5 ms·

Ubuntu provides by default an on/off slider in its privacy settings for disabling the display of online search results in the dash[1], BUT I'm not sure if chang

by cs702 13y ago

Ubuntu provides by default an on/off slider in its privacy settings for disabling the display of online search results in the dash[1], BUT I'm not sure if changing that slider to 'off' will also disable the sharing of searches with Canonical's servers. (The language used by the settings app is ambiguous: "When searching on the dash, include online search results - ON/OFF.") Moreover, I don't particularly feel like spending time & effort examining Unity Dash source code to figure out if and how my information might be shared with Canonical and/or other third parties. Canonical should make an unambiguous promise not to transmit any data to anyone, right there on the privacy settings screen, whenever that slider is set to the 'off' position. I would trust such an unambiguous promise. So thank you for submitting this website here -- I've bookmarked it for when I upgrade my desktops from 12.04 LTS to 14.04 LTS next year. -- [1] http://b2b.cbsimg.net/blogs/screenshot-from-2013-03-24-093428.png http://b2b.cbsimg.net/blogs/screenshot-from-2013-03-24-09342... -- Edit: Added second paragraph.

mdeslaur 13y ago
Yes, it's supposed to disable it completely.
- sillysaurus2 13y ago
  supposed to What's with the ambiguity? Does it disable it or not? I feel silly for asking, but the question was about ambiguous language, so the reply was ironic.
  - mdeslaur 13y ago
    Sorry, didn't mean to be ambiguous. It's what it was designed for. If there is a bug that is preventing it from working properly, I would like to know about it so I can make sure it gets fixed.
  - dinkumthinkum 13y ago
    I have to agree with another commenter ... It's not NSA level ambiguity ... It is open source, go check it if you don't believe it! :)
rlpb 13y ago
It's open source. Since it sounds like you won't trust Canonical's claim on this anyway, why don't you take a look, or ask somebody who can, instead of creating fear about it? If it turns out that searches leak out despite the setting, I'm sure you'll hit the front page of HN. Since this hasn't happened, and Canonical have been under considerable scrutiny about it, I think it's safe to say that your conspiracy theory doesn't hold up.
- mdeslaur 13y ago
  If the searches leak out despite the settings, I would like to know about it so I can promptly issue a security update.
  - bronson 13y ago
    Shouldn't you explicitly ask the user's permission before letting the searches leak out?
    - mdeslaur 13y ago
      When someone uses a box marked "search online sources", they probably don't need to be asked "Are you sure you want to search online sources?"
      - fsckin 13y ago
        The default is to leak information. There's no opt-out in the installer.
zanny 13y ago
Why not just use a non-Unity desktop? At this point all 3 major spins of Ubuntu are highly stable and functional.
- D9u 13y ago
  The other versions within the Ubuntu family also connect to Canonical servers. I see connections to "...golem.canonical.com" in Etherape when using Lubuntu 13.10.
nivla 13y ago
This reminds me of "whoopsie" when I first came across it after upgrading my servers to 12.04. Its a program that resides in the ram, automatically homes in the crash reports and would have to be explicitly disabled. At first I din't mind, but after watching it eat through my ram I had it disabled. As far as privacy goes, who knows what those sent in memory dumps might have.
- rlpb 13y ago
  whoopsie doesn't send anything without your permission.
  - nivla 13y ago
    Yes it does, how is it going to ask for my permission in a server environment? It automatically sets "report_crashes=true" under (/etc/default/whoopsie) when Ubuntu is first installed. Here are some resources with more people reporting the same: [1] http://blog.retep.org/2012/07/05/whoopsie-how-to-disable-it-on-ubuntu-12-04-or-mint-13/ http://blog.retep.org/2012/07/05/whoopsie-how-to-disable-it-... [2] http://glog.procrasstination.com/index.php?/archives/47-Ubuntu-What-is-Whoopsie-and-HOWTO-disable-it.html http://glog.procrasstination.com/index.php?/archives/47-Ubun... [3] http://ubuntuforums.org/showthread.php?t=2000108 http://ubuntuforums.org/showthread.php?t=2000108
    - rlpb 13y ago
      It's vestigal on a server. It's there because the server installation and the desktop installation share that component. But since there's no UI for you to approve transmission, currently the crash reports sit on the server awaiting (local) examination and do nothing. All the resources you pointed appear to be people who have found a setting and do not understand that it does not do anything. Like my posts elsewhere on this thread, it's open source. Take a look for yourself, or ask someone who can.
      - nivla 13y ago
        >It's vestigal on a server. Do you have any source for that? If it is vestigial, why would it need to suck up so much ram? Unless I explicitly activate it, what is point of draining the power and filling up the ram by default. Not everyone does and know how to inspect the crash dump, they are mostly useful to the OS manufacturer and the developer of the crashing application. > currently the crash reports sit on the server awaiting (local) examination and do nothing. So Ubuntu (Canonical) doesn't collect any crash data from servers but only from desktops despite having the technology built-in and activated? Highly unlikely.
keithpeter 13y ago
"I've bookmarked it for when I upgrade my desktops from 12.04 LTS to 14.04 LTS next year" Shuttleworth changes his strategy more often than his underpants but I recollect that there was a 'business edition' of 12.04 that cut out all the Web 2.0 integration stuff. Might be worth checking if a similar edition was made for 14.04. This is all I can find now, no ISOs for 12.04 any more http://www.ubuntu.com/content/introducing-ubuntu-business-desktop-remix-desktop-enterprise http://www.ubuntu.com/content/introducing-ubuntu-business-de...

