GNU bug report logs - #43796
Privacy policy

Previous Next

To reply to this bug, email your comments to 43796 AT debbugs.gnu.org.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>
To: bug-guix <at> gnu.org
Subject: Privacy policy
Date: Sun, 4 Oct 2020 17:34:19 +0200

[Message part 1 (text/plain, inline)]

IANAL but I think Guix needs a privacy policy for both its website and
the Guix software in general.

Attached is a patch for the website that also documents data use by
Guix and Guix System.  Maybe I’ve overdone some parts and probably
something important is missing.

In particular, the GDPR requires IP addresses to be deleted from logs
after a reasonable time.  I think but am not sure the current process
for nginx is to delete only when the log files become too big.  A more
suitable policy must be implemented and the users must be told about
it, I think.  See <https://gdpr-info.eu/art-13-gdpr/>.

In general I think it is better to have an incomplete policy than to
have none.

Comments?

Regards,
Florian

[0001-website-Add-privacy-policy.patch (text/plain, attachment)]

Message #8 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Julien Lepiller <julien <at> lepiller.eu>
To: bug-guix <at> gnu.org, "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>,
 43796 <at> debbugs.gnu.org
Subject: Re: bug#43796: Privacy policy
Date: Sun, 04 Oct 2020 11:56:04 -0400

[Message part 1 (text/plain, inline)]

Looks nice, but:

The GDPR is not the only legislation that applies to us. For services hosted in France for instance, there is a legal obligation to keep logs for at least one year (not sure exactly who that applies to). There could be something similar in Germany where berlin is located.

I think some of the wording is vague. Does "can be used to identify" mean we will use the IP to identify the person (is it the reason we process this data?) Or is it something that we could technically do, but refuse to do?

Le 4 octobre 2020 11:34:19 GMT-04:00, "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de> a écrit :
>IANAL but I think Guix needs a privacy policy for both its website and
>the Guix software in general.
>
>Attached is a patch for the website that also documents data use by
>Guix and Guix System.  Maybe I’ve overdone some parts and probably
>something important is missing.
>
>In particular, the GDPR requires IP addresses to be deleted from logs
>after a reasonable time.  I think but am not sure the current process
>for nginx is to delete only when the log files become too big.  A more
>suitable policy must be implemented and the users must be told about
>it, I think.  See <https://gdpr-info.eu/art-13-gdpr/>.
>
>In general I think it is better to have an incomplete policy than to
>have none.
>
>Comments?
>
>Regards,
>Florian

[Message part 2 (text/html, inline)]

Message #14 received at 43796 <at> debbugs.gnu.org (full text, mbox):

From: Tomás Ortín Fernández <tomasortin <at> mailbox.org>
To: 43796 <at> debbugs.gnu.org
Date: Mon, 5 Oct 2020 09:09:20 +0200

As I understand it, the Guix distribution is *not* a service but a piece of software. Neither the Guix community nor the GNU project have any responsibility over the third-party services you decide to use with the Guix system, your software in your computer; it's only responsible of what concerns their services: the website and the repositories.
For example, it's not that Guix shares your IP with your network provider, you share it yourself. It is indeed "your responsibility" (and your network provider's), but why would that be on the privacy policy for Guix?

>During your use of Guix’ software in its default configuration, your IP address may be revealed to the network services you use.

What configuration doesn't reveal your IP to the network services you use? If you use Tor, your IP will be revealed at least to the Tor access node. It's not possible to use the Internet without revealing your IP to at least one service.

I understand that the point of mentioning all that is more as an advice than a policy. Wouldn't it be more useful in a section about privacy recommendations (or something similar) that in the privacy policy?

Message #17 received at submit <at> debbugs.gnu.org (full text, mbox):

From: "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>
To: Julien Lepiller <julien <at> lepiller.eu>
Cc: 43796 <at> debbugs.gnu.org, bug-guix <at> gnu.org
Subject: Re: bug#43796: Privacy policy
Date: Mon, 5 Oct 2020 11:54:32 +0200

[Message part 1 (text/plain, inline)]

On Sun, Oct 04, 2020 at 11:56:04AM -0400, Julien Lepiller wrote:
> The GDPR is not the only legislation that applies to us. For
> services hosted in France for instance, there is a legal obligation
> to keep logs for at least one year (not sure exactly who that
> applies to). There could be something similar in Germany where
> berlin is located.

A quick web search does not reveal any such obligation in Germany.
I also know people who don’t log.  But again, IANAL.

The Debian Privacy Policy says they store web logs for 15 days.
But iplocation.net tells me their server is hosted in the Netherlands.

If the Guix admins do not intend to use such data to “respond to
excess usage or security attacks” on the website, logging should be
disabled and I will remove that wording from the proposed patch.

> I think some of the wording is vague. Does "can be used to identify"
> mean we will use the IP to identify the person (is it the reason we
> process this data?) Or is it something that we could technically do,
> but refuse to do?

I changed it to

During your use of Guix’ software in its default configuration,
your IP address will be revealed to the network services you use.
From an IP address it may be possible to identify who uses the
service and from which internet connection.  These services include

Attached is the complete patch with this single change.

Are there other things which are badly worded?

Regards,
Florian

[0001-website-Add-privacy-policy.patch (text/plain, attachment)]

Message #23 received at 43796 <at> debbugs.gnu.org (full text, mbox):

From: Julien Lepiller <julien <at> lepiller.eu>
To: "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>
Cc: 43796 <at> debbugs.gnu.org
Subject: Re: bug#43796: Privacy policy
Date: Mon, 05 Oct 2020 07:14:21 -0400

[Message part 1 (text/plain, inline)]

I'm pretty sure we log the date anl time along with IP and requested page.

