4 ms·

I'm not even sure what I should say to explain the difference here. It should be obvious...

tptacek 15y ago
You're implying the difference is intent. I'm saying, their intent isn't known. Their own statement is that they don't want the raw characters, just the stats. Meanwhile, there are plenty of pieces of code strewn throughout your system that get access to similar bits of sensitive data. For instance, every BSD system has a BPF device and driver that exists solely to tap your network traffic. Luckily, nobody sells a BPF-for-Android product. I'm not saying that this is a clinching argument. I'm simply making a point that is germane to the discussion. Distilled, it is: "just because a piece of systems code deals with your private information does not make a violation of your privacy; sometimes it does, sometimes it doesn't".
- burgerbrain 15y ago
  There is a hell of a lot more wrong with your analogy than a mere "difference in intent".
  - tptacek 15y ago
    I'm interested in why you think that. I wrote the comment in good faith. I'm asking you to clarify also in good faith.
    - burgerbrain 15y ago
      Having reviewed your other comments in this discussion, I must say that I do not see the point in continuing this.
- bad_user 15y ago
  Yeah, but key logging? What could you possibly do with that data? Besides, the BPF driver in every BSD system is probably open-source and could be reviewed for intent if in doubt. It's not easy, not everybody can do it, but it is possible. However, you cannot do that for CarrierIQ. Even if such logs aren't getting sent, you don't know that they haven't installed some kind of mechanism to trigger such an upload on demand.
  - tptacek 15y ago
    It's almost 2012 and "open source" doesn't matter that much anymore when it comes to stuff like this: there's enough incentive and basic competence now that someone's going to reverse engineer CarrierIQ, if only to get themselves some press.

You're implying the difference is intent. I'm saying, their intent isn't known. Their own statement is that they don't want the raw characters, just the stats. Meanwhile, there are plenty of pieces of code strewn throughout your system that get access to similar bits of sensitive data. For instance, every BSD system has a BPF device and driver that exists solely to tap your network traffic. Luckily, nobody sells a BPF-for-Android product. I'm not saying that this is a clinching argument. I'm simply making a point that is germane to the discussion. Distilled, it is: "just because a piece of systems code deals with your private information does not make a violation of your privacy; sometimes it does, sometimes it doesn't".

burgerbrain 15y ago
There is a hell of a lot more wrong with your analogy than a mere "difference in intent".
- tptacek 15y ago
  I'm interested in why you think that. I wrote the comment in good faith. I'm asking you to clarify also in good faith.
  - burgerbrain 15y ago
    Having reviewed your other comments in this discussion, I must say that I do not see the point in continuing this.
bad_user 15y ago
Yeah, but key logging? What could you possibly do with that data? Besides, the BPF driver in every BSD system is probably open-source and could be reviewed for intent if in doubt. It's not easy, not everybody can do it, but it is possible. However, you cannot do that for CarrierIQ. Even if such logs aren't getting sent, you don't know that they haven't installed some kind of mechanism to trigger such an upload on demand.
- tptacek 15y ago
  It's almost 2012 and "open source" doesn't matter that much anymore when it comes to stuff like this: there's enough incentive and basic competence now that someone's going to reverse engineer CarrierIQ, if only to get themselves some press.