Smolt: firsboot revisited

[Mike McGrath]

So smolt is still setup in firstboot and still is opt in.  My question 
is do we want to install smolt as part of a default configuration with 
F7.  My vote is yes.

    -Mike

[Jesse Keating]

On Wednesday 14 February 2007 11:59, Mike McGrath wrote:
>  So smolt is still setup in firstboot and still is opt in.  My
> question
>  is do we want to install smolt as part of a default configuration with
>  F7.  My vote is yes. 
I vote yes too, but I want to see other votes before I just do it (:

-- 
Jesse Keating
Release Engineer: Fedora

[Josh Boyer]

On Wed, 2007-02-14 at 12:00 -0500, Jesse Keating wrote:
>  On Wednesday 14 February 2007 11:59, Mike McGrath wrote:
>  > So smolt is still setup in firstboot and still is opt in.  My question
>  > is do we want to install smolt as part of a default configuration with
>  > F7.  My vote is yes.
>  
>  I vote yes too, but I want to see other votes before I just do it (: 
For which spins?  Desktop, Server, and KDE?  I would say sure.  You'd
have to ask the KDE spin guys though.  And I don't think it should be
functional on the LiveCD really... 

josh

[Toshio Kuratomi]

On Wed, 2007-02-14 at 11:08 -0600, Josh Boyer wrote:
>  On Wed, 2007-02-14 at 12:00 -0500, Jesse Keating wrote:
>  > On Wednesday 14 February 2007 11:59, Mike McGrath wrote:
>  > > So smolt is still setup in firstboot and still is opt in.  My question
>  > > is do we want to install smolt as part of a default configuration with
>  > > F7.  My vote is yes.
>  > 
>  > I vote yes too, but I want to see other votes before I just do it (:
>  
>  For which spins?  Desktop, Server, and KDE?  I would say sure.  You'd
>  have to ask the KDE spin guys though.  And I don't think it should be
>  functional on the LiveCD really... 
>   
+1

-Toshio

[David Nielsen]

ons, 14 02 2007 kl. 11:08 -0600, skrev Josh Boyer:
>  On Wed, 2007-02-14 at 12:00 -0500, Jesse Keating wrote:
>  > On Wednesday 14 February 2007 11:59, Mike McGrath wrote:
>  > > So smolt is still setup in firstboot and still is opt in.  My question
>  > > is do we want to install smolt as part of a default configuration with
>  > > F7.  My vote is yes.
>  > 
>  > I vote yes too, but I want to see other votes before I just do it (:
>  
>  For which spins?  Desktop, Server, and KDE?  I would say sure.  You'd
>  have to ask the KDE spin guys though.  And I don't think it should be
>  functional on the LiveCD really...  
It might be useful to have it available. I often boot a LiveCD on
friends machines to see if the hardware is generally supported. It would
be helpful to have a nice little frontend to tell the stats page "This
is the liveCD, all this hardware works" (ands maybe even flag something
as problematic).

I de realise this is more a LCHD (or whatever that larger database is
called - honestly it needs a sexier name).

- David

-- 
"Ridicule is the only weapon that can be used against unintelligible
propositions. Ideas must be distinct before reason can act upon them.” 
-Thomas Jefferson

[Josh Boyer]

On Thu, 2007-02-15 at 08:36 +0100, David Nielsen wrote:
>  ons, 14 02 2007 kl. 11:08 -0600, skrev Josh Boyer:
>  > On Wed, 2007-02-14 at 12:00 -0500, Jesse Keating wrote:
>  > > On Wednesday 14 February 2007 11:59, Mike McGrath wrote:
>  > > > So smolt is still setup in firstboot and still is opt in.  My question
>  > > > is do we want to install smolt as part of a default configuration with
>  > > > F7.  My vote is yes.
>  > > 
>  > > I vote yes too, but I want to see other votes before I just do it (:
>  > 
>  > For which spins?  Desktop, Server, and KDE?  I would say sure.  You'd
>  > have to ask the KDE spin guys though.  And I don't think it should be
>  > functional on the LiveCD really... 
>  
>  It might be useful to have it available. I often boot a LiveCD on
>  friends machines to see if the hardware is generally supported. It would
>  be helpful to have a nice little frontend to tell the stats page "This
>  is the liveCD, all this hardware works" (ands maybe even flag something
>  as problematic).
>  
>  I de realise this is more a LCHD (or whatever that larger database is
>  called - honestly it needs a sexier name). 
Right, I think that belongs more in the other project you mention.  We
don't want to bloat smolt numbers with LiveCD statistics unless people
actually _install_ Fedora from the LiveCD.  And if they do that, then
it's a firstboot option anyway.

josh

[Jarod Wilson]

Jesse Keating wrote:
>  On Wednesday 14 February 2007 11:59, Mike McGrath wrote:
> > So smolt is still setup in firstboot and still is opt in.  My question
> > is do we want to install smolt as part of a default configuration with
> > F7.  My vote is yes.
>  
>  I vote yes too, but I want to see other votes before I just do it (: 
Another yes from me, but would be good to hear from people not under the 
Hat...

-- 
Jarod Wilson
jwilson(a)redhat.com

[Jima]

On Wed, 14 Feb 2007, Jarod Wilson wrote:
>  Jesse Keating wrote:
> > On Wednesday 14 February 2007 11:59, Mike McGrath wrote:
> >> So smolt is still setup in firstboot and still is opt in.  My question
> >> is do we want to install smolt as part of a default configuration with
> >> F7.  My vote is yes.
> > 
> > I vote yes too, but I want to see other votes before I just do it (:
>
>  Another yes from me, but would be good to hear from people not under the 
>  Hat... 
  I don't work for Red Hat, and I vote yes.  (I am a smolt beta tester, 
though...)

      Jima

[Ola Thoresen]

Jarod Wilson wrote:
>  Jesse Keating wrote:
> > On Wednesday 14 February 2007 11:59, Mike McGrath wrote:
> >> So smolt is still setup in firstboot and still is opt in.  My question
> >> is do we want to install smolt as part of a default configuration with
> >> F7.  My vote is yes.
> >
> > I vote yes too, but I want to see other votes before I just do it (:
>  
>  Another yes from me, but would be good to hear from people not under the 
>  Hat...
>   
FWIW.
A "Yes" from me as well, as long as it defaults to "Do not send
anything".


Rgds.


-- 
          _,--',   _._.--._____
   .--.--';_'-.', ";_      _.,-'   Ola Thoresen
  .'--'.  _.'    {`'-;_ .-.>.'
        '-:_      )  / `' '=.      It is easier to fix Unix
          ) >     {_/,     /~)     than to live with Windows
          |/               `^ .'

[seth vidal]

On Wed, 2007-02-14 at 18:48 +0100, Ola Thoresen wrote:
>  Jarod Wilson wrote:
>  > Jesse Keating wrote:
>  >> On Wednesday 14 February 2007 11:59, Mike McGrath wrote:
>  >>> So smolt is still setup in firstboot and still is opt in.  My question
>  >>> is do we want to install smolt as part of a default configuration with
>  >>> F7.  My vote is yes.
>  >>
>  >> I vote yes too, but I want to see other votes before I just do it (:
>  > 
>  > Another yes from me, but would be good to hear from people not under the 
>  > Hat...
>  > 
>  
>  FWIW.
>  A "Yes" from me as well, as long as it defaults to "Do not send
> anything". 
'opt in' means you must CHOOSE to send any data. The default mode is 'do
not send any data'

-sv

[Paul W. Frields]

On Wed, 2007-02-14 at 12:10 -0500, Jarod Wilson wrote:
>  Jesse Keating wrote:
>  > On Wednesday 14 February 2007 11:59, Mike McGrath wrote:
>  >> So smolt is still setup in firstboot and still is opt in.  My question
>  >> is do we want to install smolt as part of a default configuration with
>  >> F7.  My vote is yes.
>  > 
>  > I vote yes too, but I want to see other votes before I just do it (:
>  
>  Another yes from me, but would be good to hear from people not under the 
>  Hat... 
+1.

-- 
Paul W. Frields, RHCE                          http://paul.frields.org/
  gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233  5906 ACDB C937 BD11 3717
       Fedora Project Board: http://fedoraproject.org/wiki/Board
    Fedora Docs Project:  http://fedoraproject.org/wiki/DocsProject

[Dennis Gilmore]

On Wednesday 14 February 2007 10:59, Mike McGrath wrote:
>  So smolt is still setup in firstboot and still is opt in.  My
> question
>  is do we want to install smolt as part of a default configuration with
>  F7.  My vote is yes. 
I vote yes also


-- 
Dennis Gilmore, RHCE

[Rex Dieter]

Mike McGrath wrote:

>  So smolt is still setup in firstboot and still is opt in.  My
> question
>  is do we want to install smolt as part of a default configuration with
>  F7.  My vote is yes. 
no harm, no brainer... yes

-- Rex

[Jonathan Dieter]

On Wed, 2007-02-14 at 10:59 -0600, Mike McGrath wrote:
>  So smolt is still setup in firstboot and still is opt in.  My
> question 
>  is do we want to install smolt as part of a default configuration with 
>  F7.  My vote is yes.
>  
>      -Mike
>   
My vote's yes, for what it's worth.

