[System] Does Kubuntu 18.04 Phone Home User Data?

[JeZ-l-Lee]

Hi,

Ubuntu 18.04 phones home private user data.
Does Kubuntu 18.04 phone home private user data too?

I installed current Kubuntu 18.04 64Bit into VirtualBox
and I did not see an option to turn off the above?

Let me know, thanks!

Jesse

[vinnywright]

it is NOT privet user data that gets collected ,,,just hardware info and system configuration ,,,,see hear https://fossbytes.com/ubuntu-data-collection/

VINNY

[JeZ-l-Lee]

Hi,

How do I turn that off and disable during the installation??

Jesse

[Bings]

A lesser talked about part of this data collection is the installation of a program called popcon which will send regular reports of a users package use. https://popcon.ubuntu.com/

Q) What are the privacy considerations for popularity-contest ?

A) Each popularity-contest host is identified by a random 128bit uuid
(MY_HOSTID in /etc/popularity-contest.conf). This uuid is used to
track submissions issued by the same host. It should be kept secret.
The reports are sent by email or HTTP to the popcon server. The
server automatically extracts the report from the email or HTTP and
stores it in a database for a maximum of 20 days or until the host
sends a new report. This database is readable only by Debian
Developers. The emails are readable only by the server admins.
Every day, the server computes a summary and post it on
<http://popcon.debian.org/all-popcon-results.txt.gz>. This summary
is a merge of all the submissions and does not include uuids.

Known weaknesses of the system:

1) Your submission might be eavesdropped. We evaluate the possibility
to use public-key cryptography to protect the submission while in
transit.

2) Someone who knows that you are very likely to use a particular package
reported by only one person (e.g. you are the maintainer) might infer you
are not at home when the package is not reported anymore. However this is
only a problem if you are gone for more than two weeks if the computer is
shut-down and 23 days if it is let idle.

3) Unofficial and local packages are reported. This can be an issue
due to 2) above, especially for custom-build kernel packages.
We are evaluating how far we can alleviate this problem.

[Bings]

Hi,

Ubuntu 18.04 phones home private user data.
Does Kubuntu 18.04 phone home private user data too?

I installed current Kubuntu 18.04 64Bit into VirtualBox
and I did not see an option to turn off the above?

Let me know, thanks!

Jesse

I don't think this has been enabled yet in any Ubuntu distro installer. It will not be applicable for anyone who upgrades from a previous release. As for Kubuntu (or any other derivative), I have seen no confirmation that it will be included. I don't know the politics behind how these things work, whether Canonical have some executive power over them or they are just using a name.

[JeZ-l-Lee]

Most unfortunate, I expect such SpyWare in Windows but not a Linux distro!

[GreyGeek]

Most unfortunate, I expect such SpyWare in Windows but not a Linux distro!

One way to allow Ubuntu to add drivers for printers, wifi, displays, speakers, HDs, SSDs and other hardware is for YOU to send that information to them so they can fill in the edge cases. Since Kubuntu is derived from Ubuntu Kubuntu benefits from that information as well. Otherwise, drivers for your machine, if you lack them, may never come. What if you don't know where that info is, or how to collect it? That is what the default opt-in is for. IF Ubuntu already drives your equipment adequately then they don't need your info, so opt out. On 18.04 one uses the Gnome Privacy panel. I haven't heard how the Kubuntu (KDE) version of the privacy panel will be configured, or if the option will default to in or out.

IF Canonical (Shuttleworth) is to be believed what is not being collected is the personal information on your system. What they will collect is along the lines of the output of "inxi", which is in the repository.

PRIVACY AND SECURITY
In order to maintain basic privacy and security, inxi filters out automatically on IRC things like your network card mac address, WAN and
LAN IP, your /home username directory in partitions, and a few other things.

Example output of inxi -FMNAG

Machine:   Device: laptop System: Acer product: Aspire V3-771 v: V1.07 serial: N/A
           Mobo: Type2 - Board Vendor Name1 model: VA70_HC v: Type2 - Board Version serial: N/A
           UEFI [Legacy]: Insyde v: V1.07 date: 05/11/2012
Graphics:  Card-1: Intel 3rd Gen Core processor Graphics Controller
           Card-2: NVIDIA GK107M [GeForce GT 650M]
           Display Server: x11 (X.Org 1.19.5 ) drivers: modesetting,nvidia Resolution: 1600x900@59.98hz
           OpenGL: renderer: GeForce GT 650M/PCIe/SSE2 version: 4.5.0 NVIDIA 390.25
Audio:     Card Intel 7 Series/C210 Series Family High Definition Audio Controller driver: snd_hda_intel
           Sound: Advanced Linux Sound Architecture v: k4.8.0-42-generic
Network:   Card-1: Qualcomm Atheros AR9462 Wireless Network Adapter driver: ath9k
           Card-2: Qualcomm Atheros AR8151 v2.0 Gigabit Ethernet driver: atl1c

[claydoh]

Also to note about Popcon, is that it is Debian software used for years now, and I think is offered as an option in their installer. I believe that it was also an option in the Ubuntu installer way back when, as well. I do not think that Debian would create something that would be considered spyware, but I do sort of understand the somewhat knee-jerk privacy concerns.

However, we f/oss users as a group are notoriously terrible at providing data of this sort, but are extremely quick to gripe about something that they deem vital that may not be used by many at all.

[kubicle]

The install time report and popcon are not huge privacy problems based on the collected data, but Canonical will get IP addresses (just because the data is delivered over the internet). Not a really big problem, but still should be opt-in rather than opt-out.

More questionable practice will be enabling apport (bug-reporting) by default, as apport reports include core dumps, stack traces and log files, which may include sensitive data (like passwords or credit card numbers).

So it's not really a trivial change, or one that should be made lightly.

