6 ms·

Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that

• guappa 1y ago
  It's not guaranteed that they manage to catch all the software that does this though :D
  • phoe-krk 1y ago
    Any such leftover behavior is going to be a reportable and fixable bug then.
    • guappa 1y ago
      I'm not sure it's explicitly in the policy or if any team can decide what to do…
      • pabs3 1y ago
        It isn't in policy yet no. https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues
      • gosub100 1y ago
        It's not guaranteed that policies enforce every possible case though.
  • hulitu 1y ago
    > It's not guaranteed that they manage to catch all the software that does this though :D It is really hard to run netstat. Or tcpdump. /s
• sshine 1y ago
  This policy is missing from nixpkgs, although there is a similar policy for the build process for technical reasons. So I can add spotify or signal-desktop to NixOS via nixpkgs, and they won’t succeed at updating themselves. But they might try, which would be a violation of Debian’s guidelines. It’s a tough line — I like modern, commercial software that depends on some service architecture. And I can be sure it will be sort of broken in 10-15 years because the company went bust or changed the terms of using their service. So I appreciate the principles upheld by less easily excited people who care about the long term health of the package system.
  • mort96 1y ago
    In the process of trying to update, Spotify on NixOS will likely display some big error message about how it's unable to install updates, which results in a pretty bad user experience when everything is actually working as intended. It seems fair to patch software to remove such error messages.
  • jchw 1y ago
    To be fair, we (Nixpkgs maintainers) do remove or disable features that phone home sometimes even though it's not policy. That said, it would be nice if it was policy. Definitely was discussed before (most recently after the devbox thing I guess.)
    • sshine 1y ago
      Discord downloads stuff every single time I start it. So there is definitely not a policy to remove this behaviour. And yes, good point, this was indeed discussed when devbox enabled AI training by default. It somehow seems like there is more than one category of phoning home at play here, since it is obviously tolerated in other cases.
      • jchw 1y ago
        What I mean is, it definitely isn't explicit policy to remove features that phone home; but, it is sometimes still done at the package maintainer's discretion. For things that are unfree all bets are off. (Removing or interfering with such code may be against the license.)
• pabs3 1y ago
  This is unfortunately not part of Debian Policy yet, and there are still lots of privacy issues of different severities in Debian. https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues
  • diggan 1y ago
    I don't use Debian for servers nor personal computers anymore, but the fact that they themselves host a page explaining potential privacy issues with Debian makes me trust them a lot more, and feel safer recommending it to others when it fits.
    • pabs3 1y ago
      Thats just a wiki page, written by myself and a bunch of other Debian members/contributors. Don't read too much into it :)
    • keysdev 1y ago
      What are you using instead now? Nixos?
      • diggan 1y ago
        Yeah, NixOS for all servers (homelab + dedicated remote ones) and Arch on desktop.
        • spookie 1y ago
          Arch is a minefield on this regard tbh
          • diggan 1y ago
            To be even more honest, it is what you make of it ¯\_(ツ)_/¯
            • 1y ago
• pabs3 1y ago
  I'm glad that opensnitch is available in Debian trixie too, to mitigate the issues that Debian has not found yet.
• vaporary 1y ago
  I was extremely disappointed to recently learn that visidata(1) phones home, and that this functionality has not been disabled in the Debian package, despite many people requesting its removal: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001647 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001647 https://github.com/saulpw/visidata/discussions/940 https://github.com/saulpw/visidata/discussions/940
  • hedora 1y ago
    The maintainer’s responses in that thread are really frustrating. They just keep describing the bug as though the package’s behavior is acceptable. I wonder what debian’s process is for dealing with such maintainers. I hope they make “no phone home” actual policy soon.
    • ryandrake 1y ago
      Infuriating. The developer is just making excuses and refusing to address the users' actual concern. And why are they phoning home in the first place? What is this critical use case that requires this intrusion? "This daily count of users is what keeps us working on the project, because otherwise we have feel like we are coding into a void." So, they wrote code to phone home (by default) and then digging in and defending it... just for their feelings? You've got to be kidding me!
      • grayhatter 1y ago
        > So, they wrote code to phone home (by default) and then digging in and defending it... just for their feelings? You've got to be kidding me! Is that better or worse than phoning home to serve ads? Also, if feels misleading to me to call fetching a motd phoning home. You know Ubuntu does this too right? That feels more worthy of outrage than this. If someone tells me, this software phones home, and it's not transmitting anything other than a ping; kinda feels like they're lying to me about what it's actually doing. I'm not upset by the author wanting a bit of human connection to the people who enjoy his software. I empathize with the desire to see people enjoy the stuff I've made. Is it a privacy risk? Perhaps, but it's not even on the top 1k that I see daily. There's more important windmills to tilt at. But... if you really just wanna be outraged; I recently wrote a DNS server that I use as the default for my home system. Currently It prints every request made, you might wanna try something like that. If you're that upset about this, you're gonna be blown away by what else is going on you didn't even know about.... and that's just dns queries, it's not even the telemetry getting sent!
• lqet 1y ago
  One of the many reasons I switched from Ubuntu to Debian 2 years ago. Another reason was snap.
  • master_crab 1y ago
    Yup. Snap is emblematic of all the complexity Canonical bakes into Ubuntu.
    • hedora 1y ago
      That and the whole systemd stack. Canonical employees had enough votes to force upstream it into debian. I switched to devuan. It’s great, but it sucks that the community split over something so needlessly destructive.
  • beerandt 1y ago
    Between snap and having completely different network implementations between "desktop" and "server" versions really made me fall back down the learning curve of nix. Especially since I was novice at best before the systemd thing, and my Ubuntu dive involved trying to navigate all 3 of these pretty drastic changes at once (oh yea and throw containers on top of that). I went into it with the expectation that it was going to piss me off, and boy did it easily exceeded that threshold.
