in reply to Re: Re: Gathering module usage statistics
in thread Gathering module usage statistics

So do I. How do distribution/platform name and version numbers violate one's privacy?

The distributions and platforms I'm running in my home is known to me. It is private knowledge. It is not public.

The information can only be used for statistics.

You may only be using it for statistics. It can certainly be used for other purposes.

<paranoid>

  1. I kindly take over maintenance of SOAP::Lite
  2. I add a tracker like the one you propose and log all the information I receive. Note that this information will also include the IP address of the server the module was installed on.
  3. I "accidentally" include an exploit that allows me to call arbitrary Perl code in the next SOAP::Lite release.
  4. I wait for the IP addresses of vulnerable machines to roll in

</paranoid>

I will force nobody and will be very open about what happens. There will be an easy, obvious way to opt out and it will be printed on screen and mentioned in the README.

But an automated install with no manual intervention will opt-in. This is the behaviour I think most people are (correctly in my opinion) objecting to.

Because the information sent is static and not privacy-sensitive

I don't think other people are entitled to determine how sensitive my private data is. I guess I'm just funny that way.

  • Comment on Re^3: Gathering module usage statistics

Replies are listed 'Best First'.
Re: Re^3: Gathering module usage statistics
by Juerd (Abbot) on May 04, 2004 at 21:46 UTC

    <paranoid>
    1. ...
    2. ...
    3. I "accidentally" include an exploit that allows me to call arbitrary Perl code in the next SOAP::Lite release.
    4. ...
    </paranoid>

    <realistic>
    1. I "accidentally" include code that downloads and evals some string.
    2. Eh, done.
    </realistic>
    I am no more dangerous to you with this information than without. Besides that, if you're PARANOID, you never install a module without reading its documentation, without looking at installation output. If you're REALLY PARANOID, you never install a module without reading exactly what it does.

    Juerd # { site => 'juerd.nl', plp_site => 'plp.juerd.nl', do_not_use => 'spamtrap' }