6 ms·

Is "phoning home" for checking for the latest version (no unique identifiers sent along with the request, other than IP address) frowned upon?

hedora 4y ago
It is especially frowned on if the software was packaged by a package manager that handles this for you!
- SAI_Peregrinus 4y ago
  But the upstream didn't package it, Debian forked it and added/changed build scripts to do so. It's on them to remove the update checks if they want to change the distribution mechanism.
  - hedora 4y ago
    True; the easiest solution is probably to have upstream add an option to ./configure to compile it out. FreeBSD, Red Hat, etc, etc. would also appreciate that.
    - SAI_Peregrinus 4y ago
      Yes, but there's no requirement they do so. They might (depending on the project) accept such a patch, but catering to forks of their project is rarely any OSS maintainer's top priority. Major distro forks can be important, but if someone built their own update checking mechanism they probably don't care too much about other installation methods.
      - hedora 4y ago
        Well, adding the option would significantly decrease the set of patches that the distributions need to apply, which would decrease erroneous bug reports, etc. A distribution-provided package doesn't really need to be a fork unless upstream isn't playing nicely with the rest of the OSS ecosystem.
JohnFen 4y ago
If it's undisclosed or it can't be disabled, then yes. It's even better if you have to enable it rather than disable it.
- Rygian 4y ago
  If undisclosed, it is outright illegal in Europe, as the IP address can be mapped to an individual's identity in some typical scenarios.
  - cmeacham98 4y ago
    This is a common misconception. IP addresses are only considered PII if you are in the position of being able to decode them to an identity. An anonymous version checking service obviously does not count.
    - davidmurdoch 4y ago
      Playing devils advocate here, but one interpretation of the law is that if any script that obtains the IP addresses could reverse it to an identity, then you are in violation.
      - cmeacham98 4y ago
        Sure, and "one interpretation" of the sky is that it is purple. Or instead of making random interpretations up, we could look at actual cases like Breyer v. Germany, and see how the laws are interpreted in real life.
        davidmurdoch 4y ago
        And I could interpret your text as Klingon. But that's not reasonable. My interpretation above was reasonable. An IP address alone may not reveal who had visited a site. However, Internet Service Providers have additional data that can link IP addresses to individual people. Although it's unlikely that the two data sets will ever be matched up, it is possible. So IP addresses must be treated as personal data.
worksonmine 4y ago
Depends how hardcore you are about privacy and the claims the tool makes about privacy. Those who claim to collect none are held to a higher standard than others. Even if it's just version number it does leak usage, location and so on. It can have valid uses, but can also be cleverly abused.
alkonaut 4y ago
I don't get it either. It feels like two separate things are confused . 1) "Privacy": I.e. the fear of PII being transmitted or used by a third party 2) "Control": I.e. the fear that the system does something that I didn't ask it for. They are (quite weakly) linked, but they aren't the same things. I'd avoid even discussing them in the same breath for this reason. Saying that checking for updates is a privacy violation just means that everything is lumped together which is a fantastic outcome for software that is actually violating peoples privacy. "Everyone else does it".
- zajio1am 4y ago
  I do not think that privacy is restricted to PII. For me, computer privacy is as simple as 'any information about what i do with computer that need not leak outside should not leak outside'. PII leakages are just considered more severe than general information leakages, so there is a legislation to handle them.
  - alkonaut 4y ago
    So checking for updates without sending any identifier counts, since it transmits the fact you did in fact run the application, and it's not strictly necessary. I can see the point but it seems hard to draw the line for every single feature at the precise point of "does a network connection". For some programs there is quite a grayscale of what's "necessary" (i.e. needed) and what isn't.
    - zajio1am 4y ago
      I agree that in some cases there is a grayscale because what is an important behavior for some users may be unnecessary for others. For example, i could accept that incremental search using Google when text is entered to address bar in a browser could be considered both useful feature and privacy violation depends on user expectations. But i also think there are some clear lines, like if a tool is not expected to use network at all, it should not use it. If a tool is expected to communicate just with explicitly specified hosts, it should not communicate with third-parties, ...
iuafhiuah 4y ago
For platforms where the program is sandboxed and permissions have to be declared, I would frown at the software requesting network access just to check for updates. For example, mobile apps and programs in Flatpaks.
barnabee 4y ago
Yes! If it’s not opt in. Software should not make outgoing connections or accept incoming connections unless requested by the user.
- beardog 4y ago
  If no software auto updated by default the world would have way worse botnet issues.
- charcircuit 4y ago
  Why? In a world where the vast majority of computers are internet connected. This is just how software is constructed nowadays. Especially web development which is ahead of the ancient development practises common in libre software. Just open your network tab and see how many requests it makes without asking you.
  - redeeman 4y ago
    yes, but all that is user hostile stuff that nobody really wants. modern websites are a cancer that we really quite could do without
    - charcircuit 4y ago
      >yes, but all that is user hostile stuff that nobody really wants. The proof is in the pudding. You claim nobody wants these things yet there are billions of people using these kinds of sites.
      - JohnFen 4y ago
        That vast majority of whom don't understand what's happening. Don't confuse ignorance or apathy with wanting it.
  - barnabee 4y ago
    No. My computer having an internet connection is not an automatic invitation for anyone's software to use it. Just because a lot of software sucks doesn't mean it's acceptable or we should lie down and give up. We should work on improving OS capability/permissions models so that apps can't do this by default. In the absence of better protections, I absolutely audit which processes make connections from my machine and uninstall those that make unwanted connections that can't easily be uninstalled (with a small number of unfortunate exceptions where the need to use certain software outweighs the desire to maintain a reasonable system). This doesn't mean no connections ever, it means no conections users don't ask for and no connections that don't provide value to the user. It certainly means no phoning home or stats/crash data connection without explicit opt-in.
jeroenhd 4y ago
Debian is quite an opinionated project and they take matters like these very seriously. Pages like these don't exist to judge packages, they're merely there to make people who do care aware of any risks they might not have heard of, and help them exercise control over their machine if they consider these "risks" not to be worth it. I doubt anyone will really care about version checks, unless that's the only reason your tool needs internet access at all. Maybe if you make it an opt-out rather than an opt-in feature (or don't prompt the user at all), I'd be annoyed by that (but I know others aren't). They're completely unnecessary in packaged Debian software because the Debian people will provide newer versions of your application for their users, so a flag to opt out would be nice. Using this data in a useful way, like adding a message like "new version available" would be confusing, because there is no new version available when you run the system update tool! Personally I'd say it should be possible to disable version checks through build flags if you intend to package software through official repositories. If you intend to do distribution and updates yourself I don't think you should be forced to alter your code if people decide to add your software to their distribution. The burden of removing confusion and making their version stick to their ideals should be on them. It would be nice to cooperate, but I don't think you can be blamed for someone else's redistribution.
m463 4y ago
that's what apt is for.

