3 ms·

AFAIK this isn't uniquely a Rust problem; build systems are just extremely leaky and easy to fingerprint. In fact, it's part of the reason why reproducible buil

AFAIK this isn't uniquely a Rust problem; build systems are just extremely leaky and easy to fingerprint. In fact, it's part of the reason why reproducible builds are so difficult to pull off. If I remember correctly, Stuxnet was identified as being a US/Israeli joint cyberattack by, among other things, common home directory names in debug build strings. >"If it helps, you including user ids like this violates GDPR... so this should be addressed by the rust team." This isn't true: GDPR covers entities that collect, store, and use user information ("data controllers"). Rust's developers are not data controllers; they're compiler developers. Maybe you could argue that crates.io has inadvertently become a data controller because they store these packages, but that still seems like a stretch. Regardless, the inadvertent leak of user information is directly tied to the legitimate purpose of allowing the compiler's panic machinery to output a usable backtrace. So I don't think you can scream "GDPR" just to get your Github issue more attention.

saghm 6y ago
> Maybe you could argue that crates.io has inadvertently become a data controller because they store these packages, but that still seems like a stretch. crates.io distributes packages by source, so I'd imagine it doesn't have any info regarding the username of the system the package was uploaded from (although it does obviously have the username associated with the crates.io account, but there's no reason those have to be the same)
carols10cents 6y ago
Crates.io does not store built code.
rhn_mk1 6y ago
> Maybe you could argue that crates.io has inadvertently become a data controller because they store these packages, but that still seems like a stretch. Why so? It's not different from any other serivice where people submit things. It shouldn't matter if it's a binary, text, or a video, and I've heard opinions that the contents users submit need to be monitored for personal information anyway.

saghm 6y ago

> Maybe you could argue that crates.io has inadvertently become a data controller because they store these packages, but that still seems like a stretch. crates.io distributes packages by source, so I'd imagine it doesn't have any info regarding the username of the system the package was uploaded from (although it does obviously have the username associated with the crates.io account, but there's no reason those have to be the same)

carols10cents 6y ago

Crates.io does not store built code.

rhn_mk1 6y ago

> Maybe you could argue that crates.io has inadvertently become a data controller because they store these packages, but that still seems like a stretch. Why so? It's not different from any other serivice where people submit things. It shouldn't matter if it's a binary, text, or a video, and I've heard opinions that the contents users submit need to be monitored for personal information anyway.