5 ms·

Zotero phones home with perhaps more information than you expect.[1] By default, there's a persistent connection whenever Zotero is running, a request when you

Zotero phones home with perhaps more information than you expect.[1] By default, there's a persistent connection whenever Zotero is running, a request when you visit a site with a translator (eg NYTimes) the first time since a browser start, when you download a PDF, etc. I enjoyed using it, but their approach to privacy felt creepy. That [1] is somewhat improved... but only somewhat. [1] https://www.zotero.org/support/privacy#disabling_automatic_requests https://www.zotero.org/support/privacy#disabling_automatic_r...

rikelmens 7y ago
It's an open source project. Feel free to fork it and remove parts you dislike.
- hu3 7y ago
  OP's criticism were fair enough to not deserve a dismissive response. I for one am thankful for their warnings.
  - pergadad 7y ago
    See the response by the developer and the actual page linked. It seems op didn't actually read the link he posted and the critique was fully incorrect.
  - thoraway1010 7y ago
    Their warnings are wrong.
dstillman 7y ago
(Disclosure: Zotero developer) Criticizing Zotero for privacy, of all things, is a bit bizarre. Zotero is an open-source project from a nonprofit organization with no financial interest in people's research data. It's designed as a local tool specifically to give people complete control over their data, and it's developed in the open. Most similar tools are proprietary programs owned by major publishers or analytics companies with voracious appetites for data. The page you linked to explains the reasons for every single network connection that Zotero makes and how to disable it. Every one enables a specific Zotero feature — push-based auto-sync, fast translator updates as sites change to minimize save failures, open-access PDF retrieval. When we implemented retraction notifications, we even did it using k-anonymity to avoid sending up library data from people who don't use syncing. We're always happy to discuss design decisions in our forums, but I'd argue pretty strongly that privacy is one of the main reasons one should use Zotero, not the other way around.
- djaque 7y ago
  Thanks for your work! It's nice to hear that Zotero seems to have privacy as a feature and not a side thought.
- karmelapple 7y ago
  Zotero's privacy features even extend to where data is stored: you can bring your own WebDAV server [1] and have Zotero store data there. [1] https://www.zotero.org/support/sync#webdav https://www.zotero.org/support/sync#webdav
  - Reelin 7y ago
    You do realize that (unless something changed recently) all your metadata is still on their servers? Last time I checked, a Docker image of the sync server was in the works though.
- jjoonathan 7y ago
  ...and you don't automatically upload pirated scihub papers to Elsevier cloud storage, like Mendeley does. That feature alone makes you a winner on the privacy front as far as I'm concerned!
- mncharity 7y ago
  Thank you for your work. > designed as a local tool Nod, a local tool. I have various expectations of my local tools. And if I, say, start Zotero in the morning to read a paper, then exit it for a meeting, then return to it afterward, and then exit for lunch, then at least my own expectations for a local tool are, for example, in tension with those four centralized timestamps. As are the varying tcp routes as I move my laptop among buildings. As is the request when I surf to the NYTimes during lunch. So what does privacy best practice look like? One comment here suggests the ability to fork and edit the code. Another notes the linked documentation, and being more ethical than Elsevier. The linked page notes the existence of scattered opt-out options. And also "You can avoid these requests by keeping Zotero open while you browse the web." My own understanding of privacy best practices, includes data exposure being opt-in rather than opt-out, and those privacy preferences being easily seen and changed in one place. My impression is Zotero doesn't do these. And that's just Microsoft-style privacy practice. It would be even nicer to have knobs, like "check for updates every <start/day/week/...>". > Criticizing Zotero for privacy, of all things, is a bit bizarre. I'd be fine with "we have limited resources; know privacy is important; are improving; know we have work to do to implement best practices, are working towards it". But my own fuzzy long-term impression has been, that such recognition has not been proportional to the potential degree of privacy exposure.
jmiserez 7y ago
To be fair, that's a pretty nice link, not many companies provide such an overview. And most (all) of those features are useful things that you'd probably actually want to enable in daily use. And Zotero can run completely offline, without an account. Now compare that to Zotero's biggest competitor: https://www.mendeley.com/terms/privacy https://www.mendeley.com/terms/privacy
- mncharity 7y ago
  Indeed. There does seem an issue of what baseline to use. Elsevier isn't usually thought of as a useful ethical baseline, but here it's a displaced competitor. Companies embed a variety of telemetry. And while much open source doesn't, some does, and this is perhaps increasing. And yet, if say Firefox always maintained an open but empty connection to mozilla, would it be adequate to suggest "well, no, that's not under privacy preferences, but it's documented on our privacy web page, and can be disabled by editing about.config.mumble"? Perhaps with the shift from desktop to phone, expectations of what it means to be local are changing? "Your core data is local, not hostage", but now "of course the app chats on the web... doesn't everything?"?
  - jmiserez 7y ago
    Well Firefox actually does (Web Push API): https://support.mozilla.org/en-US/kb/push-notifications-firefox#w_what-information-does-firefox-use-to-provide-web-push https://support.mozilla.org/en-US/kb/push-notifications-fire... >Firefox maintains an active connection to a push service in order to receive push messages as long as it is open. The connection ends when Firefox is closed. I see what you're getting at, but I think the harshest criticism should be reserved for the worst services: those that actually hold your data hostage, don't provide an export functionality and use your data in all sorts of unethical ways. Organisations that actually honestly do value privacy and try to make an effort to get it "right" should be given the benefit of the doubt and constructive criticism, as they might actually listen. In many cases the feature may simply be driven by convenience and the competition (e.g. cloud storage, accounts, sync), and having a toggle for those is the best you can do if they want to stay relevant. In other cases the privacy issue may have simply been overlooked and the feature is improved (IIRC Mozilla has had a few of these). Maybe a big red "offline-only" toggle would be great, but the absence of that button does not in my eyes disqualify Zotero from being a great offline solution.
deleted 7y ago
[deleted]

rikelmens 7y ago

It's an open source project. Feel free to fork it and remove parts you dislike.

