Is "phoning home" for checking for the latest version (no unique identifiers sent along with the request, other than IP address) frowned upon?
I doubt anyone will really care about version checks, unless that's the only reason your tool needs internet access at all. Maybe if you make it an opt-out rather than an opt-in feature (or don't prompt the user at all), I'd be annoyed by that (but I know others aren't).
They're completely unnecessary in packaged Debian software because the Debian people will provide newer versions of your application for their users, so a flag to opt out would be nice. Using this data in a useful way, like adding a message like "new version available" would be confusing, because there is no new version available when you run the system update tool!
Personally I'd say it should be possible to disable version checks through build flags if you intend to package software through official repositories.
If you intend to do distribution and updates yourself I don't think you should be forced to alter your code if people decide to add your software to their distribution. The burden of removing confusion and making their version stick to their ideals should be on them. It would be nice to cooperate, but I don't think you can be blamed for someone else's redistribution.
A distribution-provided package doesn't really need to be a fork unless upstream isn't playing nicely with the rest of the OSS ecosystem.
An IP address alone may not reveal who had visited a site. However, Internet Service Providers have additional data that can link IP addresses to individual people. Although it's unlikely that the two data sets will ever be matched up, it is possible. So IP addresses must be treated as personal data.
You can make up your own interpretations of the law as much as you want, but in real life the interpretation from the CJEU (for US readers like me, the EU's equivalent of the Supreme Court) is the one that matters.
But as others already said: if you don’t store the IP (eg in logs) it should be fine.
It would be illegal specifically if you _collected and stored_ the IP address information from the phone home requests to process in some form later.
If you simply process the web request, and don't store the IP address then there it no issue.
If you do end up storing IP address in a log somewhere, then simply having the logs deleted in a documented and reasonable timeframe will be enough.
"Documented and reasonable timeframe" is intentionally vague since business requirements are varied, but if you can justify whatever you come up with, then there is no issue.
Simply do not hold onto user data for longer that what is required for the purposes of the user request. That's it.
From what I've learned about EU regulations, ANY time you have technology that serves an EU citizen there is the potential for you to be sued over potential violations of the intentionally overreaching and vague privacy laws. The EU is so incredibly hostile to small business and FOSS.
It's not EU being hostile, but rather US being incredibly lax(to put it mildly) about privacy issues, so that we even consider these violations a norm.
Running a service that might serve an EU citizen quickly escalates to involving lawyers and performing risk analysis in relation to being sued in a court across the ocean.
Running any service where you are not sure of legal requirements might require consulting a lawyer first, how is it unique to GDPR? And in order to be on the radar for GDPR violations as a small business you REALLY need to do something seriously wrong.
I've always believed GDPR was a regulation that crossed borders. Meaning it applies to any EU citizen, no matter where they are located, which is what made this unique (being that it's not my countries laws). But:
> The GDPR applies to: > > a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.
from https://commission.europa.eu/law/law-topic/data-protection/r...
So now I'm wondering if an IP address reverse-geo lookup to block IPs in the EU is the easy way out for many online services, presuming that this doesn't cause compliance issues for EU users using a VPN.
"Processing shall be lawful only if and to the extent that at least one of the following applies: [..] processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data"
Reasonable abuse protection clearly falls under that, as has been fairly clearly stated even in the GDPR itself: https://gdpr-info.eu/recitals/no-49/
How long can the IP kept around for? And in what form? If it lands in a database, does it need to be encrypted at rest? Can it just be hashed? Salted, too? Do I need to rotate the salt? This limits the ability to protect the service though. Are the tools in my stack logging something somewhere else I don't know about? Could I get in trouble if it is? Cloudflare forwards IP-derived data to me, like the city of IP may be in, do I have to be concerned with that as well? Do I have to tell users upfront that I use Cloudflare and it derives data? I'm guessing I have to fully understand what CLoudflare does with this data. It eventually hits my Digital Ocean droplet, what does it log?, are there separate logs I can access from them outside my droplet? Certainly they have logs, too, what do I do about that? If I just require all users to explicitly agree to some form of data collection this probably goes away. Oh wait, now I have to manage obvious PII and ensure Right to be Forgotten can be exercised in a timely fashion, I've just made the whole thing more difficult for myself.
