Comment by cs702 | Hacker News Reader

Comment by cs702 | Hacker News Reader

Parent Full thread

Ubuntu provides by default an on/off slider in its privacy settings for disabling the display of online search results in the dash[1], BUT I'm not sure if changing that slider to 'off' will also disable the sharing of searches with Canonical's servers. (The language used by the settings app is ambiguous: "When searching on the dash, include online search results - ON/OFF.")

Moreover, I don't particularly feel like spending time & effort examining Unity Dash source code to figure out if and how my information might be shared with Canonical and/or other third parties. Canonical should make an unambiguous promise not to transmit any data to anyone, right there on the privacy settings screen, whenever that slider is set to the 'off' position. I would trust such an unambiguous promise.

So thank you for submitting this website here -- I've bookmarked it for when I upgrade my desktops from 12.04 LTS to 14.04 LTS next year.

--

[1] http://b2b.cbsimg.net/blogs/screenshot-from-2013-03-24-09342...

--

Edit: Added second paragraph.

It's open source. Since it sounds like you won't trust Canonical's claim on this anyway, why don't you take a look, or ask somebody who can, instead of creating fear about it?

If it turns out that searches leak out despite the setting, I'm sure you'll hit the front page of HN. Since this hasn't happened, and Canonical have been under considerable scrutiny about it, I think it's safe to say that your conspiracy theory doesn't hold up.

If the searches leak out despite the settings, I would like to know about it so I can promptly issue a security update.

Shouldn't you explicitly ask the user's permission before letting the searches leak out?

When someone uses a box marked "search online sources", they probably don't need to be asked "Are you sure you want to search online sources?"

The default is to leak information. There's no opt-out in the installer.

Why not just use a non-Unity desktop? At this point all 3 major spins of Ubuntu are highly stable and functional.

The other versions within the Ubuntu family also connect to Canonical servers.

I see connections to "...golem.canonical.com" in Etherape when using Lubuntu 13.10.

This reminds me of "whoopsie" when I first came across it after upgrading my servers to 12.04. Its a program that resides in the ram, automatically homes in the crash reports and would have to be explicitly disabled. At first I din't mind, but after watching it eat through my ram I had it disabled. As far as privacy goes, who knows what those sent in memory dumps might have.

whoopsie doesn't send anything without your permission.

Yes it does, how is it going to ask for my permission in a server environment? It automatically sets "report_crashes=true" under (/etc/default/whoopsie) when Ubuntu is first installed.

Here are some resources with more people reporting the same:

[1] http://blog.retep.org/2012/07/05/whoopsie-how-to-disable-it-...

[2] http://glog.procrasstination.com/index.php?/archives/47-Ubun...

[3] http://ubuntuforums.org/showthread.php?t=2000108

It's vestigal on a server. It's there because the server installation and the desktop installation share that component. But since there's no UI for you to approve transmission, currently the crash reports sit on the server awaiting (local) examination and do nothing.

All the resources you pointed appear to be people who have found a setting and do not understand that it does not do anything.

Like my posts elsewhere on this thread, it's open source. Take a look for yourself, or ask someone who can.

>It's vestigal on a server.

Do you have any source for that? If it is vestigial, why would it need to suck up so much ram? Unless I explicitly activate it, what is point of draining the power and filling up the ram by default. Not everyone does and know how to inspect the crash dump, they are mostly useful to the OS manufacturer and the developer of the crashing application.

> currently the crash reports sit on the server awaiting (local) examination and do nothing.

So Ubuntu (Canonical) doesn't collect any crash data from servers but only from desktops despite having the technology built-in and activated? Highly unlikely.

> Do you have any source for that?

Yes. "apt-get source whoopsie". What other source would you prefer? Canonical, who it seems that you don't trust and won't believe anyway?

> So Ubuntu (Canonical) doesn't collect any crash data from servers but only from desktops despite having the technology built-in and activated?

Correct, because the server end is not implemented. A summary of the gathered data is at https://errors.ubuntu.com/. You may see "server" packages there, but if this is true then this is only because you can install these packages on the desktop, too, and desktop users can agree to send crash reports for crashes on server packages. But the numbers on this site speak for themselves. Clearly server crash reports are not being reported there.

> It's vestigal on a server. It's there because the server installation and the desktop installation share that component. But since there's no UI for you to approve transmission, currently the crash reports sit on the server awaiting (local) examination and do nothing.

Aside eating up 8GB of RAM on one file server I'd built. I couldn't believe it when I saw that.

Wooopsie is just one of many reasons why I always recommend vanilla Debian over Ubuntu Server.

Ca you fix it, please?

Yes, it's supposed to disable it completely.

supposed to

What's with the ambiguity? Does it disable it or not?

I feel silly for asking, but the question was about ambiguous language, so the reply was ironic.

Sorry, didn't mean to be ambiguous.

It's what it was designed for. If there is a bug that is preventing it from working properly, I would like to know about it so I can make sure it gets fixed.

I have to agree with another commenter ... It's not NSA level ambiguity ... It is open source, go check it if you don't believe it! :)

"I've bookmarked it for when I upgrade my desktops from 12.04 LTS to 14.04 LTS next year"

Shuttleworth changes his strategy more often than his underpants but I recollect that there was a 'business edition' of 12.04 that cut out all the Web 2.0 integration stuff. Might be worth checking if a similar edition was made for 14.04.

This is all I can find now, no ISOs for 12.04 any more

http://www.ubuntu.com/content/introducing-ubuntu-business-de...

Reply on news.ycombinator.com