The "adverts" are benign. Right now it says to check out microk8s and also to look at livepatch.
But logging in and seeing a summary of: loaf, disk usage, processes, number of users logged in, IP addresses, memory usage and swap usage, kernel version and also last login time and from what IP.
That's pretty useful stuff to me.
Also if you're in the position to care about motd, you're going to have the skill to change it yourself.
My distro shouldn't be advertising to me. Call me "old school" but this has no place in Linux. Also, if you're in a position of trusted compute then you don't want this sort of information leaving your network.
> Also if you're in the position to care about motd, you're going to have the skill to change it yourself.
Yeah - and I feel I shouldn't have to add it to my images/recipes/whatever to fix this. I use Linux for a lot of reasons, and some of the most important ones are that it doesn't advertise to me and/or leak data. This is telemetry and it's unacceptable.
I don't use Ubuntu, and you don't have to either! It's almost like there are millions of Linux distributions!
I'll argue that utilization of Linux comes with certain "expectations" which is why so many of us decide to use it in the first place. Some of those expectations include (but are not limited to) rock-solid stability, "be good at one thing", lack of bloatware, sane update/upgrade cycles/policy, privacy, and security.
I've been using Linux professionally for just over 15 years now, sometimes in highly compliant/systems-critical infrastructure. The privacy and security bullet points above are the most important factors to me when designing and/or hardening systems.
> I don't use Ubuntu, and you don't have to either! It's almost like there are millions of Linux distributions!
Actually - I had to at my last position. When people make technology decisions they often go with the most popular/"safe" options and then dictate the decision to those implementing it. Welcome to corporate America (which is where the jobs are). Everything new was spun-up with Ubuntu as a base distro and you better believe I manually opted-out of this "feature".
---
There's a big problem when the most popular distro starts making moves like this as it sets precedent that it's OK. Canonical has made the decision against privacy/security in regards to their motd and that's a huge issue, and I argue it goes against the ethos of Linux and OSS.
It's a seller's market for labor.
There's a big problem when the most popular distro starts making moves like this as it sets precedent that it's OK. Canonical has made the decision against privacy/security in regards to their motd and that's a huge issue, and I argue it goes against the ethos of Linux and OSS.
You're using "OSS." "OSS" is the word that caused this situation! "OSS" was intentionally a term to make free software corporate. Canonical's just doing what people who use and coined "OSS" started: making free software corporate.
In the Free Software world, this is bad, but in the corporate world that "open source" advocates have brought among us, this is normal. It's perfectly fine: open-source software is for-profit, not for the common good.
I dislike the idea of tying particular political or economic philosophies together with a tech stack like Linux.
Everyone can distribute linux distributions however they see fit, it's an open platform and if that includes telemetry by default that's fine too as users have choice. I don't think anyone uses a Canonical distro and is genuinely upset or surprised about this particular benign case.
The linux distribution space is truly one of the few places where we can't make any excuses about market power or lack of choice. There are a billion distributions, almost all of them free. Users will pick accordingly, and my sense is that virtually nobody cares about this particular case of telemetry.
It isn't about politics nor economics. It's about privacy and control. That is linked with Linux for a lot of users. And Linux users have a pretty good situation in regard to this.
But it is starting to erode and if allowed can only get worse.
It is unacceptable and the fact that canonical don't realize this is why I'm thinking of alternatives.
Especially considering the use case. Either they haven't got a clue, or they are testing the waters. Does not look good any way you look at it.
Good for you, but don't you sort of expect this with Ubuntu? It's obviously pushing in a different direction from the likes of Debian. I'm not sure most reasonable people have much sympathy for you here.
>> It isn't about politics nor economics. It's about privacy and control. That is linked with Linux for a lot of users. And Linux users have a pretty good situation in regard to this.
Privacy and control are intermingled with politics and economics. A quick analysis of Ubuntu and Canonical would have suggested that this risk exists for you.
>> But it is starting to erode and if allowed can only get worse.
You are naive if you think that it won't erode further in your view. Economics and the desires of Ubuntu audience will result in further "features" like this. It's inherent in their mission and they don't particularly care about you.
>> It is unacceptable and the fact that canonical don't realize this is why I'm thinking of alternatives.
They do realize this. They just don't care. You are the type of customer they want to fire because you aren't their audience, yet fight their choices.
>> Especially considering the use case. Either they haven't got a clue, or they are testing the waters. Does not look good any way you look at it.
It doesn't look good to you, but it's a trade-off with their users because it's intrinsically tied to their audience, economics, politics, etc. Don't forget that audiences can change. The customers that brought them to this point may not be those who take them to their next goal. It's just business. You can say Linux is more than business, but it doesn't really make an impactful argument.
I've had to use Ubuntu in an environment with high security needs/regulations. I've had to disable this exact feature because leaking OS versions, network information, etc. externally via that user agent string was unacceptable from a security standpoint.
I was upset that something as simple as a motd had been retooled to leak data.
> and my sense is that virtually nobody cares about this particular case of telemetry.
And in my real-world experience I've been paid to care. When forced to work with Ubuntu (which is everywhere these days) I have to "reign it in" with custom images/scripts/etc.
> I dislike the idea of tying particular political or economic philosophies together with a tech stack like Linux.
This isn't "political or economic philosophies" this is security 101. Leaking data like my OS version, IP addresses, when admins are doing their work, etc to the public internet is a hard "no" for anyone who's operating in any semblance of "best practices".
