Bug 251152 - sysutils/bsdstats violates POLA and data protection rules
Summary: sysutils/bsdstats violates POLA and data protection rules
Status: New
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: freebsd-ports-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-11-15 10:25 UTC by Martin Birgmeier
Modified: 2020-11-16 21:32 UTC (History)
3 users (show)

See Also:
bugzilla: maintainer-feedback? (scrappy)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Birgmeier 2020-11-15 10:25:37 UTC
Scenario:
- FreeBSD 12.1
- lastest ports
- running "portmaster sysutils/bsdstats"

Result:
- the port gets installed
- during installation, without warning and without further user interaction:
  . it collects information and transmits it to a central site
  . it installs a tracking cookie/unique id in /var/db/bsdstats
  . it installs a setting in /etc/rc.conf making it run on every system startup
  . it installs periodic scripts making it run periodically
  . it never reveals which information is collected and sent to the central site

This amounts to a violation of POLA - ports do not usually start the programs they install immediately, and worse, to a violation of data privacy rules, for example those valid in the European Union (GDPR).

Expected result:
- the port gets installed
- no further changes to the system are made; specifically, none of the data collection programs the port installs are automatically run
- the port message informs the user about
  . what this port does
  . which data it collects
  . where the data is sent, and for what purpose
  . how to actively give assent to the port's data collection and transmission properties
  . how to enable the data collection program to run at system startup
  . how to enable the data collection program to run periodically
  . how to retract one's permission for the data collection and transmission and disable all such collection and transmission
  . how to reach the operators of the central site and demand that all collected information be deleted
- the program provides an option to inspect which information is collected without sending it anywhere

Bonus:
- the program provides an option to delete all the collected information on the central site and then deletes the locally generated cookies/unique id.

Note that the GDPR defines "personal data" as "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person".

-- Martin
Comment 1 Chris Hutchinson 2020-11-16 21:32:31 UTC
I concur. All services *must* include an rc var of
_ENABLE||_DISABLE
meaning... that any script installed to ${LOCALBASE}/etc
*require* an xyzservice_enable=(yes|no) in /etc/rc.conf
any script not following this standard should be marked
BROKEN