4 ms·

> Actually, my num_cpu crate has been downloaded 24 times in less than 24 hours, but I’m not sure if it’s by bots or real persons. Presumably the author could

> Actually, my num_cpu crate has been downloaded 24 times in less than 24 hours, but I’m not sure if it’s by bots or real persons. Presumably the author could include some payload which phones home with a randomly generated ID, to detect how many machines the package could take control over. That's probably more meaningful than trying to decide whether the package was downloaded by a "bot", and wouldn't involve any GDPR-breaking information.

CloselyChunky 5y ago
The easier, less invasive but also less accurate option would be to publish an empty crate with a random name that does not exploit typos (just some random junk) and check how often that crate is downloaded. You can assume that almost all downloads for this crate are bot downloads and just subtract that amount from the downloads of the typo-squatted crate
wizzwizz4 5y ago
> and wouldn't involve any GDPR-breaking information. Actually, this would (in my non-legal opinion) be a GDPR violation. See https://gdpr-info.eu https://gdpr-info.eu for details.
- dane-pgp 5y ago
  You want me to read the entire GDPR? It's apparently 261 pages long. https://www.enterpriseready.io/gdpr/how-to-read-gdpr/ https://www.enterpriseready.io/gdpr/how-to-read-gdpr/
  - wizzwizz4 5y ago
    It's not that long, and you don't need to read the entire thing. The first few articles make it clear that you can't do this. Article 4 > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Creating a random identifier to identify individuals means you're working with personal data. (And it's coupled with the IP address, and hence crude location data – and OS information, and metadata about their behaviour…) Article 6 > Processing shall be lawful only if and to the extent that at least one of the following applies: None of them do. If you had consent, then this would be fine, but the whole idea is going behind people's backs to secretly reprogram their computers to phone home, for your own curiosity. That's not allowed.
    - dane-pgp 5y ago
      There is, I think, some legal uncertainty about what it means for someone to be "identified indirectly", so a court might agree with you, but I think there is also a widely accepted opinion that if data can't be connected back to a specific natural person by the data controller/processor, then it is no longer "personal data". Here's what the University College London's guidance[0] says: "Once data is truly anonymised and individuals are no longer identifiable, the data will not fall within the scope of the GDPR and it becomes easier to use." Obviously in the system I am proposing, the data controller/processor would have to deliberately not log the IP address or a user agent string. It's true that timestamps could give an idea of which timezone the user is in, but that shouldn't necessarily reveal even the country the user is in. [0] https://www.ucl.ac.uk/data-protection/guidance-staff-students-and-researchers/practical-data-protection-guidance-notices/anonymisation-and#Pseudonymisation https://www.ucl.ac.uk/data-protection/guidance-staff-student...
      - wizzwizz4 5y ago
        > but I think there is also a widely accepted opinion that if data can't be connected back to a specific natural person by the data controller/processor, then it is no longer "personal data". It can't be defined that way. Consider: • Company A collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Company B collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Company C collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Facebook identifies a specific natural person. GDPR protects against this. > Obviously in the system I am proposing, the data controller/processor would have to deliberately not log the IP address or a user agent string. Good – GDPR calls this the principle of data minimisation. But the data is still going through your systems, when it doesn't really need to be created (however briefly) in the first place. Certainly not via software that people had no reason to expect would be executing on their computer. Honestly, GDPR is the least of your worries; one might consider that malicious software, and then you've got the whole book ready to be thrown at your head.
        dane-pgp 5y ago
rectang 5y ago
Do we really need hard proof of real downloads for an example like this? Typosquatting is obviously a scary problem regardless, with a history of successful exploitation in web domains, other package managers, etc.

CloselyChunky 5y ago

The easier, less invasive but also less accurate option would be to publish an empty crate with a random name that does not exploit typos (just some random junk) and check how often that crate is downloaded. You can assume that almost all downloads for this crate are bot downloads and just subtract that amount from the downloads of the typo-squatted crate

wizzwizz4 5y ago

> and wouldn't involve any GDPR-breaking information. Actually, this would (in my non-legal opinion) be a GDPR violation. See https://gdpr-info.eu https://gdpr-info.eu for details.

dane-pgp 5y ago
You want me to read the entire GDPR? It's apparently 261 pages long. https://www.enterpriseready.io/gdpr/how-to-read-gdpr/ https://www.enterpriseready.io/gdpr/how-to-read-gdpr/
- wizzwizz4 5y ago
  It's not that long, and you don't need to read the entire thing. The first few articles make it clear that you can't do this. Article 4 > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Creating a random identifier to identify individuals means you're working with personal data. (And it's coupled with the IP address, and hence crude location data – and OS information, and metadata about their behaviour…) Article 6 > Processing shall be lawful only if and to the extent that at least one of the following applies: None of them do. If you had consent, then this would be fine, but the whole idea is going behind people's backs to secretly reprogram their computers to phone home, for your own curiosity. That's not allowed.
  - dane-pgp 5y ago
    There is, I think, some legal uncertainty about what it means for someone to be "identified indirectly", so a court might agree with you, but I think there is also a widely accepted opinion that if data can't be connected back to a specific natural person by the data controller/processor, then it is no longer "personal data". Here's what the University College London's guidance[0] says: "Once data is truly anonymised and individuals are no longer identifiable, the data will not fall within the scope of the GDPR and it becomes easier to use." Obviously in the system I am proposing, the data controller/processor would have to deliberately not log the IP address or a user agent string. It's true that timestamps could give an idea of which timezone the user is in, but that shouldn't necessarily reveal even the country the user is in. [0] https://www.ucl.ac.uk/data-protection/guidance-staff-students-and-researchers/practical-data-protection-guidance-notices/anonymisation-and#Pseudonymisation https://www.ucl.ac.uk/data-protection/guidance-staff-student...
    - wizzwizz4 5y ago
      > but I think there is also a widely accepted opinion that if data can't be connected back to a specific natural person by the data controller/processor, then it is no longer "personal data". It can't be defined that way. Consider: • Company A collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Company B collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Company C collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Facebook identifies a specific natural person. GDPR protects against this. > Obviously in the system I am proposing, the data controller/processor would have to deliberately not log the IP address or a user agent string. Good – GDPR calls this the principle of data minimisation. But the data is still going through your systems, when it doesn't really need to be created (however briefly) in the first place. Certainly not via software that people had no reason to expect would be executing on their computer. Honestly, GDPR is the least of your worries; one might consider that malicious software, and then you've got the whole book ready to be thrown at your head.
      - dane-pgp 5y ago

rectang 5y ago

Do we really need hard proof of real downloads for an example like this? Typosquatting is obviously a scary problem regardless, with a history of successful exploitation in web domains, other package managers, etc.