You're afraid of the public internet seeing your IP address? The address that is required to serve responses to your requests?
In the screenshot posted you can see the following data is being sent out:
```bash
USER_AGENT="curl/$curl_ver $lsb $platform $cpu $uptime cloud_id/$cloud_id"
```
This is 100% not acceptable. That data is NOT to leave my environments.
Also we didn't use stock Ubuntu - I/we had to get it to not phone-home... it was just extra layers of "we shouldn't have to do this" in regards to managing the OS.
I left the company when it was apparent that "security culture" were just buzzwords they would repeat in meetings to make themselves feel better vs. an actual core competency. They had more resources assigned to migrating our WordPress blog to K8s than they did for the credit-card handling infrastructure.
Honestly Ubuntu was one of the least of my worries, but after the experience of getting it to "shut up" and stop phoning home I made the decision to never recommend it moving forward as a security best practice.
As such, linux is just as much a product and a service as it is a technology tied to very real markets and niches. And it with that come the exact same concerns you'd find in any other market.
Your observation is totally correct: there are tons of distributions and there is plenty of choice and people don't care.
But that choice is far from granted, and it's not an argument that deprecates questions about moral responsibility: Are companies providing a service/product entirely responsible for the consequences? Or are customers entirely responsible for their own choices and behavior? Or is it both?
Let's use an analogy to demonstrate. Bread is a great example.
The vast majority of people eat bread daily. And so there's a huge demand. But the market has consolidated in some places and so many people end up buying bread from retail chains. Sadly, such bread is a processed food and contains many ingredients that aren't that healthy such as emulgators (E-numbers), or loads of sugar.
You could argue that people still have a choice: You could go to an artisanal baker. Or you could bake your own bread: the recipe isn't that difficult and requires few raw ingredients. So, why aren't people doing that when they know retail chain bread isn't good for them? Three reasons: because artisanal bread is expensive; it's a different shop from a centralized retail shop and making decent bread takes time and skill. Consumers simply calculate cost/benefits: buying cheap bread is far more convenient in the short run, even though the long term consequences may cost more.
Okay, so how does that hold up with Linux? Same thing.
Ubuntu is huge because it was successful in it's marketing early on; and it did a bang up job in creating an effective onboarding experience for new linux users. You can argue about their design choices over the past 15 years, but in the end, they have been ahead of the competition when it comes to tapping into a new generation of users.
As time went on, what you see is that the Ubuntu community has spawned a huge volume of documentation: tutorials, videos, stackoverflow posts,... Google "how to install sound drivers in linux" and your first hit will be tutorial for Ubuntu. Whereas trying to find the same information for lesser known distributions might be just a tad harder.
And that's what makes all the difference. Convenience. If you spend an evening trying to fix your damn audio after first installing Slackware, and all you find is Ubuntu tutorials, you will likely just switch over to... Ubuntu. Especially if you aren't particularly interested in the design philosophy of Slackware, or who these Canonical people are anyway. You simply want to listen to your favorite Spotify playlist, right?
So, the issue here is that both retail chains and Canonical understand that the vast majority of people simply want convenience and they will easily choose it over principle or their own self-interest. And so, it's extremely tempting to exploit that.
The question then becomes whether it's morally right to tap into that and take more from your customers or users then what they are bargaining from. Especially when they aren't really aware you're doing it. Either by using ingredients that aren't prohibited, but clearly unhealthy, or by using techniques to gain more insights about their behavior. Especially when everyone sells them "Linux doesn't do that unlike Apple, Google or Microsoft".
And so, ever more people will keep choosing Ubuntu over other distributions, even when they do have a free choice.
The mere existence of a choice isn't a defining factor at all, it's everything else: available tutorials, number of users, onboarding experience, how quick they can get things working and so on.
Tis where the discussion does turn political. The public space is regulated through laws for many reasons. But such rules and laws aren't static. They can change through political discussion and ever changing power balances. And so, consumer protection laws exist not just to protect individual consumers, but also to ensure that large, unintended second order effects of new products and services don't cause shocks that might derail an arguably stable society.
If retail chains are free to add more and more unhealthy ingredients to their food products because that clearly drives costs down and attract more customers, the societal cost will be an increasing number of people who suffer from health concerns linked to consuming those products. Not because people don't mind their health, but because convenience forces them, and the alternatives are simply too costly.
By the same token, if companies are free to build in all kinds of telemetry sending scripts, that won't stop people from using those products as they prove to be really convenient. But the societal cost will be that private enterprises are able to derive very accurate profiles about who we are, and what we want, and use those in ways that don't align with the interests of users of their software.
This is an elitist view which implies that if someone doesn't understand something, they aren't affected by it.
And look you dont need to answer those questions either, but take it from me, that kind of thinking and attitude will tank a business and eventually compromise or overburden IT, who will just jail-firewall Machines running that kind of code because its impossible to reign-in in a militerized zone such as a company with over, say, 150+ employees, let alone anything major.
Please reconsider/rethink.
Not like it is the first time. - in the past, Ubuntu has demonstrated a willingness to sell surveillance of their user base to a third party[1].
It makes me trust the company less and worry that if their fortunes or management changes, they'll do slimier, less obvious things.
I suppose this all is ultimately a positive thing. Greed heads serve the function of keeping distro-churn up when they do something gross enough to chase people off, which helps keep the ecosystem healthy.
[1] https://www.zdnet.com/article/canonical-performs-u-turn-over...