Hacker News new | past | comments | ask | show | jobs | submit | cedsav's comments login

FormAssembly | Director of Product - REMOTE

Hello! We're looking for a Director of Product to lead our Product Management and User Experience teams at FormAssembly. In this role, you will own the vision, strategy, and roadmap for our Enterprise Data Collection platform, in order to help us build the next generation of a software used by some of the largest and most well known organizations in the world.

Your Responsibilities:

- Develop the product vision, positioning, and messaging, in alignment with the company’s overall strategy.

- Foster cross-functional cooperation and share the product vision across departments.

- Evangelize the product beyond the confines of the company.

- Engage regularly with customers and partners to gain first hand insights on our market and the user experience.

- Represent the voice of the customer in senior level management meetings.

- Recruit, motivate, and mentor a world-class Product team, including product managers and user experience designers.

- Work closely with the Engineering team to ensure steady progress in executing the roadmap.

About Us:

FormAssembly is a leading Enterprise Data Collection platform, thanks to our impressive roster of customers. We have been recognized in the 2018 Inc. 5000 list of fastest growing private companies, and we are a G2 Crowd Winter 2019 Leader. Our mission is to help organizations collect, use, and be good stewards of the personal data entrusted to them.

Learn how and why we work remotely: https://www.formassembly.com/blog/remote-jobs/

If you’re a genuinely nice person who is great to work with, respectful, and who will put the team and our customers first, we’d be thrilled to have you apply for this position. FormAssembly is an equal opportunity employer. If you belong to an under-represented group in Tech, you’ll find a welcoming culture that thrives on diversity.

The position is full-time remote, from within the United States.

To apply: https://formassembly.workable.com/


FormAssembly | Lead Software Engineer (PHP/JS) - REMOTE We are looking for a talented and passionate Lead Software Engineer to join our team.

In this role you will:

* Work on our PHP/JS stack (PHP, NGINX, MySQL, ES6, React).

* Collaborate closely with our Product Managers to streamline development and set the technical direction.

* Lead and mentor other developers, through code reviews, supportive feedback and by involving them in architecture and technical decisions.

* Balance the needs for updating the product vs. addressing technical debt.

Position is full-time, fully remote.

If you’re a genuinely nice person who is great to work with, respectful, and who will put the team and our customers first, we’d love to have you apply for a position with us. If you belong to an under-represented group in Tech, you’ll find a welcoming culture that thrives on diversity.

We're a remote-first, bootstrapped, profitable, and growing company - thanks to our impressive roster of customers. (We actually made the 2018 Inc. list of the fastest growing private companies in America!)

Our leading data collection platform helps organizations collect, use and be good stewards of the personal data entrusted to them.

To apply, go to: https://formassembly.workable.com

To learn more about us, and the team, go to https://www.formassembly.com/blog/remote-jobs/


FormAssembly | Lead Software Engineers (PHP/JS) - REMOTE

We are looking for a talented and passionate Lead Software Engineer to join our team.

If you’re a genuinely nice person who is great to work with, respectful, and who will put the team and our customers first, we’d love to have you apply for a position with us. If you belong to an under-represented group in Tech, you’ll find a welcoming culture that thrives on diversity.

We're a remote-first, bootstrapped, profitable, and growing company - thanks to our impressive roster of customers. (We actually made the 2018 Inc. list of the fastest growing private companies in America!)

Our leading data collection platform helps organizations collect, use and be good stewards of the personal data entrusted to them.

To apply, go to: https://formassembly.workable.com

To learn more about us, and the team, go to https://www.formassembly.com/blog/remote-jobs/


FormAssembly | Lead Software Engineers (PHP/JS) - REMOTE

We are looking for a talented and passionate Lead Software Engineer to join our team.

If you’re a genuinely nice person who is great to work with, respectful, and who will put the team and our customers first, we’d love to have you apply for a position with us. If you belong to an under-represented group in Tech, you’ll find a welcoming culture that thrives on diversity.

We're a remote-first, bootstrapped, profitable, and growing company - thanks to our impressive roster of customers. (We actually made the 2018 Inc. list of the fastest growing private companies in America!)

Our leading data collection platform helps organizations collect, use and be good stewards of the personal data entrusted to them.

