Comment by jka | Hacker News Reader

Comment by jka | Hacker News Reader

For anyone new to Debian: it's a Linux-based operating system distribution, available at various levels of support for multiple computer architectures:

https://wiki.debian.org/SupportedArchitectures

Debian includes an extensive set of packages -- including communication and office tools -- that can be installed at the command-line or by using a desktop UI. This includes dependency management, so that installing (or removing) a package will also pull in (or can clear out) required and related packages.

https://www.debian.org/distrib/packages

The Debian distribution does not include any telemetry or tracking (although some packages within it may do), and it has a social contract to remain 100% free and to provide source code for almost all components (some non-free packages are available in cases where the authors are not willing or able to provide them openly):

https://www.debian.org/social_contract

I've probably misrepresented a few details there, but I think it's a marvel of the modern technical world, up there with the Internet Archive, and the Linux kernel.

That's not to say it's perfect - but the nice thing is that anyone can improve it at no financial cost (and in return, they get to experience that many people benefit from reduced costs - time, frictional, and economic).

It isn't true that Debian does not include telemetry; there is the package popularity contest, and also the cross-distro hardware database (but both are opt-in):

https://popcon.debian.org/ https://qa.debian.org/popcon.php https://wiki.debian.org/Hardware/Database https://linux-hardware.org/

Unfortunately there are also many other privacy issues with many packages in Debian, but we welcome help finding more and fixing all the issues:

https://wiki.debian.org/PrivacyIssues

>Chromium suddenly starts downloading a binary blob

>A Debian bug that was filed at the end of May serves as a reminder that even open-source software is not immune to some of the problems of proprietary software. In this case, Chromium 43 was silently downloading a browser extension to enable the "OK Google" voice activation "feature" of the browser

Oh shit, that's scary...

Thank you for the correction, and I don't remember seeing the PrivacyIssues page before - that's a useful resource. Looking forward to reading a bit more about popcon & hwdb as well.

So I actually write some software that would be in violation of their ICE policy and I’m not sure how I’d remedy it. I could just not have defaults in my config file but my users have no idea what a STUN server is and there doesn’t seem to be a system location like for DNS.

I could print a message like “you need to configure some ICE stuff, if you don’t know what these are then use xxx” but that seems worse for users. Now they have to do work so be in the same place privacy wise.

To be clear, the ICE policy isn't an agreed-on Debian-wide opinion, it was just added to the page by a Debian contributor who is concerned about it.

I agree with their concern that hard-coded STUN servers are a potential issue, since the user is not in control of where their traffic goes and whether or not they trust that location.

I agree the suggested best practice doesn't work great for software with a non-technical audience.

Perhaps there needs to be a public ICE pool like the public NTP pool as well as a shared list of known public ICE servers that each software needing stun servers could depend on. Then you could say "cannot contact $foo directly [info link about IPv6, NAT etc], who would you like to try to contact them via?" followed by a list "volunteers" (the pool), Google/Ekiga/GNUnet/Mozilla/etc, custom.

Reply on news.ycombinator.com