5 ms·
Most likely because as an American company they have no clue what the GDPR really does. Many European companies are still struggling to be fully compliant. Fur
by 8fingerlouie 7y ago
Most likely because as an American company they have no clue what the GDPR really does. Many European companies are still struggling to be fully compliant.
Furthermore, if they transmit crash logs, and those contain partial memory contents (core dumps), chances are actual content from network packets are transmitted to UBNT as well, and those contents may contain PII (IP addresses, MAC addresses, usernames, passwords, real names, addresses, credit card information, etc.), meaning they’re most certainly violating the GDPR by making it opt out.
- secabeen 7y agoWith a significant fraction of Internet traffic (and all eCommerce traffic) end-to-end encrypted, is it really realistic that they would have sensitive data (usernames, passwords, real names, addresses, credit card information, etc.) in memory of an AP? This is the point of Let's Encrypt, after all, to close the exposure that we give to our ISPs and our ISPs ISPs.
- m4rtink 7y agoAFAIK ubiquity also does routers, those can hold quite some sensitive data in memory.
- noja 7y agoDon't think sensitive data, think personal data. An IP is personal data.
- zeeZ 7y agoMacs tend to use your name as their network name from what I've seen, and corporate logins usually are some variation of your first and last names. The APs absolutely know those.
- 8fingerlouie 7y agoBut APs are not limited to internet traffic. Maybe some company somewhere runs an internal server, and because it's internal they might think that encryption is not needed. Hell, it might even use GET arguments for username/passwords in the URL. The crash dumps would contain these data as well.
- lilyball 7y agoI wouldn't assume "crash logs" means "core dumps". I'd assume they mean stack traces, and perhaps register contents.
- fhars 7y agoAnd they never hold IP addresses in registers?
- ripdog 7y agoOh come on. It's extremely unlikely, and there'd be no reliable, automated way to extract them anyway.
- tallanvor 7y agoYou can absolutely automate retrieving information from a core file. I'm not saying that UI is going to purposefully extract sensitive information, but of course they'll setup automated processing of the core dumps in order to categorize the types of crashes into buckets so that engineers can examine them more closely. Next time you come across a core file, use strings on it - you'll be surprised what it will find!
- ripdog 7y agoWe were talking about registers+stack trace, not a core dump.