To apply, go to: https://formassembly.workable.com

To learn more about us, and the team, go to https://www.formassembly.com/blog/category/company-culture/


FormAssembly | Web Software Engineers (PHP/JS) - REMOTE

We are looking for talented and passionate Web, Mobile and QA Software Engineers to join our team.

If you’re a genuinely nice person who is great to work with, respectful, and who will put the team and our customers first, we’d love to have you apply for a position with us. If you belong to an under-represented group in Tech, you’ll find a welcoming culture that thrives on diversity.

We're a remote-first, bootstrapped, profitable, and growing company - thanks to our impressive roster of customers. (We actually made the 2018 Inc. list of the fastest growing private companies in America!)

Our leading data collection platform helps organizations collect, use and be good stewards of the personal data entrusted to them.

To apply, go to: https://formassembly.workable.com

To learn more about us, and the team, go to https://www.formassembly.com/blog/category/company-culture/


FormAssembly | Lead Software Engineer (PHP/JS) - REMOTE

At FormAssembly, our objective is to help organizations collect, use and be good steward of the personal data entrusted to them, with a form building and data collection solution that's easy, secure and compliant.

We're a remote-first, bootstrapped, profitable, and growing company - thanks to our impressive roster of customers.

We’re looking for a talented and passionate Lead Software Engineer, as well as Senior Web and Mobile Developers.

As a Lead Software Engineer, you will:

* Work on our PHP/JS stack (PHP, ES6, React, React Native iOS/Android).

* Collaborate closely with our Product Managers to streamline development and set the technical direction.

* Lead and mentor other developers, through code reviews, supportive feedback and by involving them in architecture and technical decisions.

To apply to this role and other Senior Developer roles, go to: https://formassembly.workable.com


Interesting question. Google might argue you should direct your request to those individuals you emailed to. Google storing the emails doesn't necessarily mean that they're responsible for processing your deletion request under the GDPR (or maybe it does, I'm just speculating).


Google still makes available to its Gmail users the previous emails I've sent to them.


Yes, but the GDPR makes a distinction between data controllers and data processors. The data controller is obligated to process your request, but Google could argue they're just the data processor, and redirect you to the users (again still speculating... not a lawyer)


I'm not a lawyer, but HN is not established (AFAIK) in the EU, and while it has EU users, it likely does not meet the threshold of actively offering goods or services to EU residents. Being accessible from the EU in itself isn't sufficient to trigger the GDPR.


I'm not a lawyer either, but have been going through the GDPR process at my job. It doesn't matter if you operate or are established in the EU. If you have EU visitors/users they gain the protections of the GDPR and you have to comply.

GDPR affects any org/site that collects personal or sensitive data. Amongst many others IP address and email address are considered PII under GDPR. We use IP address for some high level geolocation data and decided to drop the last octet so it's not tied directly to an individual visitor. The specialists we spoke with had concerns about free form input fields because anyone can write anything they want in them.

In the case of hackernews it seems like email address, ip, profiles, and comments could contain personally identifiable data. I'm also curious how HN similar sites are supposed to comply with GDPR removal requests when it can destroy the usability and functionality of the site.


In the case of hackernews it seems like email address, ip, profiles, and comments could contain personally identifiable data.

You aren't required to put anything in the profile. If you choose to put information in the profile, you can remove it yourself at any time you so choose.


The GDPR also requires personal information be removed from backups, or at least after a backup is restored (eg: restoring from backup does not negate the original Right To Be Forgotten request).

So while you can remove some of that info yourself, I don't think that can be seen as fulfilling GDPR requirements.

Disclaimer: I am neither a lawyer nor GDPR expert.


I'm very interested to see how such requests would actually work...mainly because I'm curious to see what actual authority the EU has to enforce its laws outside of its borders.

I understand it applying to companies that are doing business in Europe but beyond that...?


There's a plenty of measures the EU could take within it's jurisdiction to enforce it's laws around the world.

It might suck if the EU started blocking payments to you.



>Does your online activity lead you to sell goods or services in the European Union?

HN is not selling anything


YC does not need to sell anything. HN is a service offered by YC: a news and discussion platform service.


