Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4812

Re: Which Debian packages leak information to the network?

Show all headers | View raw

* Patrick Schleizer <adrelanos@riseup.net>, 2016-05-18, 15:50:
>we are a privacy-centric distro based on Debian and wanted to know what 
>Debian packages leak information about the system to the network 
>without a user's consent/expectation.
>
>As documented on the page below, a system's security also depends on 
>avoiding leaking any identifiable information to network adversaries by 
>accident.

python-requests used to include kernel version number in User-Agent. 
(And also Python version, but that's less exciting.) This was fixed 
upstream in 2.8.0:
https://github.com/kennethreitz/requests/issues/2785

pip leaks even more stuff in U-A:
$ python -c 'import pip; print pip.download.user_agent()'
pip/8.1.2 {"cpu":"x86_64","distro":{"libc":{"lib":"glibc","version":"2.7"},"name":"debian","version":"stretch/sid"},"implementation":{"name":"CPython","version":"2.7.11+"},"installer":{"name":"pip","version":"8.1.2"},"openssl_version":"OpenSSL 1.0.2h  3 May 2016","python":"2.7.11+","system":{"name":"Linux","release":"4.5.0-2-amd64"}}

(As a side note, I don't think this is RFC-2616-compliant...)

>Popcon, bts, wnpp-check are the noted examples

Could you explain how any of these tools leak any information "without a 
user's consent/expectation"?

-- 
Jakub Wilk

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Which Debian packages leak information to the network? Patrick Schleizer <adrelanos@riseup.net> - 2016-05-18 18:00 +0200
  Re: Which Debian packages leak information to the network? Jakub Wilk <jwilk@debian.org> - 2016-05-18 18:40 +0200
    Re: Which Debian packages leak information to the network? Holger Levsen <holger@layer-acht.org> - 2016-05-18 19:00 +0200
      Re: Which Debian packages leak information to the network? "georg@riseup.net" <georg@riseup.net> - 2016-05-19 02:00 +0200
        Re: Which Debian packages leak information to the network? Paul Wise <pabs@debian.org> - 2016-05-19 06:00 +0200
      Re: Which Debian packages leak information to the network? Cindy-Sue Causey <butterflybytes@gmail.com> - 2016-05-19 17:50 +0200
      Re: Which Debian packages leak information to the network? Patrick Schleizer <adrelanos@riseup.net> - 2016-05-19 18:10 +0200
        Re: Which Debian packages leak information to the network? "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-05-19 18:30 +0200
      Re: Which Debian packages leak information to the network? donoban <donoban@riseup.net> - 2016-05-20 10:40 +0200
        Re: Which Debian packages leak information to the network? Elmar Stellnberger <estellnb@gmail.com> - 2016-05-20 11:00 +0200
          Re: Which Debian packages leak information to the network? ale <ale@wwb.cc> - 2016-05-20 11:30 +0200
            Re: Which Debian packages leak information to the network? donoban <donoban@riseup.net> - 2016-05-20 12:00 +0200
            Re: Which Debian packages leak information to the network? Jakub Wilk <jwilk@debian.org> - 2016-05-20 18:20 +0200
  Re: Which Debian packages leak information to the network? Paul Wise <pabs@debian.org> - 2016-05-19 18:50 +0200
    Re: Which Debian packages leak information to the network? Weber <kweber33@gmx.de> - 2016-05-20 03:50 +0200
      Re: Which Debian packages leak information to the network? Geert Stappers <stappers@stappers.nl> - 2016-05-20 08:30 +0200
    Re: Which Debian packages leak information to the network? Paul Wise <pabs@debian.org> - 2016-05-20 04:50 +0200

csiph-web