Jonathan

[Thorsten Leemhuis]

Mike McGrath schrieb:
>  So smolt is still setup in firstboot and still is opt in.  My
> question 
>  is do we want to install smolt as part of a default configuration with 
>  F7.  My vote is yes. 
+1 for "yes"

CU
thl

[seth vidal]

On Wed, 2007-02-14 at 18:43 +0100, Thorsten Leemhuis wrote:
>  Mike McGrath schrieb:
>  > So smolt is still setup in firstboot and still is opt in.  My question 
>  > is do we want to install smolt as part of a default configuration with 
>  > F7.  My vote is yes.
>  
>  +1 for "yes"
>   
<aol>me too</aol>

-sv

[Peter Gordon]

Mike McGrath wrote:
>  So smolt is still setup in firstboot and still is opt in.  My
> question
>  is do we want to install smolt as part of a default configuration with
>  F7.  My vote is yes.
>  
Definitely another "yes" vote from me, as well. :]

-- 
Peter Gordon (codergeek42)
This message was sent through a webmail
    interface, and thus not signed.

[Ralf Ertzinger]

Mike McGrath schrieb:
>  So smolt is still setup in firstboot and still is opt in.  My
> question 
>  is do we want to install smolt as part of a default configuration with 
>  F7.  My vote is yes. 
Yes.

[David Nielsen]

ons, 14 02 2007 kl. 10:59 -0600, skrev Mike McGrath:
>  So smolt is still setup in firstboot and still is opt in.  My
> question 
>  is do we want to install smolt as part of a default configuration with 
>  F7.  My vote is yes. 
Smolt is doubleplus good, I vote yes.

- David Nielsen

-- 
"Ridicule is the only weapon that can be used against unintelligible
propositions. Ideas must be distinct before reason can act upon them.” 
-Thomas Jefferson

Smolt from behind a proxy (Re: Smolt: firsboot revisited)

[Leszek Matok]

Dnia 14-02-2007, śro o godzinie 19:01 +0100, David Nielsen napisał(a):
>  Smolt is doubleplus good, I vote yes. 
I don't know nice
1984-ish word for "not so good", but:

Can Smolt work from behind a proxy server, faking the User-Agent?
Because, you know, I've tried to register some machines from a real
production environment, with no luck. setenv http_proxy doesn't work,
probably because our proxy rejects most of UA-s (or because Smolt
doesn't honor http_proxy at all).

Lam

Smolt from behind a proxy (Re: Smolt: firsboot revisited)

[Mike McGrath]

Leszek Matok wrote:
>  Dnia 14-02-2007, śro o godzinie 19:01 +0100, David Nielsen
> napisał(a):
>    
> > Smolt is doubleplus good, I vote yes.
> >     
>  I don't know nice 1984-ish word for "not so good", but:
>
>  Can Smolt work from behind a proxy server, faking the User-Agent?
>  Because, you know, I've tried to register some machines from a real
>  production environment, with no luck. setenv http_proxy doesn't work,
>  probably because our proxy rejects most of UA-s (or because Smolt
>  doesn't honor http_proxy at all). 
This is a must, I'll contact you as soon as its ready.

    -Mike

Smolt from behind a proxy (Re: Smolt: firsboot revisited)

[Jeffrey Ollie]

On Wed, 2007-02-14 at 13:47 -0600, Mike McGrath wrote:
>  Leszek Matok wrote:
>  > Dnia 14-02-2007, śro o godzinie 19:01 +0100, David Nielsen napisał(a):
>  >   
>  >> Smolt is doubleplus good, I vote yes.
>  >>     
>  > I don't know nice 1984-ish word for "not so good", but:
>  >
>  > Can Smolt work from behind a proxy server, faking the User-Agent?
>  > Because, you know, I've tried to register some machines from a real
>  > production environment, with no luck. setenv http_proxy doesn't work,
>  > probably because our proxy rejects most of UA-s (or because Smolt
>  > doesn't honor http_proxy at all).
>  
>  This is a must, I'll contact you as soon as its ready. 
Setting http_proxy should work - I've tested that before.  If your proxy
blocks unusual User-Agent strings that may be more difficult to deal
with - I'm not sure how easy it is to configure urlgrabber to use a
different User-Agent string.

Jeff

Smolt from behind a proxy (Re: Smolt: firsboot revisited)

[seth vidal]

On Wed, 2007-02-14 at 13:59 -0600, Jeffrey C. Ollie wrote:
>  On Wed, 2007-02-14 at 13:47 -0600, Mike McGrath wrote:
>  > Leszek Matok wrote:
>  > > Dnia 14-02-2007, śro o godzinie 19:01 +0100, David Nielsen napisał(a):
>  > >   
>  > >> Smolt is doubleplus good, I vote yes.
>  > >>     
>  > > I don't know nice 1984-ish word for "not so good", but:
>  > >
>  > > Can Smolt work from behind a proxy server, faking the User-Agent?
>  > > Because, you know, I've tried to register some machines from a real
>  > > production environment, with no luck. setenv http_proxy doesn't work,
>  > > probably because our proxy rejects most of UA-s (or because Smolt
>  > > doesn't honor http_proxy at all).
>  > 
>  > This is a must, I'll contact you as soon as its ready.
>  
>  Setting http_proxy should work - I've tested that before.  If your proxy
>  blocks unusual User-Agent strings that may be more difficult to deal
>  with - I'm not sure how easy it is to configure urlgrabber to use a
>  different User-Agent string.
>   
for MOST proxies. Some Microsoft-based proxies like to make kittens
suffer.

-sv

Smolt from behind a proxy (Re: Smolt: firsboot revisited)

[Thorsten Leemhuis]

On 14.02.2007 20:47, Mike McGrath wrote:
>  Leszek Matok wrote:
> > Dnia 14-02-2007, śro o godzinie 19:01 +0100, David Nielsen napisał(a):
> >> Smolt is doubleplus good, I vote yes.
> > I don't know nice 1984-ish word for "not so good", but:
> > Can Smolt work from behind a proxy server, faking the User-Agent?
> > Because, you know, I've tried to register some machines from a real
> > production environment, with no luck. setenv http_proxy doesn't work,
> > probably because our proxy rejects most of UA-s (or because Smolt
> > doesn't honor http_proxy at all).
>  This is a must, I'll contact you as soon as its ready. 
Side note: Not that it helps much in the firstboot case -- as a normal 
user who does a normal install you afaik are not able to configure the 
proxy before firstboot or while in it. (¹)

CU
thl

(¹) that why you also can't use external repos in anaconda if your 
machine live in a network that forces the use of a proxy (yes, I have 
machines in such networks -- that sucks). Reminder for those that are 
interested: proxy support for anaconda RFE is #125917

Smolt from behind a proxy (Re: Smolt: firsboot revisited)

[Matthias Saou]

Mike McGrath wrote :

>  Leszek Matok wrote:
>  > Dnia 14-02-2007, śro o godzinie 19:01 +0100, David Nielsen napisał(a):
>  >   
>  >> Smolt is doubleplus good, I vote yes.
>  >>     
>  > I don't know nice 1984-ish word for "not so good", but:
>  >
>  > Can Smolt work from behind a proxy server, faking the User-Agent?
>  > Because, you know, I've tried to register some machines from a real
>  > production environment, with no luck. setenv http_proxy doesn't work,
>  > probably because our proxy rejects most of UA-s (or because Smolt
>  > doesn't honor http_proxy at all).
>  
>  This is a must, I'll contact you as soon as its ready. 
Just to confirm what I've already reported here : smoltSendProfile
fails to send any data for me from behind a transparent proxy, which
doesn't block anything specific, just logs and caches.

I get this :

[...]
Transmitting ...
Error contacting server: [Errno 14] HTTP Error 500: Server:
Squid/2.4.STABLE7 Mime-Version: 1.0
Date: Wed, 14 Feb 2007 17:56:29 GMT
Content-Type: text/html
Content-Length: 788
Expires: Wed, 14 Feb 2007 17:56:29 GMT
X-Squid-Error: ERR_READ_ERROR 104
X-Cache: MISS from proxy.lan
Connection: keep-alive

So before making the http_proxy env work, there's maybe general proxy
fixing to do, as I don't think this proxy has any weird settings...

Matthias

-- 
Clean custom Red Hat Linux rpm packages : http://freshrpms.net/
Fedora Core release 6 (Zod) - Linux kernel 2.6.19-1.2895.fc6
Load : 0.47 0.52 0.47

Smolt from behind a proxy (Re: Smolt: firsboot revisited)

[Mike McGrath]

Matthias Saou wrote:
>  I get this :
>
>  [...]
>  Transmitting ...
>  Error contacting server: [Errno 14] HTTP Error 500: Server:
>  Squid/2.4.STABLE7 Mime-Version: 1.0
>  Date: Wed, 14 Feb 2007 17:56:29 GMT
>  Content-Type: text/html
>  Content-Length: 788
>  Expires: Wed, 14 Feb 2007 17:56:29 GMT
>  X-Squid-Error: ERR_READ_ERROR 104
>  X-Cache: MISS from proxy.lan
>  Connection: keep-alive
>
>  So before making the http_proxy env work, there's maybe general proxy
>  fixing to do, as I don't think this proxy has any weird settings...
>     
To me this looks like the client is honoring the proxy settings but then 
the smolt server is failing?  I'll take a closer look, I might contact 
you off list for a test if that's ok?

