ubuntu-spyware.html (12069B)
1 <!--#include virtual="/server/header.html" --> 2 <!-- Parent-Version: 1.96 --> 3 <!-- This page is derived from /server/standards/boilerplate.html --> 4 <!--#set var="TAGS" value="essays cultural evils" --> 5 <!--#set var="DISABLE_TOP_ADDENDUM" value="yes" --> 6 <title>Ubuntu Spyware: What to Do? 7 - GNU Project - Free Software Foundation</title> 8 <!--#include virtual="/philosophy/po/ubuntu-spyware.translist" --> 9 <!--#include virtual="/server/banner.html" --> 10 <!--#include virtual="/philosophy/ph-breadcrumb.html" --> 11 <!--GNUN: OUT-OF-DATE NOTICE--> 12 <!--#include virtual="/server/top-addendum.html" --> 13 <div class="article reduced-width"> 14 <h2>Ubuntu Spyware: What to Do?</h2> 15 16 <address class="byline">by 17 <a href="https://www.stallman.org/">Richard Stallman</a></address> 18 19 <div class="introduction"> 20 <p>Since <a href="https://fossbytes.com/the-spyware-feature-in-ubuntu-will-be-disabled-in-ubuntu-16-04-xenial-xerus/">Ubuntu 21 version 16.04</a>, the spyware search facility is now disabled by 22 default. It appears that the campaign of pressure launched by this 23 article has been partly successful. Nonetheless, offering the spyware 24 search facility as an option is still a problem, as explained below. 25 Ubuntu should make the network search a command users can execute from 26 time to time, not a semipermanent option for users to enable (and 27 probably forget). 28 </p> 29 30 <p>Even though the factual situation described in the rest of this 31 page has partly changed, the page is still important. This example 32 should teach our community not to do such things again, but in order 33 for that to happen, we must continue to talk about it.</p> 34 </div> 35 36 <p>One of the major advantages of free software is that the community 37 protects users from malicious software. Now 38 Ubuntu <a href="/gnu/linux-and-gnu.html"> GNU/Linux </a> has become 39 a counterexample. What should we do?</p> 40 41 <p>Proprietary software is associated with malicious treatment of the user: 42 surveillance code, digital handcuffs (DRM or Digital Restrictions 43 Management) to restrict users, and back doors that can do nasty things 44 under remote control. Programs that do any of these things are 45 malware and should be treated as such. Widely used examples include 46 Windows, the <a 47 href="/philosophy/why-call-it-the-swindle.html">iThings</a>, and the 48 Amazon “Kindle” product for virtual book 49 burning, which do all three; Macintosh and the Playstation III which 50 impose DRM; most portable phones, which do spying and have back doors; 51 Adobe Flash Player, which does spying and enforces DRM; and plenty of 52 apps for iThings and Android, which are guilty of one or more of these 53 nasty practices.</p> 54 55 <p><a href="/philosophy/free-software-even-more-important.html"> 56 Free software gives users a chance to protect themselves from 57 malicious software behaviors</a>. Even better, usually the community 58 protects everyone, and most users don't have to move a muscle. Here's 59 how.</p> 60 61 <p>Once in a while, users who know programming find that a free program 62 has malicious code. Generally the next thing they do is release a 63 corrected version of the program; with the four freedoms that define 64 free software (see <a href="/philosophy/free-sw.html">http://www.gnu.org/philosophy/free-sw.html</a>), they 65 are free to do this. This is called a “fork” of the program. Soon 66 the community switches to the corrected fork, and the malicious 67 version is rejected. The prospect of ignominious rejection is not 68 very tempting; thus, most of the time, even those who are not stopped 69 by their consciences and social pressure refrain from putting 70 malfeatures in free software.</p> 71 72 <p>But not always. Ubuntu, a widely used and 73 influential <a href="/gnu/linux-and-gnu.html"> GNU/Linux </a> 74 distribution, has installed surveillance code. When the user 75 searches her own local files for a string using the Ubuntu desktop, 76 Ubuntu sends that string to one of Canonical's servers. (Canonical 77 is the company that develops Ubuntu.)