15 ms·

BSD vs. Ubuntu motd(5)

251 points by lelf 7y ago

kalium_xyz 7y ago
Interesting spyware they ship.
Jonnax 7y ago
Tbh I find the Ubuntu message of the day quite useful. The "adverts" are benign. Right now it says to check out microk8s and also to look at livepatch. But logging in and seeing a summary of: loaf, disk usage, processes, number of users logged in, IP addresses, memory usage and swap usage, kernel version and also last login time and from what IP. That's pretty useful stuff to me. Also if you're in the position to care about motd, you're going to have the skill to change it yourself.
- folkhack 7y ago
  > The "adverts" are benign. Right now it says to check out microk8s and also to look at livepatch. My distro shouldn't be advertising to me. Call me "old school" but this has no place in Linux. Also, if you're in a position of trusted compute then you don't want this sort of information leaving your network. > Also if you're in the position to care about motd, you're going to have the skill to change it yourself. Yeah - and I feel I shouldn't have to add it to my images/recipes/whatever to fix this. I use Linux for a lot of reasons, and some of the most important ones are that it doesn't advertise to me and/or leak data. This is telemetry and it's unacceptable.
  - Androider 7y ago
    They've also distributed security notices through the MOTD. I find it useful.
    - folkhack 7y ago
      I find features like this to be useful as well - as long as I've opted-in. This is not a "sane default" - this is telemetry enabled out-of-box which is something that I'm vehemently against with Linux.
    - smittywerben 7y ago
      I use email for security notices so I can subscribe to the lists I use and view it on my phone.
  - kylek 7y ago
    I don't think that's old school at all. I was really hoping Ubuntu would fall in line after NPM was pummeled for their ads.
  - kick 7y ago
    Alternatively: Why not let the people actually making the distros decide what and what not to throw in them? Users can decide what to use, and users have decided to let Canonical win. I don't use Ubuntu, and you don't have to either! It's almost like there are millions of Linux distributions!
    - folkhack 7y ago
      > Alternatively: Why not let the people actually making the distros decide what and what not to throw in them? I'll argue that utilization of Linux comes with certain "expectations" which is why so many of us decide to use it in the first place. Some of those expectations include (but are not limited to) rock-solid stability, "be good at one thing", lack of bloatware, sane update/upgrade cycles/policy, privacy, and security. I've been using Linux professionally for just over 15 years now, sometimes in highly compliant/systems-critical infrastructure. The privacy and security bullet points above are the most important factors to me when designing and/or hardening systems. > I don't use Ubuntu, and you don't have to either! It's almost like there are millions of Linux distributions! Actually - I had to at my last position. When people make technology decisions they often go with the most popular/"safe" options and then dictate the decision to those implementing it. Welcome to corporate America (which is where the jobs are). Everything new was spun-up with Ubuntu as a base distro and you better believe I manually opted-out of this "feature". --- There's a big problem when the most popular distro starts making moves like this as it sets precedent that it's OK. Canonical has made the decision against privacy/security in regards to their motd and that's a huge issue, and I argue it goes against the ethos of Linux and OSS.
      - kick 7y ago
        Actually - I had to at my last position. It's a seller's market for labor. There's a big problem when the most popular distro starts making moves like this as it sets precedent that it's OK. Canonical has made the decision against privacy/security in regards to their motd and that's a huge issue, and I argue it goes against the ethos of Linux and OSS. You're using "OSS." "OSS" is the word that caused this situation! "OSS" was intentionally a term to make free software corporate. Canonical's just doing what people who use and coined "OSS" started: making free software corporate. In the Free Software world, this is bad, but in the corporate world that "open source" advocates have brought among us, this is normal. It's perfectly fine: open-source software is for-profit, not for the common good.
  - Barrin92 7y ago
    >This is telemetry and it's unacceptable. I dislike the idea of tying particular political or economic philosophies together with a tech stack like Linux. Everyone can distribute linux distributions however they see fit, it's an open platform and if that includes telemetry by default that's fine too as users have choice. I don't think anyone uses a Canonical distro and is genuinely upset or surprised about this particular benign case. The linux distribution space is truly one of the few places where we can't make any excuses about market power or lack of choice. There are a billion distributions, almost all of them free. Users will pick accordingly, and my sense is that virtually nobody cares about this particular case of telemetry.
    - tjoff 7y ago
      I am upset, and I do use ubuntu, and I am reconsidering that. It isn't about politics nor economics. It's about privacy and control. That is linked with Linux for a lot of users. And Linux users have a pretty good situation in regard to this. But it is starting to erode and if allowed can only get worse. It is unacceptable and the fact that canonical don't realize this is why I'm thinking of alternatives. Especially considering the use case. Either they haven't got a clue, or they are testing the waters. Does not look good any way you look at it.
      - zerkten 7y ago
        >> I am upset, and I do use ubuntu, and I am reconsidering that. Good for you, but don't you sort of expect this with Ubuntu? It's obviously pushing in a different direction from the likes of Debian. I'm not sure most reasonable people have much sympathy for you here. >> It isn't about politics nor economics. It's about privacy and control. That is linked with Linux for a lot of users. And Linux users have a pretty good situation in regard to this. Privacy and control are intermingled with politics and economics. A quick analysis of Ubuntu and Canonical would have suggested that this risk exists for you. >> But it is starting to erode and if allowed can only get worse. You are naive if you think that it won't erode further in your view. Economics and the desires of Ubuntu audience will result in further "features" like this. It's inherent in their mission and they don't particularly care about you. >> It is unacceptable and the fact that canonical don't realize this is why I'm thinking of alternatives. They do realize this. They just don't care. You are the type of customer they want to fire because you aren't their audience, yet fight their choices. >> Especially considering the use case. Either they haven't got a clue, or they are testing the waters. Does not look good any way you look at it. It doesn't look good to you, but it's a trade-off with their users because it's intrinsically tied to their audience, economics, politics, etc. Don't forget that audiences can change. The customers that brought them to this point may not be those who take them to their next goal. It's just business. You can say Linux is more than business, but it doesn't really make an impactful argument.
- idclip 7y ago
  What systems do you come in contact with? What sort of responsibilities do you have on your job site? Anything critical? And look you dont need to answer those questions either, but take it from me, that kind of thinking and attitude will tank a business and eventually compromise or overburden IT, who will just jail-firewall Machines running that kind of code because its impossible to reign-in in a militerized zone such as a company with over, say, 150+ employees, let alone anything major. Please reconsider/rethink.
