PRIVACY PETITION

TheShniz
Posts: 213
Member Since:
2006-06-01

As ztirffritz brought up initial concern w/ functionality in November, my subsequent question w/ Kerry about Privacy/Security concerns, and recent TB 2.0's release has again got me very concerned with Privacy as it pertains 2 Trixbox's required serialization, user association, & tracking with the Fonality server.

While this may not be a big deal with SOHO users, it is a very big concern of the larger companies I deal with.

From /var/www/html/user/modules/configModules.php, line 64:

[quote]This will be used to see if the Guid for this box has a userid associated with it. If not, then the box is registered but has no one to associate the box with. If this is the case, everytime a user goes to the home page of this application they will be propmted to provide personal info which will register them with the TB forum and associate there User ID from the forum with this TB and the TB's GUID.[/quote]

By Kerry in thread:
[url=http://www.trixbox.org/modules/newbb/viewtopic.php?viewmode=flat&topic_id=6343&forum=2]http://www.trixbox.org/modules/newbb/viewtopic.php?viewmode=flat&topic_id=6343&forum=2[/url]

[quote]
There are two forms of communication between an installed system and the trixbox servers.

1) When you log into the package manager, you are obviously hitting the trixbox servers. Therefor, we know what packages people are using. Nothing magic or sinister about usage logs.

2) In 2.0, there will be a spot on the trixbox user interface for dynamic content so we can inform users of updates, patches, etc. This is common in products like phpbb, joomla, etc. Again, nothing covert there.

That is it. We don't keep tabs on your system, report usage back, or antyhing else. So the only ramification of our servers being unavailable or you not being on the net, are the inability to get into the package manager and the dynamic content box would be blank.
[/quote]

I'd like to see the required Login with the Package Manager and GUID completely removed... I see no reason why Fonality can't simply use server-side hit statistics to track what packages people are using.

The dynamic content is fine, however... I would like to see it as an option (i.e. 'Check for Updates' checkbox)

While intentions may be good, logs trivial, and nothing sinister atm... it is a big concern nonetheless and opens the potential for exploit. (very similar to voting for a state lottery or tax increases in the US, once in... they're there forever and only have the potential to get worse.).

Please remove required login and GUID, much appreciated!
- J



KodaK
Posts: 1885
Member Since:
2006-06-14
Re: PRIVACY PETITION

I agree with this.

--

WARNING: I no longer actively participate in these forums. My thoughts on trixbox in a nutshell: http://www.youtube.com/watch?v=q4xBMkWu1pE Use AsteriskNOW instead.



w5waf
Posts: 711
Member Since:
2006-06-09
Re: PRIVACY PETITION

What is totally BIZZARE in this petition is that if we were PAYING for this software, the same type of registration would be required. The same...if mot more...information would be collected.

Bill

--

Bill Ford - FtOCC
City of Vicksburg
www.vicksburg.org



takingky
Posts: 289
Member Since:
2006-09-18
Re: PRIVACY PETITION

I tend to agree that this should also be removed. I have actually gone back to the TB1.2.3 UI with kennonsoft's wonderful dynamic UI. I am quite happy to loose the functionality of the package manager. I have installed minimal KDE with the yum manager and it provides the same functionality. When I need the package manager (which is never btw) I simply startx at the CLI run the manager and when done exit xwindows. CHecked the load and speed when Xwindows is running on a fast box with lots of ram and noticed no problems. My TDM400 worded just fine with 4 simultaneous phone calls on the zap lines and 1 VOIP call thru stanaphone and KDE running.

After I have gotten the bugs worked out I will post a script to convert automatically to the old tb 1.2.3 UI along with the kennonsoft dynamic UI 2.1.

BTW all of the choices in the TB 1.2.3 UI on TB 2.0 work with the exception of MUNIN which I am in the process of writing a script for which should fix that also. You also see that it is TB 2.0 running in on the left hand side of the screen.

A2Billing is still broken in TB 2.0 but I think I have found a way to make it work with another script although that is still alpha 8^) I dont use A2billing so I just disable it on the kennonsoft UI and all is well.