hedora 4y ago

It is especially frowned on if the software was packaged by a package manager that handles this for you!

SAI_Peregrinus 4y ago
But the upstream didn't package it, Debian forked it and added/changed build scripts to do so. It's on them to remove the update checks if they want to change the distribution mechanism.
- hedora 4y ago
  True; the easiest solution is probably to have upstream add an option to ./configure to compile it out. FreeBSD, Red Hat, etc, etc. would also appreciate that.
  - SAI_Peregrinus 4y ago
    Yes, but there's no requirement they do so. They might (depending on the project) accept such a patch, but catering to forks of their project is rarely any OSS maintainer's top priority. Major distro forks can be important, but if someone built their own update checking mechanism they probably don't care too much about other installation methods.
    - hedora 4y ago
      Well, adding the option would significantly decrease the set of patches that the distributions need to apply, which would decrease erroneous bug reports, etc. A distribution-provided package doesn't really need to be a fork unless upstream isn't playing nicely with the rest of the OSS ecosystem.

JohnFen 4y ago

If it's undisclosed or it can't be disabled, then yes. It's even better if you have to enable it rather than disable it.

Rygian 4y ago
If undisclosed, it is outright illegal in Europe, as the IP address can be mapped to an individual's identity in some typical scenarios.
- cmeacham98 4y ago
  This is a common misconception. IP addresses are only considered PII if you are in the position of being able to decode them to an identity. An anonymous version checking service obviously does not count.
  - davidmurdoch 4y ago
    Playing devils advocate here, but one interpretation of the law is that if any script that obtains the IP addresses could reverse it to an identity, then you are in violation.
    - cmeacham98 4y ago
      Sure, and "one interpretation" of the sky is that it is purple. Or instead of making random interpretations up, we could look at actual cases like Breyer v. Germany, and see how the laws are interpreted in real life.
      - davidmurdoch 4y ago
        And I could interpret your text as Klingon. But that's not reasonable. My interpretation above was reasonable. An IP address alone may not reveal who had visited a site. However, Internet Service Providers have additional data that can link IP addresses to individual people. Although it's unlikely that the two data sets will ever be matched up, it is possible. So IP addresses must be treated as personal data.