- _jal 7y ago
  The adverts are telemetry, which I don't appreciate being forced to deal with, and especially in open source. At best, it is delivering a broken product to fix, a typically shitty corporate behavior that attempts to grab something in their interest at the cost of being customer-antagonistic. Not like it is the first time. - in the past, Ubuntu has demonstrated a willingness to sell surveillance of their user base to a third party[1]. It makes me trust the company less and worry that if their fortunes or management changes, they'll do slimier, less obvious things. I suppose this all is ultimately a positive thing. Greed heads serve the function of keeping distro-churn up when they do something gross enough to chase people off, which helps keep the ecosystem healthy. [1] https://www.zdnet.com/article/canonical-performs-u-turn-over-amazon-search-results-in-ubuntu-12-10/ https://www.zdnet.com/article/canonical-performs-u-turn-over...
- forgotmypw 7y ago
  >Also if you're in the position to care about motd, you're going to have the skill to change it yourself. This is an elitist view which implies that if someone doesn't understand something, they aren't affected by it.
- emidln 7y ago
  My company puts hosts info into the motd (I think via the global bashrc, but it could be a cronjob/deployment utility that triggers the update). It's very useful to find out the vitals at a glance when you remote into a random box.
phaemon 7y ago
A simple straightforward snippet of shell. Is that supposed to be bad?
- lixtra 7y ago
  It phones home...
- idclip 7y ago
  It depends, what do you define a shell’s role to be. To us purists, it shouldnt phone home for a motd.
  - folkhack 7y ago
    This isn't even an idealist "purists" thing - this is a "I don't want my distro leaking telemetry" thing.
- deleted 7y ago
  [deleted]
reanimus 7y ago
You know you can configure your motd however you like, right?
- idclip 7y ago
  Its an operating system, not a nuclear plant. *sane defaults used to be thing. I dont want to worry about stuff i dont know about making connections i didny say it should. Confugure one thing, sure is easy. You think they’ll stop at one?
  - reanimus 7y ago
    Comparing some annoying adverts to a nuclear power plant operation system failing is... Something. If it was just about the ads, I'd agree. But comparing it to BSD is silly. BSD doesn't have scriptable motd and I'm supposed to act like that's obviously better? Eh.
    - idclip 7y ago
      I am partially responsible for at least 200 individuals, let alone those who depend on them. Now if you think the digital safety off 200 isnt comparable to the digital safety of say, 200,000, well. “It is with the first link that a chain is forged”. Look, Nothing against you, you dont seem to have a systems exposure i do. Im not a fullstack dev, maybe you are and its fair to just see your own machine and expect everything else to work. Car builders and bridge builders see different problems to solve, and see risks differently too.
      - reanimus 7y ago
        Thanks for the condescension. I'm saying the modes of failure and effects are different. Digital safety and protecting people's lives are two different things. Both important, but different. But even besides that, you ought to be using a different tool for that. Is it fine to have the server I use for my personal site and projects use a dynamic motd, perhaps even reach out to the network? Yeah. It can be useful. Should a CA signing machine do that? Obviously not. I'm saying that acting like one is unambiguously better for being less featureful is wrong. That's all.
idclip 7y ago
Sometimes, Im not sure where the internet and linux are headed anymore.
- ailideex 7y ago
  Ubuntu != Linux && Ubuntu != TheInternet
jandeboevrie 7y ago
I once wrote on how to disable parts of the ubuntu motd: https://raymii.org/s/tutorials/Disable_dynamic_motd_and_motd_news_spam_on_Ubuntu_18.04.html https://raymii.org/s/tutorials/Disable_dynamic_motd_and_motd... - it's way more complicated then it should be IMHO.
- idclip 7y ago
  “uninstall ubuntu” makes things easy enough and its just two words. I actually consider it sage advice, not even cynical. Its very unacceptable behavior.
- bboozzoo 7y ago
  The fuss seems to be about motd phoning home. Disabling it is trivial, as you noted in your blog post. The remaining bits likely come from Debian. If you believe it's a bug, have you tried reporting one?
debiandev 7y ago
And this is why Debian exists. When packaging we are required to disable privacy harming "features".
- whalesalad 7y ago
  I’ve returned to vanilla Debian as of late and it’s refreshing. My gripes are the guided installer always insisting I need a swap partition and no sudo out of the box, but those are easy enough to overcome. It’s nice to see only a handful of processes running on a new setup.
  - jeltz 7y ago
    Agreed about the swap partition but Debian has supported sudo out of the box for many years, the UI is just unintuitive. If you leave the root password empty the Debian installer will install sudo for you.
    - rumanator 7y ago
      > If you leave the root password empty the Debian installer will install sudo for you. That's a heck of a gotcha.
      - deleted 7y ago
        [deleted]
      - smittywerben 7y ago
        No sir, the Debian installer says exactly that [0]. [0] https://i.imgur.com/qIqAVSI.png https://i.imgur.com/qIqAVSI.png
        rumanator 7y ago
        You are right, there is indeed text indicating that. However, even the text itself is worded to leave out the sudo implication to the end of the whole paragraph, which is typically skipped by anyone who simply wants their OS installed.
aritmo 7y ago
I remember seeing this on twitter some time ago. It was discussed a lot. edit: google found this article https://lwn.net/Articles/726902/ https://lwn.net/Articles/726902/
a-dub 7y ago
my motd shouldn't tell canonical every time i log in... looks like it never hits the cache unless the curl fails.
- justinsaccount 7y ago
  it doesn't. Right above that code is this block # If we're not forcing an update, and we have a cached motd-news file, # then just print it and exit as quickly as possible, for login performance. # Note that systemd should keep this cache file up to date, asynchronously if [ "$FORCED" != "1" ]; then if [ -r $CACHE ]; then echo safe_print $CACHE else : > $CACHE fi exit 0 fi None of that code in the tweet actually runs at login.
  - jlgaddis 7y ago
    > None of that code in the tweet actually runs at login. Except when there was a bug that caused it to do just that (and also caused a five second delay when logging in).
    - justinsaccount 7y ago
      ... 2 and a half years ago. Can you provide links to all software you have ever written so I can complain about bugs that existed in 2017?
      - jlgaddis 7y ago
        I suppose I can, if you really want me to, but: 1.) no software I've ever written is installed and enabled, by default, on pretty much every Ubuntu instance created in the last ~2.5 years (whether the "owners" of those instances want it or not), 2.) I certainly never claimed to write 100% bug-free code (in fact, I will freely admit that I absolutely DO NOT write bug-free code!), and 3.) this discussion really isn't about me or any code that I have written. (If you're the one that wrote whatever caused the bug and my comment caused your feelings to get hurt, sorry, but software bugs are a fact of life.)
sigio 7y ago
These are the kinds of packages that get uninstalled immediately, and then configured in my config-management to remove on sight. Debian luckily doesn't do crap like this.
- jlgaddis 7y ago
