7 ms·

It performs an auto-update check. You know it's just performing an auto-update check. While there's not no argument to be made here, it's not like it's secretly

by urthen 7y ago

It performs an auto-update check. You know it's just performing an auto-update check. While there's not no argument to be made here, it's not like it's secretly collecting a bunch of data and reporting it before letting you opt out. The paranoid, accusatory tone in the issue does nothing to help your argument, and I believe makes it harder for maintainers to take you seriously. Your argument is well thought out, and I don't necessarily disagree with it in principle, but you're making mountains out of molehills here. If you'd simply pointed out the issue and asked that the auto-update check be performed after the consent check - especially if it came with a PR implementing that - you'd go a lot further.

egdod 7y ago
It’s reporting your IP address. That’s not nothing.
- na85 7y ago
  What's the alternative? I'm not sure how a client can query a server for updates without exposing its IP address beyond obfuscation like TOR or perhaps a VPN.
  - hashkb 7y ago
    It can just obtain the user's consent; and, if denied, the alternative is to not phone home at all.
    - na85 7y ago
      I suppose, but that smacks of toejam-eating extremism in my opinion. I recall reading a study that showed the #1 most common habit among compute security professionals was having automatic updates enabled. The idea that you're willing to risk running an outdated version in today's extremely adversarial computing environment just to avoid "leaking" your IP address just doesn't make any sense to me. I thought we stopped considering IP addresses as confidential information years ago?
    - mirimir 7y ago
      That's pretty much the norm in Linux. One typically gets packages from the distro's repository. And traffic with modern repositories uses HTTPS. So third parties don't see what packages are being used. And unless one configures a developer repository, there's never any traffic to the developer. Also, IP addresses are considered PII under GDPR. Edit: Still, if one cares that much about ones IP address, it's prudent to use a VPN service or Tor.
      - colejohnson66 7y ago
        > Also, IP addresses are considered PII under GDPR. Not true. They’re only PII if they can be used to connect something to a person. It’s a minor distinction, but it is one nonetheless.
        jdnenej 7y ago
        In this case it would not be PII data if it was just an IP address in a webserver log saying someone checked for an update. It would be PII data if it was linked to your GitHub account.
      - jdnenej 7y ago
        IP addresses are only PII if attached to other information. I can generate a list of IP addresses and store/sell that data and it's all fine because its meaningless without associated data.
        mirimir 7y ago
        The other information is "using Atom".
        jdnenej 7y ago
        It's still impossible to link that to an individual unless they sold it to another company that has more info on the address.
  - serf 7y ago
    an alternative updating mechanism that doesn't directly expose IP of the updater? a dht/blockchain mashup comes to mind, but really it just pushes the IP knowledge to knwoledge of some other intrinsic variable that can be used for fingerprinting. the issuer of public information (an update) doesn't necessarily need to know who collects the information, it's just architected like that for most internet things.
    - gen3 7y ago
      That’s just not feasible for most projects. Why ship a blockchain along with your product, when you could just go with a GET request? The technical complexity, server space, and additional bloat that would be needed to be added to the app would be a waste, IMO.
    - sjwright 7y ago
      Or you could maintain the current version number on the Wikipedia page for your app. Your app could then request its wiki page over HTTPS as a check for updates. Then the only useful logs would be held by Wikipedia. And more broadly, requests to that page would be utterly lost in the noise.
      - dane-pgp 7y ago
        That's not a bad idea, actually. Ideally the article would contain (in a comment or some hidden field) a signature from the PGP key of the app's developer, covering both the version number and the date of release (to stop replay/rollback attacks). Alternatively, the app could look at the article history and find the latest edit made by the developer's Wikipedia account, so that malicious edits would be ignored. This assumes the threat model doesn't include rogue Wikipedia admins rewriting history or hijacking accounts. At the expense of a smaller anonymity set, it might make more sense for the app to query Wikidata instead of Wikipedia: https://www.wikidata.org/wiki/Q16766305 https://www.wikidata.org/wiki/Q16766305
        sjwright 7y ago
        > (to stop replay/rollback attacks) In my imagining, the content of the Wikipedia article does nothing more than trigger a notification to the user; it would be the user's choice whether to initiate a network connection with the vendor's server for the "real" check and binary download.
  - deleted 7y ago
    [deleted]
sneak 7y ago
> You know it's just performing an auto-update check Actually, I don't. I didn't agree to let it phone home. It does it before it tells me anything at all. It's also connecting to the telemetry service endpoint immediately on launch, despite not having selected a telemetry consent setting yet. How about this one? It phones home when you click "don't phone home". https://github.com/atom/atom/issues/20185 https://github.com/atom/atom/issues/20185
- urthen 7y ago
  Don't use Atom then? Seems pretty obvious if you care that much. I respect your privacy views and even share many/most of them (if not so strictly), and appreciate that you are probably just trying to bring this to people's attention. However, you are not the king of open source, and you cannot dictate how other authors must write their projects. It's an open source product written by a for-profit company. There's always going to be trade-offs.
  - sneak 7y ago
    > However, you are not the king of open source, and you cannot dictate how other authors must write their projects No, but I can convince other people who don't like their computers being used a spying tools against them to put social pressure on maintainers so that they stop doing this nonsense. Atom's telemetry used to be on by default; spying silently caused them such a shitstorm that they added a consent dialog. They're almost there! Now they just have to make it functional. https://github.com/atom/atom/pull/12281 https://github.com/atom/atom/pull/12281 There are precedents. We can push back, especially against open source projects. > There's always going to be trade-offs. I don't think that's how software works. I certainly don't take that to mean that I should just accept that it's going to spy on me. I don't want that, and I don't accept that, and I will yell, loudly, at anyone who says I should accept that without a fight.
    - sjwright 7y ago
      It’s open source. They aren’t forcing you to use their software, and they’re certainly not forcing you to use their binaries.
hashkb 7y ago
The maintainers who reply dodge the issue in a way that must be frustrating to the reporter; and makes it seems like they'd probably not accept a PR that modified this behavior. Calling privacy advocates "paranoid" in today's climate is a bit suspect. There's a definite issue here that the Atom team should address - a reasonable user would expect that, after opting out, the app would never phone home, and it does. Blaming tone is too easy - at this point the Atom team is representing Microsoft, so I'd say the burden is on them to soak up a little snark; especially coming from a user who maybe expects them to behave a bit more like the GitHub of old. Even if they were a small open-source team I would still expect them to directly confront the issue instead of beating around the bush. It's about privacy, and splitting hairs to deny the reporter's reality is a bad look.
- urthen 7y ago
  The application clearly states that it sends an opt-out notification anonymously after opt-out. I think they're doing better than most in terms of transparency. Is there room for improvement? Sure. But I don't think attacking people who are already doing pretty well compared to the field is the best use of anyone's time. This is just picking on an open-source team which already has shown themselves to take user feedback about privacy seriously. If you are so suspect of third parties that any device or application sending any network traffic without previous authorization is of serious concern to you, there's a lot more important and impactful products to voice concern about. Like pretty much any other part of Microsoft.
- lukasb 7y ago
  The "never phone home" UI should make it clear that it will still phone home to check for updates. But I'm sympathetic to Github here. Having users on unpatched software is a bigger risk to them than not having 100% perfect insulation from sending their IP address to Microsoft.
  - vunie 7y ago
    >Having users on unpatched software is a bigger risk to them than not having 100% perfect insulation from sending their IP address to Microsoft. That's not a decision for Github to make. Let the user decide. Perhaps by even presenting them with a dialog on first run that informs them then asks them ti decide.
TAForObvReasons 7y ago
The more interesting question, which you completely sidestep by trying to categorize the leaked info, is whether software should perform an auto-update check before giving you an option to opt out. I don't think the author would have been concerned if they were asked whether the software should check for updates.
- bromuro 7y ago
  MacOS apps are used to prompt a dialog - atom should too.