worksonmine 4y ago

Depends how hardcore you are about privacy and the claims the tool makes about privacy. Those who claim to collect none are held to a higher standard than others. Even if it's just version number it does leak usage, location and so on. It can have valid uses, but can also be cleverly abused.

alkonaut 4y ago

I don't get it either. It feels like two separate things are confused . 1) "Privacy": I.e. the fear of PII being transmitted or used by a third party 2) "Control": I.e. the fear that the system does something that I didn't ask it for. They are (quite weakly) linked, but they aren't the same things. I'd avoid even discussing them in the same breath for this reason. Saying that checking for updates is a privacy violation just means that everything is lumped together which is a fantastic outcome for software that is actually violating peoples privacy. "Everyone else does it".

zajio1am 4y ago
I do not think that privacy is restricted to PII. For me, computer privacy is as simple as 'any information about what i do with computer that need not leak outside should not leak outside'. PII leakages are just considered more severe than general information leakages, so there is a legislation to handle them.
- alkonaut 4y ago
  So checking for updates without sending any identifier counts, since it transmits the fact you did in fact run the application, and it's not strictly necessary. I can see the point but it seems hard to draw the line for every single feature at the precise point of "does a network connection". For some programs there is quite a grayscale of what's "necessary" (i.e. needed) and what isn't.
  - zajio1am 4y ago
    I agree that in some cases there is a grayscale because what is an important behavior for some users may be unnecessary for others. For example, i could accept that incremental search using Google when text is entered to address bar in a browser could be considered both useful feature and privacy violation depends on user expectations. But i also think there are some clear lines, like if a tool is not expected to use network at all, it should not use it. If a tool is expected to communicate just with explicitly specified hosts, it should not communicate with third-parties, ...

iuafhiuah 4y ago

For platforms where the program is sandboxed and permissions have to be declared, I would frown at the software requesting network access just to check for updates. For example, mobile apps and programs in Flatpaks.

barnabee 4y ago

Yes! If it’s not opt in. Software should not make outgoing connections or accept incoming connections unless requested by the user.

beardog 4y ago
If no software auto updated by default the world would have way worse botnet issues.
charcircuit 4y ago
Why? In a world where the vast majority of computers are internet connected. This is just how software is constructed nowadays. Especially web development which is ahead of the ancient development practises common in libre software. Just open your network tab and see how many requests it makes without asking you.
- redeeman 4y ago
  yes, but all that is user hostile stuff that nobody really wants. modern websites are a cancer that we really quite could do without
  - charcircuit 4y ago
    >yes, but all that is user hostile stuff that nobody really wants. The proof is in the pudding. You claim nobody wants these things yet there are billions of people using these kinds of sites.
    - JohnFen 4y ago
      That vast majority of whom don't understand what's happening. Don't confuse ignorance or apathy with wanting it.
- barnabee 4y ago
  No. My computer having an internet connection is not an automatic invitation for anyone's software to use it. Just because a lot of software sucks doesn't mean it's acceptable or we should lie down and give up. We should work on improving OS capability/permissions models so that apps can't do this by default. In the absence of better protections, I absolutely audit which processes make connections from my machine and uninstall those that make unwanted connections that can't easily be uninstalled (with a small number of unfortunate exceptions where the need to use certain software outweighs the desire to maintain a reasonable system). This doesn't mean no connections ever, it means no conections users don't ask for and no connections that don't provide value to the user. It certainly means no phoning home or stats/crash data connection without explicit opt-in.

jeroenhd 4y ago

Debian is quite an opinionated project and they take matters like these very seriously. Pages like these don't exist to judge packages, they're merely there to make people who do care aware of any risks they might not have heard of, and help them exercise control over their machine if they consider these "risks" not to be worth it. I doubt anyone will really care about version checks, unless that's the only reason your tool needs internet access at all. Maybe if you make it an opt-out rather than an opt-in feature (or don't prompt the user at all), I'd be annoyed by that (but I know others aren't). They're completely unnecessary in packaged Debian software because the Debian people will provide newer versions of your application for their users, so a flag to opt out would be nice. Using this data in a useful way, like adding a message like "new version available" would be confusing, because there is no new version available when you run the system update tool! Personally I'd say it should be possible to disable version checks through build flags if you intend to package software through official repositories. If you intend to do distribution and updates yourself I don't think you should be forced to alter your code if people decide to add your software to their distribution. The burden of removing confusion and making their version stick to their ideals should be on them. It would be nice to cooperate, but I don't think you can be blamed for someone else's redistribution.

m463 4y ago

that's what apt is for.