    -Mike

Smolt from behind a proxy (Re: Smolt: firsboot revisited)

[Matthias Saou]

Mike McGrath wrote :

>  Matthias Saou wrote:
>  > I get this :
>  >
>  > [...]
>  > Transmitting ...
>  > Error contacting server: [Errno 14] HTTP Error 500: Server:
>  > Squid/2.4.STABLE7 Mime-Version: 1.0
>  > Date: Wed, 14 Feb 2007 17:56:29 GMT
>  > Content-Type: text/html
>  > Content-Length: 788
>  > Expires: Wed, 14 Feb 2007 17:56:29 GMT
>  > X-Squid-Error: ERR_READ_ERROR 104
>  > X-Cache: MISS from proxy.lan
>  > Connection: keep-alive
>  >
>  > So before making the http_proxy env work, there's maybe general proxy
>  > fixing to do, as I don't think this proxy has any weird settings...
>  >   
>  To me this looks like the client is honoring the proxy settings but then 
>  the smolt server is failing? 
I don't have any proxy settings, it's a transparent proxy. Right now,
I've been getting a different error for the last few hours, as if the
smolt server was having a problem :

[...]
Transmitting ...
Error contacting server: [Errno 14] HTTP Error 500: Date: Thu, 15 Feb
2007 15:14:21 GMT
Server: CherryPy/2.2.1
Content-Length: 3532
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from proxy1.fedora.phx.redhat.com
X-Cache: MISS from proxy.lan
Connection: keep-alive

>  I'll take a closer look, I might contact 
>  you off list for a test if that's ok? 
Sure, feel free to contact me off-list for any testing or debugging.

Matthias

-- 
Clean custom Red Hat Linux rpm packages : http://freshrpms.net/
Fedora Core release 6 (Zod) - Linux kernel 2.6.19-1.2895.fc6
Load : 5.33 4.56 4.13

[Arthur Pemberton]

On 2/14/07, Mike McGrath <mmcgrath(a)redhat.com&gt; wrote:
>  So smolt is still setup in firstboot and still is opt in.  My
> question
>  is do we want to install smolt as part of a default configuration with
>  F7.  My vote is yes.
>
>      -Mike
>  
Not sure if following all the discussion on Smolt entitles me to vote
- but I vote yes


-- 
Fedora Core 6 and proud

[Jason L Tibbitts III]

> >>>> "MM" == Mike McGrath
> <mmcgrath(a)redhat.com&gt; writes: 
MM> So smolt is still setup in firstboot and still is opt in.  My
MM> question is do we want to install smolt as part of a default
MM> configuration with F7.  My vote is yes.

I vote yes as well, but then I'm a bit confused as how it would affect
me as to date I've installed hundreds of machines and have only seen
firstboot once.  How does someone who uses kickstart for everything
actually make use of smolt?

 - J<

[Dennis Gilmore]

On Wednesday 14 February 2007 12:11, Jason L Tibbitts III wrote:
>  >>>>> "MM" == Mike McGrath
> <mmcgrath(a)redhat.com&gt; writes:
>
>  MM> So smolt is still setup in firstboot and still is opt in.  My
>  MM> question is do we want to install smolt as part of a default
>  MM> configuration with F7.  My vote is yes.
>
>  I vote yes as well, but then I'm a bit confused as how it would affect
>  me as to date I've installed hundreds of machines and have only seen
>  firstboot once.  How does someone who uses kickstart for everything
>  actually make use of smolt? 
you would need to add the command to send the profile in your kickstart config 
after install  and of course make sure smolt is in your package set

-- 
Dennis Gilmore, RHCE

[Mike McGrath]

Jason L Tibbitts III wrote:
>  MM> So smolt is still setup in firstboot and still is opt in.  My
>  MM> question is do we want to install smolt as part of a default
>  MM> configuration with F7.  My vote is yes.
>
>  I vote yes as well, but then I'm a bit confused as how it would affect
>  me as to date I've installed hundreds of machines and have only seen
>  firstboot once.  How does someone who uses kickstart for everything
>  actually make use of smolt? 
This is my typical use case as well but I understand
that many people 
(especially the more casual users) actually do use firstboot though.

    -Mike

[Ralf Corsepius]

On Wed, 2007-02-14 at 10:59 -0600, Mike McGrath wrote:
>  So smolt is still setup in firstboot and still is opt in.  My
> question 
>  is do we want to install smolt as part of a default configuration with 
>  F7.  My vote is yes. 
My vote is no.

* It adds no user usable functionality
* It adds further package bloat
* is legally questionable.

Ralf

[seth vidal]

On Thu, 2007-02-15 at 05:48 +0100, Ralf Corsepius wrote:
>  On Wed, 2007-02-14 at 10:59 -0600, Mike McGrath wrote:
>  > So smolt is still setup in firstboot and still is opt in.  My question 
>  > is do we want to install smolt as part of a default configuration with 
>  > F7.  My vote is yes.
>  
>  My vote is no.
>   
>  * is legally questionable. 
If you have a concern here, please file a bug on it and I will make sure
it gets passed into the legal queue for evaluation. Please list the
country where you think the law might be violated.

Thanks,
-sv

[Ralf Corsepius]

On Thu, 2007-02-15 at 00:34 -0500, seth vidal wrote:
>  On Thu, 2007-02-15 at 05:48 +0100, Ralf Corsepius wrote:
>  > On Wed, 2007-02-14 at 10:59 -0600, Mike McGrath wrote:
>  > > So smolt is still setup in firstboot and still is opt in.  My question 
>  > > is do we want to install smolt as part of a default configuration with 
>  > > F7.  My vote is yes.
>  > 
>  > My vote is no.
>  > 
>  
>  > * is legally questionable.
>  
>  If you have a concern here, please file a bug on it and I will make sure
>  it gets passed into the legal queue for evaluation. 
Everything that needed to be said had been communicated to Mr. McGrath.
It's up to him to decide on what to do with it.

>   Please list the
>  country where you think the law might be violated. 
Probably most parts of the world
outside of the US, definitely in
Europe, definitely in Germany, probably also in some part of Asia. 

Besides this, you should understand that data-privacy plays a much more
important role than what you are used to in many countries and
communities - As I already said: You are playing with a loaded gun,
right in front of your face.

Here in Germany, many folks consider any such transition from user to
vendor as "hostile espionage". Press is full of articles flaming
manufactures for this and related topics. 

It will definitely be reason for users not to choose Fedora in future
(It might have escaped you, but Microsoft and other vendors having done
the similar is the reason why many users choose to switch to Linux).

Ralf

[seth vidal]

On Thu, 2007-02-15 at 06:58 +0100, Ralf Corsepius wrote:
>  On Thu, 2007-02-15 at 00:34 -0500, seth vidal wrote:
>  > On Thu, 2007-02-15 at 05:48 +0100, Ralf Corsepius wrote:
>  > > On Wed, 2007-02-14 at 10:59 -0600, Mike McGrath wrote:
>  > > > So smolt is still setup in firstboot and still is opt in.  My question 
>  > > > is do we want to install smolt as part of a default configuration with 
>  > > > F7.  My vote is yes.
>  > > 
>  > > My vote is no.
>  > > 
>  > 
>  > > * is legally questionable.
>  > 
>  > If you have a concern here, please file a bug on it and I will make sure
>  > it gets passed into the legal queue for evaluation.
>  
>  Everything that needed to be said had been communicated to Mr. McGrath.
>  It's up to him to decide on what to do with it.
>  
>  >  Please list the
>  > country where you think the law might be violated.
>  Probably most parts of the world outside of the US, definitely in
>  Europe, definitely in Germany, probably also in some part of Asia. 
>  
>  Besides this, you should understand that data-privacy plays a much more
>  important role than what you are used to in many countries and
>  communities - As I already said: You are playing with a loaded gun,
>  right in front of your face.
>  
>  Here in Germany, many folks consider any such transition from user to
>  vendor as "hostile espionage". Press is full of articles flaming
>  manufactures for this and related topics. 
>  
>  It will definitely be reason for users not to choose Fedora in future
>  (It might have escaped you, but Microsoft and other vendors having done
>  the similar is the reason why many users choose to switch to Linux). 
No need for such a screed. I wasn't arguing with you. I was simply
volunteering to take the issues through the board to legal to get them
addressed. I'll talk to Mike and make sure I have a firm handle on your
concerns so I can make sure they are represented.

Thanks,
-sv

[Simo Sorce]

On Thu, 2007-02-15 at 01:03 -0500, seth vidal wrote:
>  On Thu, 2007-02-15 at 06:58 +0100, Ralf Corsepius wrote:
>  > On Thu, 2007-02-15 at 00:34 -0500, seth vidal wrote:
>  > > On Thu, 2007-02-15 at 05:48 +0100, Ralf Corsepius wrote:
>  > > > On Wed, 2007-02-14 at 10:59 -0600, Mike McGrath wrote:
>  > > > > So smolt is still setup in firstboot and still is opt in.  My
> question 
>  > > > > is do we want to install smolt as part of a default configuration
> with 
>  > > > > F7.  My vote is yes.
>  > > > 
>  > > > My vote is no.
>  > > > 
>  > > 
>  > > > * is legally questionable.
>  > > 
>  > > If you have a concern here, please file a bug on it and I will make sure
>  > > it gets passed into the legal queue for evaluation.
>  > 
>  > Everything that needed to be said had been communicated to Mr. McGrath.
>  > It's up to him to decide on what to do with it.
>  > 
>  > >  Please list the
>  > > country where you think the law might be violated.
>  > Probably most parts of the world outside of the US, definitely in
>  > Europe, definitely in Germany, probably also in some part of Asia. 
>  > 
>  > Besides this, you should understand that data-privacy plays a much more
>  > important role than what you are used to in many countries and
>  > communities - As I already said: You are playing with a loaded gun,
>  > right in front of your face.
>  > 
>  > Here in Germany, many folks consider any such transition from user to
>  > vendor as "hostile espionage". Press is full of articles flaming
>  > manufactures for this and related topics. 
>  > 
>  > It will definitely be reason for users not to choose Fedora in future
>  > (It might have escaped you, but Microsoft and other vendors having done
>  > the similar is the reason why many users choose to switch to Linux).
>  
>  No need for such a screed. I wasn't arguing with you. I was simply
>  volunteering to take the issues through the board to legal to get them
>  addressed. I'll talk to Mike and make sure I have a firm handle on your
>  concerns so I can make sure they are represented. 
This is as much, or more, a PR issue, not just a legal issue.
In Italy we have one of the most restrictive privacy laws as well, and I
can confirm Ralf point of view.
If you want to send user data to a vendor, you better make it very clear
to the user what data is transmitted and make it very optional (ie. ask
for confirmation and offer to disable the tool at the first run).