I do appreciate all the work that went into the http UI however a lot of us want different choices and I already have my users trained on the old UI therefor less learning curve for them.

No flames please, I will not respond

Tom

--

===============================
Get scripts to make your life easier
http://www.script-trix.us
===============================



TheShniz
Posts: 213
Member Since:
2006-06-01
Re: PRIVACY PETITION

By w5waf:

Quote:
What is totally BIZZARE in this petition is that if we were PAYING for this software, the same type of registration would be required. The same...if mot more...information would be collected.

That's most definately not true... working for a company which is a distributor for 20+ different voice processing manufacturers, I can assure you that is far from the truth. Yes, some manufacturers are more intrusive than others in the questions they ask of the environment their product is being placed while others are more cookie-cutter, but none have client-server connections to track usage.

Were this a commercial application, you'd simply pay for a license for whatever features purchased at this site... and that's it.

Bizzare is NOT having privacy & 'putting in' the means by which to track end users without choice.
(e.g. Fonality's PBXtra GUI & VPN would be considered bizzare, NOT this request).
- J



andrew
Posts: 1472
Member Since:
2006-05-30
Re: PRIVACY PETITION

Trixbox is all about choice. You have to choice to change the GUI if you want (it’s all open source) you have the choice to not register your system with our server. Just don’t login to the package manager. Your system will run fine forever even if you never connect to the internet. Unlike programs such as Microsoft Windows Vista that cost $300 and stop running if you don’t register with their site.

I find it interesting that people don’t mind running a business buy selling trixbox for thousands of dollars or saving their companies thousands of dollars by installing trixbox. But they do not even donate $10 to the project.

How many people supporting this partition have ever donated to the project? The anonymous stats we gather from this connection are used to get advertizing dollars for our project. This is how we pay for the bandwidth and servers that serve the project.

The trixbox community is a democracy. I asked what people thought about anonymous usage stats before we implemented it. Most people thought it was a good idea if it helped the project.

So let’s continue the vote. But let’s change it a little should we remove the anonymous stats if it means that we delay development of the trixbox project? This means Asterisk 1.4 and many of the other new features that people have been begging for.



takingky
Posts: 289
Member Since:
2006-09-18
Re: PRIVACY PETITION

hi andrew

I appreciate your input into this issue. I really have no problem with anonymous statistics. I see it as simply a problem of perspective. Most people rebel when they have to login in to something in order to use it. What this process will produce is many users with throw away emails and no input into the community. While this may provide you with some statistics how accurate are they? Perhaps a one time opt in or out choice somewhere would be a good thing similar to winamp.

I do appreciate the work that went into the TB 2.0 and the new UI. I am a developer also and understand what it means when people don't appreciate things. I simply wanted another UI that is much closer to the old 1.2.3 UI for admin. Saves time having to rewrite admin and user manuals we use internally for TB.

My offer of a script to downgrade the UI was meant to offer an alternative UI rather than bash the new one. I have had my problems with the new UI in terms of speedy loading (even over a T3 line exposed to the internet with no firewall and on new Hardware it is slow). I suppose this made me grumpy as I have been bash up against this thing for a while. Sorry if it peeved you off 8^)

I guess we are all more than a little angry at good old billy boy and his new fiasco calling home all the time to ensure that vista is not pirated etc etc has made us wary of anything that even remotely resembles it. I sometimes wonder what fuels piracy and hacking? Big Brother and onerous software licenses? All I know is I have been playing with the corp version of Vista and all I see is support problems down the road.

Whew I feel better and I hope you do also andrew 8^)

Tom

--

===============================
Get scripts to make your life easier
http://www.script-trix.us
===============================



hoolahoous
Posts: 59
Member Since:
2006-06-02
Re: PRIVACY PETITION

Andrew,

First let me thank you for all the effort you are putting. A@H is what hooked me on to asterisk.
There are couple of points you raised which I would like to ponder on..