  I mentioned it in another comment but this functionality is included with the "base-files" package: $ sudo apt remove base-files ... WARNING: The following essential packages will be removed. This should NOT be done unless you know exactly what you are doing! base-files bash ... You are about to do something potentially harmful. To continue type in the phrase 'Yes, do as I say!' ?] Have fun with your broken system after removing that! The best you can do is disable it (and hope it isn't silently re-enabled later): $ sudo systemctl disable motd-news.timer
  - panpanna 7y ago
    Please open a bug with canonical asking for motd to be moved to oss own package.
    - JdeBP 7y ago
      Like this unfixed one from 2018, asking that removing execute permission from the script disable the attempts to run it, do you mean? * https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/1803601 https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/18...
  - JdeBP 7y ago
    You should investigate presets.
deft 7y ago
Everytime I update ubuntu the MOTD gets readded. No matter what options I pick it readds a file in the motd folder. Stupid.
- saghm 7y ago
  Obviously this isn't something you should have to do, but maybe making removing the write permissions from the directory will do the trick?
LeoPanthera 7y ago
People should really expect Ubuntu to call home. This is the same OS that for a while used to send every filesystem search you did in the default GUI to Amazon so that it could include ads in the results. I'm not even saying this is bad. Ubuntu has to fund itself somehow. But people should really know what they're getting. Ubuntu is not a privacy-focused or user-centric OS. It's the Windows of the Linux/Unix world.
- rumanator 7y ago
  > I'm not even saying this is bad. You should, though.
- clarry 7y ago
  > I'm not even saying this is bad. Ubuntu has to fund itself somehow. Yep, just like all the other distros...
- rvz 7y ago
  Well now this just makes my "Linux Desktop recommendation guide" even harder since the whole point of Linux distros these days are supposed to empower the user to have complete control over his/her computer and OS which is what Ubuntu was supposed to be doing and is viewed as the ground zero of introducing Linux to newcomers. > I'm not even saying this is bad. Ubuntu has to fund itself somehow. Oh dear. You make as if its fine for the users to give themselves up to Ubuntu (and Amazon) to be mined by the distro that does call itself "privacy-respecting" and "open-source"; some may call such claims misleading in the light of this now. Due to your defeatist rhetoric in supporting these overlords, I would have to change the guide to support the devil I know that can't read my encrypted data, rather than two or eight unknown devils that can. At least with macOS its all "encrypted" and has sane defaults with a consistent user interface and when some settings are turned off, they stay completely off.
  - lonelappde 7y ago
    Users have control to turn off Amazon search in Ubuntu. Control isn't the problem. Annoying defaults is.
tkuraku 7y ago
This is perhaps an unpopular opinion, but I wish Canonical would just charge a small amount to download Ubuntu. I don't pay money for Ubuntu, everyone I know doesn't pay for Ubuntu. Nothing is free. Individuals and corporations need to make money. I just hate that adds are the default instead of charging me a few dollars for useful software.
- john_alan 7y ago
  Beyond the telemetry there isn’t a move to have OS wide ads is there? What’s your Linux of choice?
  - tkuraku 7y ago
    Right now I am using vanilla Debian. They have tons of packages available and they aren't pretending to be anything other than free. I really like RHEL/Centos. Buying RHEL for personal use is a bit expensive and they are pretty sparse for available packages, EPEL helps but is still way behind Debian. Once EPEL fills out more for Centos 8 I will probably switch to that. RHEL/Centos are just bulletproof if they have the software you need/want. Fedora is nice, but the constant updates (including major kernel versions) just don't work for my use case. I need a stable kernel. I work a lot with hardware and need my drivers to keep working.
    - john_alan 7y ago
      Interesting thanks. Do you think we will see banner ads eventually in Ubuntu? I agree I’d rather pay 30usd or whatever.
      - tkuraku 7y ago
        I think jumping to the conclusion that there will be banner ads is a bit of an over reaction. Right now the adds are fairly innocuous, but it is still frustrating that adds are the default instead of just charging me a few dollars. I have no idea, but I would think $5 or $10 would be far more than they could get showing me a couple adds. Though if they decided to charge even $5 to download Ubuntu people would lose their minds more than they do with small adds like these, and so here we are.
egdod 7y ago
Ew, you got some Windows 10 in your Linux.
indigodaddy 7y ago
When did Ubuntu start doing that with their motd?
- tomcooks 7y ago
  Since version 17.04 "In Ubuntu 17.04, we added /etc/update-motd.d/50-motd-news"[0] [0](https://www.reddit.com/r/linux/comments/6k7a86/comment/djkd8oy https://www.reddit.com/r/linux/comments/6k7a86/comment/djkd8...)
  - indigodaddy 7y ago
    Nice find, thanks. So, a fair while.
throwGuardian 7y ago
The number of people switching to BSD because of this is exactly 0. Further, as an avid user of Ubuntu, who reaps the benefits of millions of work hours of Debian &/or Ubuntu employees, I'm ok with advertising whose source code I can audit, and modify even. And to think that the majority of dissenters are commenting from their closed source Macs & iPhones, or their equivalent commerical competitors, on Google funded browsers tracking their every click, is all a little ironic
- johnklos 7y ago
  And you know this number is zero why? This is just yet another quite literal example of how many GNU/Linux distros are becoming more like Windows - they do all sorts of things now that they were never asked to do, and it's up to us to fix things after a clean install.
  - big_chungus 7y ago
    > many GNU/Linux distros are becoming more like Windows And others aren't. Though I disagreed with the SystemD move, I've quite enjoyed arch for years. There are also some excellent other options, for instance, Alpine is a Musl/Busybox/Linux distro that works great on old machines. I think most Linux users will move to a different Linux before moving to BSD for comfort reasons.
- comex 7y ago
  > The number of people switching to BSD because of this is exactly 0. Perhaps. There is at least one person who is now less likely to use Ubuntu after learning this: me. I have typically used a mix of Debian and Ubuntu for both desktop VMs and servers; now I am more likely to use Debian, which takes a significantly stronger privacy stance. I am commenting from an iPhone though. Safari is not Google funded and does not track every click, but I do believe that Apple is getting the kind of OS version stats that Ubuntu’s motd script sends. Relatively tame for commercial software, honestly, but Linux is a different story.
- mwfunk 7y ago