Simo.

-- 
Simo Sorce <ssorce(a)redhat.com&gt;
Sr Software Engineer
Base Operating Systems
Red Hat Inc.

[Rahul Sundaram]

Simo Sorce wrote:

>  This is as much, or more, a PR issue, not just a legal issue. 
It was expressed as a legal issue.

>  In Italy we have one of the most restrictive privacy laws as well,
> and I
>  can confirm Ralf point of view.
>  If you want to send user data to a vendor, you better make it very clear
>  to the user what data is transmitted and make it very optional (ie. ask
>  for confirmation and offer to disable the tool at the first run).
>   
... which is what is being done already.

Rahul

[Simo Sorce]

On Thu, 2007-02-15 at 19:29 +0530, Rahul Sundaram wrote:
>  Simo Sorce wrote:
>  
>  > This is as much, or more, a PR issue, not just a legal issue.
>  
>  It was expressed as a legal issue. 
Yeah, I saw it, that's why I am trying to say it is more a PR thing imo.

>  > In Italy we have one of the most restrictive privacy laws as
> well, and I
>  > can confirm Ralf point of view.
>  > If you want to send user data to a vendor, you better make it very clear
>  > to the user what data is transmitted and make it very optional (ie. ask
>  > for confirmation and offer to disable the tool at the first run).
>  > 
>  
>  ... which is what is being done already. 
That's great, then I see no problem at all.

Simo.

-- 
Simo Sorce <ssorce(a)redhat.com&gt;
Sr Software Engineer
Base Operating Systems
Red Hat Inc.

[Jack Spaar]

On Thu, 15 Feb 2007 19:29:53 +0530, Rahul Sundaram wrote:

>  Simo Sorce wrote:
>  
> > This is as much, or more, a PR issue, not just a legal issue.
>  
>  It was expressed as a legal issue.
>  [rest of comments snipped...] 
Since it is both legal and PR, maybe smolt could publish a
specific privacy policy under which the data would be collected and used.
That should stand to answer questions and guide any future code changes.

I'm concerned about privacy issues more than most, and I've looked at
smolt and read what Mike has said publicly.  I for one am satisfied that
the approach taken serves a useful purpose while doing a decent job of
protecting privacy.  IMHO, the only thing missing is an actual
published policy which expresses formally what Mike has already said.

[From what I understand: it's informed consent, opt-in, with no personally
identifying information sent, and nothing is ever sent without the user's
permission.  It *does* store a randomly-generated GUID cookie on your
drive which is transmitted as part of the profile upon installation or
whenever smolt is run manually by the user.  IP addresses are never
retained, MAC addresses, Serial Numbers, or other UIDs are never sent.]


--Jack Spaar

[Thorsten Leemhuis]

On 15.02.2007 06:58, Ralf Corsepius wrote:
>  On Thu, 2007-02-15 at 00:34 -0500, seth vidal wrote:
> > On Thu, 2007-02-15 at 05:48 +0100, Ralf Corsepius wrote:
> >> On Wed, 2007-02-14 at 10:59 -0600, Mike McGrath wrote:
> >>> So smolt is still setup in firstboot and still is opt in.  My question 
> >>> is do we want to install smolt as part of a default configuration with 
> >>> F7.  My vote is yes.
> >> My vote is no.
> >> * is legally questionable.
> > If you have a concern here, please file a bug on it and I will make sure
> > it gets passed into the legal queue for evaluation.
>  Everything that needed to be said had been communicated to Mr. McGrath.
>  It's up to him to decide on what to do with it. 
Could you give a quick summary please? That would be very helpful, as 
there were a lot of mails on this topic in the last month, and one can't 
know which of them and which arguments in them you exactly mean. Thanks 
in advance.

> >  Please list the
> > country where you think the law might be violated.
>  Probably most parts of the world outside of the US, definitely in
>  Europe, definitely in Germany, probably also in some part of Asia.  
I'm not a lawyer, but I live in Germany, and I think this kind of 
anonymous opt-in mechanism should be fine, as long as it's clearly 
documented what kind of informations are send. Ralf, could you give me 
some insight why you think this should the law might be violated?

@mmcgrath, is it clearly documented what informations are send? Wuld be 
ideal if one could open a window to see what informations are going to 
be send exactly. And will that part also translated -- it *could* be 
problematic if the text is not localized...

>  [...] 
CU
thl

[Ralf Corsepius]

On Thu, 2007-02-15 at 07:21 +0100, Thorsten Leemhuis wrote:
>  On 15.02.2007 06:58, Ralf Corsepius wrote:
>  > On Thu, 2007-02-15 at 00:34 -0500, seth vidal wrote:
>  >> On Thu, 2007-02-15 at 05:48 +0100, Ralf Corsepius wrote:
>  >>> On Wed, 2007-02-14 at 10:59 -0600, Mike McGrath wrote:
>  >>>> So smolt is still setup in firstboot and still is opt in.  My question 
>  >>>> is do we want to install smolt as part of a default configuration with 
>  >>>> F7.  My vote is yes.
>  >>> My vote is no.
>  >>> * is legally questionable.
>  >> If you have a concern here, please file a bug on it and I will make sure
>  >> it gets passed into the legal queue for evaluation.
>  > Everything that needed to be said had been communicated to Mr. McGrath.
>  > It's up to him to decide on what to do with it.
>  
>  Could you give a quick summary please?  
Firstly, please note that I said "questionable", i.e. would have to
carefully examined by a specialized lawyer.

Secondly you should be aware that is actually is about two separate
issue: "Legality and correctness"

On the legal side, it is "Schutz der Privatsphäre" (Protection of
private sphere") in general, a legally complicated matter with many
booby-traps hidden inside.


In Germany, even "collecting data without prior consent" in many cases
is considered illegal. E.g. there had been a precedence in which someone
having set up a webcam monitoring his house's front yard has been
considered illegal for breach of privacy. It's the reason why most shops
using camera supervision nowadays have signs explicitly notifying their
customers.


Things become further complicated when personalized data comes into play
(BDSG - Bundesdatenschutzgesetz - "Federal Law on Data Privacy").
The crucial points here would be "when to consider data personalized"
and "which data is allowed to be collected under which circumstances".

Rule of thumb: Any personalized data must not be collected unless it is
technically required for a transaction (Classic example: Any bill must
be removed from cashier systems after the customer has paid, within a
predefined timeframe).

I.e. from a German point of view. Smolt's "machine id" in connection
with the IP address needs to be legally reviewed if this qualifies as
"personalized data". I for one regard it as such.

>  >>  Please list the
>  >> country where you think the law might be violated.
>  > Probably most parts of the world outside of the US, definitely in
>  > Europe, definitely in Germany, probably also in some part of Asia. 
>  
>  I'm not a lawyer, but I live in Germany, and I think this kind of 
>  anonymous opt-in mechanism should be fine, as long as it's clearly 
>  documented what kind of informations are send. 
IANAL, too, but, yes this matches
with my knowledge. I repeatedly said,
to be legally safe in Germany, any such transaction must be opt-in (I am
aware this not to be 100% legally correct, but it's the "rule of thumb
to be safe").


The other point is "is it correctlyness" to transmit such data:

Here apparently German perception is different from that in other
countries. Microsoft and other vendors had been flamed, Intel was flamed
for their CPU-Ids (they didn't even transmit anything, simply the fact
they implemented an option was enough), many other vendors followed, ...
Check heise's newticker for press notices concerning this, they are easy
to find ....

This touches security as well as privacy.

Ask yourself: If you were an administration/government/military
organisation, an enterprise's financial/development department, a bank,
simply a shop archiving your customer data or other entity dealing with
"secret"/"private" information, would you want details about your
systems to be exposed to the public?

Consider secret services/competitors spying the net, consider
man-in-the-middle attacks, consider intruders harvesting the
database, ...

I would not - I would take any measure to prevent and obsure such
transmission.

Ralf

[seth vidal]

On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  Firstly, please note that I said "questionable", i.e. would
> have to
>  carefully examined by a specialized lawyer.
>  
>  Secondly you should be aware that is actually is about two separate
>  issue: "Legality and correctness"
>  
>  On the legal side, it is "Schutz der Privatsphäre" (Protection of
>  private sphere") in general, a legally complicated matter with many
>  booby-traps hidden inside.
>  
>  
>  In Germany, even "collecting data without prior consent" in many cases
>  is considered illegal. E.g. there had been a precedence in which someone
>  having set up a webcam monitoring his house's front yard has been
>  considered illegal for breach of privacy. It's the reason why most shops
>  using camera supervision nowadays have signs explicitly notifying their
>  customers. 
There is prior consent. The information is not transmitted until the
user consents and it defaults to NOT transmitting. 


>  Things become further complicated when personalized data comes into
> play
>  (BDSG - Bundesdatenschutzgesetz - "Federal Law on Data Privacy").
>  The crucial points here would be "when to consider data personalized"
>  and "which data is allowed to be collected under which circumstances".
>  
>  Rule of thumb: Any personalized data must not be collected unless it is
>  technically required for a transaction (Classic example: Any bill must
>  be removed from cashier systems after the customer has paid, within a
>  predefined timeframe).
>  
>  I.e. from a German point of view. Smolt's "machine id" in connection
>  with the IP address needs to be legally reviewed if this qualifies as
>  "personalized data". I for one regard it as such.
>   
but there is no requirement that this data be transmitted. In fact, in
the default case that smolt is configured for - it is not transmitted.

and in order to use the system you need not transmit it.

