Comment 5 for bug 608701

Revision history for this message
Alan Pope 🍺🐧🐱 πŸ¦„ (popey) wrote :

I will attempt to reproduce the connectivity issue, but accept it may well just be a lack of patience, not waiting long enough for the time out.

I don't believe it's the same as ntp. With ntp the hits go to Canonical controlled ntp servers by default. Firefox checks for updates at Mozilla corporation servers?

Vino goes one of two (randomly selected) hosts which are out of the control of Canonical or upstream corporate entities. Would Canonical corporate desktop customers be happy about the existence of Ubuntu machines 'leaking' out to 3rd party sites?

I was unable to find any terms of service or a privacy policy at the URLs specified in capplet/webservices including:-

http://blog.jorgepereira.com.br/jorge/org.gnome.vino.Service.php
http://blog.jorgepereira.com.br/jorge/
http://blog.jorgepereira.com.br/
http://jorgepereira.com.br/
http://www.bani.com.br/vino/vino.php
http://www.bani.com.br/vino/

At the following URL I discovered the upstream maintainer of vino

http://www.bani.com.br/

No reference to terms of service or privacy policy regarding vino is made on any of those pages. How do I know what they are doing with the data sent to them by the vino-preferences applet?

Indeed switching on the VNC service immediately makes me vulnerable to attack by announcing to those two sites that I have a VNC server running at my IP.

If either of those domains expired, or were hacked then that could compromise the privacy and security of my desktop surely? Whilst I appreciate the same could be said of the *.ubuntu.com domains and *.mozilla.com domains, I place more 'trust' (perhaps wrongly) in Canonical and the Mozilla foundation than I do in two blogs run by individuals.

It should be noted that I'm not casting any aspersions on the owners of those two blogs or their maintainer-ship of the vino project. I am just uneasy about the remote call made without my consent or knowledge.