4 ms·

Don't bother reading through the responses -- it's mostly others arguing about what GDPR is or isn't. Ubiquiti's official response [0] is near the bottom of the

Don't bother reading through the responses -- it's mostly others arguing about what GDPR is or isn't. Ubiquiti's official response [0] is near the bottom of the thread: > We have started to gather crashes and other critical events strictly for the purpose of improving our products. Any data collected is completely anonymized, GDPR compliant, transmitted using end-to-end encryption and encrypted at rest. There is no on/off switch but there also are no penalties for blocking Internet access to the device, dropping traffic to this host, and/or blocking it via DNS. > ... > The memory leak that you reference above was a bug specific to release 4.0.60 which was fixed as of 4.0.61. [0]: https://community.ui.com/questions/UI-official-urgent-please-answer/14259289-e4c3-4c5e-aaa0-02a5baa6cbbe#answer/2329912d-667c-4a38-bce4-687025616931 https://community.ui.com/questions/UI-official-urgent-please...

journalctl 7y ago
“You can block the traffic, but we’re counting on 99% of users not doing that, so.”
mokus 7y ago
Is it even possible for this to be GDPR-compliant without even a way to opt out? I’m not very well-read in the subject, but I thought stuff like this had to be opt-in under GDPR?
- 0xcde4c3db 7y ago
  As far as I know, GDPR only applies to data that somehow relates to a person. If telemetry e.g. only sent build number + backtrace for crashes and the IP address wasn't logged, it seems like that would be allowed under GDPR.
  - dvdkhlng 7y ago
    How does it sent back data without revealing the source IP address? :)
    - 0xcde4c3db 7y ago
      I don't think GDPR attaches to every piece of data that one could hypothetically observe.
      - chopin 7y ago
        It attaches to date you actually observe. I am sure the IP address is part of that. Enough to make the thing GDPR relevant. If someone complains they're going to have a bad time.
- simpss 7y ago
  it's impossible to verify as we don't know what data is actually being sent. But there's a hint in the ToS and that doesn't sound very anonymized. ----------------------- From their privacy policy: https://www.ui.com/legal/privacypolicy/#c1 https://www.ui.com/legal/privacypolicy/#c1 The Usage Data that we collect may include information such as your device data, including your mobile devices, sensor data, device signals, device parameters, device identifiers that may uniquely identify your devices, including your mobile device, web request, Internet Protocol address, browser type, browser language, referring/exit pages and URLs, platform type, the date and time of your request, and one or more cookies that may uniquely identify your devices or browser. IN ADDITION, WE MAY AUTOMATICALLY COLLECT LOCATION INFORMATION (INCLUDING LATITUDE AND LONGITUDE), PERFORMANCE DATA, MOTION DATA, TEMPERATURE DATA, POWER USAGE DATA, AND ANY DATA OR SIGNALS COLLECTED BY THE DEVICES AS PART OF THE USAGE DATA. WE DO NOT COLLECT THE CONTENTS OF ANY COMMUNICATIONS THAT PASS THROUGH OUR DEVICES OR SERVICES. ----------------------- By this desription, it certainly isn't GDPR compliant. device identifiers/data etc.. is PII in GDPR context and requires a legal basis for processing.
berti 7y ago
> There is no on/off switch but there also are no penalties for blocking Internet access to the device, dropping traffic to this host, and/or blocking it via DNS. Sigh. More junk that requires micro-management.
antoinevg 7y ago
We specifically invested in UI equipment because it respected the boundaries of our networks. If this is their final position we will no longer be purchasing UI hardware moving forward.

journalctl 7y ago

“You can block the traffic, but we’re counting on 99% of users not doing that, so.”

mokus 7y ago

Is it even possible for this to be GDPR-compliant without even a way to opt out? I’m not very well-read in the subject, but I thought stuff like this had to be opt-in under GDPR?

0xcde4c3db 7y ago
As far as I know, GDPR only applies to data that somehow relates to a person. If telemetry e.g. only sent build number + backtrace for crashes and the IP address wasn't logged, it seems like that would be allowed under GDPR.
- dvdkhlng 7y ago
  How does it sent back data without revealing the source IP address? :)
  - 0xcde4c3db 7y ago
    I don't think GDPR attaches to every piece of data that one could hypothetically observe.
    - chopin 7y ago
      It attaches to date you actually observe. I am sure the IP address is part of that. Enough to make the thing GDPR relevant. If someone complains they're going to have a bad time.
simpss 7y ago
it's impossible to verify as we don't know what data is actually being sent. But there's a hint in the ToS and that doesn't sound very anonymized. ----------------------- From their privacy policy: https://www.ui.com/legal/privacypolicy/#c1 https://www.ui.com/legal/privacypolicy/#c1 The Usage Data that we collect may include information such as your device data, including your mobile devices, sensor data, device signals, device parameters, device identifiers that may uniquely identify your devices, including your mobile device, web request, Internet Protocol address, browser type, browser language, referring/exit pages and URLs, platform type, the date and time of your request, and one or more cookies that may uniquely identify your devices or browser. IN ADDITION, WE MAY AUTOMATICALLY COLLECT LOCATION INFORMATION (INCLUDING LATITUDE AND LONGITUDE), PERFORMANCE DATA, MOTION DATA, TEMPERATURE DATA, POWER USAGE DATA, AND ANY DATA OR SIGNALS COLLECTED BY THE DEVICES AS PART OF THE USAGE DATA. WE DO NOT COLLECT THE CONTENTS OF ANY COMMUNICATIONS THAT PASS THROUGH OUR DEVICES OR SERVICES. ----------------------- By this desription, it certainly isn't GDPR compliant. device identifiers/data etc.. is PII in GDPR context and requires a legal basis for processing.

berti 7y ago

> There is no on/off switch but there also are no penalties for blocking Internet access to the device, dropping traffic to this host, and/or blocking it via DNS. Sigh. More junk that requires micro-management.

antoinevg 7y ago

We specifically invested in UI equipment because it respected the boundaries of our networks. If this is their final position we will no longer be purchasing UI hardware moving forward.