5 ms·

Debian Privacy Issues

138 points by pabs3 4y ago

teddyh 4y ago
Note: This is not so much about privacy issues created by Debian, but a list of still-extant privacy issues in upstream programs as packaged by Debian; i.e. those issues not already patched out by the Debian maintainers.
- dspillett 4y ago
  Also, some of them seem to be things to logically expect, IMO, like remmina having clipboard data shared between the endpoints. All fine as long as they are not hidden, and perhaps can be turned off.
  - layer8 4y ago
    Expecting an issue to be present doesn’t automatically make it a non-issue. It’s useful to have such issues listed. It’s not a moral judgement.
davidmurdoch 4y ago
Is "phoning home" for checking for the latest version (no unique identifiers sent along with the request, other than IP address) frowned upon?
- hedora 4y ago
  It is especially frowned on if the software was packaged by a package manager that handles this for you!
  - SAI_Peregrinus 4y ago
    But the upstream didn't package it, Debian forked it and added/changed build scripts to do so. It's on them to remove the update checks if they want to change the distribution mechanism.
    - hedora 4y ago
      True; the easiest solution is probably to have upstream add an option to ./configure to compile it out. FreeBSD, Red Hat, etc, etc. would also appreciate that.
      - SAI_Peregrinus 4y ago
        Yes, but there's no requirement they do so. They might (depending on the project) accept such a patch, but catering to forks of their project is rarely any OSS maintainer's top priority. Major distro forks can be important, but if someone built their own update checking mechanism they probably don't care too much about other installation methods.
        hedora 4y ago
        Well, adding the option would significantly decrease the set of patches that the distributions need to apply, which would decrease erroneous bug reports, etc. A distribution-provided package doesn't really need to be a fork unless upstream isn't playing nicely with the rest of the OSS ecosystem.
- JohnFen 4y ago
  If it's undisclosed or it can't be disabled, then yes. It's even better if you have to enable it rather than disable it.
  - Rygian 4y ago
    If undisclosed, it is outright illegal in Europe, as the IP address can be mapped to an individual's identity in some typical scenarios.
    - cmeacham98 4y ago
      This is a common misconception. IP addresses are only considered PII if you are in the position of being able to decode them to an identity. An anonymous version checking service obviously does not count.
      - davidmurdoch 4y ago
        Playing devils advocate here, but one interpretation of the law is that if any script that obtains the IP addresses could reverse it to an identity, then you are in violation.
        cmeacham98 4y ago
        Sure, and "one interpretation" of the sky is that it is purple. Or instead of making random interpretations up, we could look at actual cases like Breyer v. Germany, and see how the laws are interpreted in real life.
        davidmurdoch 4y ago
        And I could interpret your text as Klingon. But that's not reasonable. My interpretation above was reasonable. An IP address alone may not reveal who had visited a site. However, Internet Service Providers have additional data that can link IP addresses to individual people. Although it's unlikely that the two data sets will ever be matched up, it is possible. So IP addresses must be treated as personal data.
- worksonmine 4y ago
  Depends how hardcore you are about privacy and the claims the tool makes about privacy. Those who claim to collect none are held to a higher standard than others. Even if it's just version number it does leak usage, location and so on. It can have valid uses, but can also be cleverly abused.
- alkonaut 4y ago
  I don't get it either. It feels like two separate things are confused . 1) "Privacy": I.e. the fear of PII being transmitted or used by a third party 2) "Control": I.e. the fear that the system does something that I didn't ask it for. They are (quite weakly) linked, but they aren't the same things. I'd avoid even discussing them in the same breath for this reason. Saying that checking for updates is a privacy violation just means that everything is lumped together which is a fantastic outcome for software that is actually violating peoples privacy. "Everyone else does it".
  - zajio1am 4y ago
    I do not think that privacy is restricted to PII. For me, computer privacy is as simple as 'any information about what i do with computer that need not leak outside should not leak outside'. PII leakages are just considered more severe than general information leakages, so there is a legislation to handle them.
    - alkonaut 4y ago
      So checking for updates without sending any identifier counts, since it transmits the fact you did in fact run the application, and it's not strictly necessary. I can see the point but it seems hard to draw the line for every single feature at the precise point of "does a network connection". For some programs there is quite a grayscale of what's "necessary" (i.e. needed) and what isn't.
      - zajio1am 4y ago
        I agree that in some cases there is a grayscale because what is an important behavior for some users may be unnecessary for others. For example, i could accept that incremental search using Google when text is entered to address bar in a browser could be considered both useful feature and privacy violation depends on user expectations. But i also think there are some clear lines, like if a tool is not expected to use network at all, it should not use it. If a tool is expected to communicate just with explicitly specified hosts, it should not communicate with third-parties, ...
- iuafhiuah 4y ago
  For platforms where the program is sandboxed and permissions have to be declared, I would frown at the software requesting network access just to check for updates. For example, mobile apps and programs in Flatpaks.
- barnabee 4y ago
  Yes! If it’s not opt in. Software should not make outgoing connections or accept incoming connections unless requested by the user.
  - beardog 4y ago
    If no software auto updated by default the world would have way worse botnet issues.
  - charcircuit 4y ago
    Why? In a world where the vast majority of computers are internet connected. This is just how software is constructed nowadays. Especially web development which is ahead of the ancient development practises common in libre software. Just open your network tab and see how many requests it makes without asking you.
    - redeeman 4y ago
      yes, but all that is user hostile stuff that nobody really wants. modern websites are a cancer that we really quite could do without
      - charcircuit 4y ago
        >yes, but all that is user hostile stuff that nobody really wants. The proof is in the pudding. You claim nobody wants these things yet there are billions of people using these kinds of sites.