by urthen 7y ago

egdod 7y ago

It’s reporting your IP address. That’s not nothing.

na85 7y ago
What's the alternative? I'm not sure how a client can query a server for updates without exposing its IP address beyond obfuscation like TOR or perhaps a VPN.
- hashkb 7y ago
  It can just obtain the user's consent; and, if denied, the alternative is to not phone home at all.
  - na85 7y ago
    I suppose, but that smacks of toejam-eating extremism in my opinion. I recall reading a study that showed the #1 most common habit among compute security professionals was having automatic updates enabled. The idea that you're willing to risk running an outdated version in today's extremely adversarial computing environment just to avoid "leaking" your IP address just doesn't make any sense to me. I thought we stopped considering IP addresses as confidential information years ago?
  - mirimir 7y ago
    That's pretty much the norm in Linux. One typically gets packages from the distro's repository. And traffic with modern repositories uses HTTPS. So third parties don't see what packages are being used. And unless one configures a developer repository, there's never any traffic to the developer. Also, IP addresses are considered PII under GDPR. Edit: Still, if one cares that much about ones IP address, it's prudent to use a VPN service or Tor.
    - colejohnson66 7y ago
      > Also, IP addresses are considered PII under GDPR. Not true. They’re only PII if they can be used to connect something to a person. It’s a minor distinction, but it is one nonetheless.
      - jdnenej 7y ago
        In this case it would not be PII data if it was just an IP address in a webserver log saying someone checked for an update. It would be PII data if it was linked to your GitHub account.
    - jdnenej 7y ago
      IP addresses are only PII if attached to other information. I can generate a list of IP addresses and store/sell that data and it's all fine because its meaningless without associated data.
      - mirimir 7y ago
        The other information is "using Atom".
        jdnenej 7y ago
        It's still impossible to link that to an individual unless they sold it to another company that has more info on the address.
- serf 7y ago
  an alternative updating mechanism that doesn't directly expose IP of the updater? a dht/blockchain mashup comes to mind, but really it just pushes the IP knowledge to knwoledge of some other intrinsic variable that can be used for fingerprinting. the issuer of public information (an update) doesn't necessarily need to know who collects the information, it's just architected like that for most internet things.
  - gen3 7y ago
    That’s just not feasible for most projects. Why ship a blockchain along with your product, when you could just go with a GET request? The technical complexity, server space, and additional bloat that would be needed to be added to the app would be a waste, IMO.
  - sjwright 7y ago
    Or you could maintain the current version number on the Wikipedia page for your app. Your app could then request its wiki page over HTTPS as a check for updates. Then the only useful logs would be held by Wikipedia. And more broadly, requests to that page would be utterly lost in the noise.
    - dane-pgp 7y ago
      That's not a bad idea, actually. Ideally the article would contain (in a comment or some hidden field) a signature from the PGP key of the app's developer, covering both the version number and the date of release (to stop replay/rollback attacks). Alternatively, the app could look at the article history and find the latest edit made by the developer's Wikipedia account, so that malicious edits would be ignored. This assumes the threat model doesn't include rogue Wikipedia admins rewriting history or hijacking accounts. At the expense of a smaller anonymity set, it might make more sense for the app to query Wikidata instead of Wikipedia: https://www.wikidata.org/wiki/Q16766305 https://www.wikidata.org/wiki/Q16766305
      - sjwright 7y ago
        > (to stop replay/rollback attacks) In my imagining, the content of the Wikipedia article does nothing more than trigger a notification to the user; it would be the user's choice whether to initiate a network connection with the vendor's server for the "real" check and binary download.
- deleted 7y ago
  [deleted]

