Hacker News Reader

Comment by zxzax | Hacker News Reader

Controversial? This looks extremely similar to most other privacy policies. I would urge you to read the privacy policy on any other web sites that you visit, or for any other services that you use, and compare and contrast. A good starting point might be the privacy policy on your phone's app store.

View on HN

We're talking about Free Software — not about websites, services, or mobile cartels.

I'm not sure what you're suggesting the difference is, or what specifically here is a "mobile cartel?" FOSS projects and other related things also have privacy policies, and in fact you probably want them to so that they're clear what they're doing with the data they've aggregated. Here's some examples:

https://docs.github.com/en/github/site-policy/github-privacy...

https://www.debian.org/legal/privacy.en.html

https://fedoraproject.org/wiki/Legal:PrivacyPolicy

https://www.fsf.org/about/free-software-foundation-privacy-p...

Those are all talking about interacting with those projects' websites and community events, not about interacting with the software those projects produce or package. It is absolutely not the norm that Free Software running on my machine reports my usage.

Do you expect to be able to receive updates and security fixes to your installed programs? Or send back a patch or bug report? If so, then it absolutely is the norm, because all that needs to be done over the internet and can generate PII. It probably shouldn't be assumed that a distribution platform can avoid having a clear and straightforward privacy policy because it calls itself a "FOSS repo" and not an "app store." Or did I miss something? Do some people only exchange security updates and crash dumps off of physical media given in person?

> Do some people only exchange security updates and crash dumps off of physical media given in person?

Sure it's not "the norm" but personally I run a Poudriere[0] server and build all my own software packages. One server syncs the FreeBSD Ports collection and downloads the needed software source distfiles, but then none of my other machines/jails are allowed to install software from anywhere outside my own network. A lot of them don't get any Internet access at all.

That still has nothing to do with in-app analytics though.

[0] https://github.com/freebsd/poudriere/wiki

I'm still not sure what you're saying, you're still downloading the source from an external website on the internet, which I would expect would have a privacy policy, and would do things like comply with the GDPR. And presumably, the ports collection is getting the original source from upstreams, which could be on github or a similar service, so you can't sidestep that if you want to maintain your own ports tree.

It absolutely does have to do with analytics: in particular, Debian has an opt-in anayltics system called "popcon" which is mentioned in the privacy policy.

"none of my other machines/jails are allowed to install software from anywhere outside my own network. A lot of them don't get any Internet access at all."

Presumably the objective is to have machines that do not connect to the network without at least a human in the loop. This used to be the default, and is still very helpful in a lot of situations. For one, it keeps the noise down when you are trying to debug network issues.

How is Microsoft Github a FOSS project?

That FSF link relates to their site.

Audacity is an offline non-networked application.

Reply on news.ycombinator.com