product search in Ubuntu 12.10

存储架构 2012-11-10 阅读原文

The EFF has already discussed the product search “feature” in Ubuntu 12.10′s Unity UI. Ways for disabling it are covered:

  • sudo apt-get remove unity-lens-shopping – it isn’t easy to generally blacklist a package, it might end up getting re-installed later, etc.
  • System Settings / Privacy / Search Results – the naming says nothing about it disabling product search results.
  • use a UI other than Unity – this is what I do.

Here’s another way, that overrides the URL used for the product searching (restart your session after making this change):

$ sudo -s
# echo 'OFFERS_URI="https://localhost:0/"' >> /etc/environment

Or, if you run an organization where you build devices that run Ubuntu, and want to snoop on all the things people type into their Unity search bar, just change that to a URL you control.

I’m astonished by Canonical’s blatant disregard for providing a way to opt-in to this gaping privacy hole. This is a dramatic case of “calling home”, and provides a large amount of information about the user, in real-time. Besides sending the content of their searches and the version of the software installed, it also sends every keystroke, which means in some weird cases, even passive observers can examine keystroke timing which has been shown to potentially leak what is being typed: - - [09/Nov/2012:14:29:41 -0800] "GET //v1/search?q=p HTTP/1.1" 404 522 "-" "Unity Shopping Lens 6.8.0" - - [09/Nov/2012:14:29:41 -0800] "GET //v1/search?q=pw HTTP/1.1" 404 521 "-" "Unity Shopping Lens 6.8.0" - - [09/Nov/2012:14:29:41 -0800] "GET //v1/search?q=pwn HTTP/1.1" 404 521 "-" "Unity Shopping Lens 6.8.0"

Ubuntu is a general-purpose OS, with Unity as its default interface. It is not a vendor-tied appliance nor a telephone company device, and Unity is not a browser (in fact, even in a browser there are visual indicators of where what you have typed will go).

Even if the default for this is enabled, there needs to be (likely at install-time) a page describing what to expect, and the system owner can choose “yes, search online” or “no thanks”. This behavior needs to be fixed in 13.04 and SRUed into 12.10. If there is no fast solution, then it just needs to be disabled by default until it has a sane notification flow.

© 2012,Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License .




Ubuntu 18.04: Unity is gone, GNOME is back—and Ubu... It's time for an upgrade to Bionic Beaver. ...
Myths and Misunderstandings about Unity, Mir and U... SwagArch GNU/Linux 2017.06 SwagArch GNU/Linux is a relatively new addition t...
How To Install Unity 7.0 Desktop on Ubuntu 18.04 You can install Unity 7 desktop onUbuntu 18.04 without removing GNOME. ...
Ubuntu and GNOME Devs Team Up to Ease Your “... The Ubuntu 17.10 (Artful Aardvark) operating system is only a few weeks away, an...
Ubuntu 新 Dock 抢先看,不欲重现 Unity 的体验... 据 OMGUbuntu 报道,Ubuntu Desktop 团队内部正在创建一个 Dash Dock 的分支 , 在 Dash to Dock(热门的 GNO...