by cs702 13y ago

mdeslaur 13y ago

Yes, it's supposed to disable it completely.

sillysaurus2 13y ago
supposed to What's with the ambiguity? Does it disable it or not? I feel silly for asking, but the question was about ambiguous language, so the reply was ironic.
- mdeslaur 13y ago
  Sorry, didn't mean to be ambiguous. It's what it was designed for. If there is a bug that is preventing it from working properly, I would like to know about it so I can make sure it gets fixed.
- dinkumthinkum 13y ago
  I have to agree with another commenter ... It's not NSA level ambiguity ... It is open source, go check it if you don't believe it! :)

rlpb 13y ago

It's open source. Since it sounds like you won't trust Canonical's claim on this anyway, why don't you take a look, or ask somebody who can, instead of creating fear about it? If it turns out that searches leak out despite the setting, I'm sure you'll hit the front page of HN. Since this hasn't happened, and Canonical have been under considerable scrutiny about it, I think it's safe to say that your conspiracy theory doesn't hold up.

mdeslaur 13y ago
If the searches leak out despite the settings, I would like to know about it so I can promptly issue a security update.
- bronson 13y ago
  Shouldn't you explicitly ask the user's permission before letting the searches leak out?
  - mdeslaur 13y ago
    When someone uses a box marked "search online sources", they probably don't need to be asked "Are you sure you want to search online sources?"
    - fsckin 13y ago
      The default is to leak information. There's no opt-out in the installer.

zanny 13y ago

Why not just use a non-Unity desktop? At this point all 3 major spins of Ubuntu are highly stable and functional.

D9u 13y ago
The other versions within the Ubuntu family also connect to Canonical servers. I see connections to "...golem.canonical.com" in Etherape when using Lubuntu 13.10.

nivla 13y ago

This reminds me of "whoopsie" when I first came across it after upgrading my servers to 12.04. Its a program that resides in the ram, automatically homes in the crash reports and would have to be explicitly disabled. At first I din't mind, but after watching it eat through my ram I had it disabled. As far as privacy goes, who knows what those sent in memory dumps might have.

rlpb 13y ago
whoopsie doesn't send anything without your permission.
- nivla 13y ago
  Yes it does, how is it going to ask for my permission in a server environment? It automatically sets "report_crashes=true" under (/etc/default/whoopsie) when Ubuntu is first installed. Here are some resources with more people reporting the same: [1] http://blog.retep.org/2012/07/05/whoopsie-how-to-disable-it-on-ubuntu-12-04-or-mint-13/ http://blog.retep.org/2012/07/05/whoopsie-how-to-disable-it-... [2] http://glog.procrasstination.com/index.php?/archives/47-Ubuntu-What-is-Whoopsie-and-HOWTO-disable-it.html http://glog.procrasstination.com/index.php?/archives/47-Ubun... [3] http://ubuntuforums.org/showthread.php?t=2000108 http://ubuntuforums.org/showthread.php?t=2000108
  - rlpb 13y ago
    It's vestigal on a server. It's there because the server installation and the desktop installation share that component. But since there's no UI for you to approve transmission, currently the crash reports sit on the server awaiting (local) examination and do nothing. All the resources you pointed appear to be people who have found a setting and do not understand that it does not do anything. Like my posts elsewhere on this thread, it's open source. Take a look for yourself, or ask someone who can.
    - nivla 13y ago
      >It's vestigal on a server. Do you have any source for that? If it is vestigial, why would it need to suck up so much ram? Unless I explicitly activate it, what is point of draining the power and filling up the ram by default. Not everyone does and know how to inspect the crash dump, they are mostly useful to the OS manufacturer and the developer of the crashing application. > currently the crash reports sit on the server awaiting (local) examination and do nothing. So Ubuntu (Canonical) doesn't collect any crash data from servers but only from desktops despite having the technology built-in and activated? Highly unlikely.

keithpeter 13y ago

"I've bookmarked it for when I upgrade my desktops from 12.04 LTS to 14.04 LTS next year" Shuttleworth changes his strategy more often than his underpants but I recollect that there was a 'business edition' of 12.04 that cut out all the Web 2.0 integration stuff. Might be worth checking if a similar edition was made for 14.04. This is all I can find now, no ISOs for 12.04 any more http://www.ubuntu.com/content/introducing-ubuntu-business-desktop-remix-desktop-enterprise http://www.ubuntu.com/content/introducing-ubuntu-business-de...