  Even if everything you wrote is 100% true (and I think it is), that's all tangential. The point is that nobody should be curling anything in a login script, not "HAHA DERP BSD BETTER". People having emotional reactions as if some tribe they imagine they belong to has been insulted by someone else who they imagine belongs to some other imaginary tribe, instead of just, "yeah that's wrong nobody should do that, let's do better" has always been one of the most off-putting things to me about the whole free software community, such as it is. It was annoying on Usenet in the mid-'90s, it was obnoxious whenever RMS prioritized that sort of thinking over actually just turning the other cheek and making the world a better place, and wow does it not do anyone any good decades later. My theory is that people get sucked into these black holes of rational thought because, like me, a lot of people drawn to the open source world tend to be obsessive introverts who often feel more comfortable with computers than people, and like me, are susceptible to getting sucked into feelings of belonging and camaraderie with often imaginary subcultures/tribes/families online or elsewhere, when in reality the only common thread is they're random people from mailing lists trying to work together towards a very narrow range of common goals. The instant people get sucked into the dark side, next thing you know they're going around IRL saying stuff like "ACTUALLY it's guh-noo SLASH lee-nooks and anything else is disrespectful and I will personally feel disrespected by anyone who defies me". And then all is lost and this whole thing becomes a net negative for everyone involved. No fun, no fun at all. Nobody should feel personally insulted by anyone pointing out obvious technical flaws in anything really, including their own work, but certainly not in open source operating systems that they may or may not even contribute to.
userbinator 7y ago
I am not surprised. It seems like every piece of software with enough people and commercially-oriented interests will silently phone home now. Whether it's open-source doesn't matter, they'll still do it regardless of what others think.
jlgaddis 7y ago
To disable the part of the MOTD which calls home, setting ENABLED=0 in /etc/default/motd-news should be sufficient. To get rid of the entire "dynamic" MOTD, disable the timer unit: $ sudo systemctl disable motd-news.timer Alternatively, stop supporting companies that covertly slip spyware like this into their software. Debian is wonderful, of course. (I'm on an iPad and going from memory, but I think this is correct -- someone will correct me if it isn't!)
- deith 7y ago
  If Debian offered the same things Ubuntu does, people wouldn't use Ubuntu. But, alas, they don't.
  - brimstedt 7y ago
    I use both, but prefer Debian. Care to elaborate on what you miss in Debian?
    - deith 7y ago
      Many things. Mostly PPAs. I can install Ubuntu Stable and use the most recent version of PHP, which has been built and is stored in Canonical's servers. With Debian, that's a gamble: either wait until the Debian developers stop bikeshedding and upload a new version of PHP to experimental, breaking all my system if I install it, or I have to add a repo from some guy I don't know or trust.
      - deleted 7y ago
        [deleted]
      - throw0101a 7y ago
        > ... or I have to add a repo from some guy I don't know or trust. The Debian PHP maintainer, Ondřej Surý, maintains his own repo: * https://deb.sury.org https://deb.sury.org * https://packages.sury.org/php/README.txt https://packages.sury.org/php/README.txt * https://qa.debian.org/developer.php?login=ondrej%40debian.org https://qa.debian.org/developer.php?login=ondrej%40debian.or...
jlgaddis 7y ago
One implication of this that some people don't realize is that a brand new Ubuntu instance -- whether a physical host, a virtual machine, an EC2 instance, whatever -- immediately calls home to Canonical as soon as it spins up for the first time. The functionality is included in the "base-files" package, which has a priority of "required" and is marked as an "essential" package. Thus, if you have an Ubuntu instance, it's nearly 100% guaranteed this is installed and enabled by default. (If memory serves, this was added in 17.04 or thereabouts.)
- panpanna 7y ago
  I don't think this is "calling home". Ubuntu has been pretty open with their "analytics", which are are really minimal (OS version + screen size + disk size + ...). And yes, they ask for consent. I think this motd is there to (1) advertise more complex canonical products and (2) be used for security announcements. Also, I don't think you ever see motd on a desktop install.
  - jlgaddis 7y ago
    > Also, I don't think you ever see motd on a desktop install. Whether you see it or not, it's still there and it's still running every ~12 hours.
    - panpanna 7y ago
      Ah, I did not know that. I used to have a privacy.sh script for fresh Ubuntu installs back on the Amazon shenanigans days. That file has been empty for a while but I guess I need to update it again.
  - wrkronmiller 7y ago
    The user agent string contains specifics including cpu uptime I believe.
    - deleted 7y ago
      [deleted]
sw3d 7y ago
Does it man it's no longer safe to update Ubuntu, for the risk of getting some spyware tools?
- ziftface 7y ago
  Ubuntu always had spyware though
jlgaddis 7y ago
See also: - Bug #1701068, "motd.ubuntu.com currently shows media item (HBO's Silicon Valley using Ubuntu)" [0] - Dustin Kirkland's explanation here (on HN) back when this first happened [1]. --- [0]: https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/1701068 https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/17... [1]: https://news.ycombinator.com/edit?id=14663947 https://news.ycombinator.com/edit?id=14663947
deleted 7y ago
[deleted]
dmurray 7y ago
I read this as BBC vs Ubuntu motd https://en.m.wikipedia.org/wiki/Match_of_the_Day https://en.m.wikipedia.org/wiki/Match_of_the_Day
rs23296008n1 7y ago
I'm assuming Canonical wont remove it due to it "increasing customer synergies" or similar. Perhaps we make a package that patches this out? I'm thinking of something that detects this file and replaces it rather than a manual process. That way it gets fixed whenever "base-files" or whatever gets its updates. Make it a depend on base or similar. Somebody with a sharper set of teeth and specialised dorsal fin might want to do an audit for similar shenanigans. Canonical have "prior art" for this kind of thing. I doubt this is the only addition.
quicklime 7y ago
I've never seen the motd come up on my laptop. When I open up a GNOME Terminal, it doesn't print the motd by default. I've only seen it when I ssh into another machine, or log into a console. If this is supposed to be phoning home for analytics purposes, isn't it missing a big chunk of data? Also, wouldn't apt be a much better source of analytics data? Yes, there are apt mirrors which aren't controlled by Canonical, but most people would be hitting ftp.{countrycode}.ubuntu.com, or at the very least be downloading http://mirrors.ubuntu.com/mirrors.txt http://mirrors.ubuntu.com/mirrors.txt.
- catalogia 7y ago
  > The default configuration is that this "motd-news" feature is enabled and that it will check https://motd.ubuntu.com https://motd.ubuntu.com for updates. That check is not done at login time, but is periodically done (every twelve hours or so) and the result is cached. https://lwn.net/Articles/726902/ https://lwn.net/Articles/726902/ It runs twice a day, regardless of whether you ever see it.
- JdeBP 7y ago
  You don't correctly understand when the script is being run. * https://git.launchpad.net/ubuntu/+source/base-files/tree/debian/motd-news.timer https://git.launchpad.net/ubuntu/+source/base-files/tree/deb... * https://git.launchpad.net/ubuntu/+source/base-files/tree/debian/motd-news.service https://git.launchpad.net/ubuntu/+source/base-files/tree/deb...
3xblah 7y ago
HN commenters sometimes ask why bother with DNS-based ad blocking when one can just install a browser extension. This is why. There seems to be one assumption that all online advertisers and telemetry implementers make. They assume the user is not in full control of name resolution. ("Full control" as used here means relying on whitelists not third party blocklists.) In this case, they assume motd.ubuntu.com will be resolved without any user input. "Without any user input" here means the user never looked at the domain "motd.ubuntu.com" and made a decision whether it was needed or not.
- tedunangst 7y ago
  How many people have motd in their ad block lists?

