4 ms·

> Albeit I am undecided whether we should really force every FLOSS developer to create a table like this I don't see any reason why open-source software should

> Albeit I am undecided whether we should really force every FLOSS developer to create a table like this I don't see any reason why open-source software should get a free pass on privacy issues.

bee_rider 4y ago
I think it depends more on the business model. If an open source project is really just somebody releasing their own code, they don't have any obligation at all to the end user. If a business is releasing open source code and has some business model that ultimately turns that into profit (even indirectly, for example via selling your private info), then they have an moral obligation to be clear on how they are making money. On the other hand, the app stores have no obligation to host projects generally.
- usr1106 4y ago
  The Google app store has an interest to publish all kind of apps, FOSS or not. It supports their "the customer is the product" business model. Apple has an interest to publish the same apps. It supports their "keep the users in the walled garden" business model. Both form an unhealty duopoly from both app developers and end users point of view. Saying they have no obligation to host an app might be correct, but it's a very limited perspective of the whole situation.
- pmontra 4y ago
  If they release the source and I'm building the app, maybe you're right but it would be nice to know how they it handles privacy without having to read every single line. If they distribute the app there is little difference from a closed source install. Again, "read the code and learn what we do about privacy" would be pretty hostile.
- ggeorgovassilis 4y ago
  > I think it depends more on the business model. In this case it doesn't. I also can't give away meth for free. Distribution of an app that processes personal data without a valid data privacy statement is illegal in the EU and could get the author and/or github into trouble unless they implement an export restriction (eg. EULA that prohibits distribution in the EU).
  - jhgb 4y ago
    > Distribution of an app that processes personal data without a valid data privacy statement is illegal in the EU Is that really true? For example data processors are bound by GDPR but I don't see how the author of this application is a data processor (or a data controller). In fact I'm not sure that legally "app that processes personal data" is the correct description here, considering the very specific meaning of "to process" in this context. If an email client run by a user on his own machine with no involvement of the vendor of that software requires "a valid data privacy statement", then so does probably the user's keyboard driver. And the text formatting engine. And the networking stack. Etc. etc.
    - ggeorgovassilis 4y ago
      > Is that really true? Best I can do is offer my interpretation. GDPR applies to "[...] the processing of personal data wholly or partly by automated means" [1]. I take "automated means" to include this app. So when this app runs and processes EU citizens' data, the law applies. But to what or whom... > I don't see how the author of this application is a data processor (or a data controller) ... I understand as follows: things are generally not responsible under the law, their owners and creators are. If I install and use a software, the GDPR entitles me to knowledge of its personal data processing capabilities if it processes personal data, which this app seems to do. As the GDPR evolved from consumer protection law, I'll employ an analogy: if I win a free vacuum cleaner in a raffle, the product still needs to include a safety guide - the manufacturer or distributor can't delegate safety responsibility to me. GDPR is about personal data safety. > If an email client run by a user on his own machine with no involvement of the vendor of that software requires "a valid data privacy statement" Conversely, at least one mainstream email client comes with a data privacy statement [2]. Which doesn't prove my point, it might be just ass-covering. > then so does probably the user's keyboard driver. Maybe the operating system's data privacy statement covers this? Otherwise that reasoning appears sound. [1] https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/ [2] https://www.mozilla.org/en-US/privacy/thunderbird/ https://www.mozilla.org/en-US/privacy/thunderbird/
      - 4y ago
freedomben 4y ago
"open source" isn't a very helpful label/designation IMHO with regards to this. "Open source" can describe somebody's hacked together personal project or AOSP, which are wildly different.

> Albeit I am undecided whether we should really force every FLOSS developer to create a table like this I don't see any reason why open-source software should get a free pass on privacy issues.

bee_rider 4y ago

I think it depends more on the business model. If an open source project is really just somebody releasing their own code, they don't have any obligation at all to the end user. If a business is releasing open source code and has some business model that ultimately turns that into profit (even indirectly, for example via selling your private info), then they have an moral obligation to be clear on how they are making money. On the other hand, the app stores have no obligation to host projects generally.

usr1106 4y ago
The Google app store has an interest to publish all kind of apps, FOSS or not. It supports their "the customer is the product" business model. Apple has an interest to publish the same apps. It supports their "keep the users in the walled garden" business model. Both form an unhealty duopoly from both app developers and end users point of view. Saying they have no obligation to host an app might be correct, but it's a very limited perspective of the whole situation.
pmontra 4y ago
If they release the source and I'm building the app, maybe you're right but it would be nice to know how they it handles privacy without having to read every single line. If they distribute the app there is little difference from a closed source install. Again, "read the code and learn what we do about privacy" would be pretty hostile.
ggeorgovassilis 4y ago
> I think it depends more on the business model. In this case it doesn't. I also can't give away meth for free. Distribution of an app that processes personal data without a valid data privacy statement is illegal in the EU and could get the author and/or github into trouble unless they implement an export restriction (eg. EULA that prohibits distribution in the EU).
- jhgb 4y ago
  > Distribution of an app that processes personal data without a valid data privacy statement is illegal in the EU Is that really true? For example data processors are bound by GDPR but I don't see how the author of this application is a data processor (or a data controller). In fact I'm not sure that legally "app that processes personal data" is the correct description here, considering the very specific meaning of "to process" in this context. If an email client run by a user on his own machine with no involvement of the vendor of that software requires "a valid data privacy statement", then so does probably the user's keyboard driver. And the text formatting engine. And the networking stack. Etc. etc.
  - ggeorgovassilis 4y ago
    > Is that really true? Best I can do is offer my interpretation. GDPR applies to "[...] the processing of personal data wholly or partly by automated means" [1]. I take "automated means" to include this app. So when this app runs and processes EU citizens' data, the law applies. But to what or whom... > I don't see how the author of this application is a data processor (or a data controller) ... I understand as follows: things are generally not responsible under the law, their owners and creators are. If I install and use a software, the GDPR entitles me to knowledge of its personal data processing capabilities if it processes personal data, which this app seems to do. As the GDPR evolved from consumer protection law, I'll employ an analogy: if I win a free vacuum cleaner in a raffle, the product still needs to include a safety guide - the manufacturer or distributor can't delegate safety responsibility to me. GDPR is about personal data safety. > If an email client run by a user on his own machine with no involvement of the vendor of that software requires "a valid data privacy statement" Conversely, at least one mainstream email client comes with a data privacy statement [2]. Which doesn't prove my point, it might be just ass-covering. > then so does probably the user's keyboard driver. Maybe the operating system's data privacy statement covers this? Otherwise that reasoning appears sound. [1] https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/ [2] https://www.mozilla.org/en-US/privacy/thunderbird/ https://www.mozilla.org/en-US/privacy/thunderbird/
    - 4y ago

freedomben 4y ago

"open source" isn't a very helpful label/designation IMHO with regards to this. "Open source" can describe somebody's hacked together personal project or AOSP, which are wildly different.