</p> 78 79 <p>This is just like the first surveillance practice I learned about in 80 Windows. My late friend Fravia told me that when he searched for a 81 string in the files of his Windows system, it sent a packet to some 82 server, which was detected by his firewall. Given that first example 83 I paid attention and learned about the propensity of “reputable” 84 proprietary software to be malware. Perhaps it is no coincidence that 85 Ubuntu sends the same information.</p> 86 87 <p>Ubuntu uses the information about searches to show the user ads to buy 88 various things from Amazon. 89 <a href="https://stallman.org/amazon.html">Amazon commits many 90 wrongs</a>; by promoting Amazon, Canonical contributes to them. 91 However, the ads are not the core of the problem. The main issue is 92 the spying. Canonical says it does not tell Amazon who searched for 93 what. However, it is just as bad for Canonical to collect your 94 personal information as it would have been for Amazon to collect it. 95 Ubuntu surveillance 96 is <a href="https://jagadees.wordpress.com/2014/08/27/ubuntu-dash-search-is-not-anonymous/">not 97 anonymous</a>.</p> 98 99 <p>People will certainly make a modified version of Ubuntu without this 100 surveillance. In fact, several GNU/Linux distros are modified 101 versions of Ubuntu. When those update to the latest Ubuntu as a base, 102 I expect they will remove this. Canonical surely expects that too.</p> 103 104 <p>Most free software developers would abandon such a plan given the 105 prospect of a mass switch to someone else's corrected version. But 106 Canonical has not abandoned the Ubuntu spyware. Perhaps Canonical 107 figures that the name “Ubuntu” has so much momentum and influence that 108 it can avoid the usual consequences and get away with surveillance.</p> 109 110 <p>Canonical says this feature searches the Internet in other ways. 111 Depending on the details, that might or might not make the problem 112 bigger, but not smaller.</p> 113 114 <p>Ubuntu allows users to switch the surveillance off. Clearly Canonical 115 thinks that many Ubuntu users will leave this setting in the default 116 state (on). And many may do so, because it doesn't occur to them to 117 try to do anything about it. Thus, the existence of that switch does 118 not make the surveillance feature ok.</p> 119 120 <p>Even if it were disabled by default, the feature would still be 121 dangerous: “opt in, once and for all” for a risky practice, where the 122 risk varies depending on details, invites carelessness. To protect 123 users' privacy, systems should make prudence easy: when a local search 124 program has a network search feature, it should be up to the user to 125 choose network search explicitly <em>each time</em>. This is easy: 126 all it takes is to have separate buttons for network searches and 127 local searches, as earlier versions of Ubuntu did. A network search 128 feature should also inform the user clearly and concretely about who 129 will get what personal information of hers, if and when she uses the 130 feature.</p> 131 132 <p>If a sufficient part of our community's opinion leaders view this 133 issue in personal terms only, if they switch the surveillance off for 134 themselves and continue to promote Ubuntu, Canonical might get away 135 with it. That would be a great loss to the free software community.</p> 136 137 <p>We who present free software as a defense against malware do not say 138 it is a perfect defense. No perfect defense is known. We don't say 139 the community will deter malware <em>without fail</em>. Thus, 140 strictly speaking, the Ubuntu spyware example doesn't mean we have to 141 eat our words.</p> 142 143 <p>But there's more at stake here than whether some of us have to eat 144 some words. What's at stake is whether our community can effectively 145 use the argument based on proprietary spyware. If we can only say, 146 “free software won't spy on you, unless it's Ubuntu,” that's much less 147 powerful than saying, “free software won't spy on you.”</p> 148 149 <p>It behooves us to give Canonical whatever rebuff is needed to make it 150 stop this. Any excuse Canonical offers is inadequate; even if it used 151 all the money it gets from Amazon to develop free software, that can 152 hardly overcome what free software will lose if it ceases to offer an 153 effective way to avoid abuse of the users.</p> 154 155 <p>If you ever recommend or redistribute GNU/Linux, please remove Ubuntu 156 from the distros you recommend or redistribute. If its practice of 157 installing and recommending nonfree software didn't convince you to 158 stop, let this convince you. In your install fests, in your Software 159 Freedom Day events, in your FLISOL events, don't install or recommend 160 Ubuntu. Instead, tell people that Ubuntu is shunned for spying.</p> 161 162 <p>While you're at it, you can also tell them that Ubuntu contains 163 nonfree programs and suggests other nonfree programs. (See 164 <a href="/distros/common-distros.html"> 165 http://www.gnu.org/distros/common-distros.html</a>.) That will counteract 166 the other form of negative influence that Ubuntu exerts in the free 167 software community: legitimizing nonfree software.</p> 168 169 <div class="important"> 170 <p> 171 The presence of nonfree software in Ubuntu is a separate ethical 172 issue. For Ubuntu to be ethical, that too must be fixed. 173 </p> 174 </div> 175 </div> 176 177 </div><!-- for id="content", starts in the include above --> 178 <!--#include virtual="/server/footer.html" --> 179 <div id="footer" role="contentinfo"> 180 <div class="unprintable"> 181 182 <p>Please send general FSF & GNU inquiries to 183 <a href="mailto:gnu@gnu.org"><gnu@gnu.org></a>. 184 There are also <a href="/contact/">other ways to contact</a> 185 the FSF. Broken links and other corrections or suggestions can be sent 186 to <a href="mailto:webmasters@gnu.org"><webmasters@gnu.org></a>.</p> 187 188 <p><!-- TRANSLATORS: Ignore the original text in this paragraph, 189 replace it with the translation of these two: 190 191 We work hard and do our best to provide accurate, good quality 192 translations. However, we are not exempt from imperfection. 193 Please send your comments and general suggestions in this regard 194 to <a href="mailto:web-translators@gnu.org"> 195 <web-translators@gnu.org></a>.</p> 196 197 <p>For information on coordinating and contributing translations of 198 our web pages, see <a 199 href="/server/standards/README.translations.html">Translations 200 README</a>. --> 201 Please see the <a 202 href="/server/standards/README.translations.html">Translations 203 README</a> for information on coordinating and contributing translations 204 of this article.</p> 205 </div> 206 207 <!-- Regarding copyright, in general, standalone pages (as opposed to 208 files generated as part of manuals) on the GNU web server should 209 be under CC BY-ND 4.0. Please do NOT change or remove this 210 without talking with the webmasters or licensing team first. 211 Please make sure the copyright date is consistent with the 212 document. For web pages, it is ok to list just the latest year the 213 document was modified, or published. 214 215 If you wish to list earlier years, that is ok too. 216 Either "2001, 2002, 2003" or "2001-2003" are ok for specifying 217 years, as long as each year in the range is in fact a copyrightable 218 year, i.e., a year in which the document was published (including 219 being publicly visible on the web or in a revision control system). 220 221 There is more detail about copyright years in the GNU Maintainers 222 Information document, www.gnu.org/prep/maintain. --> 223 224 <p>Copyright © 2012, 2014, 2016, 2022 Richard Stallman</p> 225 226 <p>This page is licensed under a <a rel="license" 227 href="http://creativecommons.org/licenses/by-nd/4.0/">Creative 228 Commons Attribution-NoDerivatives 4.0 International License</a>.</p> 229 230 <!--#include virtual="/server/bottom-notes.html" --> 231 232 <p class="unprintable">Updated: 233 <!-- timestamp start --> 234 $Date: 2022/04/12 11:15:32 $ 235 <!-- timestamp end --> 236 </p> 237 </div> 238 </div><!-- for class="inner", starts in the banner include --> 239 </body> 240 </html>