HN is selling HN, their associated startups, job postings, and so on.

Edit: who are they selling to? Would-be founders... you understand how the VC model works, right?


? Who are they selling it to?


I wonder how this applies to SESTA/FOSTA, as many escort listing sites are apparently already operating from overseas.


There are cases out there, like LICRA vs Yahoo! [1] that could suggest otherwise.

[1]: https://en.wikipedia.org/wiki/LICRA_v._Yahoo!


I'm not sure how this case suggests otherwise, but Yahoo is not HN/YCombinator, and Yahoo is most definitely impacted by the GDPR.


my understanding is that these conditions apply to people in the EU, i.e. that EU residents must be able to delete their content from HN (but HN has no obligation to non-EU residents)


How would EU law compel a non-EU entity to delete content based on the residency of the user?

As an example of the opposite state, where this does definitely apply: Tarsnap complies with Canadian law around collecting names/addresses for users who are located in Canada, because Tarsnap is operated as a Canadian business. But if Tarsnap were located in the US, it would not be responsible for collecting that information from Canadian users.


> How would EU law compel a non-EU entity

Because US and EU have singed agreements to that effect. It's the price US must pay for EU to allow American internet companies to serve EU customers.

It obviously applies to any company with direct business operations in any one of the 28 member states of the EU. But financial transaction is not nessesary for the extended scope of the law to kick in. Collecting personal data from EU citizen is enough.


Which agreement between the US and EU mandates this?


EU-U.S. and Swiss-U.S. Privacy Shield Framework.

It came to effect 2016 and replaced the Safe Harbor agreement.


"While joining the Privacy Shield is voluntary, once an eligible organization makes the public commitment to comply with the Framework’s requirements, the commitment will become enforceable under U.S. law."

From https://www.privacyshield.gov/Program-Overview


U.S companies have option to either do legally binding self-certifications or outside compliance reviews.

If they don't do that, they have no authority to collect data from EU Citizens (no user accounts or customers from EU).


> But if Tarsnap were located in the US, it would not be responsible for collecting that information from Canadian users.

Responsibility is not defined by gut-feelings, but by law. So, with a suited law, Tarsnap could also be bound in Canada's jurisdiction even if it were located in the US.


I'm not sure where you derived your comment about gut-feelings from.

Do you have an example of precedent for one country's laws being enforced on a company with no business presence in that country, without there being a law or treaty in a country the business does operate in that mandates compliance with the foreign law?

I don't think anyone would dispute that if the US were to make a law requiring US companies to comply with the GDPR for EU users, that law would apply to US companies. My point is that absent some measure by the US government, EU laws are not applicable to companies without business presence in the EU


> My point is that absent some measure by the US government, EU laws are not applicable to companies without business presence in the EU

They are applicable if they say they are applicable. Effective enforceability is optional to applicability.

The case is pretty simple in my eyes.

We have separate, sovereign jurisdictions and governments. They can do about anything they want, if they have the means to do so and aren't bound by some treaty or law. For example, they can take legal or executive measures against anybody in the world, and it is irrelevant if that person agrees or disagrees. In fact, in the first place, it is also irrelevant what position the sovereign of that entity takes.

Now, can each sovereign entity enforce what they have decided? Well, that depends on many factors, but is optional to their decision.

The sovereign we are dealing with here is the EU. They can, within the bounds by their law and international treaties, judge and take measures against entities not residing under their jurisdiction. Who's stopping them?

See for example the sanctions on Russian officials currently imposed by the EU.

The EU has many tools to enforce it's decisions.

I don't see what's the difficulty of understanding this situation, besides not agreeing with it.


I'll admit to what feels like a pedantic point: Yes, the EU can make a law saying it'll be very very angry if a non-EU entity does not do what it wants. But since this post is asking about HN's compliance with the GDPR, it seems practical to scope the conversation to "Can the EU make and enforce a law that affects non-EU entities".

Otherwise, it's fair to say that I can personally draft a document saying HN must give me $3.50, and sign it into law for the House Of Akerl. But my law is quite uninteresting to HN, given the low odds of any of the YC folks sending me $3.50.


Well, it seems we agree that the EU can make a law theoretically-legally affecting non-EU entities.

