Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

It seems like all user input to the Dash home lens is send to Amazon by default in Ubuntu 12.10, is this correct?

share|improve this question
5  
I'm reopening this after reading back through various policies we've come up with in the past. –  Marco Ceppi Sep 24 '12 at 16:04
    

4 Answers 4

up vote 25 down vote accepted

They are proxying through productsearch.ubuntu.com with HTTPS encryption (though there's still a a heated bug discussion over whether the search should be included at all). Unfortunately, while no personally identifying information is sent to Amazon, the privacy policy for Ubuntu sharing information about proxied searches is still unclear.

Also, there are concerns that the image thumbnails of results that users download could allow Amazon to correlate queries to IP addresses.

Shuttleworth also wrote a blog post that tries to address the privacy issues with this feature.

share|improve this answer
3  
The answer is, everything typed into the home lens will be send by default anonymized to Amazon (current version: Ubuntu 12.10 Beta 1) - jonobacon.org/2012/09/25/… –  Paradiesstaub Sep 24 '12 at 23:44
    
Turns out #2 was just marked "visibility: private" by someone and Launchpad uses the 404 page for that. Someone else made it public again. I've archived a copy of the page contents as of now in case it happens again. –  ssokolow Sep 25 '12 at 1:45

I do not believe Amazon will see every query in its original state since these queries are sent to productsearch.ubuntu.com and then continue on so your ip address is not reaching Amazon's API. However the other concern is how does Canonical handle these queries since they get them in the original form and have no issued a privacy policy explaining whether any search data is kept.

It is not unreasonable to think that Canonical keeps logs on all of its servers for some period of time and maybe even backups.

share|improve this answer
14  
Given that Mr. Shuttleworth's response to all this (in a recent blog post) is essentially: if we wanted to spy on you, we could have already sent you a trojan, I have a bad feeling about how seriously Canonical takes this private user data. Such a flippant attitude to security and user trust does not normally end well... –  Jonathan Chan Sep 23 '12 at 19:00
2  
@JonathanChan yeah, that's what I thought too but we all make mistakes sometimes. I think his intentions are good here but this plan wasn't well communicated and isn't being managed well yet. –  Tom Brossman Sep 23 '12 at 19:24

Dash search terms are not sent to Amazon directly. They're sent to Canonical, which then sends them to Amazon. That means Amazon doesn't get your IP.

However, as of the current implementation, thumbnail requests are directly sent to Amazon. So Amazon does get your IP in the end.

More details: https://perot.me/ubuntu-privacy-blunder-over-amazon-ads-continues

share|improve this answer
5  
The Problem I see here is, that the default search sends data through the wire without the average user expecting it. Its a privacy problem. The IP thing is just one point here. –  Paradiesstaub Sep 28 '12 at 10:18
3  
I concur. The current implementation gives them little credibility when they claim that they anonymize your search terms. –  Etienne Perot Sep 28 '12 at 17:24

That is correct. Dash in Unity leaks information to Amazon and others.

You can read more about the privacy issues and how to fix them in EFF's post Privacy in Ubuntu 12.10: Amazon Ads and Data Leaks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.