        JohnFen 4y ago
        That vast majority of whom don't understand what's happening. Don't confuse ignorance or apathy with wanting it.
    - barnabee 4y ago
      No. My computer having an internet connection is not an automatic invitation for anyone's software to use it. Just because a lot of software sucks doesn't mean it's acceptable or we should lie down and give up. We should work on improving OS capability/permissions models so that apps can't do this by default. In the absence of better protections, I absolutely audit which processes make connections from my machine and uninstall those that make unwanted connections that can't easily be uninstalled (with a small number of unfortunate exceptions where the need to use certain software outweighs the desire to maintain a reasonable system). This doesn't mean no connections ever, it means no conections users don't ask for and no connections that don't provide value to the user. It certainly means no phoning home or stats/crash data connection without explicit opt-in.
- jeroenhd 4y ago
  Debian is quite an opinionated project and they take matters like these very seriously. Pages like these don't exist to judge packages, they're merely there to make people who do care aware of any risks they might not have heard of, and help them exercise control over their machine if they consider these "risks" not to be worth it. I doubt anyone will really care about version checks, unless that's the only reason your tool needs internet access at all. Maybe if you make it an opt-out rather than an opt-in feature (or don't prompt the user at all), I'd be annoyed by that (but I know others aren't). They're completely unnecessary in packaged Debian software because the Debian people will provide newer versions of your application for their users, so a flag to opt out would be nice. Using this data in a useful way, like adding a message like "new version available" would be confusing, because there is no new version available when you run the system update tool! Personally I'd say it should be possible to disable version checks through build flags if you intend to package software through official repositories. If you intend to do distribution and updates yourself I don't think you should be forced to alter your code if people decide to add your software to their distribution. The burden of removing confusion and making their version stick to their ideals should be on them. It would be nice to cooperate, but I don't think you can be blamed for someone else's redistribution.
- m463 4y ago
  that's what apt is for.
Kenji 4y ago
[dead]
HankB99 4y ago
I used to be able to check out my `ntpd` config file and see where my system was getting it's time. Now on Bookworm I cannot find it. I suppose that's some Systemd service but I have not easily determined which one. My point was going to be that I don't ever recall seeing a mention of this WRT privacy and Debian (or any other distro) collecting statistics on usage. The Debian installs that used `ntpd` used to default to a pool of Debian NTP servers. It seems to me that would provide a way of determining how many installs were active, at least the ones using the default server. In my case I changed them to use my pfSense firewall which got time from somewhere else. This 'privacy leak' is probably on the order of the information revealed by APT queries. I'd have to do a little more digging to determine where Bookworm is getting time by default.
- saint_yossarian 4y ago
  Probably via `systemd-timesyncd`, run `timedatectl timesync-status` to see the used server (still the same Debian pool by default). You can change this in /etc/systemd/timesyncd.conf
  - HankB99 4y ago
    That's what I see in my desktop running Bullseye. And it lists the servers #FallbackNTP=0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org I suppose according to the other reply these are not operated by Debian but include their their name.
- jeroenhd 4y ago
  Your NTP client is probably systemd-timesyncd if you're using the systemd NTP client: https://wiki.archlinux.org/title/systemd-timesyncd https://wiki.archlinux.org/title/systemd-timesyncd It'll use either the server you (or your distro) configures in the config, the NTP server provisioned by your network configuration, or the fallback servers in the source code. Debian ships systemd with a config file that has their servers pre-filled, but commented out, free for you to use. The systemd source says they use the Google NTP pool by default as a hard coded fallback, though Debian may have altered that. I think the Debian project assumes that you're okay with communicating to Debian in some fashions if you choose to use their software. After all, if you run their code at the highest privilege, you're already putting a lot of trust in them.
bmacho 4y ago
> File format writing software leaks this into files It is always so annoying, I don't want my files to have my user name in some meta fields. (text editors, image viewers, pdf viewers, literally if a file can contain my user name, all the software put it there by default. Maybe music files are the only exceptions.)
- bmacho 4y ago
  I should just use an internet personality user name on my home computer at this point, instead of fighting it.
  - pessimizer 4y ago
    I have since forever. If you want my real name from my computer, you need to comb it until you find .pdfs of old bills or forms, maybe an old graphic of a business card design. It's not going to be in an API call (coming from inside the house) to your servers.
m463 4y ago
it's nice to see debian taking a stance here. Although ubuntu is based on debian, it is significantly worse with respect to privacy and respect for the user.
vmoore 4y ago
I have OpenSnitch[0] installed on Ubuntu, and when I launch the Calculator app it alerts me that Calculator tries to phone home to `imf.org` apparently for currency conversion purposes. I really don't want the International Monetary Fund in my calculator app. [0] https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch
- _vjcz 4y ago
  That makes sense, though. Conversion rates change frequently.
  - tengwar2 4y ago
    It does if you are doing a currency conversion. It does not at other times.
- cute_boi 4y ago
  most ppl don't use calculator to convert foreign currencies.
camgunz 4y ago
TIL about the DO_NOT_TRACK envvar [0]; maybe Go's telemetry dust up could also support this? [0]: https://consoledonottrack.com/ https://consoledonottrack.com/
- JohnFen 4y ago
  That will likely be as effective as the web DNT is.
  - camgunz 4y ago
    I think a couple things work in our favor here: - users and makers of dev tools are grouchy tech people like us. I think it's more than likely that tools for us and by us will implement stuff we want. - most of this stuff is open source, so we can add it ourselves But, that said I share your cynicism. When I learned about AWS_CLI_TELEMETRY (or whatever it is) I was like, "sigh, it begins".