In fact, it's likely to provide very skewed data (whether it's opt-in or opt-out) as linux people tend to be quite tech savvy and more privacy oriented (at least compared to the general population), so it's unlikely Canonical will get any really useful technical data from it...and that makes me think Canonical's real reasoning behind the change is finding potential clients for their paid corporate support (when you start getting a lot of apport reports from an IP range belonging to a medium-sized company, it's a good time for that sales call...I don't think it's a coincidence that this change is made fairly quickly after Canonical lost one of it's biggest clients in Google...so they are in desperate need of new contracts).

So my advice is to opt-out if you are concerned (and you can also purge the packages related to it if you wish). There will be a way to opt-out in Kubuntu as well, if this change will be enabled by default (I'm hopeful that it is not...even though I use Neon instead of Kubuntu). There is also a chance enabling it by default will actually violate the EU GDPR, which would force Canonical to back down a bit (to make it opt-in, for example).

[NietGiftig]

... blahblah

IF Canonical (Shuttleworth) is to be believed what is not being collected is the personal information on your system. What they will collect is along the lines of the output of "inxi", which is in the repository.

That's how Microsoft and the others started with saying, "no sir, nothing personal is being transferred"

Starting Innocent, but every time silent increasing the amount of data, see where they are now.

If you tried to explain to a person 20 years in past, what is now the norm, and acceptable (even for Linux guru's old grey geeks & vinnywright), they would not believe you.

As long as I do not get a button with the text "Yes, please please, I want to share" it's not good for me.

Not with installing, with a small little cross you must untick or something like that.
Or hidden in an advanced setup.
And ultimate no choice (M$ ?)
Because i think that's where we are going to (when one sheep is over the wall, the rest will follow).

[oshunluvr]

The install time report and popcon are not huge privacy problems based on the collected data, but Canonical will get IP addresses (just because the data is delivered over the internet). Not a really big problem, but still should be opt-in rather than opt-out.

More questionable practice will be enabling apport (bug-reporting) by default, as apport reports include core dumps, stack traces and log files, which may include sensitive data (like passwords or credit card numbers).

So it's not really a trivial change, or one that should be made lightly.

In fact, it's likely to provide very skewed data (whether it's opt-in or opt-out) as linux people tend to be quite tech savvy and more privacy oriented (at least compared to the general population), so it's unlikely Canonical will get any really useful technical data from it...and that makes me think Canonical's real reasoning behind the change is finding potential clients for their paid corporate support (when you start getting a lot of apport reports from an IP range belonging to a medium-sized company, it's a good time for that sales call...I don't think it's a coincidence that this change is made fairly quickly after Canonical lost one of it's biggest clients in Google...so they are in desperate need of new contracts).

So my advice is to opt-out if you are concerned (and you can also purge the packages related to it if you wish). There will be a way to opt-out in Kubuntu as well, if this change will be enabled by default (I'm hopeful that it is not...even though I use Neon instead of Kubuntu). There is also a chance enabling it by default will actually violate the EU GDPR, which would force Canonical to back down a bit (to make it opt-in, for example).

A sane and salient view point. Well said.

[GreyGeek]

Does Kubuntu 18.04 Phone Home User Data?

When ever a program crashed on my system (both Kubuntu and KDE Neon) a dialog was presented asking if I wanted to send in a crash report. When ever I clicked “yes” the dialog churned for a second or two and then returned stating that I needed to install *.dev files. I never did because crashes occurred so rarely I didn’t want to waste the disk space.

Kubical, will Canonical began loading the dev files which support variable definitions so that valid reports can be generated? If so, how will this affect the size of the iso files?

And, if Canonical is planning on being so devious in its quest to replace Google cash what’s to stop it from including hidden functions or software that randomly generates bug reports, valid or not, to generate business?

If Canonical begins being that devious it wouldn’t take me long to switch to Debian.

[kubicle]

When ever a program crashed on my system (both Kubuntu and KDE Neon) a dialog was presented asking if I wanted to send in a crash report. When ever I clicked “yes” the dialog churned for a second or two and then returned stating that I needed to install *.dev files. I never did because crashes occurred so rarely I didn’t want to waste the disk space.

Apport (and related stuff) are one of the first things I remove from my installations, so I can't be sure, but you probably mean -dbg and -dbgsym packages (rather than -dev packages) that include the debug symbols necessary to create a useful debug output for programs.

Kubical, will Canonical began loading the dev files which support variable definitions so that valid reports can be generated? If so, how will this affect the size of the iso files?

I'd assume they would still be installed as needed (by apport, possibly automatically), including them in the ISOs wouldn't make much sense.

And, if Canonical is planning on being so devious in its quest to replace Google cash what’s to stop it from including hidden functions or software that randomly generates bug reports, valid or not, to generate business?

I doubt that would be in Canonical's best interest (and it would be nearly impossible to hide stuff like that in open source software), after all they will also get useful bug reports with the system (they probably wouldn't benefit from bogus ones). I'm just skeptical because they currently get more bug reports than they can effectively handle, how would getting more of them be really worth it? And of course I cannot be sure they are parsing their server logs for potential clients, that's just what I would do if I were them.

And I don't mean bug reporting software is bad by itself, most times they can really help in improving software (KDE plasma has it's own bug reporter "drkonqi"), but IMO it's questionable to enable stuff like that by default and make it opt-out (rather than opt-in), so people really can make informed decisions about whether they want to participate or not.

[GreyGeek]

Yes, -dbg and -dbgsym packages is what I meant, I just couldn't remember those terms ... among many others which have left the barn.

Thanks for your input!

[JeZ-l-Lee]

Been running Manjaro KDE 64Bit for a few months now, it's quite nice and very private:

https://manjaro.org/get-manjaro/