If I ask you for your name and you choose not to give it have I
committed a crime by asking and giving you the option of giving me the
information? Of course not. can you imagine what a law that made that
illegal would look like?

>  IANAL, too, but, yes this matches with my knowledge. I repeatedly
> said,
>  to be legally safe in Germany, any such transaction must be opt-in (I am
>  aware this not to be 100% legally correct, but it's the "rule of thumb
>  to be safe"). 
and we are safe in that regard. smolt is opt-in.


>  The other point is "is it correctlyness" to transmit such
> data:
>   
We're giving the user the choice to send this data or not. We default to
NOT sending this information. How much more correct can you get?


>  Ask yourself: If you were an administration/government/military
>  organisation, an enterprise's financial/development department, a bank,
>  simply a shop archiving your customer data or other entity dealing with
>  "secret"/"private" information, would you want details about your
>  systems to be exposed to the public?
>  
>  Consider secret services/competitors spying the net, consider
>  man-in-the-middle attacks, consider intruders harvesting the
>  database, ...
>  
>  I would not - I would take any measure to prevent and obsure such
>  transmission. 
Thats fine. In that case you can simply instruct your users to not send
such information and the users can simply just click 'next' on the menu.
But there's no legal issue with the above, only a corporate or
administrative policy issue.

-sv

[Ralf Corsepius]

On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote: 
>  > Ask yourself: If you were an administration/government/military
>  > organisation, an enterprise's financial/development department, a bank,
>  > simply a shop archiving your customer data or other entity dealing with
>  > "secret"/"private" information, would you want details about
> your
>  > systems to be exposed to the public?
>  > 
>  > Consider secret services/competitors spying the net, consider
>  > man-in-the-middle attacks, consider intruders harvesting the
>  > database, ...
>  > 
>  > I would not - I would take any measure to prevent and obsure such
>  > transmission.
>  
>  Thats fine. In that case you can simply instruct your users to not send
>  such information and the users can simply just click 'next' on the menu.
Many folks around here would advise their management to classify Fedora
as not trustworthy and to ban it :-o. 

Is exactly the kind of argumentation why before-mentioned institutions
chose to migrate away from Microsoft systems.

Ralf

[seth vidal]

On Thu, 2007-02-15 at 09:15 +0100, Ralf Corsepius wrote:
>  On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  
>  > > Ask yourself: If you were an administration/government/military
>  > > organisation, an enterprise's financial/development department, a bank,
>  > > simply a shop archiving your customer data or other entity dealing with
>  > > "secret"/"private" information, would you want details
> about your
>  > > systems to be exposed to the public?
>  > > 
>  > > Consider secret services/competitors spying the net, consider
>  > > man-in-the-middle attacks, consider intruders harvesting the
>  > > database, ...
>  > > 
>  > > I would not - I would take any measure to prevent and obsure such
>  > > transmission.
>  > 
>  > Thats fine. In that case you can simply instruct your users to not send
>  > such information and the users can simply just click 'next' on the menu.
>  Many folks around here would advise their management to classify Fedora
>  as not trustworthy and to ban it :-o. 
>  
>  Is exactly the kind of argumentation why before-mentioned institutions
>  chose to migrate away from Microsoft systems. 
but that's not a legal issue. You said you had a legal concern with
including smolt and this is not a legal issue at all.

-sv

[Arthur Pemberton]

On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>
>  > > Ask yourself: If you were an administration/government/military
>  > > organisation, an enterprise's financial/development department, a bank,
>  > > simply a shop archiving your customer data or other entity dealing with
>  > > "secret"/"private" information, would you want details
> about your
>  > > systems to be exposed to the public?
>  > >
>  > > Consider secret services/competitors spying the net, consider
>  > > man-in-the-middle attacks, consider intruders harvesting the
>  > > database, ...
>  > >
>  > > I would not - I would take any measure to prevent and obsure such
>  > > transmission.
>  >
>  > Thats fine. In that case you can simply instruct your users to not send
>  > such information and the users can simply just click 'next' on the menu.
>  Many folks around here would advise their management to classify Fedora
>  as not trustworthy and to ban it :-o.
>
>  Is exactly the kind of argumentation why before-mentioned institutions
>  chose to migrate away from Microsoft systems.
>
>  Ralf 
I don't think you've ever said how the information is being sent
without user permission or what the personal data is that is being
sent.

-- 
Fedora Core 6 and proud

[Ralf Corsepius]

On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote: 
>  I don't think you've ever said how the information is being
> sent
>  without user permission or what the personal data is that is being
>  sent. 
The smolt developers would be the ones to reply this. 

AFAIS (I banned smolt from my installations), it transmits
a machine-id, several HW details (CPU brand, type, peripherials,
bogomips) and OS details via http.

i.e. they have the IP, they have a "machine-id", and they have
information which is not publicly available elsewhere.

Ralf

[seth vidal]

On Thu, 2007-02-15 at 09:32 +0100, Ralf Corsepius wrote:
>  On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  
>  > I don't think you've ever said how the information is being sent
>  > without user permission or what the personal data is that is being
>  > sent. 
>  The smolt developers would be the ones to reply this.  
The smolt developers and the smolt code HAS replied to this.
there is no way for smolt to transmit information w/o the consent of the
user. The user must explicitly agree to send the information. If the
user chooses the default behavior then the information is not
transmitted.

so in any execution of smolt the user has 2 options:

1. select no, do not send this information
2. select yes, send this information

option 1 is already selected for the user. If they make no change to the
selection then they will NOT transmit information.

-sv

[Ralf Corsepius]

On Thu, 2007-02-15 at 03:37 -0500, seth vidal wrote:
>  On Thu, 2007-02-15 at 09:32 +0100, Ralf Corsepius wrote:
>  > On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  > 
>  > > I don't think you've ever said how the information is being sent
>  > > without user permission or what the personal data is that is being
>  > > sent.
>  
>  > The smolt developers would be the ones to reply this. 
>  The smolt developers and the smolt code HAS replied to this. 
Yes, but this thread started with "Shall smolt be installed by default",
so the question wasn't "opt-in/opt-out", it was "installed by
default"

I expressed my opinion and said: No, ...

Arthur's was "how" - I said "http:" and "what"

Ralf

[Arthur Pemberton]

On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  On Thu, 2007-02-15 at 03:37 -0500, seth vidal wrote:
>  > On Thu, 2007-02-15 at 09:32 +0100, Ralf Corsepius wrote:
>  > > On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > > > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  > >
>  > > > I don't think you've ever said how the information is being sent
>  > > > without user permission or what the personal data is that is being
>  > > > sent.
>  >
>  > > The smolt developers would be the ones to reply this.
>  > The smolt developers and the smolt code HAS replied to this.
>
>  Yes, but this thread started with "Shall smolt be installed by default",
>  so the question wasn't "opt-in/opt-out", it was "installed by
> default"
>
>  I expressed my opinion and said: No, ...
>
>  Arthur's was "how" - I said "http:" and "what"
>
>  Ralf 
I think "installed by default" here means that the Smolt code will be
on the install media and copied to the hard drive by default (if even
that much) - installing sends no data - the user has to choose to run
it. hence the "opt-in" . The discussion on opt-in/out ended long ago.

-- 
Fedora Core 6 and proud

[seth vidal]

On Thu, 2007-02-15 at 09:43 +0100, Ralf Corsepius wrote:
>  On Thu, 2007-02-15 at 03:37 -0500, seth vidal wrote:
>  > On Thu, 2007-02-15 at 09:32 +0100, Ralf Corsepius wrote:
>  > > On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > > > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  > > 
>  > > > I don't think you've ever said how the information is being sent
>  > > > without user permission or what the personal data is that is being
>  > > > sent.
>  > 
>  > > The smolt developers would be the ones to reply this. 
>  > The smolt developers and the smolt code HAS replied to this.
>  
>  Yes, but this thread started with "Shall smolt be installed by default",
>  so the question wasn't "opt-in/opt-out", it was "installed by
> default" 
just b/c something is installed by default means nothing about whether
or not you have to run it and nothing further on whether or not you have
to agree to do anything if it does run.

-sv

[Baris Cicek]

Why is that so different from bug-buddy sending bug report, or MS
Windows sending bug report using already installed (for MS case, even
embedded) software? If it was a legal issue, it might have been brought
forward years ago and should have been resolved already. 

For those mechanisms you can choose to send it or easily discard it. I'm
not quite sure about MS bug reporting tool, but bug-buddy is helpful for
GNOME developers. 

I hope smolt would serve similar benefits. And well my vote is 'yes' if
it counts. 


