5 ms·
It can just obtain the user's consent; and, if denied, the alternative is to not phone home at all.
by hashkb 7y ago
It can just obtain the user's consent; and, if denied, the alternative is to not phone home at all.
- na85 7y agoI suppose, but that smacks of toejam-eating extremism in my opinion. I recall reading a study that showed the #1 most common habit among compute security professionals was having automatic updates enabled. The idea that you're willing to risk running an outdated version in today's extremely adversarial computing environment just to avoid "leaking" your IP address just doesn't make any sense to me. I thought we stopped considering IP addresses as confidential information years ago?
- mirimir 7y agoThat's pretty much the norm in Linux. One typically gets packages from the distro's repository. And traffic with modern repositories uses HTTPS. So third parties don't see what packages are being used. And unless one configures a developer repository, there's never any traffic to the developer. Also, IP addresses are considered PII under GDPR. Edit: Still, if one cares that much about ones IP address, it's prudent to use a VPN service or Tor.
- colejohnson66 7y ago> Also, IP addresses are considered PII under GDPR. Not true. They’re only PII if they can be used to connect something to a person. It’s a minor distinction, but it is one nonetheless.
- jdnenej 7y agoIn this case it would not be PII data if it was just an IP address in a webserver log saying someone checked for an update. It would be PII data if it was linked to your GitHub account.
- jdnenej 7y agoIP addresses are only PII if attached to other information. I can generate a list of IP addresses and store/sell that data and it's all fine because its meaningless without associated data.