138 points by pabs3 4y ago

Note: This is not so much about privacy issues created by Debian, but a list of still-extant privacy issues in upstream programs as packaged by Debian; i.e. those issues not already patched out by the Debian maintainers.

dspillett 4y ago
Also, some of them seem to be things to logically expect, IMO, like remmina having clipboard data shared between the endpoints. All fine as long as they are not hidden, and perhaps can be turned off.
- layer8 4y ago
  Expecting an issue to be present doesn’t automatically make it a non-issue. It’s useful to have such issues listed. It’s not a moral judgement.

davidmurdoch 4y ago

Is "phoning home" for checking for the latest version (no unique identifiers sent along with the request, other than IP address) frowned upon?

hedora 4y ago
It is especially frowned on if the software was packaged by a package manager that handles this for you!
- SAI_Peregrinus 4y ago
  But the upstream didn't package it, Debian forked it and added/changed build scripts to do so. It's on them to remove the update checks if they want to change the distribution mechanism.
  - hedora 4y ago
    True; the easiest solution is probably to have upstream add an option to ./configure to compile it out. FreeBSD, Red Hat, etc, etc. would also appreciate that.
    - SAI_Peregrinus 4y ago
      Yes, but there's no requirement they do so. They might (depending on the project) accept such a patch, but catering to forks of their project is rarely any OSS maintainer's top priority. Major distro forks can be important, but if someone built their own update checking mechanism they probably don't care too much about other installation methods.
      - hedora 4y ago
        Well, adding the option would significantly decrease the set of patches that the distributions need to apply, which would decrease erroneous bug reports, etc. A distribution-provided package doesn't really need to be a fork unless upstream isn't playing nicely with the rest of the OSS ecosystem.
JohnFen 4y ago
If it's undisclosed or it can't be disabled, then yes. It's even better if you have to enable it rather than disable it.
- Rygian 4y ago
  If undisclosed, it is outright illegal in Europe, as the IP address can be mapped to an individual's identity in some typical scenarios.
  - cmeacham98 4y ago
    This is a common misconception. IP addresses are only considered PII if you are in the position of being able to decode them to an identity. An anonymous version checking service obviously does not count.
    - davidmurdoch 4y ago
      Playing devils advocate here, but one interpretation of the law is that if any script that obtains the IP addresses could reverse it to an identity, then you are in violation.
      - cmeacham98 4y ago
        Sure, and "one interpretation" of the sky is that it is purple. Or instead of making random interpretations up, we could look at actual cases like Breyer v. Germany, and see how the laws are interpreted in real life.
        davidmurdoch 4y ago
        And I could interpret your text as Klingon. But that's not reasonable. My interpretation above was reasonable. An IP address alone may not reveal who had visited a site. However, Internet Service Providers have additional data that can link IP addresses to individual people. Although it's unlikely that the two data sets will ever be matched up, it is possible. So IP addresses must be treated as personal data.
worksonmine 4y ago
Depends how hardcore you are about privacy and the claims the tool makes about privacy. Those who claim to collect none are held to a higher standard than others. Even if it's just version number it does leak usage, location and so on. It can have valid uses, but can also be cleverly abused.
alkonaut 4y ago
I don't get it either. It feels like two separate things are confused . 1) "Privacy": I.e. the fear of PII being transmitted or used by a third party 2) "Control": I.e. the fear that the system does something that I didn't ask it for. They are (quite weakly) linked, but they aren't the same things. I'd avoid even discussing them in the same breath for this reason. Saying that checking for updates is a privacy violation just means that everything is lumped together which is a fantastic outcome for software that is actually violating peoples privacy. "Everyone else does it".
- zajio1am 4y ago
  I do not think that privacy is restricted to PII. For me, computer privacy is as simple as 'any information about what i do with computer that need not leak outside should not leak outside'. PII leakages are just considered more severe than general information leakages, so there is a legislation to handle them.
  - alkonaut 4y ago
