https://popcon.debian.org/ https://qa.debian.org/popcon.php https://wiki.debian.org/Hardware/Database https://linux-hardware.org/
Unfortunately there are also many other privacy issues with many packages in Debian, but we welcome help finding more and fixing all the issues:
>A Debian bug that was filed at the end of May serves as a reminder that even open-source software is not immune to some of the problems of proprietary software. In this case, Chromium 43 was silently downloading a browser extension to enable the "OK Google" voice activation "feature" of the browser
Oh shit, that's scary...
I could print a message like “you need to configure some ICE stuff, if you don’t know what these are then use xxx” but that seems worse for users. Now they have to do work so be in the same place privacy wise.
I agree with their concern that hard-coded STUN servers are a potential issue, since the user is not in control of where their traffic goes and whether or not they trust that location.
I agree the suggested best practice doesn't work great for software with a non-technical audience.
Perhaps there needs to be a public ICE pool like the public NTP pool as well as a shared list of known public ICE servers that each software needing stun servers could depend on. Then you could say "cannot contact $foo directly [info link about IPv6, NAT etc], who would you like to try to contact them via?" followed by a list "volunteers" (the pool), Google/Ekiga/GNUnet/Mozilla/etc, custom.