5 ms·

> It also transmits a HUGE amount of sensitive data about your system to Docker without your consent, so it's spyware. [...] If you work on any sort of private

by nickjj 6y ago

> It also transmits a HUGE amount of sensitive data about your system to Docker without your consent, so it's spyware. [...] If you work on any sort of private codebases or under NDA, this thing is a liability magnet. Can you please share a full list of what gets transmit with and without having the "Send usage statistics" option enabled? I'm assuming you have this data available because the wording of your reply is so specific.

sneak 6y ago
Crash it and look in $TMPDIR for a zip it uploads.
- wildrhythms 6y ago
  The creation of a .zip file in $TMPDIR does not imply uploading.
  - sneak 6y ago
    You're right. The software uploading the zip is what plainly indicates uploading.
- GordonS 6y ago
  It's been a long time since I had Docker Desktop crash on me (it seems to be very stable these days), but I was sure there was an optional "send crash report" button?
  - sneak 6y ago
    It sends spy data even when it doesn't crash, too.
- yladiz 6y ago
  sneak, the commenter didn't ask how to reproduce it, they asked what it sends. What is in the zip file and what exactly does it upload when it crashes? Are you certain that it uploads the whole zip file upon a crash?
  - sneak 6y ago
    The commenter asked for free research, which I'm not about to reproduce for them (at a minimum it takes the time to format/reinstall a machine), so rather than not answer I told them precisely what they need to do to get the data they desire.
    - nickjj 6y ago
      > The commenter asked for free research, which I'm not about to reproduce for them Not really. You specifically wrote that anyone using Docker Desktop is now liable for breaking NDAs and that a "HUGE" amount of sensitive data about your system is being sent to Docker without consent. I mean, I'm taking for granted here that you didn't wake up yesterday with intent to write those sentences without having ever done the research yourself at least once. You're the one making these claims. If you've done the research, why not just post it here so other folks can verify what you're saying? What I'm getting from your latest reply is you're trying to make it sound way worse than it is and are using a lack of information to guide folks into thinking the worst case scenario by filling in the gaps with their own interpretation of what you wrote. Transmitting a crash dump is much different than them sending sensitive data without your consent, especially considering you can turn the "send usage stats" option off which no longer sends crash dumps, and the dump itself is only sent on a crash. Also the help text under the option says that it sends crash dumps too. Your original reply made it seem like every time you run a container with a volume, the contents of your source code is sent to Docker because in a lot of people's minds that's a "HUGE" amount of sensitive data and ties into your "private code base" and NDA liability sentence before.
      - sneak 6y ago
        > I'm taking for granted here that you didn't wake up yesterday with intent to write those sentences without having ever done the research yourself at least once. You're the one making these claims. If you've done the research, why not just post it here so other folks can verify what you're saying? I have provided specific instructions for verifying precisely what I'm saying. I'm not going to spend hours reproducing this simply because I'm being cross-examined in a comment. It is immaterial to me if you believe my reports of the truth or not.

by nickjj 6y ago

sneak 6y ago

Crash it and look in $TMPDIR for a zip it uploads.

wildrhythms 6y ago
The creation of a .zip file in $TMPDIR does not imply uploading.
- sneak 6y ago
  You're right. The software uploading the zip is what plainly indicates uploading.
GordonS 6y ago
It's been a long time since I had Docker Desktop crash on me (it seems to be very stable these days), but I was sure there was an optional "send crash report" button?
- sneak 6y ago
  It sends spy data even when it doesn't crash, too.
yladiz 6y ago
sneak, the commenter didn't ask how to reproduce it, they asked what it sends. What is in the zip file and what exactly does it upload when it crashes? Are you certain that it uploads the whole zip file upon a crash?
- sneak 6y ago
  The commenter asked for free research, which I'm not about to reproduce for them (at a minimum it takes the time to format/reinstall a machine), so rather than not answer I told them precisely what they need to do to get the data they desire.
  - nickjj 6y ago
    > The commenter asked for free research, which I'm not about to reproduce for them Not really. You specifically wrote that anyone using Docker Desktop is now liable for breaking NDAs and that a "HUGE" amount of sensitive data about your system is being sent to Docker without consent. I mean, I'm taking for granted here that you didn't wake up yesterday with intent to write those sentences without having ever done the research yourself at least once. You're the one making these claims. If you've done the research, why not just post it here so other folks can verify what you're saying? What I'm getting from your latest reply is you're trying to make it sound way worse than it is and are using a lack of information to guide folks into thinking the worst case scenario by filling in the gaps with their own interpretation of what you wrote. Transmitting a crash dump is much different than them sending sensitive data without your consent, especially considering you can turn the "send usage stats" option off which no longer sends crash dumps, and the dump itself is only sent on a crash. Also the help text under the option says that it sends crash dumps too. Your original reply made it seem like every time you run a container with a volume, the contents of your source code is sent to Docker because in a lot of people's minds that's a "HUGE" amount of sensitive data and ties into your "private code base" and NDA liability sentence before.
    - sneak 6y ago
      > I'm taking for granted here that you didn't wake up yesterday with intent to write those sentences without having ever done the research yourself at least once. You're the one making these claims. If you've done the research, why not just post it here so other folks can verify what you're saying? I have provided specific instructions for verifying precisely what I'm saying. I'm not going to spend hours reproducing this simply because I'm being cross-examined in a comment. It is immaterial to me if you believe my reports of the truth or not.