Can that law be enforced? That depends on whether YC has a representation in the EU, or people from YC plan to visit the EU in the future, or many other things. Maybe the EU gets creative to find other ways of enforceability. I don't intend to give a full assessment of the ways of enforcement.

Either way, it is not a nice thing to have a big jurisdiction going after you.

One can avoid the GDPR by not handling data from or about European citizens or people in the EU, and having no presence there, and actively filtering out affected people.

Or one can implement the GDPR.


I haven't researched that particular point, but I'm not sure that your HN comments qualify as "personal data" under the GDPR (they'd need to personally identify you).


"Personal data" is defined quite broadly in the GDPR:

Article 4 states

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person


I just read a pretty interesting white paper (written by a compliance law firm) about data anonymisation and pseudonymisation with regards to GDPR. It provided a really neat ballpark of data that constitutes "user information" on two separate levels.

Direct identifiers include such material as: name, address, phone number, all kinds of national identifiers, biometrics, device identifiers and clinical trial record numbers.

Indirect (or "quasi-direct", a new word for me) include: gender, date of birth, postal codes or other geographic grouping identifiers, first language at home, marital status, ethnicity, ....

---

If you look at the two groups, there's a pretty clear distinction. Anything that would allow to send a highly personalised communication to a person is direct. Anything that allows to target marketing cohorts is indirect.

The indirect ones may not sound important on the surface, but once you start doing group intersections, their combinations can become extremely narrow pointers.


IP addresses are identified as personal data in GDPR. They're not exposed in the frontend, but HN might use them e.g. for logging.

Also things like deletion, takeout and consent/opt-out need to be supported (provided that HN falls under GDPR).


Yes, but you need to explicitly target the EU. What that exactly means will be determined will eventually be determined in court, but some examples:

- If you offer your products in Euros, which is the currency in most of the EU - If you offer payment methods which only exist in the EU or one of its members - Otherwise suggest you target EU citizens

Hacker News exists as a generic website on the internet, but it does not to target any country or region specifically. Therefore HN should be exempt from the legislation.


That is incorrect. You don't need to specifically target the EU. If you handle data from European citizens, the GDPR applies to you.


I'm baffled. Why the downvotes? See for applicability: https://gdpr-info.eu/art-3-gdpr/

Also, in the case of HN, YC offers a service. Just like a forum is a service, this discussion and news platform is a service. It's irrelevant if it's paid for or free.


I'm baffled. Why the downvotes?

Because HN is now like Reddit, but for techno-snobs. If you don't follow the tightly defined groupthink, you'll get downvoted.

Many years of discussion groups have proven that downvoting has a chilling effect on discussion groups. Allow upvotes, and "spam" flags.


FormAssembly | Lead Software Engineer (PHP) - REMOTE or Bloomington, Indiana, United States.

We run FormAssembly.com, a leading form building and data processing service. Thousands of organizations worldwide rely on us to capture the data they need quickly and securely.

We're lean, bootstrapped, profitable, and growing rapidly - thanks to our impressive roster of customers.

We’re looking for a talented and passionate Lead Software Engineer to improve and expand our web-based application.

In this role you will:

* Work on our PHP stack (PHP, NGINX, MySQL, JS), and occasionally on new projects with a clean slate.

* Collaborate closely with our Product Manager to streamline development and set the technical direction.

* Lead and mentor other developers, through code reviews, supportive feedback, and by involving them in technical decisions. 
 We are a remote-first company. Our team is spread across 5 different countries and a dozen US states. You're also welcome, of course, to work from Bloomington, Indiana, where our headquarter is located. It's been named one of the best cities for doing business and is the #7 in the US for best places to bike!


Position is full-time, local or remote. Compensation includes health benefits, 401K and 4 weeks paid vacations.

To apply, please go to: https://formassembly.workable.com/j/C56B721331


I have the opposite experience. We have many more informal channels and opportunities to check in and learn what other teams are doing by being remote and having our conversations openly in our group chat.

IMO, good communication, collaboration and transparency is not about remote vs. office. I'm sure we can find plenty of bad experiences for both.


You have different opportunities. Better/worse is debatable.


Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: