Hacker News Reader

Comment by greenwalls | Hacker News Reader

Thanks for your feedback. We'll try to add more transparency. The calling home is for software updates and it shows up on the graph, and GlassWire can even block itself.

View on HN

Update channels are very hard to secure and is a huge opportunity to take ownership of the software (and from it, the machine).

For an example, check out the Defcon 22 talk Hack All the Things[1], page ~61. NTV200-100NAS owned through unsigned updates....

[1] http://download.gtvhacker.com/file/generic/GTVHacker-DEFCON2...

Thank you. We will check it out in detail.

Another simple fix: tell us who you are. The contact page is woefully generic and anonymous. Glasswire appears to be a company, more than one person. Where are you based? What's your background? Funding?

That may be the case, but it's still not acceptable in my opinion. Calling home to fetch a new database of malicious hosts and such is fine, but calling home for analytics is not okay. At the very least, clearly disclose it and make it easy to opt out.

Out of curiosity, do you have any security concerns about calling home for analytic or is it just you would prefer the privacy of not having your usage tracked?

It's mostly privacy concerns, but also the fact that you use this software at all can disclose some interesting information to eavesdropping attackers. Most worrisome is just that it's not very well disclosed - most users just don't know it's happening, and it's not very well justified.

How can you say "most users don't know it's happening" when it's the first thing you see in the graph when you load the application?

We got your initial point..

I think you're just grinding metal at this point.. Ease down.. ease down...

I don't see anywhere that it discloses what is being sent, just that it's sending something. Did I miss something?

If it's opt-in, I enable it. If it's opt-out, I disable it.

For me it's a matter of principle. That people politely ask is both an indication of trustworthiness and how I prefer things to be, so I try to help by enabling it.

It also depends on the way they ask. Mozilla Firefox for Android tells me that I should choose what I share, enabling crash reports and disabling telemetry by default. Even though the crash report is technically opt-out, they ask me in clear terms. I like that.

> but calling home for analytics is not okay

It's like you didn't even read what was written.

Reply on news.ycombinator.com