4 ms·

There are numerous privacy issues in distros, some known, most probably unknown, some examples from Debian: https://wiki.debian.org/PrivacyIssues https://wiki.

by pabs3 1y ago

There are numerous privacy issues in distros, some known, most probably unknown, some examples from Debian: https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues Luckily there are things like opensnitch that can block some of these issues: https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch

fsflover 1y ago
Are you saying it's an ordinary behavior? There's nothing coming close in your links, especially in Debian.
account42 1y ago
Your link is about privacy issues in upstream software that Debian hasn't sufficiently worked around yet. The main advantage of the Distro model (as opposed to developer-maintained package ecosystems) is exactly that there is someone protecting you from questionable software "features".
- GrayShade 1y ago
  Who protects you when the packagers decide to trust a shady CA (adding it to the root store) because it's used by the distro's infra?
  - account42 1y ago
    Is this supposed to be some kind of gotcha argument? Against what?
    - GrayShade 1y ago
      Not exactly the same thing, but see https://en.wikipedia.org/wiki/GNU_IceCat#Additional_security_and_privacy_features https://en.wikipedia.org/wiki/GNU_IceCat#Additional_security....
- amiga386 1y ago
  I don't think Debian intentionally shields you from privacy-invading software. Other distros may differ on this point. Debian does not mandate anything about privacy in its Policy Manual (which are the standards for selecting and packaging software that maintainers must adhere to): https://www.debian.org/doc/debian-policy/search.html?q=privacy&check_keywords=yes&area=default https://www.debian.org/doc/debian-policy/search.html?q=priva... There's also no insistence on privacy in the Debian Social Contract or DFSG (not that these would be appropriate places for it, they're mainly about licensing)
  - fsflover 1y ago
    > I don't think Debian intentionally shields you from privacy-invading software. Don't they change the Firefox defaults for more privacy?
    - pabs3 1y ago
      They do indeed, probably other packages have patches too.
  - pabs3 1y ago
    > I don't think Debian intentionally shields you from privacy-invading software There is a culture of valuing privacy though, including patching out privacy issues. Especially since a lot of Debian folks are from Europe, with corresponding GDPR knowledge. I know that the lintian warnings pointing out privacy issues in HTML documentation do get a lot of patches. Also, opensnitch is packaged as a mitigation. You are right about the policy problem, Debian really needs to do something about that. There is at least a privacy policy for Debian services. https://www.debian.org/legal/privacy https://www.debian.org/legal/privacy
- pabs3 1y ago
  Agreed, but it is definitely not enough, which is why some Debian folks packaged opensnitch.
graemep 1y ago
That is interesting. There is nothing in that list anything like as bad as this. The next worst is Chromium which is no surprise.

by pabs3 1y ago

fsflover 1y ago

Are you saying it's an ordinary behavior? There's nothing coming close in your links, especially in Debian.

account42 1y ago

Your link is about privacy issues in upstream software that Debian hasn't sufficiently worked around yet. The main advantage of the Distro model (as opposed to developer-maintained package ecosystems) is exactly that there is someone protecting you from questionable software "features".

GrayShade 1y ago
Who protects you when the packagers decide to trust a shady CA (adding it to the root store) because it's used by the distro's infra?
- account42 1y ago
  Is this supposed to be some kind of gotcha argument? Against what?
  - GrayShade 1y ago
    Not exactly the same thing, but see https://en.wikipedia.org/wiki/GNU_IceCat#Additional_security_and_privacy_features https://en.wikipedia.org/wiki/GNU_IceCat#Additional_security....
amiga386 1y ago
I don't think Debian intentionally shields you from privacy-invading software. Other distros may differ on this point. Debian does not mandate anything about privacy in its Policy Manual (which are the standards for selecting and packaging software that maintainers must adhere to): https://www.debian.org/doc/debian-policy/search.html?q=privacy&check_keywords=yes&area=default https://www.debian.org/doc/debian-policy/search.html?q=priva... There's also no insistence on privacy in the Debian Social Contract or DFSG (not that these would be appropriate places for it, they're mainly about licensing)
- fsflover 1y ago
  > I don't think Debian intentionally shields you from privacy-invading software. Don't they change the Firefox defaults for more privacy?
  - pabs3 1y ago
    They do indeed, probably other packages have patches too.
- pabs3 1y ago
  > I don't think Debian intentionally shields you from privacy-invading software There is a culture of valuing privacy though, including patching out privacy issues. Especially since a lot of Debian folks are from Europe, with corresponding GDPR knowledge. I know that the lintian warnings pointing out privacy issues in HTML documentation do get a lot of patches. Also, opensnitch is packaged as a mitigation. You are right about the policy problem, Debian really needs to do something about that. There is at least a privacy policy for Debian services. https://www.debian.org/legal/privacy https://www.debian.org/legal/privacy
pabs3 1y ago
Agreed, but it is definitely not enough, which is why some Debian folks packaged opensnitch.

graemep 1y ago

That is interesting. There is nothing in that list anything like as bad as this. The next worst is Chromium which is no surprise.