On Mon, Feb 25, 2008 at 10:16:29AM +0100, Giacomo A. Catenazzi wrote: > Lars Wirzenius wrote: >> On su, 2008-02-24 at 16:43 -0600, Raphael Geissert wrote: >>> * The package/software SHOULD offer a way to disable the 'phoning home' code >>> if it contains such kind of 'feature'.
>> Speaking as a human being, I would suggest that Debian policy should be >> that all "phoning home" MUST be enabled explicitly, and MUST be turned >> off by default. > No, I prefer the SHOULD form, because it permit the > right thing to be done, giving the debian developer > the freedom (and burden) to check what it is bad, and > what it is acceptable. "should" here would only mean that we've failed to correctly define "phoning home". There's no legitimate reason for Debian packages to phone home, and it's always a bug if they do; if this is to be referenced in policy at all, this should be made plain. > Think about: > apt Not "phoning home": - the requests don't contain identifying information about the client, with the exception of the source IP address. - with the exception of security.d.o, there's no calling back to a central server. - the requests are central to the functionality of the package, not gratuitous calls for purposes of statistics-gathering. - the requests must be initiated by the user. > ntpdate Not phoning home, for the same reasons as above (minus the last point). > clamav-freshclam - central to the functionality of the package; if you don't want to be trackable you don't install the package. - statistics gathering is a side-effect of the main purpose of the package, and there's no way around this short of anonymizing your client access through tor or similar. > dcc-client again, if you don't want to be included in statistics, you wouldn't install this package; sending data to the central server is core functionality of the package. > icewasel Not sure which behavior you're referring to, here? I think even when it comes to trying to find plugins, this is user-initiated (i.e., you have to click the "find plugins" button). > popularity-contest Defaults to off; not an issue. > and IIRC bind will check the root zone. Yes, which is central to the functionality of a nameserver. > Some of such project collects statistics. The issue is not whether packages communicate with projects that collect statistics; the issue is whether the packages do so for the *purpose* of allowing statistics-gathering. -- Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. Ubuntu Developer http://www.debian.org/ [EMAIL PROTECTED] [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
