Precedence: list
MIME-Version: 1.0
From: Christine Dodrill <shadow.h511@gmail.com>
Date: Fri, 23 Mar 2018 02:16:28 +0000
Message-ID: <CADBeeMuMv8vbgK4Vex1U3GM8195phHPn7ABEOfGq=QBU-88B2w@mail.gmail.com>
Subject: [alpine-devel] What is the policy for telemetry in packages in Alpine's repos?
To: "alpine-devel@lists.alpinelinux.org" <alpine-devel@lists.alpinelinux.org>
Content-Type: multipart/alternative; boundary="000000000000b38e7905680b0379"

--000000000000b38e7905680b0379
Content-Type: text/plain; charset="UTF-8"

Hello all,

I just got a notification from the Caddy[1] project's GitHub page[2] that
the Caddy project is indeed going ahead with their plan to implement
telemetry into the server. As implemented (default on) [3] (search
"telemetry"), it exposes a rather terrifying amount of data including but
not limited to:

   - the number of vhosts you are serving
   - the version of Caddy
   - the number of TCP(/UDP?) listeners Caddy has open
   - the server type of Caddy (in case you compile in the DNS server option)
   - OS (linux, windows, etc)
   - Architecture (aarch64, ppc64, etc)
   - CPU brand name
   - Number of logical CPU cores
   - CPU AES-NI support
   - the number of configuration directives in the loaded configuration
   - how many connections are likely or not likely to be TLS-MITM-ed
   - its best guess if the user is running this in development or
   production based on what ACME servers Caddy is configured to use
   - the number of sites being served by Caddy
   - how many hits from how many unique user agents Cadey processes
   - the number of HTTP requests Caddy processes
   - the number of TLS certs Caddy manages
   - the number of TLS certs that Caddy manually loads from files
   - the number of TLS certs obtained from an ACME server
   - the number of TLS certs renewed from an ACME server
   - the number of TLS certs revoked from an ACME server
   - TLS client hello information [4] (this isn't implemented yet, but they
   obviously plan to)
   - TLS handshake count
   - TLS handshake unique error count
   - the number of managed TLS certs currently loaded into ram
   - the number of manually loaded TLS certs currently loaded into ram
   - the number of self-signed certs Caddy is configured to generate in ram

This seems a bit much for opt-out telemetry, and made me wonder if Alpine
has any policies about packages with telemetry features in general. If so,
what are they? If not, I think it would be reasonable for telemetry in
alpine programs to be OPT-IN (as in: the user MUST take action to enable
telemetry) or patched out from programs.

---

Christine Dodrill
https://christine.website

[1]: https://caddyserver.com/
[2]: https://github.com/mholt/caddy/pull/2079
[3]: https://github.com/mholt/caddy/pull/2079/files
[4]:
https://github.com/mholt/caddy/blob/52316952a575b01871224e68d4d248c0e2cdf271/caddytls/handshake.go#L103

--000000000000b38e7905680b0379
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello all,<div><br></div><div>I just got a notification fr=
om the Caddy[1] project&#39;s GitHub page[2] that the Caddy project is inde=
ed going ahead with their plan to implement telemetry into the server. As i=
mplemented (default on) [3] (search &quot;telemetry&quot;), it exposes a ra=
ther terrifying amount of data including but not limited to:</div><div><ul>=
<li>the number of vhosts you are serving</li><li>the version of Caddy</li><=
li>the number of TCP(/UDP?) listeners Caddy has open</li><li>the server typ=
e of Caddy (in case you compile in the DNS server option)</li><li>OS (linux=
, windows, etc)</li><li>Architecture (aarch64, ppc64, etc)</li><li>CPU bran=
d name</li><li>Number of logical CPU cores</li><li>CPU AES-NI support</li><=
li>the number of configuration directives in the loaded configuration</li><=
li>how many connections are likely or not likely to be TLS-MITM-ed</li><li>=
its best guess if the user is running this in development or production bas=
ed on what ACME servers Caddy is configured to use</li><li>the number of si=
tes being served by Caddy</li><li>how many hits from how many unique user a=
gents Cadey processes</li><li>the number of HTTP requests Caddy processes</=
li><li>the number of TLS certs Caddy manages</li><li>the number of TLS cert=
s that Caddy manually loads from files</li><li>the number of TLS certs obta=
ined from an ACME server</li><li>the number of TLS certs renewed from an AC=
ME server</li><li>the number of TLS certs revoked from an ACME server</li><=
li>TLS client hello information [4] (this isn&#39;t implemented yet, but th=
ey obviously plan to)</li><li>TLS handshake count</li><li>TLS handshake uni=
que error count</li><li>the number of managed TLS certs currently loaded in=
to ram</li><li>the number of manually loaded TLS certs currently loaded int=
o ram</li><li>the number of self-signed certs Caddy is configured to genera=
te in ram</li></ul><div>This seems a bit much for opt-out telemetry, and ma=
de me wonder if Alpine has any policies about packages with telemetry featu=
res in general. If so, what are they? If not, I think it would be reasonabl=
e for telemetry in alpine programs to be OPT-IN (as in: the user MUST take =
action to enable telemetry) or patched out from programs.</div></div><div><=
br></div><div>---</div><div><br></div><div>Christine Dodrill</div><div><a h=
ref=3D"https://christine.website">https://christine.website</a></div><div><=
br></div><div>[1]:=C2=A0<a href=3D"https://caddyserver.com/">https://caddys=
erver.com/</a></div><div>[2]:=C2=A0<a href=3D"https://github.com/mholt/cadd=
y/pull/2079">https://github.com/mholt/caddy/pull/2079</a></div><div>[3]:=C2=
=A0<a href=3D"https://github.com/mholt/caddy/pull/2079/files">https://githu=
b.com/mholt/caddy/pull/2079/files</a></div><div>[4]:=C2=A0<a href=3D"https:=
//github.com/mholt/caddy/blob/52316952a575b01871224e68d4d248c0e2cdf271/cadd=
ytls/handshake.go#L103">https://github.com/mholt/caddy/blob/52316952a575b01=
871224e68d4d248c0e2cdf271/caddytls/handshake.go#L103</a></div></div>

--000000000000b38e7905680b0379--


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---