1) people run windows, pay money and, register but for trixbox they have issues

well, people do not have choice in case of windows. also using doesn't mean liking.. i am sure very very few people like registering however they simply don't have choice.. if trixbox tries to become windows, people will simply move away from it .. here they have choice..

2) people are not donating to project

i thought trixbox was a 'community project' (vs. commerical project).. means donating is not enforced. some people donate some do not.. if you have issues with people not donating money, probably you should start charging for trixbox.. i have no problems with that.. btw since fonality took over, i think is much less need of donation now that it has commercial backing.. from what you are saying, trixbox is trying to become a 'adware' where it gets money from advertizing.. again I have not problems with that, just say it so..
that raises one more question too.. since trixbox is collection of other freeware utlities, I am not sure how much fonality is donating to developers of those utlities

Please do not take these comments perosnally, I am just trying to have an open disucssion..

btw.. anonymous stats are not problem.. problem is mandatory registration.. why is username a requirment for 'anonymous stats' ? linux (I run fedora) doesn't require me to register to get update..



rasker
Posts: 529
Member Since:
2006-06-02
Re: PRIVACY PETITION

I also have issues with registration from a trixbox. Anonymous stats means no user tracking. The web interface can send anonymous data without having to log users in (asking first would be nice too).

Another issue is security as well as privacy. The trixbox does not have things like php globals set to off (indeed many web apps in trixbox would break if this were set so). This is a huge issue in the php world and should be for us as well. It means that one can fudge the url to tell the php application that you are logged in. In such an unsecure environment I would be hesitant to allow system level access (installing RPM's) as this means that the web server/php can execute the RPM or yum command allowing someone else to potentially install thier own RPM (virus/keylogger etc etc). However unlikely this is it is best paractise to not let web apps have access to system commands. I love the kennonsoft UI too but it too suffers from not being able to run with php globals off.

On the subject of contributing cash dollars. There is more than one way to contribute to an open source project. More valuable than actual cash dollars is peoples time and expertise (much more costly). I have mentioned before that trixbox should have the means for users to contribute thier time and expertise in a more meaning full way than posting in the forum. At the very least stickies for useful contributions. Had trixbox had to have paid people for all thier contributions then I wonder....

Just my two pence worth (can't spend cents here in the UK)

R



kerryg
Posts: 6790
Member Since:
2006-05-31
Re: PRIVACY PETITION

The trixbox project currently employs two full time engineers, a fulltime product manager, a part time graphic artist, and has a number of contract workers on different projects. This makles trixbox a huge cost center. Just because Fonality is spoonsoring the project does not mean they shouldn't find some way to offset those costs. Donations and advertising are certainly ways to accomplish that. We are not going to beat a dead horse about the package manager login, this was discussed months ago with a very favorable response from the community. If we feel that the community did not respond appropriately originally then we will, of course, revisit this issue for the next major release.

As for "other ways to donate", I totally agree. This includes helping in the forum, adding bugs to the bug tracker, adding information to the wiki (coming soon) and sending me very cool hardware :-) .

As always, we appreciate your comments and we do listen to what people have to say. For right now, we can make any major changes to the platform. However, when we ask for suggestions for the next release, please don't hesitate to bring this up again.

--

Kerry Garrison
http://www.VoipStore.com - http://3cxbook.com
(888) VOIPSTORE - (888) 864-7786



jstraten
Posts: 165
Member Since:
2006-08-16
Re: PRIVACY PETITION

Kerry,

I understand where you are coming from and so I would like to propose a compromise which might satisfy everybody. Here it goes:

Instead of using the forum id to gather unique anonymous information you could simply generate a unique install number for each Trixbox installation. This could simply be a long number which gets created the first time you connect to the online repository. Wouldn't that work for everybody? I mean you would get anonymous information from each Trixbox installation and no end user would get identified by name. This solution should also be quite easy to implement. Basically you only need to replace the logon code with a code that asks the remote installation for a unique number to use the module repository. If it doesn't have one you could just assign one and send it back. If needed you can even make it smarter by logging the IP along with unique number (I know some people will scream again now, but let's be realistic, if you connect to a FTP server anywhere your IP will be logged) which would allow you to clean up the list (e.g. deleting re-installations).

