Smolt: Fedora Hardware Profiler

[Ralf Corsepius]

On Wed, 2007-01-31 at 11:32 -0600, Dennis Gilmore wrote:
> On Wednesday 31 January 2007 11:15, Ralf Corsepius wrote:
> 
> >
> > It must be opt-in.
> >
> > 1. May-be you should consider to talk to RH legal.
> > In many parts of this world opt-out is ILLEGAL.
> >
> > 2. It should be is a matter of fairness to make it opt-in.
> >
> > 3. In many parts of this world SPY-WARE like yours is a very hot
> > political topic. You are at risk at exposing Fedora to be subjects to
> > such flames.  Even Microsoft has learned their lessons and made
> > "registration opt-in", now you are committing the same FAULT.
> Ralf,
> 
> it is not registration, it is not spy ware. 
It unattendedly collects various data which is not publically available
from a local machine => SPY-WARE

Connecting this information with IP-numbers opens many opportunities for
abuse => Opens many chances to privacy breaches.

I don't have any reasons to trust this URL smolt sends it data too.

>  it is a voluntary hardware 
> profile. there is no way to know that a profile is yours unless you give me 
> your unique hardware id  that is generated on your system at package install 
> time. 
You have this (BTW: absolutely not unique and forgable) hardware id in
connection with IP-numbers. This allows backtracking.

You might have heard about the fuzz HW CPU-ID had caused in the past?

>   This will help fedora in many ways. 
I guess, I don't have to mention: My opinion differs very much.

> it is opt-in   you can choose to install or not install smolt. 
Mike asked about making installation the default. That's why I am so
embarrassed.

Having a script that is not being run automatically (not used by first
boot), but being run at user-request as part of eg. a 
bug-report (similar to bug-buddy) is a completely different topic.


> Feel free to look at the code.  there is no package list sent, no ip, no 
> anything that can be associated to you without you giving me your id.
I'll pretty soon add an "Obsoletes: smolt" into the base package of my local repos.

> And again to re-iterate it is entirely voluntary "you choose" to submit or not 
> your profile
OK, I will have a look at the sources and look if something has changed
since it was under review. At that time I did not notice any opt-in, but
noticed a scripts being run at installation time.

In this particular case, I'll continue to be VERY stubborn.

There is not way to convince me about such spy-ware. If you want to
collect statics with an opt-in, you can achieve the same by launching a
counter website.

Ralf