There is a cost, and it affect the small honest devs the most.
I'm not saying what GDPR is attempting to do is a bad thing, I'm just saying that it is not easy to comply like everyone keeps saying.
You have to be sure that you or anyone else in your chain can't link an IP to a specific person without explicit consent (and thus compliant with the rest of the regulation).
You can have cloudflare giving you IP/location pairs as long as cloudflare doesn't know who that person is.
You can keep your own logs of IP/person. You have to keep it safe, and inform somewhere in a policy that you are doing that. If the logs are kept abroad or cloud, then you need consent (and comply with the rest of the regulation).
It's all made to avoid companies tracking using across boundaries, selling data and having all that PII unwarranted for the next "We take your data and security very seriously" blog post about a leak.
It's easier not to keep any PII around. IPs? you can have as many as you want as long it can't be used to identify a person (without consent).
PS: here is a checklist => https://gdpr.eu/checklist/
Updates for OSS is also often installed via a package manager so additional checks are less useful and generally unwanted. That leaves non-package distribution (e.g. Windows or portable binaries) - I think best would be to either ask during installation or ask once if the local clock is quite a bit past the release date of the current version.
Of course different people will have different opions on this.
If you want to push updates faster than Debian stable does, the proper way to do it is to provide a third-party APT repository. Then I can decide to disclose my IP to a mirror of my choice, using a proxy of my choice, that can be configured globally in /etc/apt.
Software should not make outgoing connections or accept incoming connections unless requested by the user.
modern websites are a cancer that we really quite could do without
The proof is in the pudding. You claim nobody wants these things yet there are billions of people using these kinds of sites.
Just because a lot of software sucks doesn't mean it's acceptable or we should lie down and give up. We should work on improving OS capability/permissions models so that apps can't do this by default.
In the absence of better protections, I absolutely audit which processes make connections from my machine and uninstall those that make unwanted connections that can't easily be uninstalled (with a small number of unfortunate exceptions where the need to use certain software outweighs the desire to maintain a reasonable system).
This doesn't mean no connections ever, it means no conections users don't ask for and no connections that don't provide value to the user. It certainly means no phoning home or stats/crash data connection without explicit opt-in.
1) "Privacy": I.e. the fear of PII being transmitted or used by a third party
2) "Control": I.e. the fear that the system does something that I didn't ask it for.
They are (quite weakly) linked, but they aren't the same things. I'd avoid even discussing them in the same breath for this reason. Saying that checking for updates is a privacy violation just means that everything is lumped together which is a fantastic outcome for software that is actually violating peoples privacy. "Everyone else does it".
PII leakages are just considered more severe than general information leakages, so there is a legislation to handle them.
I can see the point but it seems hard to draw the line for every single feature at the precise point of "does a network connection". For some programs there is quite a grayscale of what's "necessary" (i.e. needed) and what isn't.
But i also think there are some clear lines, like if a tool is not expected to use network at all, it should not use it. If a tool is expected to communicate just with explicitly specified hosts, it should not communicate with third-parties, ...
Most other operating systems (linux, macos, ios, etc) update through an os-wide mechanism.
Debian already has apt and that downloads a list of package names and versions from each repo and what is on the system is generally hidden. If the user asks to install a package, then the user has opted-in to download and install that package/dependencies. Also the packages can come from a variety of caches and mirrors.
Yes it's definitely a mentality of "the apps are separate from the OS" at least, which is basically every OS except Linux/Unixes with central package managers. Even on a Debian or Ubuntu system, I'd be using dozens of non-packaged applications though (Be they locally compiled from github, or flatpacks or whatever).
Your IP address is considered PII. Hell with a timestamp you can easily track the behavior of people. When do they work, when are they asleep, which holidays do they observe, when are they on vacation, ... . You can get really creepy with a tiny amount of actual information and some statistical analysis.