hu3 7y ago
OP's criticism were fair enough to not deserve a dismissive response. I for one am thankful for their warnings.
- pergadad 7y ago
  See the response by the developer and the actual page linked. It seems op didn't actually read the link he posted and the critique was fully incorrect.
- thoraway1010 7y ago
  Their warnings are wrong.

dstillman 7y ago

(Disclosure: Zotero developer) Criticizing Zotero for privacy, of all things, is a bit bizarre. Zotero is an open-source project from a nonprofit organization with no financial interest in people's research data. It's designed as a local tool specifically to give people complete control over their data, and it's developed in the open. Most similar tools are proprietary programs owned by major publishers or analytics companies with voracious appetites for data. The page you linked to explains the reasons for every single network connection that Zotero makes and how to disable it. Every one enables a specific Zotero feature — push-based auto-sync, fast translator updates as sites change to minimize save failures, open-access PDF retrieval. When we implemented retraction notifications, we even did it using k-anonymity to avoid sending up library data from people who don't use syncing. We're always happy to discuss design decisions in our forums, but I'd argue pretty strongly that privacy is one of the main reasons one should use Zotero, not the other way around.

djaque 7y ago
Thanks for your work! It's nice to hear that Zotero seems to have privacy as a feature and not a side thought.
karmelapple 7y ago
Zotero's privacy features even extend to where data is stored: you can bring your own WebDAV server [1] and have Zotero store data there. [1] https://www.zotero.org/support/sync#webdav https://www.zotero.org/support/sync#webdav
- Reelin 7y ago
  You do realize that (unless something changed recently) all your metadata is still on their servers? Last time I checked, a Docker image of the sync server was in the works though.
jjoonathan 7y ago
...and you don't automatically upload pirated scihub papers to Elsevier cloud storage, like Mendeley does. That feature alone makes you a winner on the privacy front as far as I'm concerned!
mncharity 7y ago
Thank you for your work. > designed as a local tool Nod, a local tool. I have various expectations of my local tools. And if I, say, start Zotero in the morning to read a paper, then exit it for a meeting, then return to it afterward, and then exit for lunch, then at least my own expectations for a local tool are, for example, in tension with those four centralized timestamps. As are the varying tcp routes as I move my laptop among buildings. As is the request when I surf to the NYTimes during lunch. So what does privacy best practice look like? One comment here suggests the ability to fork and edit the code. Another notes the linked documentation, and being more ethical than Elsevier. The linked page notes the existence of scattered opt-out options. And also "You can avoid these requests by keeping Zotero open while you browse the web." My own understanding of privacy best practices, includes data exposure being opt-in rather than opt-out, and those privacy preferences being easily seen and changed in one place. My impression is Zotero doesn't do these. And that's just Microsoft-style privacy practice. It would be even nicer to have knobs, like "check for updates every <start/day/week/...>". > Criticizing Zotero for privacy, of all things, is a bit bizarre. I'd be fine with "we have limited resources; know privacy is important; are improving; know we have work to do to implement best practices, are working towards it". But my own fuzzy long-term impression has been, that such recognition has not been proportional to the potential degree of privacy exposure.

jmiserez 7y ago

To be fair, that's a pretty nice link, not many companies provide such an overview. And most (all) of those features are useful things that you'd probably actually want to enable in daily use. And Zotero can run completely offline, without an account. Now compare that to Zotero's biggest competitor: https://www.mendeley.com/terms/privacy https://www.mendeley.com/terms/privacy

mncharity 7y ago
Indeed. There does seem an issue of what baseline to use. Elsevier isn't usually thought of as a useful ethical baseline, but here it's a displaced competitor. Companies embed a variety of telemetry. And while much open source doesn't, some does, and this is perhaps increasing. And yet, if say Firefox always maintained an open but empty connection to mozilla, would it be adequate to suggest "well, no, that's not under privacy preferences, but it's documented on our privacy web page, and can be disabled by editing about.config.mumble"? Perhaps with the shift from desktop to phone, expectations of what it means to be local are changing? "Your core data is local, not hostage", but now "of course the app chats on the web... doesn't everything?"?
- jmiserez 7y ago
  Well Firefox actually does (Web Push API): https://support.mozilla.org/en-US/kb/push-notifications-firefox#w_what-information-does-firefox-use-to-provide-web-push https://support.mozilla.org/en-US/kb/push-notifications-fire... >Firefox maintains an active connection to a push service in order to receive push messages as long as it is open. The connection ends when Firefox is closed. I see what you're getting at, but I think the harshest criticism should be reserved for the worst services: those that actually hold your data hostage, don't provide an export functionality and use your data in all sorts of unethical ways. Organisations that actually honestly do value privacy and try to make an effort to get it "right" should be given the benefit of the doubt and constructive criticism, as they might actually listen. In many cases the feature may simply be driven by convenience and the competition (e.g. cloud storage, accounts, sync), and having a toggle for those is the best you can do if they want to stay relevant. In other cases the privacy issue may have simply been overlooked and the feature is improved (IIRC Mozilla has had a few of these). Maybe a big red "offline-only" toggle would be great, but the absence of that button does not in my eyes disqualify Zotero from being a great offline solution.

deleted 7y ago

[deleted]