally Identifiable Information (PII)? as a story · 5 points
HN discussionFWIW I recently attempted to translate literally the entirety of the GDPR into Plain English (albeit for a technical audience). It's at: https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... In general I think legislatures putting out goals/guidelines instead of detailed specifications is a feature not a bug. Tech moves faster than they can possibly keep up with and to call out things down to the patchnote…
Comment linking /gdpr-requirements-list-in-plain-english/
on “Ask HN: Why are law documents (GDPR) so difficult to understand?”Submitted International Space Station Invades Google Analytics as a story · 4 points
HN discussionThat's a lot of questions. To sum up, the GDPR is forcing: - granular consent (like you might opt into a newsletter, but not retargeting ads) - right to request what a company knows about you - right to get that data in digital format (json, xml) - right to know when your data is exposed in a data breach - right to request that your data be deleted - right to request that an organization stop processing data about y…
Comment linking /gdpr-requirements-list-in-plain-english/
on “Europe’s New Privacy Rules Favor Google and Facebook”Submitted EC2: What Happens When There's No Cloud? as a story · 4 points
HN discussion