251 points by lelf 7y ago

Interesting spyware they ship.

Tbh I find the Ubuntu message of the day quite useful. The "adverts" are benign. Right now it says to check out microk8s and also to look at livepatch. But logging in and seeing a summary of: loaf, disk usage, processes, number of users logged in, IP addresses, memory usage and swap usage, kernel version and also last login time and from what IP. That's pretty useful stuff to me. Also if you're in the position to care about motd, you're going to have the skill to change it yourself.

folkhack 7y ago
> The "adverts" are benign. Right now it says to check out microk8s and also to look at livepatch. My distro shouldn't be advertising to me. Call me "old school" but this has no place in Linux. Also, if you're in a position of trusted compute then you don't want this sort of information leaving your network. > Also if you're in the position to care about motd, you're going to have the skill to change it yourself. Yeah - and I feel I shouldn't have to add it to my images/recipes/whatever to fix this. I use Linux for a lot of reasons, and some of the most important ones are that it doesn't advertise to me and/or leak data. This is telemetry and it's unacceptable.
- Androider 7y ago
  They've also distributed security notices through the MOTD. I find it useful.
  - folkhack 7y ago
    I find features like this to be useful as well - as long as I've opted-in. This is not a "sane default" - this is telemetry enabled out-of-box which is something that I'm vehemently against with Linux.
  - smittywerben 7y ago
    I use email for security notices so I can subscribe to the lists I use and view it on my phone.
- kylek 7y ago
  I don't think that's old school at all. I was really hoping Ubuntu would fall in line after NPM was pummeled for their ads.
- kick 7y ago
  Alternatively: Why not let the people actually making the distros decide what and what not to throw in them? Users can decide what to use, and users have decided to let Canonical win. I don't use Ubuntu, and you don't have to either! It's almost like there are millions of Linux distributions!
  - folkhack 7y ago
    > Alternatively: Why not let the people actually making the distros decide what and what not to throw in them? I'll argue that utilization of Linux comes with certain "expectations" which is why so many of us decide to use it in the first place. Some of those expectations include (but are not limited to) rock-solid stability, "be good at one thing", lack of bloatware, sane update/upgrade cycles/policy, privacy, and security. I've been using Linux professionally for just over 15 years now, sometimes in highly compliant/systems-critical infrastructure. The privacy and security bullet points above are the most important factors to me when designing and/or hardening systems. > I don't use Ubuntu, and you don't have to either! It's almost like there are millions of Linux distributions! Actually - I had to at my last position. When people make technology decisions they often go with the most popular/"safe" options and then dictate the decision to those implementing it. Welcome to corporate America (which is where the jobs are). Everything new was spun-up with Ubuntu as a base distro and you better believe I manually opted-out of this "feature". --- There's a big problem when the most popular distro starts making moves like this as it sets precedent that it's OK. Canonical has made the decision against privacy/security in regards to their motd and that's a huge issue, and I argue it goes against the ethos of Linux and OSS.
    - kick 7y ago
      Actually - I had to at my last position. It's a seller's market for labor. There's a big problem when the most popular distro starts making moves like this as it sets precedent that it's OK. Canonical has made the decision against privacy/security in regards to their motd and that's a huge issue, and I argue it goes against the ethos of Linux and OSS. You're using "OSS." "OSS" is the word that caused this situation! "OSS" was intentionally a term to make free software corporate. Canonical's just doing what people who use and coined "OSS" started: making free software corporate. In the Free Software world, this is bad, but in the corporate world that "open source" advocates have brought among us, this is normal. It's perfectly fine: open-source software is for-profit, not for the common good.
- Barrin92 7y ago
  >This is telemetry and it's unacceptable. I dislike the idea of tying particular political or economic philosophies together with a tech stack like Linux. Everyone can distribute linux distributions however they see fit, it's an open platform and if that includes telemetry by default that's fine too as users have choice. I don't think anyone uses a Canonical distro and is genuinely upset or surprised about this particular benign case. The linux distribution space is truly one of the few places where we can't make any excuses about market power or lack of choice. There are a billion distributions, almost all of them free. Users will pick accordingly, and my sense is that virtually nobody cares about this particular case of telemetry.
  - tjoff 7y ago
    I am upset, and I do use ubuntu, and I am reconsidering that. It isn't about politics nor economics. It's about privacy and control. That is linked with Linux for a lot of users. And Linux users have a pretty good situation in regard to this. But it is starting to erode and if allowed can only get worse. It is unacceptable and the fact that canonical don't realize this is why I'm thinking of alternatives. Especially considering the use case. Either they haven't got a clue, or they are testing the waters. Does not look good any way you look at it.
    - zerkten 7y ago
      >> I am upset, and I do use ubuntu, and I am reconsidering that. Good for you, but don't you sort of expect this with Ubuntu? It's obviously pushing in a different direction from the likes of Debian. I'm not sure most reasonable people have much sympathy for you here. >> It isn't about politics nor economics. It's about privacy and control. That is linked with Linux for a lot of users. And Linux users have a pretty good situation in regard to this. Privacy and control are intermingled with politics and economics. A quick analysis of Ubuntu and Canonical would have suggested that this risk exists for you. >> But it is starting to erode and if allowed can only get worse. You are naive if you think that it won't erode further in your view. Economics and the desires of Ubuntu audience will result in further "features" like this. It's inherent in their mission and they don't particularly care about you. >> It is unacceptable and the fact that canonical don't realize this is why I'm thinking of alternatives. They do realize this. They just don't care. You are the type of customer they want to fire because you aren't their audience, yet fight their choices. >> Especially considering the use case. Either they haven't got a clue, or they are testing the waters. Does not look good any way you look at it. It doesn't look good to you, but it's a trade-off with their users because it's intrinsically tied to their audience, economics, politics, etc. Don't forget that audiences can change. The customers that brought them to this point may not be those who take them to their next goal. It's just business. You can say Linux is more than business, but it doesn't really make an impactful argument.
idclip 7y ago
What systems do you come in contact with? What sort of responsibilities do you have on your job site? Anything critical? And look you dont need to answer those questions either, but take it from me, that kind of thinking and attitude will tank a business and eventually compromise or overburden IT, who will just jail-firewall Machines running that kind of code because its impossible to reign-in in a militerized zone such as a company with over, say, 150+ employees, let alone anything major. Please reconsider/rethink.
_jal 7y ago
The adverts are telemetry, which I don't appreciate being forced to deal with, and especially in open source. At best, it is delivering a broken product to fix, a typically shitty corporate behavior that attempts to grab something in their interest at the cost of being customer-antagonistic. Not like it is the first time. - in the past, Ubuntu has demonstrated a willingness to sell surveillance of their user base to a third party[1]. It makes me trust the company less and worry that if their fortunes or management changes, they'll do slimier, less obvious things. I suppose this all is ultimately a positive thing. Greed heads serve the function of keeping distro-churn up when they do something gross enough to chase people off, which helps keep the ecosystem healthy. [1] https://www.zdnet.com/article/canonical-performs-u-turn-over-amazon-search-results-in-ubuntu-12-10/ https://www.zdnet.com/article/canonical-performs-u-turn-over...
forgotmypw 7y ago
>Also if you're in the position to care about motd, you're going to have the skill to change it yourself. This is an elitist view which implies that if someone doesn't understand something, they aren't affected by it.
emidln 7y ago
My company puts hosts info into the motd (I think via the global bashrc, but it could be a cronjob/deployment utility that triggers the update). It's very useful to find out the vitals at a glance when you remote into a random box.

