Re: Which Debian packages leak information to the network?

From	donoban <donoban@riseup.net>
Newsgroups	linux.debian.security
Subject	Re: Which Debian packages leak information to the network?
Date	2016-05-20 10:40 +0200
Message-ID	<rAO8r-3ca-41@gated-at.bofh.it> (permalink)
References	<rAc39-439-33@gated-at.bofh.it> <rAcFP-4xl-1@gated-at.bofh.it> <rAcZc-4DW-15@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 18/05/16 18:54, Holger Levsen wrote:
> On Wed, May 18, 2016 at 06:33:52PM +0200, Jakub Wilk wrote:
>> Could you explain how any of these tools leak any information
>> "without a user's consent/expectation"?
> 
> gnome-calculator contacts a web page/service with currency
> exchange information *on every start*, I think that's a good
> example of the kind of programs Patrick is looking for.
> 
> 

I am running Debian on Qubes OS, I use gnome-calculator on a vault
domain (a VM without any network device) because I though it does not
need Internet or data/files from another domain. So without any
knowledge I was protecting myself from this privacy leak...

Maybe Debian should adopt a strong policy about what packages should
have Internet access and what does not... All packages not supposed to
have Internet access will be blocked by firewall or a similar approach
(probably some kind of whitelist).

Then, the privacy leak surface will be very small and easy to audit.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXPsweAAoJEBQTENjj7Qil9oUQALTcpe+hrqSccXeqTGSieIEs
Lf6pHoVSNU6grzvIs4YTxKPhTbzq/ZBohmBhps1FLJbeeDHNtZisxVOwj0lcTKpZ
835QmWZ0+fOXgwbh6V6UqwCjraKj9g7236RhfXmob//ejKhrZHfKoYfYl1KzO6nx
/Q9sMj7XoKL1tFItyWX6Edq9BqIvPZwmsrGLmOaTkPtWRI1GWFFgOjYwLv9vjUBY
z+AwX8eEGG7DUvfYMqez1HkEvDhcxnxw0wS+Yn0aQL33jhS1beoh4lI1GXcLbm8F
3gny5ZizMiA4lmaRC+HPUOW6bcEeNEemH8zumQNu3A3CxStW62s6rSaf9C9WK++G
TRwtP43gN6OlM6GZM4jssYk7GD4chjmbb74LujQWuuHSMyxED6MOhUH2RyMTHl1y
gPx2x6XGyByyu8s/DcbuJzjhQ16Xy64GIx1/uOb03HuxnHRrM5astHM0FqF4kWW4
JrzXU5jMzm7/a2Fqz3MZBZsBgUAZTql+LerkZG8WIrIJing1ocnDQvo/bYS/yL7G
LN4h2Iojsq/NE3mIZbpRsP/60nRyFagRjNDWAL3HrZ8h9dLRec4NrsGisGB7NqDc
ypOHEwPrZ25Ha2w5hGBz1LPH0tNvK1KNX9IWbYFABPm8qIQ9uNB7R+Eej+WyRdVQ
CoSqJxhqugd/FlFFL74/
=OPRB
-----END PGP SIGNATURE-----

Thread

Which Debian packages leak information to the network? Patrick Schleizer <adrelanos@riseup.net> - 2016-05-18 18:00 +0200
  Re: Which Debian packages leak information to the network? Jakub Wilk <jwilk@debian.org> - 2016-05-18 18:40 +0200
    Re: Which Debian packages leak information to the network? Holger Levsen <holger@layer-acht.org> - 2016-05-18 19:00 +0200
      Re: Which Debian packages leak information to the network? "georg@riseup.net" <georg@riseup.net> - 2016-05-19 02:00 +0200
        Re: Which Debian packages leak information to the network? Paul Wise <pabs@debian.org> - 2016-05-19 06:00 +0200
      Re: Which Debian packages leak information to the network? Cindy-Sue Causey <butterflybytes@gmail.com> - 2016-05-19 17:50 +0200
      Re: Which Debian packages leak information to the network? Patrick Schleizer <adrelanos@riseup.net> - 2016-05-19 18:10 +0200
        Re: Which Debian packages leak information to the network? "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-05-19 18:30 +0200
      Re: Which Debian packages leak information to the network? donoban <donoban@riseup.net> - 2016-05-20 10:40 +0200
        Re: Which Debian packages leak information to the network? Elmar Stellnberger <estellnb@gmail.com> - 2016-05-20 11:00 +0200
          Re: Which Debian packages leak information to the network? ale <ale@wwb.cc> - 2016-05-20 11:30 +0200
            Re: Which Debian packages leak information to the network? donoban <donoban@riseup.net> - 2016-05-20 12:00 +0200
            Re: Which Debian packages leak information to the network? Jakub Wilk <jwilk@debian.org> - 2016-05-20 18:20 +0200
  Re: Which Debian packages leak information to the network? Paul Wise <pabs@debian.org> - 2016-05-19 18:50 +0200
    Re: Which Debian packages leak information to the network? Weber <kweber33@gmx.de> - 2016-05-20 03:50 +0200
      Re: Which Debian packages leak information to the network? Geert Stappers <stappers@stappers.nl> - 2016-05-20 08:30 +0200
    Re: Which Debian packages leak information to the network? Paul Wise <pabs@debian.org> - 2016-05-20 04:50 +0200

csiph-web