81–90 of 210 posts
The counterpoint would be the Debian-specific loss of private key entropy [1] back in 2008. While this is now a very ancient bug, the obvious follow-up question would be: how does Debian prevent or mitigate such incidents today? Was there any later (non-security, of course) incident of similar nature? [1] https://en.wikipedia.org/wiki/OpenSSL#Predictable_private_ke...
Earlier quoted context omitted.
Since this is the FOSS world, you are of course free to eschew distributions. But: > it's effectively nothing but the "app store" model, having an activist distributor insert themselves between the user and software. is just factually wrong. Distributions like Debian try to make a coherent operating system from tens of thousands of pieces of independently developed software. It's fine not to like that. It's fine to i…
I'm using Arch and, AFAIK, it tries to use upstream code as much as possible. That's much better model IMO.
I'm just trying to correct the notion that somehow a distro is an "app store" that "inserts itself" between the software and its users. A distribution is an attempt to make lots of disparate pieces of software "work together", at varying degrees. Varying degrees of modification may or may not factor into that. On one extreme is perhaps just a collection of entirely disjoint software, without anything attaching those pieces of software together. On the other extreme is perhaps something like the BSDs. Arch and Debian sit somewhere in between, at either side.
Thoughtful people can certainly disagree about what the correct degree of "work together" or modification is.
Earlier quoted context omitted.
So they have their own Go fork? Just one possible example, among many others that have telemetry code into them.
No they don't. The formulation in TFA is a bit too generic - Debian will usually not remove any code that "calls home". There are perfectly valid reasons for software to "phone home", and yes, that includes telemetry. In fact, Debian has its own "telemetry" system: https://popcon.debian.org/ Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry,…
Telemetry contains personal data by definition. It just varies how sensitive & how it's used. Also it's been shown repeatedly that 'anonymized' is shaky ground.
In that popcon example, I'd expect some Debian-run server to collect a minimum of data, aggregate, and Debian maintainers using it to decide where to focus effort w/ respect to integrating packages, keeping up with security updates, etc. Usually ok.
For commercial software, I'd expect telemetry to slurp whatever is legally allowed / stays under users' radar (take your pick ;), vendor keeping datapoints tied to unique IDs, and sell data on "groups of interest" to the highest bidder. Not ok.
Personal preference: eg. a crash report: "report" or "skip" (default = skip), with a checkbox for "don't ask again". That way it's no effort to provide vendor with helpful info, and just as easy to have it get out of users' way.
It's annoying the degree to which vendors keep ignoring the above (even for paying customers), given how simple it is.
Not the best name for the article. My first guess was version changes, or software being added/removed from repo. Turns out this is about source code modification.
As a native (British) English speaker, I was also unclear until reading the article. Personally, I believe s/change/modify would make more sense, but that's just my opinion. That aside, I'm a big fan of Debian, it has always "felt" quieter as a distro to me compared to others, which is something I care greatly about; and it's great to see that removing of calling home is a core principle. All the more reason to have…
Earlier quoted context omitted.
No they don't. The formulation in TFA is a bit too generic - Debian will usually not remove any code that "calls home". There are perfectly valid reasons for software to "phone home", and yes, that includes telemetry. In fact, Debian has its own "telemetry" system: https://popcon.debian.org/ Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry,…
> Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data Telemetry contains personal data by definition . It just varies how sensitive & how it's used. Also it's been shown repeatedly that 'anonymized' is shaky ground. In that popcon example, I'd expect some Debian-run server to collect a minimum of data, aggregate, and Debian maintainers using it to decide where to focus effort…
No. Please look up the definition of "telemetry" and "personal data". The latter always refers to an identifiable person.
Earlier quoted context omitted.
No they don't. The formulation in TFA is a bit too generic - Debian will usually not remove any code that "calls home". There are perfectly valid reasons for software to "phone home", and yes, that includes telemetry. In fact, Debian has its own "telemetry" system: https://popcon.debian.org/ Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data, and both apply to Go's telemetry,…
> Telemetry is perfectly acceptable as long as it is opt-in and does not contain personal data Telemetry contains personal data by definition . It just varies how sensitive & how it's used. Also it's been shown repeatedly that 'anonymized' is shaky ground. In that popcon example, I'd expect some Debian-run server to collect a minimum of data, aggregate, and Debian maintainers using it to decide where to focus effort…
Why it has to include PII by definition? I'd say DNF Counting (https://github.com/fedora-infra/mirrors-countme) should be considered "telemetry", yet it doesn't seem to collect any personal data, at least by what I understand telemetry and personal data to mean.
I'm guessing that you'd either have to be able to argue that DNF Counting isn't telemetry, or that it contains PII, but I don't see how you could do either.