[deleted]
Why does Debian change software?
121–130 of 210 posts
Re: Why does Debian change software?
#122Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.
This is one of my favorite things about Debian.
Re: Why does Debian change software?
#123Earlier quoted context omitted.
This is unfortunately not part of Debian Policy yet, and there are still lots of privacy issues of different severities in Debian. https://wiki.debian.org/PrivacyIssues
I don't use Debian for servers nor personal computers anymore, but the fact that they themselves host a page explaining potential privacy issues with Debian makes me trust them a lot more, and feel safer recommending it to others when it fits.
Thats just a wiki page, written by myself and a bunch of other Debian members/contributors. Don't read too much into it :)
Re: Why does Debian change software?
#124Earlier quoted context omitted.
Patching out privacy issues isn't in Debian Policy, its just part of the culture of Debian, but there are still unfixed/unfound issues too, it is best to run opensnitch to mitigate some of those problems. https://wiki.debian.org/PrivacyIssues
Thanks for the link, that'll come in very useful. > it is best to run opensnitch to mitigate some of those problems Opensnitch is a nice recommendation for someone concerned about protecting their workstation(s); for me, I'm more concerned about the tens of VMs and containers running hundreds of pieces of software that are always-on in my Homelab, a privacy conscious OS is a good foundation, and there are many more l…
Homelabs are usually running software not from a distro too, so potentially more privacy issues there too. Firewalling outgoing networking, along with a filtering SOCKS proxy like privoxy might be a good start.
Re: Why does Debian change software?
#125Earlier quoted context omitted.
> Telemetry contains personal data by definition. No. Please look up the definition of "telemetry" and "personal data". The latter always refers to an identifiable person.
Virtually all anonymization schemes are reversible, so “identifiable” isn’t carrying any weight in your definition. “Person” isn’t either, unless the software knows for sure it’s not being uses by a person.
By your definition, all data is PII.
Re: Why does Debian change software?
#126Earlier quoted context omitted.
No they don't. The formulation in TFA is a bit too generic - Debian will usually not remove any code that "calls home". There are perfectly valid reasons for software to "phone home", and yes, that includes telemetry. In fact, Debian has its own "telemetry" system: https://popcon.debian.org/ Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry,…
> Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data Telemetry contains personal data by definition . It just varies how sensitive & how it's used. Also it's been shown repeatedly that 'anonymized' is shaky ground. In that popcon example, I'd expect some Debian-run server to collect a minimum of data, aggregate, and Debian maintainers using it to decide where to focus effort…
The ongoing problem with popcon is that it's known not to be accurate, but since it's the data that's available, people make decisions based on it.
popcon is least likely to be turned on by:
- organizations with any kind of sensible privacy policy (which includes almost everyone running more than a handful of machines)
- individuals concerned about privacy
popcon is most likely to be turned on by Debian developers, and people new to Debian who have just installed it for the first time.
Re: Why does Debian change software?
#127Earlier quoted context omitted.
> jwz however is also off the rails with entitlement. Always remember to not link to his site from HN because you'll get a testicle NSFW image when you click on a link to his site from HN. dang used to have rel=noreferrer on outgoing links, but that led to even more drama with other people... Some people in the FOSS scene just love to stir drama, and jwz is far from the only one. Another person with such issues IMHO…
> Always remember to not link to his site from HN because you'll get a testicle NSFW image What's his reason for targeting HN users this way?
The testicle speaks for itself [1]. He has held a serious political grudge against VC way over a decade back [2], the earliest mention of the JWZ testicles appearing on HN that I could find is over 9 years old [3].
[1] NSFW https://imgur.com/32R3qLv
[2] (Redirects to NSFW, so open in incognito or you'll get the testicles) https://www.jwz.org/blog/2011/11/watch-a-vc-use-my-name-to-s...
Re: Why does Debian change software?
#128Earlier quoted context omitted.
The patch was posted on the wrong OpenSSL mailing list, and frankly that particular Debian bug was worse than anything else we've seen even from OpenSSL. Last I knew Debian didn't do dedicated security review of patches to security-critical software, which is normal practice for other distributions.
On the other hand it exposed that OpenSSL was depending on Undefined Behavior always working predictably. Something as simple as a GCC update could have had the same effect across far more systems than just Debian, with no patch to OpenSSL itself.
> On the other hand it exposed that OpenSSL was depending on Undefined Behavior always working predictably. Something as simple as a GCC update could have had the same effect across far more systems than just Debian, with no patch to OpenSSL itself.
No it wasn't. It was reading (and xoring into the randomness that would become the key being generated) uninitialised char values from an array whose address was taken, that results in unspecified values not undefined behaviour.
Re: Why does Debian change software?
#129Earlier quoted context omitted.
> Telemetry contains personal data by definition Why it has to include PII by definition ? I'd say DNF Counting ( https://github.com/fedora-infra/mirrors-countme ) should be considered "telemetry", yet it doesn't seem to collect any personal data, at least by what I understand telemetry and personal data to mean. I'm guessing that you'd either have to be able to argue that DNF Counting isn't telemetry, or that it con…
IPs are PII. You hit the server, and your anonymity is breached.
Yes, so the vendor must not store it. Something along those lines is usually said in the privacy policy. If you don't trust the vendor to do that, then do not opt-in to sending data, or even better, do not use the vendor's software at all.
Re: Why does Debian change software?
#130Debian will remove code that “calls home” or tries to update software in a way that bypasses the Debian packaging system. Thank god. I'm so happy that such a distro exists.
This is no longer true. Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox. And there's the inclusion of non-Free software in the base install, which is completely against the Debian Social Contract. The Debian Project drastically changed when they decided to allow Ubuntu to dictate their release schedule. What used to be a…
>Most obvious example is Firefox. The Debian Project allows Firefox to update outside the packaging system, automatically, at the whim of Firefox.
It seems likely that you personally chose to install a flatpak or tar.gz version probably because you are running an older no longer supported version of Debian.
>These days, the only way to avoid that (crashes) is...
Running older unsupported versions with known never to be fixed security holes isn't good advice nor is ripping out the plumbing. Its almost never a great idea to start ripping out the floorboards to get at the pipes.
Pipewire seems pretty stable and if you really desire something more minimal it's better to start with something minimal than stripping something down.
Void is nice on this front for instance.