On Thu, 2007-02-15 at 09:43 +0100, Ralf Corsepius wrote:
>  On Thu, 2007-02-15 at 03:37 -0500, seth vidal wrote:
>  > On Thu, 2007-02-15 at 09:32 +0100, Ralf Corsepius wrote:
>  > > On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > > > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  > > 
>  > > > I don't think you've ever said how the information is being sent
>  > > > without user permission or what the personal data is that is being
>  > > > sent.
>  > 
>  > > The smolt developers would be the ones to reply this. 
>  > The smolt developers and the smolt code HAS replied to this.
>  
>  Yes, but this thread started with "Shall smolt be installed by default",
>  so the question wasn't "opt-in/opt-out", it was "installed by
> default"
>  
>  I expressed my opinion and said: No, ...
>  
>  Arthur's was "how" - I said "http:" and "what"
>  
>  Ralf
>  
>

[Dennis Gilmore]

Once upon a time Thursday 15 February 2007 2:43 am, Ralf Corsepius wrote:

>  Yes, but this thread started with "Shall smolt be installed by
> default",
>  so the question wasn't "opt-in/opt-out", it was "installed by
> default"
>
>  I expressed my opinion and said: No, ... 
by installed by default we want to give
users the option at first boot to send 
in their profile if they so choose.  nothing more

Stop making this about more than it is

[Arthur Pemberton]

On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>
>  > I don't think you've ever said how the information is being sent
>  > without user permission or what the personal data is that is being
>  > sent.
>  The smolt developers would be the ones to reply this.
>
>  AFAIS (I banned smolt from my installations), it transmits
>  a machine-id, several HW details (CPU brand, type, peripherials,
>  bogomips) and OS details via http.
>
>  i.e. they have the IP, they have a "machine-id", and they have
>  information which is not publicly available elsewhere.
>
>  Ralf
>  
Fair enough. However the machine-id cannot legally id your computer,
nor is it supposed to be able to. As far as I understand, your
machine-id will be specific to Fedora.

But considiering you have to TELL IT to transmit thoise things, how
can there be any legal problems? Or are you saying it is illegal to
ask someone to fillout a survey form , where they can simply ignore,
in your country?
-- 
Fedora Core 6 and proud

[Ralf Corsepius]

On Fri, 2007-02-16 at 02:46 +0000, Arthur Pemberton wrote:
>  On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  >
>  > > I don't think you've ever said how the information is being sent
>  > > without user permission or what the personal data is that is being
>  > > sent.
>  > The smolt developers would be the ones to reply this.
>  >
>  > AFAIS (I banned smolt from my installations), it transmits
>  > a machine-id, several HW details (CPU brand, type, peripherials,
>  > bogomips) and OS details via http.
>  >
>  > i.e. they have the IP, they have a "machine-id", and they have
>  > information which is not publicly available elsewhere.
>  >
>  > Ralf
>  >
>  
>  Fair enough. However the machine-id cannot legally id your computer,
>  nor is it supposed to be able to. As far as I understand, your
>  machine-id will be specific to Fedora.
>  
>  But considiering you have to TELL IT to transmit thoise things, how
>  can there be any legal problems? 
There is one dead-beat argument likely rendering this discussion moot:

Not wrt. smolt, because the server is hosted in a foreign country,
therefore the data, unless it's contents is lawful, is likely not
subject to German laws (To be verified by a German lawyer).

=> Case closed from a US-biased, RH/Fedora-biased view.


The actual problems remain: "trust" and "safety".

The thresholds to trust any such site probably are much higher in
Germany than in other countries because people are aware about different
standards of "privacy policies" in different countries/institutions.

[This applies even within Germany. Media are filled with warnings and
flames on certain enterprises on what "public opinion considers abuse of
data privacy"]

>   Or are you saying it is illegal to
>  ask someone to fillout a survey form , 
No, it is not, but (at least some) Germans
probably will be very
reluctant to fill out such forms and be very careful about what they
fill out.

>   where they can simply ignore,
>  in your country? 
Common practice on "statistical survey forms" is them to
carry an
explicit "data-privacy disclaimer", which people explicitly have to
check (== opt-in), which details what the data is being used for, to
whom it will be passed on and when it will be deleted.

Typical are disclaimers similar to 
[ ] Personalized data and survey data will be kept strictly separate.
Survey data does not allow any conclusion to the person having submitted
the data. Personalized data will only be used for administrational
purposes during this survey and will be deleted upon termination of the
survey (<date>)

Or in case of a "commercial customer survey": 
"[ ] I acknowledge that the data obtained during this survey may be
passed on to other parties."

Ralf

[Arthur Pemberton]

On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  On Fri, 2007-02-16 at 02:46 +0000, Arthur Pemberton wrote:
>  > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > > > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  > >
>  > > > I don't think you've ever said how the information is being sent
>  > > > without user permission or what the personal data is that is being
>  > > > sent.
>  > > The smolt developers would be the ones to reply this.
>  > >
>  > > AFAIS (I banned smolt from my installations), it transmits
>  > > a machine-id, several HW details (CPU brand, type, peripherials,
>  > > bogomips) and OS details via http.
>  > >
>  > > i.e. they have the IP, they have a "machine-id", and they have
>  > > information which is not publicly available elsewhere.
>  > >
>  > > Ralf
>  > >
>  >
>  > Fair enough. However the machine-id cannot legally id your computer,
>  > nor is it supposed to be able to. As far as I understand, your
>  > machine-id will be specific to Fedora.
>  >
>  > But considiering you have to TELL IT to transmit thoise things, how
>  > can there be any legal problems?
>
>  There is one dead-beat argument likely rendering this discussion moot:
>
>  Not wrt. smolt, because the server is hosted in a foreign country,
>  therefore the data, unless it's contents is lawful, is likely not
>  subject to German laws (To be verified by a German lawyer). 
Maybe Fedora needs to simply not run smolt in german countries. You
make it seem as if there is some special, useful data being stored.
The data is only interesting from a statistical point of view, and to
a limited audience.

>  => Case closed from a US-biased, RH/Fedora-biased view.
>
>
>  The actual problems remain: "trust" and "safety".
>
>  The thresholds to trust any such site probably are much higher in
>  Germany than in other countries because people are aware about different
>  standards of "privacy policies" in different countries/institutions.
>
>  [This applies even within Germany. Media are filled with warnings and
>  flames on certain enterprises on what "public opinion considers abuse of
>  data privacy"]
>
>  >  Or are you saying it is illegal to
>  > ask someone to fillout a survey form ,
>  No, it is not, but (at least some) Germans probably will be very
>  reluctant to fill out such forms and be very careful about what they
>  fill out. 
Okay. So what's the differene bween not filling out the form and not
running smolt?

>  >  where they can simply ignore,
>  > in your country?
>  Common practice on "statistical survey forms" is them to carry an
>  explicit "data-privacy disclaimer", which people explicitly have to
>  check (== opt-in), which details what the data is being used for, to
>  whom it will be passed on and when it will be deleted. 
There is no fundamental difference between smolt and a survey form -
down to to the fac that machine readable survey forms do have id
numbers (in this case the machine id - may be it should be called the
smolt id since there is no such thing as a machine id, yet at least)

>  Typical are disclaimers similar to
>  [ ] Personalized data and survey data will be kept strictly separate.
>  Survey data does not allow any conclusion to the person having submitted
>  the data. Personalized data will only be used for administrational
>  purposes during this survey and will be deleted upon termination of the
>  survey (<date>) 
I'm pretty sure a disclaimer will be there, implied...or can be easily added.

>  Or in case of a "commercial customer survey":
>  "[ ] I acknowledge that the data obtained during this survey may be
>  passed on to other parties."
>
>  Ralf
>  
-- 
Fedora Core 6 and proud

[Ralf Corsepius]

On Fri, 2007-02-16 at 04:35 +0000, Arthur Pemberton wrote:
>  On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > On Fri, 2007-02-16 at 02:46 +0000, Arthur Pemberton wrote:
>  > > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > > On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > > > > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > > > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  > > >
>  > > > > I don't think you've ever said how the information is being
> sent
>  > > > > without user permission or what the personal data is that is being
>  > > > > sent.
>  > > > The smolt developers would be the ones to reply this.
>  > > >
>  > > > AFAIS (I banned smolt from my installations), it transmits
>  > > > a machine-id, several HW details (CPU brand, type, peripherials,
>  > > > bogomips) and OS details via http.
>  > > >
>  > > > i.e. they have the IP, they have a "machine-id", and they have
>  > > > information which is not publicly available elsewhere.
>  > > >
>  > > > Ralf
>  > > >
>  > >
>  > > Fair enough. However the machine-id cannot legally id your computer,
>  > > nor is it supposed to be able to. As far as I understand, your
>  > > machine-id will be specific to Fedora.
>  > >
>  > > But considiering you have to TELL IT to transmit thoise things, how
>  > > can there be any legal problems?
>  >
>  > There is one dead-beat argument likely rendering this discussion moot:
>  >
>  > Not wrt. smolt, because the server is hosted in a foreign country,
>  > therefore the data, unless it's contents is lawful, is likely not
>  > subject to German laws (To be verified by a German lawyer).
>  
>  Maybe Fedora needs to simply not run smolt in german countries. You
>  make it seem as if there is some special, useful data being stored. 
Absolutely not. I am only commenting from a German perspective, because
I am living in Germany, because I am familiar with the situation around
here. I am pretty sure, what I said applies to many other countries as
well.

>  The data is only interesting from a statistical point of view, and
> to
>  a limited audience. 
For YOU, but ... the fact "$big business" is running
42 Fedora 6
machines with 9 of them being equipped with a topsecret "IBMINTAMD"
processor at 50 GHz in their development departments might be a business
secret.

>  > >  Or are you saying it is illegal to
>  > > ask someone to fillout a survey form ,
>  > No, it is not, but (at least some) Germans probably will be very
>  > reluctant to fill out such forms and be very careful about what they
>  > fill out.
>  
>  Okay. So what's the differene bween not filling out the form and not
>  running smolt? 
What is the difference between not installing smolt and having to
fill
out a form?

Basically: security, less exposure to risks.

>  > >  where they can simply ignore,
>  > > in your country?
>  > Common practice on "statistical survey forms" is them to carry an
>  > explicit "data-privacy disclaimer", which people explicitly have to
>  > check (== opt-in), which details what the data is being used for, to
>  > whom it will be passed on and when it will be deleted.
>  
>  There is no fundamental difference between smolt and a survey form -
>  down to to the fac that machine readable survey forms do have id
>  numbers (in this case the machine id - may be it should be called the
>  smolt id since there is no such thing as a machine id, yet at least) 
German laws
probably would mandate to keep the machine id separate from
the IP or not to record the IP at all.

