BSD vs. Ubuntu motd(5)

I used to have a privacy.sh script for fresh Ubuntu installs back on the Amazon shenanigans days. That file has been empty for a while but I guess I need to update it again.

It was always a big one for me, I ran with ZFS root for 2+ years and every kernel/zfs update was a bit of a Russian roulette (I did have to perform elaborate recovery once or twice). Even if it was 100% guaranteed to compile and work, there was 1. a very scary window during which if the system hung, you're semi-bricked; 2. the long build.

Running a desktop/laptop without a time-traveling file system is quite simply not an option (especially once you get used to it).

On servers, not so much difference. Well unless you are using k8s, etcd, juju and all that jazz

Privacy is not a super-set of Open Source. They're two different things; somewhat correlated, but only insomuch as the auditability and self-correction of any claims to privacy may be.

Auditability is important, but most people won't do it, and even those who do miss things; OpenSSL is fully auditable, yet security bugs are discovered every year. Its not the same thing, but its in the same vein; just becuase we're capable of catching a needle among the haystack of a million lines of code doesn't mean we will (in the case of the MOTD, its less of a needle and more of a giagantic pile of crap just laying on top).

Self-Correction is important, but even fewer people will do it. Defaults Matter. People just don't dive into VSCode and rip out Microsoft's analytics tracking code en mass. It doesn't happen. People use the defaults.

In the face of these two assertions; Open Source is important in the fight for Privacy, there's no doubt about that. But even more important than that is Trust. Its not enough to see the code; its important that the organization and people writing it have a demonstrated history of caring about the privacy of their users, and that they've taken both "table-stakes" and "above and beyond" steps to assert their position on the matter on behalf of those users.

Canonical does not have this demonstrated history. They barely lurch in the right direction, against their collective wills, when we care enough to crusade across the internet to convince them that they're wrong. By comparison; Apple does care. You can complain that its in the interest of their profit margins (OF COURSE IT IS) or that its genuine (I'd bet my net worth that this is also true); it doesn't matter. They productized full disk encryption with hardware security modules. They don't just support hardware MFA; they make it the default. When they realized phones wouldn't have the power to do natural-language processing on voice in the same way servers do, they didn't just throw their hands up and move everything to the server like Google did; they made better silicon. That's their history; Canonical's history is sending keystrokes to Amazon so they can sell you more expensive toilet paper. The most knowledgeable Ubuntu users turn this off; the most vulnerable won't even know its happening.

Everyone is welcome to their own opinion on this, and you're also welcome to place the value of open source above the value of privacy; but I take the stance that Privacy isn't negotiable, and its more important than a product being open source or having privacy if you tweak the knobs in just the right way.

I'll argue that utilization of Linux comes with certain "expectations" which is why so many of us decide to use it in the first place. Some of those expectations include (but are not limited to) rock-solid stability, "be good at one thing", lack of bloatware, sane update/upgrade cycles/policy, privacy, and security.

I've been using Linux professionally for just over 15 years now, sometimes in highly compliant/systems-critical infrastructure. The privacy and security bullet points above are the most important factors to me when designing and/or hardening systems.

> I don't use Ubuntu, and you don't have to either! It's almost like there are millions of Linux distributions!

Actually - I had to at my last position. When people make technology decisions they often go with the most popular/"safe" options and then dictate the decision to those implementing it. Welcome to corporate America (which is where the jobs are). Everything new was spun-up with Ubuntu as a base distro and you better believe I manually opted-out of this "feature".

---

There's a big problem when the most popular distro starts making moves like this as it sets precedent that it's OK. Canonical has made the decision against privacy/security in regards to their motd and that's a huge issue, and I argue it goes against the ethos of Linux and OSS.

It isn't about politics nor economics. It's about privacy and control. That is linked with Linux for a lot of users. And Linux users have a pretty good situation in regard to this.

But it is starting to erode and if allowed can only get worse.

It is unacceptable and the fact that canonical don't realize this is why I'm thinking of alternatives.

Especially considering the use case. Either they haven't got a clue, or they are testing the waters. Does not look good any way you look at it.

I've had to use Ubuntu in an environment with high security needs/regulations. I've had to disable this exact feature because leaking OS versions, network information, etc. externally via that user agent string was unacceptable from a security standpoint.

I was upset that something as simple as a motd had been retooled to leak data.

> and my sense is that virtually nobody cares about this particular case of telemetry.

And in my real-world experience I've been paid to care. When forced to work with Ubuntu (which is everywhere these days) I have to "reign it in" with custom images/scripts/etc.

> I dislike the idea of tying particular political or economic philosophies together with a tech stack like Linux.

This isn't "political or economic philosophies" this is security 101. Leaking data like my OS version, IP addresses, when admins are doing their work, etc to the public internet is a hard "no" for anyone who's operating in any semblance of "best practices".