phaemon 7y ago

A simple straightforward snippet of shell. Is that supposed to be bad?

lixtra 7y ago
It phones home...
idclip 7y ago
It depends, what do you define a shell’s role to be. To us purists, it shouldnt phone home for a motd.
- folkhack 7y ago
  This isn't even an idealist "purists" thing - this is a "I don't want my distro leaking telemetry" thing.
deleted 7y ago
[deleted]

reanimus 7y ago

You know you can configure your motd however you like, right?

idclip 7y ago
Its an operating system, not a nuclear plant. *sane defaults used to be thing. I dont want to worry about stuff i dont know about making connections i didny say it should. Confugure one thing, sure is easy. You think they’ll stop at one?
- reanimus 7y ago
  Comparing some annoying adverts to a nuclear power plant operation system failing is... Something. If it was just about the ads, I'd agree. But comparing it to BSD is silly. BSD doesn't have scriptable motd and I'm supposed to act like that's obviously better? Eh.
  - idclip 7y ago
    I am partially responsible for at least 200 individuals, let alone those who depend on them. Now if you think the digital safety off 200 isnt comparable to the digital safety of say, 200,000, well. “It is with the first link that a chain is forged”. Look, Nothing against you, you dont seem to have a systems exposure i do. Im not a fullstack dev, maybe you are and its fair to just see your own machine and expect everything else to work. Car builders and bridge builders see different problems to solve, and see risks differently too.
    - reanimus 7y ago
      Thanks for the condescension. I'm saying the modes of failure and effects are different. Digital safety and protecting people's lives are two different things. Both important, but different. But even besides that, you ought to be using a different tool for that. Is it fine to have the server I use for my personal site and projects use a dynamic motd, perhaps even reach out to the network? Yeah. It can be useful. Should a CA signing machine do that? Obviously not. I'm saying that acting like one is unambiguously better for being less featureful is wrong. That's all.

idclip 7y ago

Sometimes, Im not sure where the internet and linux are headed anymore.

ailideex 7y ago
Ubuntu != Linux && Ubuntu != TheInternet

jandeboevrie 7y ago

I once wrote on how to disable parts of the ubuntu motd: https://raymii.org/s/tutorials/Disable_dynamic_motd_and_motd_news_spam_on_Ubuntu_18.04.html https://raymii.org/s/tutorials/Disable_dynamic_motd_and_motd... - it's way more complicated then it should be IMHO.

idclip 7y ago
“uninstall ubuntu” makes things easy enough and its just two words. I actually consider it sage advice, not even cynical. Its very unacceptable behavior.
bboozzoo 7y ago
The fuss seems to be about motd phoning home. Disabling it is trivial, as you noted in your blog post. The remaining bits likely come from Debian. If you believe it's a bug, have you tried reporting one?

debiandev 7y ago

And this is why Debian exists. When packaging we are required to disable privacy harming "features".

whalesalad 7y ago
I’ve returned to vanilla Debian as of late and it’s refreshing. My gripes are the guided installer always insisting I need a swap partition and no sudo out of the box, but those are easy enough to overcome. It’s nice to see only a handful of processes running on a new setup.
- jeltz 7y ago
  Agreed about the swap partition but Debian has supported sudo out of the box for many years, the UI is just unintuitive. If you leave the root password empty the Debian installer will install sudo for you.
  - rumanator 7y ago
    > If you leave the root password empty the Debian installer will install sudo for you. That's a heck of a gotcha.
    - deleted 7y ago
      [deleted]
    - smittywerben 7y ago
      No sir, the Debian installer says exactly that [0]. [0] https://i.imgur.com/qIqAVSI.png https://i.imgur.com/qIqAVSI.png
      - rumanator 7y ago
        You are right, there is indeed text indicating that. However, even the text itself is worded to leave out the sudo implication to the end of the whole paragraph, which is typically skipped by anyone who simply wants their OS installed.

aritmo 7y ago

I remember seeing this on twitter some time ago. It was discussed a lot. edit: google found this article https://lwn.net/Articles/726902/ https://lwn.net/Articles/726902/

a-dub 7y ago

my motd shouldn't tell canonical every time i log in... looks like it never hits the cache unless the curl fails.

justinsaccount 7y ago
it doesn't. Right above that code is this block # If we're not forcing an update, and we have a cached motd-news file, # then just print it and exit as quickly as possible, for login performance. # Note that systemd should keep this cache file up to date, asynchronously if [ "$FORCED" != "1" ]; then if [ -r $CACHE ]; then echo safe_print $CACHE else : > $CACHE fi exit 0 fi None of that code in the tweet actually runs at login.
- jlgaddis 7y ago
  > None of that code in the tweet actually runs at login. Except when there was a bug that caused it to do just that (and also caused a five second delay when logging in).
  - justinsaccount 7y ago
    ... 2 and a half years ago. Can you provide links to all software you have ever written so I can complain about bugs that existed in 2017?
    - jlgaddis 7y ago
      I suppose I can, if you really want me to, but: 1.) no software I've ever written is installed and enabled, by default, on pretty much every Ubuntu instance created in the last ~2.5 years (whether the "owners" of those instances want it or not), 2.) I certainly never claimed to write 100% bug-free code (in fact, I will freely admit that I absolutely DO NOT write bug-free code!), and 3.) this discussion really isn't about me or any code that I have written. (If you're the one that wrote whatever caused the bug and my comment caused your feelings to get hurt, sorry, but software bugs are a fact of life.)

sigio 7y ago

These are the kinds of packages that get uninstalled immediately, and then configured in my config-management to remove on sight. Debian luckily doesn't do crap like this.

jlgaddis 7y ago
I mentioned it in another comment but this functionality is included with the "base-files" package: $ sudo apt remove base-files ... WARNING: The following essential packages will be removed. This should NOT be done unless you know exactly what you are doing! base-files bash ... You are about to do something potentially harmful. To continue type in the phrase 'Yes, do as I say!' ?] Have fun with your broken system after removing that! The best you can do is disable it (and hope it isn't silently re-enabled later): $ sudo systemctl disable motd-news.timer
- panpanna 7y ago
  Please open a bug with canonical asking for motd to be moved to oss own package.
  - JdeBP 7y ago
    Like this unfixed one from 2018, asking that removing execute permission from the script disable the attempts to run it, do you mean? * https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/1803601 https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/18...
- JdeBP 7y ago
  You should investigate presets.

deft 7y ago

Everytime I update ubuntu the MOTD gets readded. No matter what options I pick it readds a file in the motd folder. Stupid.

saghm 7y ago
Obviously this isn't something you should have to do, but maybe making removing the write permissions from the directory will do the trick?