• pjmlp 1y ago
  So they have their own Go fork? Just one possible example, among many others that have telemetry code into them.
  • layer8 1y ago
    “Will remove” means that it’s one of the typical/accepted reasons why patches are applied by Debian maintainers, as in meaning 4 here [0], not that there is a guarantee of all telemetry being removed. [0] https://www.merriam-webster.com/dictionary/will https://www.merriam-webster.com/dictionary/will
  • deng 1y ago
    No they don't. The formulation in TFA is a bit too generic - Debian will usually not remove any code that "calls home". There are perfectly valid reasons for software to "phone home", and yes, that includes telemetry. In fact, Debian has its own "telemetry" system: https://popcon.debian.org/ https://popcon.debian.org/ Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry, so there's no need for a fork.
    • RetroTechie 1y ago
      > Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data Telemetry contains personal data by definition. It just varies how sensitive & how it's used. Also it's been shown repeatedly that 'anonymized' is shaky ground. In that popcon example, I'd expect some Debian-run server to collect a minimum of data, aggregate, and Debian maintainers using it to decide where to focus effort w/ respect to integrating packages, keeping up with security updates, etc. Usually ok. For commercial software, I'd expect telemetry to slurp whatever is legally allowed / stays under users' radar (take your pick ;), vendor keeping datapoints tied to unique IDs, and sell data on "groups of interest" to the highest bidder. Not ok. Personal preference: eg. a crash report: "report" or "skip" (default = skip), with a checkbox for "don't ask again". That way it's no effort to provide vendor with helpful info, and just as easy to have it get out of users' way. It's annoying the degree to which vendors keep ignoring the above (even for paying customers), given how simple it is.
• exiguus 1y ago
  Most good stuffed Distros do this. For example SUSE recently banned a package because of "calling home" e.g. did side-leading. https://security.opensuse.org/2025/05/07/deepin-desktop-removal.html https://security.opensuse.org/2025/05/07/deepin-desktop-remo... Debian indeed does this. In release FF has disabled telemetry: https://wiki.debian.org/Firefox https://wiki.debian.org/Firefox
  • winternewt 1y ago
    I wouldn't think the Firefox license allows them to do that. I thought only binaries built by Mozilla could use the FF brand.
    • rmccue 1y ago
      Indeed, Mozilla only recently allowed Debian to use the brand for their modified version: https://en.wikipedia.org/wiki/Debian%E2%80%93Mozilla_trademark_dispute https://en.wikipedia.org/wiki/Debian%E2%80%93Mozilla_tradema...
      • jefftk 1y ago
        Recently? It was almost a decade ago: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815006 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815006
    • akdev1l 1y ago
      That’s the reason for a while we had IceWeasel
  • gus_ 1y ago
    Unfortunately that is not entirely true. For example, when closing firefox on OpenSUSE Leap 15.6, "pingsender" is launched to collect telemetry: https://imgur.com/a/k3Nnbbj https://imgur.com/a/k3Nnbbj It has been there for years. It is also on other distros.
    • diggan 1y ago
• mystified5016 1y ago
  God, I wish someone would do this to discord already. I'm so sick of updating it through my package manager every other day only for discord to then download its own updates anyway. Yes, I've disabled the update check. No, it doesn't solve the problem.
• BarbaryCoast 1y ago
  This is no longer true. Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox. And there's the inclusion of non-Free software in the base install, which is completely against the Debian Social Contract. The Debian Project drastically changed when they decided to allow Ubuntu to dictate their release schedule. What used to be a distro by sysadmins for sysadmins, and which prized stability over timeliness has been overtaken by Ubuntu and the Freedesktop.Org people. I've been running Debian since version 3, and I used to go _years_ between crashes. These days, the only way to avoid that is to 1) rip out all the Freedesktop.Org code (pulseaudio, udisks2, etc.), and 2) stick with Debian 9 or lower.
  • officeplant 1y ago
    Long time Debian fan, current Devuan user. I'm sure it still has it's problems, but it feels nice and stable, especially on older hardware that is struggling with the times. (Thinkpad R61i w/core2duo T8100 swapped in and middleton bios)
  • bayindirh 1y ago
    > Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox. No, it's not. Stable ships ESR which has its update mechanism is disabled. Same for Testing/Unstable. It follows standard releases, but autoupdate is disabled. Even Official Firefox Package for Debian from Mozilla has its auto-updates disabled and you get updates from the repository. Only auto-updating version is the .tar.gz version which you extract to your home folder. This is plain FUD. Moreover: Debian doesn't ship pulseaudio anymore. It's pipewire since forever. Many people didn't notice this, it was that smooth. Ubuntu's changes are not allowed to permeate without proper rigor (I follow debian-devel), and it's still released when it's ready. Ubuntu follows Debian Unstable, and Unstable suite is a rolling release, and they can snapshot it and start working on it whenever they want. I'm using Debian since version 3 too, and I still reboot or tend my system only at kernel changes. It's way snappier w.r.t. Ubuntu with the same configuration for the same tasks, and is the Debian we all know and like (maybe sans systemd. I'll not open that can of worms).
• JohnFen 1y ago
  This is one of my favorite things about Debian.
• binaryturtle 1y ago
  Why can't I get GNOME stop calling home? (on a Debian installation) Each time I fire up my Debian VM with GNOME here on my OSX host system Little Snitch pops up because some weird connection to a GNOME web endpoint. One major pet peeve of mine.
  • 28304283409234 1y ago
    Please send patches.
  • LtWorf 1y ago
    You can ask the gnome team if they'd accept a patch. They might be of the idea that patching stuff out is bad.