As such, linux is just as much a product and a service as it is a technology tied to very real markets and niches. And it with that come the exact same concerns you'd find in any other market.

Your observation is totally correct: there are tons of distributions and there is plenty of choice and people don't care.

But that choice is far from granted, and it's not an argument that deprecates questions about moral responsibility: Are companies providing a service/product entirely responsible for the consequences? Or are customers entirely responsible for their own choices and behavior? Or is it both?

Let's use an analogy to demonstrate. Bread is a great example.

The vast majority of people eat bread daily. And so there's a huge demand. But the market has consolidated in some places and so many people end up buying bread from retail chains. Sadly, such bread is a processed food and contains many ingredients that aren't that healthy such as emulgators (E-numbers), or loads of sugar.

You could argue that people still have a choice: You could go to an artisanal baker. Or you could bake your own bread: the recipe isn't that difficult and requires few raw ingredients. So, why aren't people doing that when they know retail chain bread isn't good for them? Three reasons: because artisanal bread is expensive; it's a different shop from a centralized retail shop and making decent bread takes time and skill. Consumers simply calculate cost/benefits: buying cheap bread is far more convenient in the short run, even though the long term consequences may cost more.

Okay, so how does that hold up with Linux? Same thing.

Ubuntu is huge because it was successful in it's marketing early on; and it did a bang up job in creating an effective onboarding experience for new linux users. You can argue about their design choices over the past 15 years, but in the end, they have been ahead of the competition when it comes to tapping into a new generation of users.

As time went on, what you see is that the Ubuntu community has spawned a huge volume of documentation: tutorials, videos, stackoverflow posts,... Google "how to install sound drivers in linux" and your first hit will be tutorial for Ubuntu. Whereas trying to find the same information for lesser known distributions might be just a tad harder.

And that's what makes all the difference. Convenience. If you spend an evening trying to fix your damn audio after first installing Slackware, and all you find is Ubuntu tutorials, you will likely just switch over to... Ubuntu. Especially if you aren't particularly interested in the design philosophy of Slackware, or who these Canonical people are anyway. You simply want to listen to your favorite Spotify playlist, right?

So, the issue here is that both retail chains and Canonical understand that the vast majority of people simply want convenience and they will easily choose it over principle or their own self-interest. And so, it's extremely tempting to exploit that.

The question then becomes whether it's morally right to tap into that and take more from your customers or users then what they are bargaining from. Especially when they aren't really aware you're doing it. Either by using ingredients that aren't prohibited, but clearly unhealthy, or by using techniques to gain more insights about their behavior. Especially when everyone sells them "Linux doesn't do that unlike Apple, Google or Microsoft".

And so, ever more people will keep choosing Ubuntu over other distributions, even when they do have a free choice.

The mere existence of a choice isn't a defining factor at all, it's everything else: available tutorials, number of users, onboarding experience, how quick they can get things working and so on.

Tis where the discussion does turn political. The public space is regulated through laws for many reasons. But such rules and laws aren't static. They can change through political discussion and ever changing power balances. And so, consumer protection laws exist not just to protect individual consumers, but also to ensure that large, unintended second order effects of new products and services don't cause shocks that might derail an arguably stable society.

If retail chains are free to add more and more unhealthy ingredients to their food products because that clearly drives costs down and attract more customers, the societal cost will be an increasing number of people who suffer from health concerns linked to consuming those products. Not because people don't mind their health, but because convenience forces them, and the alternatives are simply too costly.

By the same token, if companies are free to build in all kinds of telemetry sending scripts, that won't stop people from using those products as they prove to be really convenient. But the societal cost will be that private enterprises are able to derive very accurate profiles about who we are, and what we want, and use those in ways that don't align with the interests of users of their software.

The popularity-contest package is installed, you're asked whether you want to participate, and then the package is uninstalled when you say no -- as opposed to asking and then installing the package if you say yes.

That's a heck of a gotcha.

edit: If, after installing, you install sudo and manually disable the root password, you won't be able to boot to the rescue or emergency targets; a valid root password is now required by default.

If you want them to work without a password, like classic "single-user mode", you can edit both the rescue and emergency unit files, and add the --force flag to sulogin.

I have been running swapless for two decades without any issue.

Good point - the phrasing is rather unfortunate.

* https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/18...

Do you think we will see banner ads eventually in Ubuntu?

I agree I’d rather pay 30usd or whatever.

Can you provide links to all software you have ever written so I can complain about bugs that existed in 2017?

Look, Nothing against you, you dont seem to have a systems exposure i do. Im not a fullstack dev, maybe you are and its fair to just see your own machine and expect everything else to work.

Car builders and bridge builders see different problems to solve, and see risks differently too.