9 ms·
Telemetry systems are out of control, and really exploded with the smartphone era. Personally, I run application level firewalls on all my devices i) to stop ad
by cmroanirgo 7y ago
Telemetry systems are out of control, and really exploded with the smartphone era. Personally, I run application level firewalls on all my devices i) to stop ads & ii) to stop telemetry. Unfortunately, it's too hard/too much trouble for the average user to maintain.
We need to come up with a better way to (automatically) hobble this nonsense, probably at the os level.
- journalctl 7y agoI think we need laws.
- jakeogh 7y agoI vote with my money. Laws are lazy, trivial to insert exploits into and stacked with unintended consequences. Eduication is much more effective.
- liability 7y agoPassing laws is pragmatic. Individual boycotts are idealistic, they go totally unnoticed and the status quo continues.
- jakeogh 7y agoThe "status quo" argument of apathy is self-fulfilling. There are few things that are more effective than market forces, hence the 24x7x365 war for your opinion. Note how often people say "insert law here". Compare that with how many times they actually propose the text of a law. Our most effective laws are exceptionally simple and short. It's not accidental that "modern" laws are intractably complex. How about try it? Propose the law.
- liability 7y agoSome people, dare I say most people, care more about results than dogmatic adherence to libertarian free market ideology. That is why effective regulation is everywhere you look. Regulation is popular and effective, regardless of how badly it offends your sensibilities.
- jakeogh 7y agoOr? Is it in theory possible that your preception of reality is off? Government regulation of the net (aka speech) is a non-starter, so the people who think "insert rule" fixes something are forced to rebrand it to "net betterness". More than half of the general public is wise to these techniques. What "pragmatic" law do you have in mind?
- Angostura 7y agoTake a look at GDPR
- driverdan 7y agoHosts file blocklists work well for known domains. https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- the8472 7y agoEach application shipping with its own DoH resolver - spearheaded by browser vendors in the name of security - will put a lid on that.
- userbinator 7y agoThey are rightly saying that DoH will secure requests from tampering --- but when it's the owner who's doing the tampering, it becomes yet another anti-user security feature. Personally, I'm less concerned about privacy of DNS queries than the loss of control and need to have another centralised third-party in the process.
- michaelmrose 7y agoOn Firefox it is configurable or even disablable trivially. Much ado about nothing.
- paulryanrogers 7y agoThat doesn't mean the other apps which use DOH will also be trivially configurable to disable it.
- ubercow13 7y agoIt was a bad security feature anyway, easy to bypass
- denkmoon 7y agoI'm glad I'm not the only one concerned about this. As far as I'm concerned, Google are only interested in DoH so far as prohibiting DNS level adblocking within their walled gardens.
- m463 7y agoI think GDPR helps in some cases, but I suspect as the laws are analyzed and tested in court, the old habits will come back. All OS vendors benefit from this telemetry, so they all have it and support it. Microsoft collects lots of data, but don't be fooled, Apple also collects lots of telemetry. I think what folks will start to realize is that RMS was right and only free software will be the only way to navigate this mess (since users are not denied access to the source code, which can be analyzed and the idiocy removed, like people do with ubuntu).
- jeroenhd 7y agoI'm reasonably sure this stuff doesn't fly in the EU anyway (hiding away information like this deep within some privacy document is not the clear consent the GDPR requires). Tools are becoming available though. Projects like PiHole are making it easier to block many malicious trackers. There are even companies selling pre-built PiHole devices. Unless HP is hardcoding IP addresses, it's only a matter of adding the required domains to a tracker blocklist (if they're not already on there) and most of these problems go away nearly instantaneously. I've noticed my PiHole helping a lot in regards to stuff like mobile apps (Google Analytics, Facebook Graph, etc.) and embedded devices like these are probably no exception.
- _Understated_ 7y agoI can tell you that my UK printer has the same shit! I went through it with a magnifying glass to make sure it didn't select anything. In addition, I set up the IP stuff manually on the printer to ensure there was no gateway... can't get out without a gateway.
- jlgaddis 7y agoI used to do the same exact thing. At some point, though, I noticed that "something" [0] still managed to "get out". After running some packet captures, it became clear what was going on. Although the device was using the network settings that I had manually configured, I had not specified a default gateway. The device decided it would use DHCP to discover the default gateway for the network and began automatically using it so it could get out to the Internet. Since then, I've started specifying a default gateway for any devices that I don't want to get out. I give 'em an IP address that isn't in use on the network and, fortunately, I haven't ran into any other instances of crap like this happening. [0]: I really wish I could remember what device this was but it's been a long time ago and I really have no idea, sorry.
- dvdkhlng 7y agoThese kinds of concerns are why I put all my "untrusted" devices on a separate VLANs, so I can reliably shut them out of the internet. Simple VLAN-enabled switches don't cost that much any more. Such a switch allows you to treat any port of the switch as a distinct network interface on your main router, where you can just disable forwarding for selected interfaces entirely. It also prevents your untrusted devices from seeing each other, i.e. your printer wont't be physically able to send ethernet frames to your VoIP phone, even if connected to the same switch. Here is some introduction to the concept: http://corecom.com/external/livesecurity/vlans.htm http://corecom.com/external/livesecurity/vlans.htm
- sabareesh 7y agoHey I am interested in application level firewalls. Can you please share how you do this.
