Crud: EU GDPR Compatibility (DSGVO)

[PKuebler]

Hey, for the EU all CDN and Google fonts have to be replaced.

We started with that, but since many field types do, we can not update after that.

Are you planning that?

Greets from Germany
Philipp

[welcome[bot]]

Hello there! Thanks for opening your first issue on this repo!

Just a heads-up: Here at Backpack we use Github Issues only for tracking bugs. Talk about new features is also acceptable. This helps _a lot_ in keeping our focus on improving Backpack. If you issue is not a bug/feature, please help us out by closing the issue yourself and posting in the appropriate medium (see below). If you're not sure where it fits, it's ok, a community member will probably reply to help you with that.

Backpack communication mediums:

• Bug Reports, Feature Requests - Github Issues (here);
• Quick help (_How do I do X_) - Gitter Chatroom;
• Long questions (_I have done X and Y and it won't do Z wtf_) - Stackoverflow, using the backpack-for-laravel tag;

Please keep in mind Backpack offers no official / paid support. Whatever help you receive here, on Gitter, Slack or Stackoverflow is thanks to our awesome _awesome_ community members, who give up some of their time to help their peers. If you want to join our community, just start pitching in. We take pride in being a welcoming bunch.

Thank you!

--
Justin Case
The Backpack Robot

[androidedev]

Hi @PKuebler by "replace" do you mean to store all fonts localy? If that is the case acording to this https://github.com/google/fonts/issues/1495#issuecomment-394168955 from @davelab6, wich was updated 18 days ago, google is working on it.

Woldn't be be better to wait how this is resolved by google or if they are going to resolve at all, backpack is not the only project affected by this issue, if fact I belive that 99% of project being dinamic or static are affected by this. :)

Don't take me bad, You're right, right now the Google fonts are a problem for the GPRD but maybe it's better to wait a little longer until we see how this issue is resolved by Google.

[pehbehbeh]

This does not only affect Google Fonts. We have to replace all external sources which are loaded via CDNs (cdn.jsdelivr.net, cdn.datatables.net, cdnjs.cloudflare.com, ...).

[tabacitu]

Well _thank you_ EU for this... I was unaware that CNDs breach GDPR, thank you @PKuebler .

If that's the case, yes, we will probably replace all CDNs with locally-hosted files. But I agree with @androidedev that we should wait a bit on this, see if the issue resolves itself and we can keep using CDNs.

I personally love using CDNs, and additionally use CloudFlare for most of the stuff I develop. I'd hate to reduce website performance because of this law...

[MartinKolarik]

Well thank you EU for this... I was unaware that CNDs breach GDPR

CDNs don't necessarily breach GDPR - a CDN is simply a service operated by a 3rd party (similarly to e.g. a web hosting) and may or may not be GDPR compliant - most of them are compliant, since they have many users in EU.

Some people just prefer reducing the number of used 3rd party services as it means a smaller risk of GDPR-related problems.

[OwenMelbz]

Theres issues on this within the Google Fonts repo and they confirmed it's not breach of GDPR as you're not really providing any personal information to them.

Yes the IP address of the user is revealed as they make a request - but this is deemed as acceptable as the user can choose to block this from the browser, additionally it would break 1/2 the internet.

The data is not stored for processing etc theoretically.

However, we recently put CSP in place and noticed there are A LOT of different CDNs used throughout backpack, including local scripts, so it seems a bit of a mess in that instance.

If a tidy up was due it should probably be around

1. Making sure all CDNs are from the same one
2. Make everything local

But not because of GDPR, for the sake of sanity :D

[AbbyJanke]

@OwenMelbz I've read abit of the google forms on GDPR relating to all their services they continue to say they don't store user data and do not but do not disclose if they store the server request or any data. they simply say "they do not store the user's IP" it creates weird gray area and concerns many people who deal with that type of data because in the end of google is breaching GDPR we don't know and the lawsuit can end up back on the company using a CDN. As open as google typically is with most info this is something they haven't been very open about.

I wonder if maybe reaching out to StackPath is an option for Backpack (@tabacitu) They host the CDN for Bootstrap, FontAwesome, jQuery, and more without cost cause they are open source. I know it is a stretch but perhaps it's something we can try and work with them on to help spread word more about Backpack, Laravel as a whole etc. (https://www.stackpath.com/open-source) I've looked into all 3 that i mentioned at least and yeah their latest CDNs are all GDPR compliant (Bootstrap 4, FontAwesome 5, jQuery 3.3)

Additional Note: StackPath bought MaxCDN so i assume older versions of Bootstrap, FontAwesome, and jQuery which used MaxCDN is probably compliant as well.

[OwenMelbz]

Based off what we’re doing at work, and the fact we’re in the EU, we don’t believe there is anything to worry about.

Think of it this way:

• a CDN is a host to provide website files.
• a web server is a host to provide website files.

You do not run the web server, a hosting company does.

You do not run the CDN, a hosting company does.

Thus it’s treated the same, if your website was hosted on google cloud platform, you wouldn’t be asking these questions. If a user can show legitimate interest in your service you can use the data responsibly. Simply serving them a website is using doing just that.

—

But I still think we should bin off the CDN completely as it’s a mixture of different CDNs and local files. So makes sense to unify.

[lloy0076]

@tabacitu This doesn't seem to be an actual issue and should be closed, however as it may affect a whole bunch of people if it does - and I'm not the guy where the issue stops (Tabacitu Trump for the win) - I'll let you close this one off.

This should NOT become a discussion of HOW we're going to get rid of CDNs, though.

1404 might be that one; and I'm sure there was another one at some stage.

[tabacitu]

I agree - let’s move the conversation to #1404