LeoPanthera 7y ago

People should really expect Ubuntu to call home. This is the same OS that for a while used to send every filesystem search you did in the default GUI to Amazon so that it could include ads in the results. I'm not even saying this is bad. Ubuntu has to fund itself somehow. But people should really know what they're getting. Ubuntu is not a privacy-focused or user-centric OS. It's the Windows of the Linux/Unix world.

rumanator 7y ago
> I'm not even saying this is bad. You should, though.
clarry 7y ago
> I'm not even saying this is bad. Ubuntu has to fund itself somehow. Yep, just like all the other distros...
rvz 7y ago
Well now this just makes my "Linux Desktop recommendation guide" even harder since the whole point of Linux distros these days are supposed to empower the user to have complete control over his/her computer and OS which is what Ubuntu was supposed to be doing and is viewed as the ground zero of introducing Linux to newcomers. > I'm not even saying this is bad. Ubuntu has to fund itself somehow. Oh dear. You make as if its fine for the users to give themselves up to Ubuntu (and Amazon) to be mined by the distro that does call itself "privacy-respecting" and "open-source"; some may call such claims misleading in the light of this now. Due to your defeatist rhetoric in supporting these overlords, I would have to change the guide to support the devil I know that can't read my encrypted data, rather than two or eight unknown devils that can. At least with macOS its all "encrypted" and has sane defaults with a consistent user interface and when some settings are turned off, they stay completely off.
- lonelappde 7y ago
  Users have control to turn off Amazon search in Ubuntu. Control isn't the problem. Annoying defaults is.

tkuraku 7y ago

This is perhaps an unpopular opinion, but I wish Canonical would just charge a small amount to download Ubuntu. I don't pay money for Ubuntu, everyone I know doesn't pay for Ubuntu. Nothing is free. Individuals and corporations need to make money. I just hate that adds are the default instead of charging me a few dollars for useful software.

john_alan 7y ago
Beyond the telemetry there isn’t a move to have OS wide ads is there? What’s your Linux of choice?
- tkuraku 7y ago
  Right now I am using vanilla Debian. They have tons of packages available and they aren't pretending to be anything other than free. I really like RHEL/Centos. Buying RHEL for personal use is a bit expensive and they are pretty sparse for available packages, EPEL helps but is still way behind Debian. Once EPEL fills out more for Centos 8 I will probably switch to that. RHEL/Centos are just bulletproof if they have the software you need/want. Fedora is nice, but the constant updates (including major kernel versions) just don't work for my use case. I need a stable kernel. I work a lot with hardware and need my drivers to keep working.
  - john_alan 7y ago
    Interesting thanks. Do you think we will see banner ads eventually in Ubuntu? I agree I’d rather pay 30usd or whatever.
    - tkuraku 7y ago
      I think jumping to the conclusion that there will be banner ads is a bit of an over reaction. Right now the adds are fairly innocuous, but it is still frustrating that adds are the default instead of just charging me a few dollars. I have no idea, but I would think $5 or $10 would be far more than they could get showing me a couple adds. Though if they decided to charge even $5 to download Ubuntu people would lose their minds more than they do with small adds like these, and so here we are.

egdod 7y ago

Ew, you got some Windows 10 in your Linux.

indigodaddy 7y ago

When did Ubuntu start doing that with their motd?

tomcooks 7y ago
Since version 17.04 "In Ubuntu 17.04, we added /etc/update-motd.d/50-motd-news"[0] [0](https://www.reddit.com/r/linux/comments/6k7a86/comment/djkd8oy https://www.reddit.com/r/linux/comments/6k7a86/comment/djkd8...)
- indigodaddy 7y ago
  Nice find, thanks. So, a fair while.

throwGuardian 7y ago

The number of people switching to BSD because of this is exactly 0. Further, as an avid user of Ubuntu, who reaps the benefits of millions of work hours of Debian &/or Ubuntu employees, I'm ok with advertising whose source code I can audit, and modify even. And to think that the majority of dissenters are commenting from their closed source Macs & iPhones, or their equivalent commerical competitors, on Google funded browsers tracking their every click, is all a little ironic

johnklos 7y ago
And you know this number is zero why? This is just yet another quite literal example of how many GNU/Linux distros are becoming more like Windows - they do all sorts of things now that they were never asked to do, and it's up to us to fix things after a clean install.
- big_chungus 7y ago
  > many GNU/Linux distros are becoming more like Windows And others aren't. Though I disagreed with the SystemD move, I've quite enjoyed arch for years. There are also some excellent other options, for instance, Alpine is a Musl/Busybox/Linux distro that works great on old machines. I think most Linux users will move to a different Linux before moving to BSD for comfort reasons.
comex 7y ago
> The number of people switching to BSD because of this is exactly 0. Perhaps. There is at least one person who is now less likely to use Ubuntu after learning this: me. I have typically used a mix of Debian and Ubuntu for both desktop VMs and servers; now I am more likely to use Debian, which takes a significantly stronger privacy stance. I am commenting from an iPhone though. Safari is not Google funded and does not track every click, but I do believe that Apple is getting the kind of OS version stats that Ubuntu’s motd script sends. Relatively tame for commercial software, honestly, but Linux is a different story.
mwfunk 7y ago
Even if everything you wrote is 100% true (and I think it is), that's all tangential. The point is that nobody should be curling anything in a login script, not "HAHA DERP BSD BETTER". People having emotional reactions as if some tribe they imagine they belong to has been insulted by someone else who they imagine belongs to some other imaginary tribe, instead of just, "yeah that's wrong nobody should do that, let's do better" has always been one of the most off-putting things to me about the whole free software community, such as it is. It was annoying on Usenet in the mid-'90s, it was obnoxious whenever RMS prioritized that sort of thinking over actually just turning the other cheek and making the world a better place, and wow does it not do anyone any good decades later. My theory is that people get sucked into these black holes of rational thought because, like me, a lot of people drawn to the open source world tend to be obsessive introverts who often feel more comfortable with computers than people, and like me, are susceptible to getting sucked into feelings of belonging and camaraderie with often imaginary subcultures/tribes/families online or elsewhere, when in reality the only common thread is they're random people from mailing lists trying to work together towards a very narrow range of common goals. The instant people get sucked into the dark side, next thing you know they're going around IRL saying stuff like "ACTUALLY it's guh-noo SLASH lee-nooks and anything else is disrespectful and I will personally feel disrespected by anyone who defies me". And then all is lost and this whole thing becomes a net negative for everyone involved. No fun, no fun at all. Nobody should feel personally insulted by anyone pointing out obvious technical flaws in anything really, including their own work, but certainly not in open source operating systems that they may or may not even contribute to.

