Hacker News Reader

Comment by f4stjack | Hacker News Reader

"We are not telling Amazon what you are searching for. Your anonymity is preserved because we handle the query on your behalf. Don’t trust us? Erm, we have root. You do trust us with your data already."

Sorry but you have root to what exactly? I am not using ubuntu one and I don't trust my data with ubuntu, thank you. And I don't find his arguments convincing seriously. Some of us are old enough to remember "BonziBuddy" who "helped" with our searches and as far as I remember it also Just Worked, except it was an irritating pervasive spyware.

Privacy and Functionality are two different spheres, I can't accept something very functional if it invades my privacy.

View on HN

You installed Ubuntu. How do you know that Ubuntu itself and all of the programs that run as root that you installed as part of Ubuntu are not malicious?

A: Trust.

If you are installing updates from Ubuntu (and you should be), how to do you know apt-get/dpkg that you run as root, but came from Ubuntu is not malicious? How do you know that the programs that apt-get just installed that run as root are not malicious?

A: Trust.

Obviously there are different kinds of trust. I trust restaurant employees not to poison my food, but that doesn't mean I trust them with my SS number, bank account, and the details of my personal life. Pre 12.04, if Canonical wanted access to the personal information of their users, it would have involved putting in a backdoor that would be 1)detectable by all Ubuntu users 2)illegal under most spyware laws and 3)cause an extremely large backlash and wide mistrust of Canonical. So I 'trusted' Canonical not to engage in widespread criminal hacking which would have severe legal and social consequences. These consequences now seem removed: 1)There's no way to know if they are misusing the information that is now passed through their servers, barring someone on their end leaking something. 2)They don't appear to have made a legally binding promise about what they are actually doing with the data. Even if they did, the legal consequence of breaking it may be ambiguous. Just because I _did_ trust Canonical doesn't mean I trust them forever. Canonical's method of dumping an obviously intrusive function on users and then issuing a smarmy response that downplays genuine concerns shows that they are missing the social intelligence that would be required to even properly understand issues of privacy invasion, and I'm certainly looking to migrate elsewhere.

It's not the same thing. Installing binaries from them doesn't send them any of my local data.

I guess their apps could start uploading stuff, but people will figure out pretty soon Ubuntu has/is trojans.

What we are talking here is about an intentional privacy leak which is brushed off as if they can do anything they please just because they make the distro.

There are different layers. I can trust them with the binaries but not with anything else. Or I can trust them with Ubuntu One, but only with what I put there. Or I can trust them sending all the queries to Amazon.

It's a continuum but implying that one level of trust involves everything else is naive.

Nope. Not trust, because they are open source and I can read the source code and I do read source code. Although this is kinda derailing my argument. I am saying, they don't have my data - not voluntarily if I accept your argumentation and assume they are collecting it without my consent, if this is the case; this will open a can of worms.

Unless you compile the whole distro and all updates on your own, you still have to trust Ubuntu that the code they ship was actually built from source packages unmodified from the one you just checked.

So you do have to trust them. They could easily have shipped a version of Chrome that sends the browsing history (or your password keychain) to Canonical while shipping source code that doesn't contain that feature.

Of course this doesn't change the fact that I really do want my OS ad-free. It does mean however that I trust them not to violate their promises as well as not to ship spyware.

If it gets out that they did either, it's the moment that everybody stops using Ubuntu which really doesn't help them in their (apparently perceived evil) monetization schemes.

That's not just trust in them, it's partly trust in the community that if they shipped a malicious browser, say, someone would notice and cry foul.

Offering source that doesn't match the binaries doesn't stop someone monitoring their own network traffic. And if you recompile the binaries with the same settings, the hashes should match.

Trust is certainly a large component. But it's also control: In lazy moments I sometimes wireshark my traffic to see who's phoning out and what kind of data they send. I'm sure other people are doing this, are checking the code going into daemons, etc.

Applied to this situation I could see my queries going to canonical's servers but I have no idea what happens then. That's only trust and no control.

That doesn't really follow. Just because they can do something worse doesn't mean they can just get away with doing something less bad.

What if Ubuntu uploaded some phrases from your local documents to show you better results or ads? Is that acceptable? What about uploading entire documents, keystrokes, Google search terms etc. to better target ads?

You trust them enough to run their entire OS right? What if it was Microsoft that did this to improve Bing instead of Ubuntu? Why are so many people running Windows if they don't trust Microsoft already?

Reply on news.ycombinator.com