4 ms·

Note that this software unethically phones home with your usage data without your consent. Such opt-out, on-by-default spyware exfiltrates your data silently.

by sneak 3y ago

Note that this software unethically phones home with your usage data without your consent. Such opt-out, on-by-default spyware exfiltrates your data silently. They claim it’s anonymous, but that’s false as it includes your client IP address, which frequently maps directly to physical location. You have to patch it out, because even if you try to turn it off, it still phones home in violation of your expressed wishes: https://www.ory.sh/docs/ecosystem/sqa https://www.ory.sh/docs/ecosystem/sqa > Disabling telemetry doesn't have any downsides, except for us not being able to improve the project. Note that Ory always sends minimal ping with version information once on start up. Why do people feel entitled to spy on users of the software they gave away? I would never, ever even consider using their SaaS, or that of any other company these founders ever run. https://github.com/ory/x/blame/master/metricsx/metrics.go https://github.com/ory/x/blame/master/metricsx/metrics.go Kevin Goslar, formerly of Google (per his GitHub profile), is the one that committed this code (per the history publicly available on GitHub). It is somewhat unsurprising that free software at his new startup follows the same ethical framework regarding nonconsensual surveillance as the world’s largest advertising surveillance company where he used to work. The trend of open source spyware is increasing. We need to be more vigilant both about the presence of spyware in open source software, as well as being mindful of the people who engage in such unethical practices. (For instance, Mattermost is another offender in this category.)

vinckr 3y ago
If you look in the source code for this software which is provided for everyone to see you will realize that Kevin Goslar is entirely innocent of this heinous crime. He merely added the copyright headers to each file. You misunderstand the purpose of the SQA telemetry. There are some reasons for SQA telemetry listed in the doc you posted: - Be able to say how many production deployments exist. - Understand which features are used and how. - Understand how much throughput deployments handle. - Evaluate how frequently specific features are used. - Detect issues introduced by new features (such as a buggy releases). - Identify problems at scale (such as slow endpoints). - Understand which versions are deployed. If you have concerns about privacy as you rightly noted you can turn it off with a simple flag (--sqa-opt-out) and if you don't like the version ping you can block in your network. Hundreds of users are running Ory Kratos without any telemetry sent without any extra work. So if this is a plot to produce open source spyware it's not the best.
- lmeyerov 3y ago
  This practice being considered acceptable has been a nightmare - we had OSS libraries add spying later, change their APIs for disabling it, etc. When it's a nested dependency, even worse. Now and then we run our stack with mitm monitor just to sniff out this dangerous crap. More recently, we are seeing it in ML libraries. For a security vendor to do it is extra bad because they can't claim not understanding why it's bad and often illegal.
- sneak 3y ago
  Developers are not entitled to knowledge of what software runs or does not run on machines that do not belong to them. To co-opt those machines without the consent of the user or device owner means your software is malware. To do so even after the user has explicitly opted out is even worse, and in my opinion, is criminal behavior. With consent, it’s fine. Without consent, it is the same as any other spying.
rstat1 3y ago
If this is indeed "spyware" (which it isn't) they sure do a poor job of hiding it from you. Going so far as to tell you exactly what sort of harmless data they're collecting and even putting the code for doing so in a public repo, and then even letting you opt out of it. Doesn't sound like any kind of spyware I've ever seen.

by sneak 3y ago

vinckr 3y ago

If you look in the source code for this software which is provided for everyone to see you will realize that Kevin Goslar is entirely innocent of this heinous crime. He merely added the copyright headers to each file. You misunderstand the purpose of the SQA telemetry. There are some reasons for SQA telemetry listed in the doc you posted: - Be able to say how many production deployments exist. - Understand which features are used and how. - Understand how much throughput deployments handle. - Evaluate how frequently specific features are used. - Detect issues introduced by new features (such as a buggy releases). - Identify problems at scale (such as slow endpoints). - Understand which versions are deployed. If you have concerns about privacy as you rightly noted you can turn it off with a simple flag (--sqa-opt-out) and if you don't like the version ping you can block in your network. Hundreds of users are running Ory Kratos without any telemetry sent without any extra work. So if this is a plot to produce open source spyware it's not the best.

lmeyerov 3y ago
This practice being considered acceptable has been a nightmare - we had OSS libraries add spying later, change their APIs for disabling it, etc. When it's a nested dependency, even worse. Now and then we run our stack with mitm monitor just to sniff out this dangerous crap. More recently, we are seeing it in ML libraries. For a security vendor to do it is extra bad because they can't claim not understanding why it's bad and often illegal.
sneak 3y ago
Developers are not entitled to knowledge of what software runs or does not run on machines that do not belong to them. To co-opt those machines without the consent of the user or device owner means your software is malware. To do so even after the user has explicitly opted out is even worse, and in my opinion, is criminal behavior. With consent, it’s fine. Without consent, it is the same as any other spying.

rstat1 3y ago

If this is indeed "spyware" (which it isn't) they sure do a poor job of hiding it from you. Going so far as to tell you exactly what sort of harmless data they're collecting and even putting the code for doing so in a public repo, and then even letting you opt out of it. Doesn't sound like any kind of spyware I've ever seen.