- colechristensen 7y agoTelemetry is fine when it is included with enterprise software with licensing agreements handled by lawyers and corporate security. Telemetry is actually helpful and a good thing in that use case. It is not in consumer products, period. Unless you are paying me for this information (in actual money, not discounts, not services) telemetry should be banned.
- justinclift 7y ago> ... with licensing agreements handled by lawyers and corporate security. So it's helpful when it's someone else's problem?
- protomyth 7y agoIt's helpful when the iSeries calls IBM to get someone out for part replacement. Both parties know the whole deal since there is an actual contract with specifics. Consumers don't have 'contract support' unless they have cash.
- mrep 7y ago> Consumers don't have 'contract support' unless they have cash. So what do you propose then? Every website have a paywall and block poor people?
- hakfoo 7y agoThis isn't a website, it's a printer. We're already paying customers. If there was a paywall, we passed through it when we went to the store and dropped $100 on their product. I suppose the big problem is that everyone gets into the data broker business when they get big enough these days. It fundamentally changes the expectations of your relationship with the company. It's a lot like the Vizio/Samsung/etc Smart TV privacy fiasco. Back when you bought a $699 21" Zenith tube television, their business model was transparently "we make and sell televisions." The up-front cost was sufficient that they weren't too concerned with a trickle lifetime recurring revenue. There's no real place in that business model to focus on a data gathering side hustle, and you as a consumer had no reason to think they'd be interested that you kept the knob on UHF all night. Similarly, if HP's business model is legitimately selling printers and printer accessories, there's very little information they need but are not getting from their existing "what retailers order for restock" and "direct sales and ink-as-a-service" channels. Even the obnoxious personalized 'you print lots of photos, buy our photo paper' ad doesn't require remote data submission; you could calculate it on the fly locally and pop up a banner, just like with 'you've printed 29 pages, time for a new cartridge!" I could see system and document info for crash log purposes, but even that's a one-time permission request you can make on demand. I guess what's amazing is how much the tail has come to wag the dog-- they'd rather creep out people and run the risk people finding out losing the $100-plus-years-of-expensive-consumable sale in order to get that sweet sweet consumer-profile data worth a few dozen cents per-user in quantity. Honestly, I want to replace my arthritic LaserJet 5 with something offering duplexing and more than four real-world pages per minute, but new printers seem to be doing everything they can to be a distasteful purchase instead of an exciting one.
- michaelmrose 7y agoNot running any of bad oems specific software and relying on in kernel drivers to talk to whole classes of Hardware seems to work.
- unionpivo 7y agoPi hole, and similar, and block all other DNS, would probably be a good start. Tackling on edge firewall, looking what goes through, and blocking it there is second step (but since a lot of it is going to various cloud providers and cloud flare) this is often not an option
- vezycash 7y agoAutomatic blocking doesn't work cos they are constantly coming up with new ways to bypass blocks. Here's what I use. There's a free tool called Windows Ultimate Tweaker. It'll help with basic settings. Next, Du Meter - shows network traffic right on taskbar. If I'm not actively using the internet and Du Meter shows 1MB/s, I get suspicious. Finally BWMeter. I'll say it's little snitch for Windows. It'll alert you any time an application tries to access the internet. You can allow/forbid temporarily or permanently. They are all light on resources. BWMeter's UI isn't great but it gets the job done.
- aj7 7y agoAnyone know Mac equivalents?
- marci 7y agoLitte Snitch https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html And Activity Monitor in the Dock (Icon set to Network Access)
- yantrams 7y agoLittle Snitch -- https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html
- pdimitar 7y agoiStat Menus will give you amazing insights on your system in the menu bar. It has a rich choice of views. There's also Little Snitch for network monitoring. For the rest, haven't researched much.
- heroprotagonist 7y agoRealistically you want it at the router level. Force all traffic through a transparent proxy like mitmproxy with some custom code to strip out the sends you don't like. Stop all those IoT devices. Its on my plate to make a go at it, with some inspiration from pihole. But really it'd be about enabling myself to use some of this great data without sharing it with a third party. For example, I'd wear my fitbit if it wasn't reporting in to their servers. But if I force my phone through a VPN, which routes through my transparent proxy, I could feed fitbit junk data while scraping the pieces I want to my own system. We need apps that take control of these devices and their telemetry away from the third parties.
- mindslight 7y agoPhilosophically, I completely agree with you. The problem is that this isn't inherently possible because the whole thing could be E2E encrypted. I know there is a Linux (python?) client that will sync (at least some models of fitbit) to their cloud service. But I've no idea if there is one that will dump the data locally. It's entirely possible that the cloud client is merely passing along an opaque blob.
- Freak_NL 7y agoWhy not just block everything the printer sends? When does a printer actually need internet?
- mindslight 7y agoYes, removing Internet access is always an option (although eventually we might have to physically disconnect wifi antennas or use a Faraday cage...). I was responding to a comment that was talking about creating Free Software to communicate with the device, specifically the idea of proxying access to the corporate server and modifying the communication, rather than implementing the whole protocol from scratch. I'd guess the Fitbit protocol is encrypted, from a desire to keep people from cheating their activity reports. If a company wants to spend the development time, there is basically nothing that can be done to prevent a device requiring Internet access on a dumb-pipe all-or-nothing basis.