- https://infosec-handbook.eu/ (centralized HTTPS version of our blog)
- dat://4354ef3fa9ae5df664fd4a40707cab7450a24d29d4d9f2770b29ebdc720c7151 (decentralized dat version of our blog)
- By default, our web server processes your IP address. This is technically necessary to send our content to your client.
- By default, we do not log any personal data of you. Log files are automatically encrypted after 1 day, and stored in encrypted format for 10 days.
- We do not track your browsing behavior or anything else. We do not try to identify you. We do not collect statistics. We do not set any cookies. We do not serve ads.
- Your rights according to the European GDPR are explained in Articles 15–21 and 77 GDPR.
- For further information about our security measures, read our security policy.
This website and its web server are operated by private individuals domiciled in different European states. Our server is physically located in Germany.
Controller in terms of the GDPR is:
.cS.M ,řítyR bukaJ .rM
ynačosyV ,aharP 00 091
- Personal data we process
- Personal data third parties process for us
- Accessing our website using dat protocol
- Accessing our website using mirrors and archives
- Your rights (Articles 15–20 GDPR)
- Right to object (Article 21 GDPR)
- Right to lodge a complaint with a supervisory authority (Article 77 GDPR)
There are several definitions in the GDPR. The most important definitions are:
- ‘personal data’ means any information relating to an identified or identifiable natural person
- ‘processing’ means any operation […] on personal data […] such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
If we talk about your personal data in the following, we mean anything that can be used to identify you. This includes your name, e-mail address, and IP address. When we talk about “processing of personal data”, we mean any type of processing.
Personal data we process
When you visit our website, your IP address and user agent are automatically processed by our web server. We automatically get this data from your client (e.g., your web browser or RSS/Atom feed reader). Our web server needs your IP address to send our contents back to your client. By default, we do not process any other personal data of you. Furthermore, our web server doesn’t store your IP address permanently (e.g., in log files).
The legal basis for processing your personal data as explained above is Article 6(1) f GDPR. Our legitimate interest is providing our content.
Our web server writes information about certain client-side request to so-called log files. We use these log files to detect attack-like behavior and to improve our services. Our web server automatically encrypts all log files after one day using public-key cryptography. The encrypted log files are automatically deleted after 10 days.
In case of abnormal requests (for technical people: all HTTP status codes except 200, 302, 304), we only log the following. This includes repeated attempts to access blacklisted files, or other attack-like behavior:
- timestamp (
- IP address (
- HTTP status code (
- bytes transmitted (
- first line of request for each request/HTTP version (
"GET /secrets.bak HTTP/1.1")
- user agent (
Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0)
- in some cases, our web application firewall also logs full client-side requests and full server-side responses
We use this data to identify new attacks, audit blocked requests and unblock legitimate users, if necessary. Blocked IP addresses are stored for 14 days. We also use this data to identify broken links (for technical people: HTTP status code 404).
The legal basis for processing your personal data as explained in this section is Article 6(1) f GDPR. Our legitimate interests are blocking attacks and improving our services.
Personal data third parties process for us
The following third parties process personal data for us:
netcup GmbH, Germany
We concluded a data processing agreement according to Article 28 GDPR with netcup GmbH.
The legal basis for processing your personal data is Article 6(1) f GDPR. Our legitimate interest and the interest of the netcup GmbH is detecting/blocking attack-like behavior, and proving our content.
Tutao GmbH, Germany (e-mail only)
The legal basis for processing your personal data is Article 6(1) a GDPR. You may withdraw your consent with this at any time.
Accessing our website using dat protocol
Besides “traditional” HTTPS, we allow interested readers to access our content via the “dat” protocol. dat is a peer-to-peer protocol, offering a decentralized experience. It comes with built-in encryption and several other advantages.
However, as normal for peer-to-peer protocols, content can be freely re-shared by every client. This means that there is no central server, and all clients connect directly to each other. By doing so, your dat client may disclose your IP address and user agent to unknown third parties. If you don’t want this, simply access our web server via HTTPS.
Accessing our website using mirrors and archives
Your rights (Articles 15–20 GDPR)
According to the Articles 15 to 20 of the GDPR, you have several rights concerning your personal data processed by us:
- Art. 15: Right of access
- Art. 16: Right to rectification
- Art. 17: Right to erasure
- Art. 18: Right to restriction of processing
- Art. 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing
- Art. 20: Right to data portability
You may exercise your rights by contacting us.
Right to object (Article 21 GDPR)
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point e or f of Article 6(1) GDPR, including profiling based on those provisions. We no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of you or for the establishment, exercise or defence of legal claims. This doesn’t affect the lawfulness of processing based on consent before its withdrawal (point c of Article 13(2) GDPR).
Right to lodge a complaint with a supervisory authority (Article 77 GDPR)
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
We updated this page on December 7, 2019. For transparency, we provide a complete changelog of this page on codeberg.orgexternal link .