    So checking for updates without sending any identifier counts, since it transmits the fact you did in fact run the application, and it's not strictly necessary. I can see the point but it seems hard to draw the line for every single feature at the precise point of "does a network connection". For some programs there is quite a grayscale of what's "necessary" (i.e. needed) and what isn't.
    - zajio1am 4y ago
      I agree that in some cases there is a grayscale because what is an important behavior for some users may be unnecessary for others. For example, i could accept that incremental search using Google when text is entered to address bar in a browser could be considered both useful feature and privacy violation depends on user expectations. But i also think there are some clear lines, like if a tool is not expected to use network at all, it should not use it. If a tool is expected to communicate just with explicitly specified hosts, it should not communicate with third-parties, ...
iuafhiuah 4y ago
For platforms where the program is sandboxed and permissions have to be declared, I would frown at the software requesting network access just to check for updates. For example, mobile apps and programs in Flatpaks.
barnabee 4y ago
Yes! If it’s not opt in. Software should not make outgoing connections or accept incoming connections unless requested by the user.
- beardog 4y ago
  If no software auto updated by default the world would have way worse botnet issues.
- charcircuit 4y ago
  Why? In a world where the vast majority of computers are internet connected. This is just how software is constructed nowadays. Especially web development which is ahead of the ancient development practises common in libre software. Just open your network tab and see how many requests it makes without asking you.
  - redeeman 4y ago
    yes, but all that is user hostile stuff that nobody really wants. modern websites are a cancer that we really quite could do without
    - charcircuit 4y ago
      >yes, but all that is user hostile stuff that nobody really wants. The proof is in the pudding. You claim nobody wants these things yet there are billions of people using these kinds of sites.
      - JohnFen 4y ago
        That vast majority of whom don't understand what's happening. Don't confuse ignorance or apathy with wanting it.
  - barnabee 4y ago
    No. My computer having an internet connection is not an automatic invitation for anyone's software to use it. Just because a lot of software sucks doesn't mean it's acceptable or we should lie down and give up. We should work on improving OS capability/permissions models so that apps can't do this by default. In the absence of better protections, I absolutely audit which processes make connections from my machine and uninstall those that make unwanted connections that can't easily be uninstalled (with a small number of unfortunate exceptions where the need to use certain software outweighs the desire to maintain a reasonable system). This doesn't mean no connections ever, it means no conections users don't ask for and no connections that don't provide value to the user. It certainly means no phoning home or stats/crash data connection without explicit opt-in.
jeroenhd 4y ago
Debian is quite an opinionated project and they take matters like these very seriously. Pages like these don't exist to judge packages, they're merely there to make people who do care aware of any risks they might not have heard of, and help them exercise control over their machine if they consider these "risks" not to be worth it. I doubt anyone will really care about version checks, unless that's the only reason your tool needs internet access at all. Maybe if you make it an opt-out rather than an opt-in feature (or don't prompt the user at all), I'd be annoyed by that (but I know others aren't). They're completely unnecessary in packaged Debian software because the Debian people will provide newer versions of your application for their users, so a flag to opt out would be nice. Using this data in a useful way, like adding a message like "new version available" would be confusing, because there is no new version available when you run the system update tool! Personally I'd say it should be possible to disable version checks through build flags if you intend to package software through official repositories. If you intend to do distribution and updates yourself I don't think you should be forced to alter your code if people decide to add your software to their distribution. The burden of removing confusion and making their version stick to their ideals should be on them. It would be nice to cooperate, but I don't think you can be blamed for someone else's redistribution.
m463 4y ago
that's what apt is for.