Well, I am sure there are other mechanisms, but I just wanted to point out another option that might satisfy most people.

I also want you to know that I appreciate all the work Andrew, you and others put into this.

Cheers,
Jens



Rager
Posts: 79
Member Since:
2006-11-30
Re: PRIVACY PETITION

People get up in arms about privacy all the time. Its like the new cool thing to complain about. In reality we have more privacy now that we have ever had.

I for one do not see a problem with fonality gathering usage data. They need some level of recovery for sponsoring the project.

thats just my 2 cents worth

Thanks

Rager :-)



KodaK
Posts: 1885
Member Since:
2006-06-14
Re: PRIVACY PETITION
Quote:
Rager wrote:
In reality we have more privacy now that we have ever had.

At the risk of derailing this thread: what planet do you live on and can I move in with you? That's certainly not the reality I experience.

--

WARNING: I no longer actively participate in these forums. My thoughts on trixbox in a nutshell: http://www.youtube.com/watch?v=q4xBMkWu1pE Use AsteriskNOW instead.



Rager
Posts: 79
Member Since:
2006-11-30
Re: PRIVACY PETITION

The problem is not that we are loosing privacy, its the fact that now everyone is becoming more interconnected and so with you end up divuldging more information just due to the nature of it. There are more laws protecting your privacy now than has ever been before.

However if you live in the USA I'd say this may not be true, but in NZ it is.

My intention was not to start a flame war but rather just to say I don't really see any problems with it.



agit8or
Posts: 302
Member Since:
2006-05-31
Re: PRIVACY PETITION

Yes, LAWS were DESIGNED to protect your privacy. Enforcing those laws and cleaning up the mess AFTER the fact however is something entirely different. ;)



SteveSy
Posts: 41
Member Since:
2006-07-20
Re: PRIVACY PETITION

I agree...a unique numeric id would be more agreeable.

I was kind of shocked to see I was required to give up my TB.org login to use part of the app. The lack of anonymity, the possiblity of being locked in to a pay for application, and ridiculous licensing fees for even simple things were the major factors to why I've moved away from commercial products like MS or SonicWall.

I used to have nothing but bad to say about opensource I was a pure MS guy. Now I avoid MS like the plague and ANY opportunity to use opensource to avoid MS or commercial products like Sonicwall will be utilized. It's not just about the money it's about someone having control over my projects.

The login thing gave me the uneasy feeling that Fonality might in some distant future lock parts of the app out unless you pay them for a license. It’s not unheard of; I’ve been lured into such things many times with commercial software. While I have no problem with paying for things I do have the concern I will implement this project and get to where I have no choice but to comply with whatever license they might demand because I have so much time, effort and resources invested in it.

Please do not take this as a flame on TrixBox, or Fonailty for that matter, but Fonailty is a commercial entity and their mission is to make money like any other business.

If it's a problem with contributions and you have no choice but to collect names then I would request that you first make a plea to the community with the caveat that if you fail to raise $X you will have no choice but to proceed with other means to keep the project alive.

Before you say it, you’re right I have the option to move on….but its opensource and what makes opensource great is community input.
Just my .02…..

Btw, need resources? I’ll be happy to donate bandwidth and server space or even a decent server. I have 10 megs up/down.



KodaK
Posts: 1885
Member Since:
2006-06-14
Re: PRIVACY PETITION
Quote:
SteveSy wrote:
but its opensource and what makes opensource great is community input.

The other thing that makes FOSS great is the fact that it can be forked if need be.

If Fonality decides to do something like start charging for access to updates or something (not unheard of -- see RedHat) then I guarantee you that there will be a fork of Trixbox.

I have no reason to believe that this is the case or anything, I'm just pointing out what would happen in a worst-case scenario.

--

WARNING: I no longer actively participate in these forums. My thoughts on trixbox in a nutshell: http://www.youtube.com/watch?v=q4xBMkWu1pE Use AsteriskNOW instead.



Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.