Ironically, the same refuse to get rid of in the default build have a security bug bounty program sponsored by the Sovereign Tech Fund.

What’s more than leaking personal data to by default?

@krakenbuerger @tarakiyee @polexa @mechko

Show thread

@Shamar you are raising an issue without even proposing a solution.
Also bear in mind that every distro can change this settings while using systemd choosing a default DNS configuration that better suits their needs.

As much as I don't like using these DNS I don't think it's as sensational as you're making it appear.

@ed I proposed a simple solution as soon as the issue has been considered by the team (unfortunately, to close it without much reflection).

The solution is pretty simple: fail early.

Just make the build fail if the user didn't specify the required constants to `./configure`.

This way anybody can pick the desired values at compile time and won't get neither (pretty undetectable) personal data-leaks nor malfunctions.

@Shamar why? It really makes no sense making the build fail unless you specify something like that.

Also: not everyone that's trying to build it have the time or the will to check all the DNS Servers that could suits their needs and using a wrong DNS Servers might impact systemd performance and functionalities so... it's not a systemd responsability.

@ed because, as explained in the issue, people (and corporations) compile and use open source software from source routinely, and even more in these years of supply chain attacks.

A failing build can be fixed in an hour (at most, if the build process is properly documented), but a personal data-leak can not be fixed at all after it occurred.

People who can't find DNS server more suited for their needs can happily use Google's one, but it must be a conscious decision not something they are not aware of.

As for it being a systemd responsibility, I think it is (they wrote that code and picked the worst possible defaults).
And frankly, they happily renamed the default branch from `master` to `main` to please US people who do not like to remember their heritage, why they shouldn't do a cheap fix here that benefit all the rest of the world?

Also note that **no actual distro build would be affected** as they already define the constants.

So why not?

@Shamar
Let's see If I understand this right....
1.- Systemd need to leak private information of their users because is when it works fine
2.- The privacy of their users is not the political view of their devs.
3.- You are a bad infuence if you value your personal data.

What's not lo love about it!!!!

Sign in to participate in the conversation
Qoto Mastodon

QOTO: Question Others to Teach Ourselves
An inclusive, Academic Freedom, instance
All cultures welcome.
Hate speech and harassment strictly forbidden.