Hacker News Reader

Comment by akerl_ | Hacker News Reader

I'm not sure how I feel about programs phoning home like that. I tolerate it with apps, but command line tools ought to be doing their stated function when run.

View on HN

There was a discussion of this a few weeks ago on the mailinglist of a scientific software project I use. The people were very clearly divided into the "Flash does it, so it's ok" and "omg no, think of the user privacy" camps, it was quite interesting.

I think I'm much more ok with background things upgrading in the background. For instance: I never open a new browser tab and think "hmmm, lets launch a Flash process", it's just there, ready to respond when needed. So it isn't shocking to find that it polls for updates and applies them.

By contrast, git is a tool that I manually invoke on the command line, and when the process terminates it's done. Having that phone home at runtime feels more invasive.

That's a good point actually. It fits with the principle of least confusion. (The software I mentioned is a command line tool/library.)

A tool printing "This version has a critical vulnerability, upgrade immediately" wouldn't be confusing though, or cause any problems. Even if it wasn't connected to the network, it simply wouldn't print that message. Everything else would still work properly.

It seems like people are worried about privacy without thinking it through.

I think it's a distro's job to deal with it. The cli tool shouldn't phone home, but the distro should be able to be notified of a critical update and strongly warn you the next time you try to launch it.

Maybe even a push update you can subscribe to.

It can be done in a way that preserves privacy: Package manager regularly asks for compromise information. When programs run, they ask package manager if they are compromised.

That still feels like asking too much of each individual program. I'd prefer it if the package manager did the check itself periodically.

Reply on news.ycombinator.com