Ralf

[Dennis Gilmore]

Once upon a time Thursday 15 February 2007 5:10 am, Ralf Corsepius wrote:
>  German laws probably would mandate to keep the machine id separate from
>  the IP or not to record the IP at all. 
The IP is only collected in the web logs  and there is no way to tie the ip to 
the UUID  so we are already doing this

you are being very petty without facts  please stop

[Jima]

On Thu, 15 Feb 2007, Ralf Corsepius wrote:
>  For YOU, but ... the fact "$big business" is running 42
> Fedora 6
>  machines with 9 of them being equipped with a topsecret "IBMINTAMD"
>  processor at 50 GHz in their development departments might be a business
>  secret. 
  Then $big business should either not check "Yes" (i.e., changing the 
default) or (more likely) they're installing via kickstart anyway and 
won't even install Smolt, much less run it.

> >> No, it is not, but (at least some) Germans probably will be
> very
> >> reluctant to fill out such forms and be very careful about what they
> >> fill out. 
  Yes, there are people like this all over the world.  This is not uniquely 
a German trait.

>  German laws probably would mandate to keep the machine id separate
> from
>  the IP or not to record the IP at all. 
  As Dennis said, we do keep the IP logged separately.  The information 
(including system ID) is transmitted via POST, therefore none of that data 
ends up in the web log, just in the database.

      Jima

[Michael Schwendt]

This entire discussion would be easier if it discussed specific issues
with "smolt" instead of trying to cover general problems related to data
acquisition and data protection. "smolt" is not about personal data, such
as name, address, data of birth, phone numbers.

If you are concerned that the IP address is stored, too, and is some form
of personalisation or could lead to illegal data acquisition activities,
you should not use the Internet, not connect to any server, not use Yum,
not use AptRPM, not send mails, not enable Cookies, nothing.

>  >  Or are you saying it is illegal to
>  > ask someone to fillout a survey form ,
>
>  No, it is not, but (at least some) Germans probably will be very
>  reluctant to fill out such forms and be very careful about what they
>  fill out. 
What has this to do with smolt? Generally paranoid or overcautious people
would not opt-in for smolt even if it came with a long legal disclaimer
and if it displayed exactly the raw data it wants to transfer. I don't
think there is reason to worry, because this is an open source piece of
software, opt-in, not running in the background, not running unattended,
can be removed again. And, of course, Red Hat would be playing with fire
if any questionable data acquisition practices ever turned up in "smolt".

>  >  where they can simply ignore,
>  > in your country?
>  Common practice on "statistical survey forms" is them to carry an
>  explicit "data-privacy disclaimer", which people explicitly have to
>  check (== opt-in), which details what the data is being used for, to
>  whom it will be passed on and when it will be deleted. 
I think the "when it will be deleted" is not well-defined in the majority
of cases. Further, if you agree that your data may be passed on to third
parties, you've lost already.

[Dennis Gilmore]

Once upon a time Thursday 15 February 2007 2:32 am, Ralf Corsepius wrote:
>  On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  >
>  > I don't think you've ever said how the information is being sent
>  > without user permission or what the personal data is that is being
>  > sent.
>
>  The smolt developers would be the ones to reply this.
>
>  AFAIS (I banned smolt from my installations), it transmits
>  a machine-id, several HW details (CPU brand, type, peripherials,
>  bogomips) and OS details via http. 
Only if you choose to.  send your information
there is no mechanism for 
automatically sending the data without your consent.  and you are free to not 
install smolt.

>  i.e. they have the IP, they have a "machine-id", and they
> have
>  information which is not publicly available elsewhere. 
we have no way to tie a UUID to an IP  web log information is publicliy 
available.  as is the ability for me to look up your ip  via mail headers in 
mail you send.  but i still cant tell what machine is yours if you choose to 
send in a profile.  they only way i could know that would be if you 
personally gave me your uuid

Stop spreading FUD

[Ralf Corsepius]

On Thu, 2007-02-15 at 06:46 -0600, Dennis Gilmore wrote:
>  Once upon a time Thursday 15 February 2007 2:32 am, Ralf Corsepius
> wrote:
>  > On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote: 
>  > i.e. they have the IP, they have a "machine-id", and
> they have
>  > information which is not publicly available elsewhere.
>  
>  we have no way to tie a UUID to an IP  web log information is publicliy 
>  available.  as is the ability for me to look up your ip  via mail headers in 
>  mail you send.  but i still cant tell what machine is yours if you choose to 
>  send in a profile. 
You can, if you want to, it's all under your control.

>    they only way i could know that would be if you 
>  personally gave me your uuid
>  
>  Stop spreading FUD 
Give me one reason why I should trust you more than anybody
else.

Ralf

[Richard Hughes]

On 15/02/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  On Thu, 2007-02-15 at 06:46 -0600, Dennis Gilmore wrote:
>  > Once upon a time Thursday 15 February 2007 2:32 am, Ralf Corsepius wrote:
>  > Stop spreading FUD
>  Give me one reason why I should trust you more than anybody else. 
Can you please stop wasting our time. Many thanks.

Richard.

[Dennis Gilmore]

Once upon a time Thursday 15 February 2007, Ralf Corsepius wrote:
>  On Thu, 2007-02-15 at 06:46 -0600, Dennis Gilmore wrote:
>  > Once upon a time Thursday 15 February 2007 2:32 am, Ralf Corsepius wrote:
>  > > On Fri, 2007-02-16 at 02:19 +0000, Arthur Pemberton wrote:
>  > > > On 2/16/07, Ralf Corsepius <rc040203(a)freenet.de&gt; wrote:
>  > > > > On Thu, 2007-02-15 at 02:33 -0500, seth vidal wrote:
>  > > > > > On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote:
>  > >
>  > > i.e. they have the IP, they have a "machine-id", and they have
>  > > information which is not publicly available elsewhere.
>  >
>  > we have no way to tie a UUID to an IP  web log information is publicliy
>  > available.  as is the ability for me to look up your ip  via mail headers
>  > in mail you send.  but i still cant tell what machine is yours if you
>  > choose to send in a profile.
>
>  You can, if you want to, it's all under your control. 
How?  

>  >   they only way i could know that would be if you
>  > personally gave me your uuid
>  >
>  > Stop spreading FUD
>
>  Give me one reason why I should trust you more than anybody else. 
Since your contining to be unreasonable and overly paranoid i dont think 
anything i say or do will have you trust me.  but then  how can you trust 
anything anyone does?  you really shouldn't use a computer   someone at some 
stage may have set  up something to gather your data.  oh  mail headers, http 
headers.,  What smolt collects is less personally identifiable than those.

Dennis

[Jesse Keating]

On Thursday 15 February 2007 08:03, Ralf Corsepius wrote:
>  Give me one reason why I should trust you more than anybody else.
Because the source to the application/server we're talking about is opensource 
and available for you to review and form your own conclusions.  Which you 
should do, instead of continually spreading FUD.

-- 
Jesse Keating
Release Engineer: Fedora

[Paul W. Frields]

On Thu, 2007-02-15 at 08:19 -0500, Jesse Keating wrote:
>  On Thursday 15 February 2007 08:03, Ralf Corsepius wrote:
>  > Give me one reason why I should trust you more than anybody else.
>  
>  Because the source to the application/server we're talking about is opensource 
>  and available for you to review and form your own conclusions.  Which you 
>  should do, instead of continually spreading FUD. 
Yes, let's please put this thread to rest.  Any users/administrators
have at least three junctures at which they can block smolt on their
system, and can take advantage of any of them:

1.  Don't install it; use a kickstart file that removes smolt from the
installation, or make a custom repo without it.
2.  Disable the firstboot module by twiddling around with the bits in
the %post section.
3.  When smolt asks you if you want to send any information, choose the
default NO action.

Ralf, you are trying to assert opinions about the law without any
credentials, and about the code apparently without having looked at it.
Your concerns have been noted and will be give due consideration.  Time
to move on.

-- 
Paul W. Frields, RHCE                          http://paul.frields.org/
  gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233  5906 ACDB C937 BD11 3717
       Fedora Project Board: http://fedoraproject.org/wiki/Board
    Fedora Docs Project:  http://fedoraproject.org/wiki/DocsProject

[Keith Sharp]

On Thu, 2007-02-15 at 09:02 -0500, Paul W. Frields wrote:
>  On Thu, 2007-02-15 at 08:19 -0500, Jesse Keating wrote:
>  > On Thursday 15 February 2007 08:03, Ralf Corsepius wrote:
>  > > Give me one reason why I should trust you more than anybody else.
>  > 
>  > Because the source to the application/server we're talking about is opensource 
>  > and available for you to review and form your own conclusions.  Which you 
>  > should do, instead of continually spreading FUD.
>  
>  Yes, let's please put this thread to rest.  Any users/administrators
>  have at least three junctures at which they can block smolt on their
>  system, and can take advantage of any of them:
>  
>  1.  Don't install it; use a kickstart file that removes smolt from the
>  installation, or make a custom repo without it.
>  2.  Disable the firstboot module by twiddling around with the bits in
>  the %post section.
>  3.  When smolt asks you if you want to send any information, choose the
>  default NO action. 
4. Explicitly block access to the Smolt server on your firewall or
proxy.

Keith.

PS. Not that I'll be doing any of these, I think Smolt is a great idea.