Kenji 4y ago

[dead]

HankB99 4y ago

I used to be able to check out my `ntpd` config file and see where my system was getting it's time. Now on Bookworm I cannot find it. I suppose that's some Systemd service but I have not easily determined which one. My point was going to be that I don't ever recall seeing a mention of this WRT privacy and Debian (or any other distro) collecting statistics on usage. The Debian installs that used `ntpd` used to default to a pool of Debian NTP servers. It seems to me that would provide a way of determining how many installs were active, at least the ones using the default server. In my case I changed them to use my pfSense firewall which got time from somewhere else. This 'privacy leak' is probably on the order of the information revealed by APT queries. I'd have to do a little more digging to determine where Bookworm is getting time by default.

saint_yossarian 4y ago
Probably via `systemd-timesyncd`, run `timedatectl timesync-status` to see the used server (still the same Debian pool by default). You can change this in /etc/systemd/timesyncd.conf
- HankB99 4y ago
  That's what I see in my desktop running Bullseye. And it lists the servers #FallbackNTP=0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org I suppose according to the other reply these are not operated by Debian but include their their name.
jeroenhd 4y ago
Your NTP client is probably systemd-timesyncd if you're using the systemd NTP client: https://wiki.archlinux.org/title/systemd-timesyncd https://wiki.archlinux.org/title/systemd-timesyncd It'll use either the server you (or your distro) configures in the config, the NTP server provisioned by your network configuration, or the fallback servers in the source code. Debian ships systemd with a config file that has their servers pre-filled, but commented out, free for you to use. The systemd source says they use the Google NTP pool by default as a hard coded fallback, though Debian may have altered that. I think the Debian project assumes that you're okay with communicating to Debian in some fashions if you choose to use their software. After all, if you run their code at the highest privilege, you're already putting a lot of trust in them.

bmacho 4y ago

> File format writing software leaks this into files It is always so annoying, I don't want my files to have my user name in some meta fields. (text editors, image viewers, pdf viewers, literally if a file can contain my user name, all the software put it there by default. Maybe music files are the only exceptions.)

bmacho 4y ago
I should just use an internet personality user name on my home computer at this point, instead of fighting it.
- pessimizer 4y ago
  I have since forever. If you want my real name from my computer, you need to comb it until you find .pdfs of old bills or forms, maybe an old graphic of a business card design. It's not going to be in an API call (coming from inside the house) to your servers.

m463 4y ago

it's nice to see debian taking a stance here. Although ubuntu is based on debian, it is significantly worse with respect to privacy and respect for the user.

vmoore 4y ago

I have OpenSnitch[0] installed on Ubuntu, and when I launch the Calculator app it alerts me that Calculator tries to phone home to `imf.org` apparently for currency conversion purposes. I really don't want the International Monetary Fund in my calculator app. [0] https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch

_vjcz 4y ago
That makes sense, though. Conversion rates change frequently.
- tengwar2 4y ago
  It does if you are doing a currency conversion. It does not at other times.
cute_boi 4y ago
most ppl don't use calculator to convert foreign currencies.

camgunz 4y ago

TIL about the DO_NOT_TRACK envvar [0]; maybe Go's telemetry dust up could also support this? [0]: https://consoledonottrack.com/ https://consoledonottrack.com/

JohnFen 4y ago
That will likely be as effective as the web DNT is.
- camgunz 4y ago
  I think a couple things work in our favor here: - users and makers of dev tools are grouchy tech people like us. I think it's more than likely that tools for us and by us will implement stuff we want. - most of this stuff is open source, so we can add it ourselves But, that said I share your cynicism. When I learned about AWS_CLI_TELEMETRY (or whatever it is) I was like, "sigh, it begins".