Le 5 octobre 2020 05:54:32 GMT-04:00, "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de> a écrit :
>On Sun, Oct 04, 2020 at 11:56:04AM -0400, Julien Lepiller wrote:
>> The GDPR is not the only legislation that applies to us. For
>> services hosted in France for instance, there is a legal obligation
>> to keep logs for at least one year (not sure exactly who that
>> applies to). There could be something similar in Germany where
>> berlin is located.
>
>A quick web search does not reveal any such obligation in Germany.
>I also know people who don’t log.  But again, IANAL.
>
>The Debian Privacy Policy says they store web logs for 15 days.
>But iplocation.net tells me their server is hosted in the Netherlands.
>
>If the Guix admins do not intend to use such data to “respond to
>excess usage or security attacks” on the website, logging should be
>disabled and I will remove that wording from the proposed patch.
>
>> I think some of the wording is vague. Does "can be used to identify"
>> mean we will use the IP to identify the person (is it the reason we
>> process this data?) Or is it something that we could technically do,
>> but refuse to do?
>
>I changed it to
>
>During your use of Guix’ software in its default configuration,
>your IP address will be revealed to the network services you use.
>From an IP address it may be possible to identify who uses the
>service and from which internet connection.  These services include
>
>Attached is the complete patch with this single change.
>
>Are there other things which are badly worded?
>
>Regards,
>Florian

[Message part 2 (text/html, inline)]

Message #26 received at 43796 <at> debbugs.gnu.org (full text, mbox):

From: Jelle Licht <jlicht <at> posteo.net>
To: "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>,
 43796 <at> debbugs.gnu.org
Subject: Re: bug#43796: Privacy policy
Date: Mon, 05 Oct 2020 12:57:20 +0200

Hello,

"pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de> writes:

> IANAL but I think Guix needs a privacy policy for both its website and
> the Guix software in general.
Thanks for looking into this.

IANAL but I do not think it makes sense to have such a privacy policy at
this moment in time. I'd rather have a person with legal expertise look
at this situation and do the following:

1. Notice that we do need such a policy
2. Draft (or at least proof read) this policy.

The reason for this is two-fold: I think there are enough 'legal' texts
on the Internet of questionable enforcability/applicability, and doing
things this way creates a cargo-cult mentality.

Compare to the questionable habit of unconditionally adding the "The
content of this email is confidential ..."-esque spam outgoing email
(even if that mail is addressed to a public mailing list).

If others disagree in principle or in practice with me on this, that is
fine too of course :-)

- Jelle

Message #29 received at 43796 <at> debbugs.gnu.org (full text, mbox):

From: "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>
To: Tomás Ortín Fernández <tomasortin <at> mailbox.org>
Cc: Jelle Licht <jlicht <at> posteo.net>, 43796 <at> debbugs.gnu.org
Subject: Re: bug#43796: (no subject)
Date: Mon, 5 Oct 2020 15:16:32 +0200

On Mon, Oct 05, 2020 at 09:09:20AM +0200, Tomás Ortín Fernández via Bug reports for GNU Guix wrote:
> As I understand it, the Guix distribution is *not* a service but a
> piece of software. Neither the Guix community nor the GNU project
> have any responsibility over the third-party services you decide to
> use with the Guix system, your software in your computer; it's only
> responsible of what concerns their services: the website and the
> repositories.

Actually I think we Guix contributors are responsible for the default
configuration.  I would suppose we even should display the Terms of
Service of the default NTP pool <https://www.ntppool.org/tos.html>
during install.

Regards,
Florian

Message #32 received at 43796 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Julien Lepiller <julien <at> lepiller.eu>
Cc: 43796 <at> debbugs.gnu.org,
 "pelzflorian \(Florian Pelz\)" <pelzflorian <at> pelzflorian.de>
Subject: Re: bug#43796: Privacy policy
Date: Mon, 05 Oct 2020 16:14:07 +0200

Hi,

Julien Lepiller <julien <at> lepiller.eu> skribis:

> I'm pretty sure we log the date anl time along with IP and requested page.

I think we’ll have to work on the nginx and log rotation settings for
our machines (see maintenance.git under hydra/).

Ludo’.

Message #35 received at 43796 <at> debbugs.gnu.org (full text, mbox):

From: Tomás Ortín Fernández <tomasortin <at> mailbox.org>
To: 43796 <at> debbugs.gnu.org
Date: Mon, 5 Oct 2020 17:29:51 +0200

> I would suppose we even should display the Terms of
> Service of the default NTP pool <https://www.ntppool.org/tos.html>
> during install.

I don't know of any distribution that does that (although maybe there are, or maybe they all should even if they don't). Still, it would make much more sense to display that kind of information during the install than as an standard privacy policy for Guix. Actually I think including easy access to the privacy policies and/or terms of service of the default services is a good idea, but IMO that shouldn't be included in Guix's privacy policy.

Message #38 received at 43796 <at> debbugs.gnu.org (full text, mbox):

From: "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>
To: Tomás Ortín Fernández <tomasortin <at> mailbox.org>
Cc: 43796 <at> debbugs.gnu.org
Subject: Re: bug#43796: (no subject)
Date: Mon, 5 Oct 2020 21:53:21 +0200

On Mon, Oct 05, 2020 at 09:09:20AM +0200, Tomás Ortín Fernández via Bug reports for GNU Guix wrote:
> I understand that the point of mentioning all that is more as an
> advice than a policy. Wouldn't it be more useful in a section about
> privacy recommendations (or something similar) that in the privacy
> policy?

Do you mean that the part about Guix and Guix System should rather be
explained in the manual?  Then I agree.  The website’s privacy policy
(or whatever we shall call it) should reference the manual then.

Regards,
Florian

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.