Hacker News Reader

Comment by ethbr0 | Hacker News Reader

The alternative is that Azure owns complete access to the customer. Which seems... well, an easy skip to App Store-esque rent seeking.

So MS sharing "their" customer details with the image provider seems more generous than evil. Provided there's a "Do not share" config option somewhere.

View on HN

If I'm doing business with Azure, I would absolutely expect them to keep my data and behavior private. It's part of the reason why I would be paying them (instead of expecting something for free) in the first place.

So if I write a piece of software that eventually makes it to Debian and Ubuntu, am I entitled to your name, address, phone number, email, and a data feed showing every time you start or stop your Ubuntu instances on Azure? After all, I am a third party software provider at that point. And look, Azure doesn’t even have to tell you they are sending me all that stuff. It’s in the TOS you didn’t read!

If I choose to run an image maintained by IgorPartola, sure!

If I download packages and Ubuntu, and assemble my own image, or use one assembled by another org, probably not.

I think the disconnect is that for me, image packaging and updating is work, and that work has an author, and the author is deserving of certain rights others are not.

If Azure is auto-pulling Ubuntu images, building containers, and publishing themselves, then that's a different story.

The issue is more so *why* Microsoft is sharing this information with Canonical. — what does it obtain from it?

Ubuntu is gratis, so Canonical can't have coerced Microsoft into doing so; it is quite probable that one approached the other to make a deal, and that Canonical is paying a certain fee for this information.

The code is gratis. Although, partnership deals tend to go beyond simply sharing code, and into the realm of dedicating time and resources to working with each other.

The code is more than just gratis; it's libre. This is Ubuntu, based on Debian GNU/Linux. (Yeah, okay, some of the code is merely gratis, but most of it is libre.)

I don't expect an OS based on an OS based on an OS based on a half-finished OS based on free software principles to have shady data-dealing attached, yet hidden from the people whose data is being dealt.

My point is that it's not about the code at all.

You might not have expected it, but privacy protection is not any sort of obligation encoded in any extant concept of Free Software.

It has nothing to do with Free Software. I'd expect the same treatment if I were paying Microsoft to run Oracle for me.

So you didn't read the ToS, I take it? I did. I do whenever it's something important to the company's infrastructure. Canonical is the one at fault here for not adhering to Microsoft's guidelines. But Microsoft put the warning on the package.

I mean, it's kind of ridiculous to think that you could do anything in a cloud environment system and not have your actions tracked. Hell, with automated load balancing and load-based billing, that's literally what you're signing up for.

Free software is about user empowerment, and the ability for users to be hackers if they want to (or employ people to make changes on their behalf). “Sike, we've been stalking you and you can't do anything about it” is antithetical to this ideal.

Privacy protection is not an obligation, but transparency and openness is. Yes, you're not contractually required to not make a separate computer system that's proprietary and closed and disempowering, but that's so pedantic as to be malicious.

another vector here is the WSL

I wouldn't be surprised to learn Azure was paid (either money or developer time) and this is happening for other products. I would think twice before using Azure if I was concerned about my usage being shared.

It is. For example I've warned others about the eula shipped with Dell systems with Linux (Ubuntu) on them for similar reasons... and encourage people to do their own installion of images (containerized or otherwise).

I think this is why this doesn't shock (shock!) me.

We're talking about a curated, supported, official image here, right?

If folks want to use a "MyUbuntuImage" they or someone else packaged and uploaded, more power to them.

But by pulling a Canonical image, you have a relationship with Canonical. Expecting that relationship not to exist "because open source" seems to be misunderstanding who does what work.

As to whether this should be opt-in, done, etc. is another matter entirely. But the fact that it exists at all doesn't feel particular shocking.

It's not like we're talking about everyone who pulls a RedHat image's info being sent to Canonical!

Reply on news.ycombinator.com