Re: Security leak: Public disclosure of user data without their consent by installing software via pkg

On Tue, Apr 06, 2021 at 03:11:31AM +0200, Stefan Blachmann wrote:
> Hello,
> 
> I had a very distressing experience today.
> I installed a package to view its scripts (and *not* to run them!).
> 
> I was shocked when pkg told me that my system configuration, including
> which packages and their versions are installed on my system, has been
> sent to an external entity, without asking for my content.
> 
> This is a security leak as well as a breach of EU data protection
> rules, but above all, it is a breach of trust of the unsuspecting
> FreeBSD users.
> 
> Read this: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251152
> And read my experience in this and the following forum posts:
> https://forums.freebsd.org/threads/toplist-freebsd-usage-per-1m-inhabitants.79669/post-504430
> 
> If this does not get fixed in short time, I will contact ArsTechnica,
> TheRegister and some other reputed IT news outlets, to create public
> pressure to get the issue resolved.
> 
> So please get this fixed and report back.

1. BSDStats isn't run/maintained by the FreeBSD project. File the
   report with the BSDStats project, not FreeBSD.
2. You install a package that is made to submit statistical data.
3. You're upset that it submits statistical data?

lolwut,

-- 
Shawn Webb
Cofounder / Security Engineer
HardenedBSD

https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEA6TL67gupaZ9nzhT/y5nonf44foFAmBsb9QACgkQ/y5nonf4
4fqJKw/+Ka6325Pk6m4RZpdXLjkqYsIliPqPnK1eYFS+I0tBQbZTf4w8T/mRM1nQ
j31dirVLvIuac2/VWlQTMKNWmpshLgC/gcu6CdSPj+LF0Uc6s0N/uzTMFa1ZP2Un
+BcXHO3GHkx9PgiPLmlD/zvNQEwik5X1zhI6vxQOnUuGNF+wvcq3e0H1+lpVF9B8
3QJgbLT+5mlrV9HPWZo0xaDGSa7xTMtaai7E+tHWHnvG2ShMSORIWA+aZ355g2ol
PdiJs+e5qroG0O9OYGc7+9AsWau3Z8HqD7fJhHBPuT6JUW15+M8InVUj7S6uDTh7
eFJY+GuBu0HkZe6k8tNQuGI/In+iQoDbGAQiWX8Q1kuLiYSO0B8OmJDkL7ZxAt7c
O6+U7gXanpKL8hoUikOUxfblH6Jh8HpGZ0WMd+JAIMwNEuGb7cVtvsTcZ0MFx+j8
GPDoSEZ9FoFqXlzjDtEJgShTVAYpG0k+ftLFkMgezebMja8OK0hAMqN9v1KlFJYp
xwMgI0EiZh7k3h7XaylGd7uP6+wSjizp/Oaj8lZhZJaXnt0Y3Rokom1M0Xw8Vv9u
9As9uoI53F3RsJzNGp95D1oxHREcldFqhcQos1XYPb2WfWH3kQKwXVZiWVy7FvsH
wM0dBCmMHXTzq8KxgfbnXF9+U8Sh4TWhkOrLvyky+WHq+jGUpnw=
=+cPv
-----END PGP SIGNATURE-----