From owner-freebsd-ports-bugs@freebsd.org Sun Nov 15 10:25:41 2020 Return-Path: Delivered-To: freebsd-ports-bugs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id C51CD2E3611 for ; Sun, 15 Nov 2020 10:25:41 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mailman.nyi.freebsd.org (mailman.nyi.freebsd.org [IPv6:2610:1c1:1:606c::50:13]) by mx1.freebsd.org (Postfix) with ESMTP id 4CYpJ46C1Qz3RC6 for ; Sun, 15 Nov 2020 10:25:40 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: by mailman.nyi.freebsd.org (Postfix) id 2F74F2E35B1; Sun, 15 Nov 2020 10:25:40 +0000 (UTC) Delivered-To: ports-bugs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 224D12E3709 for ; Sun, 15 Nov 2020 10:25:40 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4CYpJ25pmkz3RFC for ; Sun, 15 Nov 2020 10:25:38 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 9329C1A858 for ; Sun, 15 Nov 2020 10:25:37 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 0AFAPb1c033737 for ; Sun, 15 Nov 2020 10:25:37 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 0AFAPbli033736 for ports-bugs@FreeBSD.org; Sun, 15 Nov 2020 10:25:37 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 251152] sysutils/bsdstats violates POLA and data protection rules Date: Sun, 15 Nov 2020 10:25:37 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Ports & Packages X-Bugzilla-Component: Individual Port(s) X-Bugzilla-Version: Latest X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: d8zNeCFG@aon.at X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: ports-bugs@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback? X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter cc flagtypes.name Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Nov 2020 10:25:42 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D251152 Bug ID: 251152 Summary: sysutils/bsdstats violates POLA and data protection rules Product: Ports & Packages Version: Latest Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: Individual Port(s) Assignee: ports-bugs@FreeBSD.org Reporter: d8zNeCFG@aon.at CC: scrappy@hub.org CC: scrappy@hub.org Flags: maintainer-feedback?(scrappy@hub.org) Scenario: - FreeBSD 12.1 - lastest ports - running "portmaster sysutils/bsdstats" Result: - the port gets installed - during installation, without warning and without further user interaction: . it collects information and transmits it to a central site . it installs a tracking cookie/unique id in /var/db/bsdstats . it installs a setting in /etc/rc.conf making it run on every system sta= rtup . it installs periodic scripts making it run periodically . it never reveals which information is collected and sent to the central site This amounts to a violation of POLA - ports do not usually start the progra= ms they install immediately, and worse, to a violation of data privacy rules, = for example those valid in the European Union (GDPR). Expected result: - the port gets installed - no further changes to the system are made; specifically, none of the data collection programs the port installs are automatically run - the port message informs the user about . what this port does . which data it collects . where the data is sent, and for what purpose . how to actively give assent to the port's data collection and transmiss= ion properties . how to enable the data collection program to run at system startup . how to enable the data collection program to run periodically . how to retract one's permission for the data collection and transmission and disable all such collection and transmission . how to reach the operators of the central site and demand that all collected information be deleted - the program provides an option to inspect which information is collected without sending it anywhere Bonus: - the program provides an option to delete all the collected information on= the central site and then deletes the locally generated cookies/unique id. Note that the GDPR defines "personal data" as "any information relating to = an identified or identifiable natural person (=E2=80=98data subject=E2=80=99);= an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors speci= fic to the physical, physiological, genetic, mental, economic, cultural or soci= al identity of that natural person". -- Martin --=20 You are receiving this mail because: You are the assignee for the bug.=