userbinator 7y ago

I am not surprised. It seems like every piece of software with enough people and commercially-oriented interests will silently phone home now. Whether it's open-source doesn't matter, they'll still do it regardless of what others think.

jlgaddis 7y ago

To disable the part of the MOTD which calls home, setting ENABLED=0 in /etc/default/motd-news should be sufficient. To get rid of the entire "dynamic" MOTD, disable the timer unit: $ sudo systemctl disable motd-news.timer Alternatively, stop supporting companies that covertly slip spyware like this into their software. Debian is wonderful, of course. (I'm on an iPad and going from memory, but I think this is correct -- someone will correct me if it isn't!)

deith 7y ago
If Debian offered the same things Ubuntu does, people wouldn't use Ubuntu. But, alas, they don't.
- brimstedt 7y ago
  I use both, but prefer Debian. Care to elaborate on what you miss in Debian?
  - deith 7y ago
    Many things. Mostly PPAs. I can install Ubuntu Stable and use the most recent version of PHP, which has been built and is stored in Canonical's servers. With Debian, that's a gamble: either wait until the Debian developers stop bikeshedding and upload a new version of PHP to experimental, breaking all my system if I install it, or I have to add a repo from some guy I don't know or trust.
    - deleted 7y ago
      [deleted]
    - throw0101a 7y ago
      > ... or I have to add a repo from some guy I don't know or trust. The Debian PHP maintainer, Ondřej Surý, maintains his own repo: * https://deb.sury.org https://deb.sury.org * https://packages.sury.org/php/README.txt https://packages.sury.org/php/README.txt * https://qa.debian.org/developer.php?login=ondrej%40debian.org https://qa.debian.org/developer.php?login=ondrej%40debian.or...

jlgaddis 7y ago

One implication of this that some people don't realize is that a brand new Ubuntu instance -- whether a physical host, a virtual machine, an EC2 instance, whatever -- immediately calls home to Canonical as soon as it spins up for the first time. The functionality is included in the "base-files" package, which has a priority of "required" and is marked as an "essential" package. Thus, if you have an Ubuntu instance, it's nearly 100% guaranteed this is installed and enabled by default. (If memory serves, this was added in 17.04 or thereabouts.)

panpanna 7y ago
I don't think this is "calling home". Ubuntu has been pretty open with their "analytics", which are are really minimal (OS version + screen size + disk size + ...). And yes, they ask for consent. I think this motd is there to (1) advertise more complex canonical products and (2) be used for security announcements. Also, I don't think you ever see motd on a desktop install.
- jlgaddis 7y ago
  > Also, I don't think you ever see motd on a desktop install. Whether you see it or not, it's still there and it's still running every ~12 hours.
  - panpanna 7y ago
    Ah, I did not know that. I used to have a privacy.sh script for fresh Ubuntu installs back on the Amazon shenanigans days. That file has been empty for a while but I guess I need to update it again.
- wrkronmiller 7y ago
  The user agent string contains specifics including cpu uptime I believe.
  - deleted 7y ago
    [deleted]

sw3d 7y ago

Does it man it's no longer safe to update Ubuntu, for the risk of getting some spyware tools?

ziftface 7y ago
Ubuntu always had spyware though

jlgaddis 7y ago

See also: - Bug #1701068, "motd.ubuntu.com currently shows media item (HBO's Silicon Valley using Ubuntu)" [0] - Dustin Kirkland's explanation here (on HN) back when this first happened [1]. --- [0]: https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/1701068 https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/17... [1]: https://news.ycombinator.com/edit?id=14663947 https://news.ycombinator.com/edit?id=14663947

deleted 7y ago

[deleted]

dmurray 7y ago

I read this as BBC vs Ubuntu motd https://en.m.wikipedia.org/wiki/Match_of_the_Day https://en.m.wikipedia.org/wiki/Match_of_the_Day

rs23296008n1 7y ago

I'm assuming Canonical wont remove it due to it "increasing customer synergies" or similar. Perhaps we make a package that patches this out? I'm thinking of something that detects this file and replaces it rather than a manual process. That way it gets fixed whenever "base-files" or whatever gets its updates. Make it a depend on base or similar. Somebody with a sharper set of teeth and specialised dorsal fin might want to do an audit for similar shenanigans. Canonical have "prior art" for this kind of thing. I doubt this is the only addition.

quicklime 7y ago

I've never seen the motd come up on my laptop. When I open up a GNOME Terminal, it doesn't print the motd by default. I've only seen it when I ssh into another machine, or log into a console. If this is supposed to be phoning home for analytics purposes, isn't it missing a big chunk of data? Also, wouldn't apt be a much better source of analytics data? Yes, there are apt mirrors which aren't controlled by Canonical, but most people would be hitting ftp.{countrycode}.ubuntu.com, or at the very least be downloading http://mirrors.ubuntu.com/mirrors.txt http://mirrors.ubuntu.com/mirrors.txt.

catalogia 7y ago
> The default configuration is that this "motd-news" feature is enabled and that it will check https://motd.ubuntu.com https://motd.ubuntu.com for updates. That check is not done at login time, but is periodically done (every twelve hours or so) and the result is cached. https://lwn.net/Articles/726902/ https://lwn.net/Articles/726902/ It runs twice a day, regardless of whether you ever see it.
JdeBP 7y ago
You don't correctly understand when the script is being run. * https://git.launchpad.net/ubuntu/+source/base-files/tree/debian/motd-news.timer https://git.launchpad.net/ubuntu/+source/base-files/tree/deb... * https://git.launchpad.net/ubuntu/+source/base-files/tree/debian/motd-news.service https://git.launchpad.net/ubuntu/+source/base-files/tree/deb...

3xblah 7y ago

HN commenters sometimes ask why bother with DNS-based ad blocking when one can just install a browser extension. This is why. There seems to be one assumption that all online advertisers and telemetry implementers make. They assume the user is not in full control of name resolution. ("Full control" as used here means relying on whitelists not third party blocklists.) In this case, they assume motd.ubuntu.com will be resolved without any user input. "Without any user input" here means the user never looked at the domain "motd.ubuntu.com" and made a decision whether it was needed or not.

tedunangst 7y ago
How many people have motd in their ad block lists?