5 ms·

Thanks for your feedback. We'll try to add more transparency. The calling home is for software updates and it shows up on the graph, and GlassWire can even bl

Thanks for your feedback. We'll try to add more transparency. The calling home is for software updates and it shows up on the graph, and GlassWire can even block itself.

Sir_Cmpwn 12y ago
That may be the case, but it's still not acceptable in my opinion. Calling home to fetch a new database of malicious hosts and such is fine, but calling home for analytics is not okay. At the very least, clearly disclose it and make it easy to opt out.
- specialk 12y ago
  Out of curiosity, do you have any security concerns about calling home for analytic or is it just you would prefer the privacy of not having your usage tracked?
  - Sir_Cmpwn 12y ago
    It's mostly privacy concerns, but also the fact that you use this software at all can disclose some interesting information to eavesdropping attackers. Most worrisome is just that it's not very well disclosed - most users just don't know it's happening, and it's not very well justified.
    - sbarre 12y ago
      How can you say "most users don't know it's happening" when it's the first thing you see in the graph when you load the application? We got your initial point.. I think you're just grinding metal at this point.. Ease down.. ease down...
      - Sir_Cmpwn 12y ago
        I don't see anywhere that it discloses what is being sent, just that it's sending something. Did I miss something?
  - lucb1e 12y ago
    If it's opt-in, I enable it. If it's opt-out, I disable it. For me it's a matter of principle. That people politely ask is both an indication of trustworthiness and how I prefer things to be, so I try to help by enabling it. It also depends on the way they ask. Mozilla Firefox for Android tells me that I should choose what I share, enabling crash reports and disabling telemetry by default. Even though the crash report is technically opt-out, they ask me in clear terms. I like that.
- johnduhart 12y ago
  > but calling home for analytics is not okay It's like you didn't even read what was written.
zdrummond 12y ago
Update channels are very hard to secure and is a huge opportunity to take ownership of the software (and from it, the machine). For an example, check out the Defcon 22 talk Hack All the Things[1], page ~61. NTV200-100NAS owned through unsigned updates.... [1] http://download.gtvhacker.com/file/generic/GTVHacker-DEFCON22.pdf http://download.gtvhacker.com/file/generic/GTVHacker-DEFCON2...
- greenwalls 12y ago
  Thank you. We will check it out in detail.
stfnfhrmnn 12y ago
Another simple fix: tell us who you are. The contact page is woefully generic and anonymous. Glasswire appears to be a company, more than one person. Where are you based? What's your background? Funding?
- mbrownnyc 12y ago
  I did a corporate search and tracked the owner: ANTON BONDAR. Also affiliated with ManyCam.

Thanks for your feedback. We'll try to add more transparency. The calling home is for software updates and it shows up on the graph, and GlassWire can even block itself.

Sir_Cmpwn 12y ago

That may be the case, but it's still not acceptable in my opinion. Calling home to fetch a new database of malicious hosts and such is fine, but calling home for analytics is not okay. At the very least, clearly disclose it and make it easy to opt out.

specialk 12y ago
Out of curiosity, do you have any security concerns about calling home for analytic or is it just you would prefer the privacy of not having your usage tracked?
- Sir_Cmpwn 12y ago
  It's mostly privacy concerns, but also the fact that you use this software at all can disclose some interesting information to eavesdropping attackers. Most worrisome is just that it's not very well disclosed - most users just don't know it's happening, and it's not very well justified.
  - sbarre 12y ago
    How can you say "most users don't know it's happening" when it's the first thing you see in the graph when you load the application? We got your initial point.. I think you're just grinding metal at this point.. Ease down.. ease down...
    - Sir_Cmpwn 12y ago
      I don't see anywhere that it discloses what is being sent, just that it's sending something. Did I miss something?
- lucb1e 12y ago
  If it's opt-in, I enable it. If it's opt-out, I disable it. For me it's a matter of principle. That people politely ask is both an indication of trustworthiness and how I prefer things to be, so I try to help by enabling it. It also depends on the way they ask. Mozilla Firefox for Android tells me that I should choose what I share, enabling crash reports and disabling telemetry by default. Even though the crash report is technically opt-out, they ask me in clear terms. I like that.
johnduhart 12y ago
> but calling home for analytics is not okay It's like you didn't even read what was written.

zdrummond 12y ago

Update channels are very hard to secure and is a huge opportunity to take ownership of the software (and from it, the machine). For an example, check out the Defcon 22 talk Hack All the Things[1], page ~61. NTV200-100NAS owned through unsigned updates.... [1] http://download.gtvhacker.com/file/generic/GTVHacker-DEFCON22.pdf http://download.gtvhacker.com/file/generic/GTVHacker-DEFCON2...

greenwalls 12y ago
Thank you. We will check it out in detail.

stfnfhrmnn 12y ago

Another simple fix: tell us who you are. The contact page is woefully generic and anonymous. Glasswire appears to be a company, more than one person. Where are you based? What's your background? Funding?

mbrownnyc 12y ago
I did a corporate search and tracked the owner: ANTON BONDAR. Also affiliated with ManyCam.