sneak 7y ago

> You know it's just performing an auto-update check Actually, I don't. I didn't agree to let it phone home. It does it before it tells me anything at all. It's also connecting to the telemetry service endpoint immediately on launch, despite not having selected a telemetry consent setting yet. How about this one? It phones home when you click "don't phone home". https://github.com/atom/atom/issues/20185 https://github.com/atom/atom/issues/20185

urthen 7y ago
Don't use Atom then? Seems pretty obvious if you care that much. I respect your privacy views and even share many/most of them (if not so strictly), and appreciate that you are probably just trying to bring this to people's attention. However, you are not the king of open source, and you cannot dictate how other authors must write their projects. It's an open source product written by a for-profit company. There's always going to be trade-offs.
- sneak 7y ago
  > However, you are not the king of open source, and you cannot dictate how other authors must write their projects No, but I can convince other people who don't like their computers being used a spying tools against them to put social pressure on maintainers so that they stop doing this nonsense. Atom's telemetry used to be on by default; spying silently caused them such a shitstorm that they added a consent dialog. They're almost there! Now they just have to make it functional. https://github.com/atom/atom/pull/12281 https://github.com/atom/atom/pull/12281 There are precedents. We can push back, especially against open source projects. > There's always going to be trade-offs. I don't think that's how software works. I certainly don't take that to mean that I should just accept that it's going to spy on me. I don't want that, and I don't accept that, and I will yell, loudly, at anyone who says I should accept that without a fight.
  - sjwright 7y ago
    It’s open source. They aren’t forcing you to use their software, and they’re certainly not forcing you to use their binaries.

hashkb 7y ago

The maintainers who reply dodge the issue in a way that must be frustrating to the reporter; and makes it seems like they'd probably not accept a PR that modified this behavior. Calling privacy advocates "paranoid" in today's climate is a bit suspect. There's a definite issue here that the Atom team should address - a reasonable user would expect that, after opting out, the app would never phone home, and it does. Blaming tone is too easy - at this point the Atom team is representing Microsoft, so I'd say the burden is on them to soak up a little snark; especially coming from a user who maybe expects them to behave a bit more like the GitHub of old. Even if they were a small open-source team I would still expect them to directly confront the issue instead of beating around the bush. It's about privacy, and splitting hairs to deny the reporter's reality is a bad look.

urthen 7y ago
The application clearly states that it sends an opt-out notification anonymously after opt-out. I think they're doing better than most in terms of transparency. Is there room for improvement? Sure. But I don't think attacking people who are already doing pretty well compared to the field is the best use of anyone's time. This is just picking on an open-source team which already has shown themselves to take user feedback about privacy seriously. If you are so suspect of third parties that any device or application sending any network traffic without previous authorization is of serious concern to you, there's a lot more important and impactful products to voice concern about. Like pretty much any other part of Microsoft.
lukasb 7y ago
The "never phone home" UI should make it clear that it will still phone home to check for updates. But I'm sympathetic to Github here. Having users on unpatched software is a bigger risk to them than not having 100% perfect insulation from sending their IP address to Microsoft.
- vunie 7y ago
  >Having users on unpatched software is a bigger risk to them than not having 100% perfect insulation from sending their IP address to Microsoft. That's not a decision for Github to make. Let the user decide. Perhaps by even presenting them with a dialog on first run that informs them then asks them ti decide.

TAForObvReasons 7y ago

The more interesting question, which you completely sidestep by trying to categorize the leaked info, is whether software should perform an auto-update check before giving you an option to opt out. I don't think the author would have been concerned if they were asked whether the software should check for updates.

bromuro 7y ago
MacOS apps are used to prompt a dialog - atom should too.