[Dennis Gilmore]

Once upon a time Thursday 15 February 2007 1:20 am, Ralf Corsepius wrote:

>  I.e. from a German point of view. Smolt's "machine id"
> in connection
>  with the IP address needs to be legally reviewed if this qualifies as
>  "personalized data". I for one regard it as such. 
Ralf
Did you look at the code like i asked last time ?  IP's are not collected.  
the data is transmitted by post  so there is is no way to tie a UUID to an ip 
and it is completely opt in  you see exactly what is going to be sent before 
it is sent.


So what you are arguing for is exactly what smolt does.  Stop spreading FUD 
now.   you are perfectly  free to uncheck smolt from your installs and not 
participate.  that is your right to do.

Seriously  look at the code 

Dennis

[R P Herrold]

On Thu, 15 Feb 2007, Dennis Gilmore wrote:

>  Did you look at the code like i asked last time ?  IP's are 
>  not collected. the data is transmitted by post so there is 
>  is no way to tie a UUID to an ip 
ummm ... don't be silly -- it is trivial to associate an 
originating IP to a POST

This test widget at http://www.herrold.com/post/ has this 
HTML code to the client:

<form method="post">
Digits only please: <input type="text" name="acme"><br>
<input type="submit" name="show" value="show">
</form>

and reveals the REMOTE_ADDR quite readily.

The source PHP may be viewed at:

http://www.herrold.com/post/index.phps

-- Russ Herrold

[Arthur Pemberton]

On 2/15/07, R P Herrold <herrold(a)owlriver.com&gt; wrote:
>  On Thu, 15 Feb 2007, Dennis Gilmore wrote:
>
>  > Did you look at the code like i asked last time ?  IP's are
>  > not collected. the data is transmitted by post so there is
>  > is no way to tie a UUID to an ip
>
>  ummm ... don't be silly -- it is trivial to associate an
>  originating IP to a POST
>
>  This test widget at http://www.herrold.com/post/ has this
>  HTML code to the client:
>
>  <form method="post">
>  Digits only please: <input type="text" name="acme"><br>
>  <input type="submit" name="show" value="show">
>  </form>
>
>  and reveals the REMOTE_ADDR quite readily.
>
>  The source PHP may be viewed at:
>
>  http://www.herrold.com/post/index.phps
>
>  -- Russ Herrold 
I have to agree with this. Not that I think that this is specifically
a problem. But it was false to imply that an HTTP Post is immune to IP
harvesting.
-- 
Fedora Core 6 and proud

[Dennis Gilmore]

Once upon a time Thursday 15 February 2007, Arthur Pemberton wrote:
>  On 2/15/07, R P Herrold <herrold(a)owlriver.com&gt; wrote:
>  > On Thu, 15 Feb 2007, Dennis Gilmore wrote:
>  > > Did you look at the code like i asked last time ?  IP's are
>  > > not collected. the data is transmitted by post so there is
>  > > is no way to tie a UUID to an ip
>  >
>  > ummm ... don't be silly -- it is trivial to associate an
>  > originating IP to a POST
>  >
>  > This test widget at http://www.herrold.com/post/ has this
>  > HTML code to the client:
>  >
>  > <form method="post">
>  > Digits only please: <input type="text"
> name="acme"><br>
>  > <input type="submit" name="show" value="show">
>  > </form>
>  >
>  > and reveals the REMOTE_ADDR quite readily.
>  >
>  > The source PHP may be viewed at:
>  >
>  > http://www.herrold.com/post/index.phps
>  >
>  > -- Russ Herrold
>
>  I have to agree with this. Not that I think that this is specifically
>  a problem. But it was false to imply that an HTTP Post is immune to IP
>  harvesting. 
sure it could be done  if smolt was coded to do so  but if it was in a
GET  it 
would be in the logs.

[Arthur Pemberton]

On 2/15/07, Dennis Gilmore <dennis(a)ausil.us&gt; wrote:
>  Once upon a time Thursday 15 February 2007, Arthur Pemberton wrote:
>  > On 2/15/07, R P Herrold <herrold(a)owlriver.com&gt; wrote:
>  > > On Thu, 15 Feb 2007, Dennis Gilmore wrote:
>  > > > Did you look at the code like i asked last time ?  IP's are
>  > > > not collected. the data is transmitted by post so there is
>  > > > is no way to tie a UUID to an ip
>  > >
>  > > ummm ... don't be silly -- it is trivial to associate an
>  > > originating IP to a POST
>  > >
>  > > This test widget at http://www.herrold.com/post/ has this
>  > > HTML code to the client:
>  > >
>  > > <form method="post">
>  > > Digits only please: <input type="text"
> name="acme"><br>
>  > > <input type="submit" name="show"
> value="show">
>  > > </form>
>  > >
>  > > and reveals the REMOTE_ADDR quite readily.
>  > >
>  > > The source PHP may be viewed at:
>  > >
>  > > http://www.herrold.com/post/index.phps
>  > >
>  > > -- Russ Herrold
>  >
>  > I have to agree with this. Not that I think that this is specifically
>  > a problem. But it was false to imply that an HTTP Post is immune to IP
>  > harvesting.
>  sure it could be done  if smolt was coded to do so  but if it was in a GET  it
>  would be in the logs.
>  
How does one establish an HTTP connection without making your IP
available to the server?

-- 
Fedora Core 6 and proud

[Jima]

On Thu, 15 Feb 2007, Arthur Pemberton wrote:
>  On 2/15/07, Dennis Gilmore <dennis(a)ausil.us&gt; wrote:
> > sure it could be done  if smolt was coded to do so  but if it was in a GET 
> > it
> > would be in the logs.
>
>  How does one establish an HTTP connection without making your IP
>  available to the server? 
  Of course the IP is exposed to the server; that doesn't mean the CGI 
script needs to make use of that information (which, in this case, it 
doesn't).  The POST-vs-GET is only a matter of whether the submitted data 
(i.e., UUID) ends up in the log, the same place the IP does.

      Jima

[Alexandre Oliva]

On Feb 16, 2007, "Arthur Pemberton" <pemboa(a)gmail.com&gt; wrote:

>  How does one establish an HTTP connection without making your IP
>  available to the server? 
TOR?

-- 
Alexandre Oliva         http://www.lsd.ic.unicamp.br/~oliva/
FSF Latin America Board Member         http://www.fsfla.org/
Red Hat Compiler Engineer   aoliva(a){redhat.com, gcc.gnu.org}
Free Software Evangelist  oliva(a){lsd.ic.unicamp.br, gnu.org}

[seth vidal]

On Fri, 2007-02-16 at 04:09 -0200, Alexandre Oliva wrote:
>  On Feb 16, 2007, "Arthur Pemberton"
> <pemboa(a)gmail.com&gt; wrote:
>  
>  > How does one establish an HTTP connection without making your IP
>  > available to the server?
>  
>  TOR?
>   
I almost said the exact same thing :)

-sv

[Simo Sorce]

On Fri, 2007-02-16 at 04:09 -0200, Alexandre Oliva wrote:
>  On Feb 16, 2007, "Arthur Pemberton"
> <pemboa(a)gmail.com&gt; wrote:
>  
>  > How does one establish an HTTP connection without making your IP
>  > available to the server?
>  
>  TOR? 
Also anonymizing  proxies.

Simo.

-- 
Simo Sorce <ssorce(a)redhat.com&gt;
Sr Software Engineer
Base Operating Systems
Red Hat Inc.

[Luya Tshimbalanga]

Luya nods for enable smolt by default.


-- 
Luya Tshimbalanga
Fedora Project contributor
http://www.fedoraproject.org/wiki/LuyaTshimbalanga

[Jef Spaleta]

On 2/14/07, Mike McGrath <mmcgrath(a)redhat.com&gt; wrote:
>  So smolt is still setup in firstboot and still is opt in.  My
> question
>  is do we want to install smolt as part of a default configuration with
>  F7.  My vote is yes. 
Now that its reporting correctly for my current systems.... yes

-jef"did i happen to mention that my votes can be bought?"spaleta

[Rahul Sundaram]

Mike McGrath wrote:
>  So smolt is still setup in firstboot and still is opt in.  My
> question 
>  is do we want to install smolt as part of a default configuration with 
>  F7.  My vote is yes.
>   
I would also like to have a menu entry on the DE's like GNOME and KDE if 
that is not too much work.

Rahul

[Mike McGrath]

Rahul Sundaram wrote:
>  Mike McGrath wrote:
> > So smolt is still setup in firstboot and still is opt in.  My 
> > question is do we want to install smolt as part of a default 
> > configuration with F7.  My vote is yes.
> >
>  I would also like to have a menu entry on the DE's like GNOME and KDE 
>  if that is not too much work. 
This should be very doable, Toshio's already wrote some stuff that would 
be perfect there.

    -Mike

[Phil Knirsch]

Mike McGrath wrote:
>  So smolt is still setup in firstboot and still is opt in.  My
> question 
>  is do we want to install smolt as part of a default configuration with 
>  F7.  My vote is yes.
>  
>     -Mike
>   
I r German, and i vote for yes! ;)

Read ya, Phil

-- 
Philipp Knirsch      | Tel.:  [phone]
Development          | Fax.:  [phone]
Red Hat GmbH         | Email: Phil Knirsch <phil(a)redhat.de&gt;
Hauptstaetterstr. 58 | Web:   http://www.redhat.de/
D-70178 Stuttgart
Motd:  You're only jealous cos the little penguins are talking to me.

[Gilboa Davara]

On Wed, 2007-02-14 at 10:59 -0600, Mike McGrath wrote:
>  So smolt is still setup in firstboot and still is opt in.  My
> question 
>  is do we want to install smolt as part of a default configuration with 
>  F7.  My vote is yes.
>  
>      -Mike
>   
/+1.

- Gilboa