web analytics

Unity Shopping Lens: Privacy, Security and FUD

By On September 24, 2012 · 25 Comments
Screenshot from 2012 09 24 143630 1024x575 Unity Shopping Lens: Privacy, Security and FUD

Oh look I found Ubuntu Books with Unity Shopping Lens! Must Buy!

In light of the FUD over the Unity Shopping Lens package that has landed in Quantal there were also some legitimate security and privacy concerns surrounding this new innovative feature that I think will be very useful to many Ubuntu Users.

I had an opportunity to exchange a e-mail with Mark Shuttleworth late last night who put me in touch with Canonical’s Legal Team who is now looking into what changes they will need to introduce to cover how search data is collected and handled when it reaches  http://productsearch.ubuntu.com (ultimately SSL will land soon).

I do honestly think that shopping results will be a great feature but I do not think the work is done and this lens needs polishing which it will surely get from the Unity Team. Think how much time can be saved if you could search for products relevant to you and compare prices from a number of online retailers and find the best price all while supporting Ubuntu?

There has been a lot of concern since this conversation started over the weekend and much of it is sensational at best but I think the real important and productive discussion is occurring on Ubuntu IRC and our mailing lists where the Community, Developers and Canonical are working hard to make sure users have great Quetzal in the coming weeks. If for whatever reason you do not want the Unity Shopping Lens you can remove it by running “sudo apt-get remove unity-lens-shopping” in Terminal.

Remember you can be a partner in the discussion and development of Ubuntu by joining the Community.

Stay Calm and Download Ubuntu!

Update 9/25/12 4:38PM: I have drawn up a Technical Diagram of How I understand the Shopping Lens to work.

 

 

Tagged with: • • • • • •
 
  • http://blog.ssokolow.com/ Stephan Sokolow

    And STILL nothing on the fact that we don’t want our local system searches going over the network but we DO want to keep the shopping lens installed in a separate place where it can be extended with other product sources.

    Why is everyone operating under the mistaken assumption that the shopping lens, as an inherent property of what it does, can only be coded such that it must either be installed in the home dash or not at all.

    • veryannoyed

      Exactly. This point is not being addressed at all and it is the most sensible course of action. ALL the objections disappear as far as I can tell (that is, once the queries are encrypted). But no, all I feel is stubbornness from the designers and it such a big turn off. :( I will not send Canonical my queries unless it is an separate shopping lens, and I hope there is a legal basis for a lawsuit against them for the millions of users who will be unaware that they are automatically sending their Dash keystrokes to a third party.

  • http://blog.ssokolow.com/ Stephan Sokolow

    That’s the whole point of this meteorically-rising bug report that keeps getting toggled between “confirmed” and “invalid”.

    “Don’t include remote searches in the home lens”

    https://bugs.launchpad.net/ubuntu/+source/unity-lens-shopping/+bug/1054776

    (Sorry I said dash rather than lens earlier. I normally run Lubuntu, so I don’t get much practice with the terminology.)

    • http://blog.ssokolow.com/ Stephan Sokolow

      …and now bug 1054776 is 404ing rather than having roughly 260 “affects me too”s and a heat of 1158 (which puts it in the top 75 hottest bugs for Ubuntu as a whole in roughly 48 hours).

      I guess someone who’s “got root” got fed up with how people kept undo-ing the “Resolved: Invalid” to state legitimate concerns and did the adult version of throwing a tantrum.

      Classy. Now Ubuntu truly has grown beyond being Google’s apprentice in the art of being closed and obtuse. (Google did the same thing when they removed http:// from the Chrome address bar, but they just locked out further comments on the bug they themselves had opened to “solicit feedback”)

      • http://blog.ssokolow.com/ Stephan Sokolow

        …and now it’s back. I guess Launchpad allows arbitrary users to argue with the visibility metadata too. (I learn something new every day)

        Launchpad needs a better message than the default 404 one for when you try to access a “visibility: private” bug.

        • Benjamin Kerensa

          That is true a 404 message does imply an asset on a server is no longer there http://en.wikipedia.org/wiki/HTTP_404

          • http://blog.ssokolow.com/ Stephan Sokolow

            Agreed. The most appropriate solution would probably be a “403 Forbidden” with a properly meaningful human-readable response.

  • xg

    I don’t get why you keep invoking the word “FUD” in every post. You were the one who was wrong about the “shopping results” in your last post. (What’s the extreme opposite of FUD, denial? propaganda?) And Mark is at best splitting hairs by claiming these “results” are not ads. (doublespeak?) Amazon may or may not be paying for placement, but Canonical are using the dash to advertise their affiliate links in a way that’s similar to spam. Just because the result is “relevant” (although this is questionable) does not make it not an advertisement.

    Saying, I have root, is not helpful. Canonical should ask permission before logging keystrokes and data. We hardly trust them: that’s why we use open source: so we don’t have to trust them. I certainly don’t trust them not to break anything: in fact I my dual boot laptop won’t load into Ubuntu after a recent update. (An update that included asking to automatically send crash reports to Canonical. I shouldn’t have these types of permissions changes in an maintenance update. I want to control my data.)

  • http://gravatar.com/vadirkp Vadim P.

    Because that’s how it is at the moment… this feature was introduced like this, doesn’t have an option yet. It was just introduced as a test-bed for generation discussion on this. I’m fairly certain it’s not the final, finished and agreed-upon product.

  • Martin

    “Remember you can be a partner in the discussion and development of Ubuntu by joining the Community.”

    Except for the parts of it that Canonical works on internally without telling anyone about until after feature and UI freeze. Or the parts that are under a contributor license agreement that blocks people who don’t feel like getting a lawyer to read it or just hitting “accept” and hoping for the best. Or the parts that sabdfl decides on by fiat and then defends with comments that insinuate that people who disagree are trolls who hate Canonical for trying to monetize Ubuntu.

    If you actually want to be a partner in the discussion and development of a distribution, I would recommend going with a distribution that’s community-developed in the open. Ubuntu is no longer that distribution, and has not been for a while (this is not the first time software has been pushed into Ubuntu after freezes without the community hearing about it first, after all).

    Interesting experiment: will this end up being approved, or do you block commentors that don’t drink the kool aid?

    • Benjamin Kerensa

      Sorry it took a few minutes for me to approve the comment. But due to the level of traffic I get moderation is necessary.

      Martin I understand your frustrations about how Canonical makes decisions sometimes with no input from the community.

      Although you may believe I’m in the Kool Aid circle I assure you that I am critical of Canonical when on occasion. Heck I’m critical of governance processes and teams that are community based when the need arises.

      I have a great desire to see our community grow in the right direction and I know you want that to regardless of how much you think Canonical is ruining it.

    • Benjamin Kerensa

      Notably I have been very vocal about Canonical not having an adequate privacy policy which as a result is now be addressed.

  • Not A Celestial Lawnmower, Just Concerned.

    I really don’t appreciate you, and other members of the pro-search crowd latching onto the “FUD” term. It has a lot of connotation attached to it, and it’s basically tantamount to you dismissing the people with concerns as sensationalists.

    As an aside, purging the shopping lens is fine, UNTIL you’re on a multiuser system where one user wants it and another doesn’t.

    Back on topic….
    However, since we’re on the subject of FUD, I’d like to point out how this, and this is merely the latest in a line of these sorts of things (features being seemingly-mandated after Feature Freeze, behind closed doors, etc) are actually stirring up FUD in a different way:
    Fear: that a single-minded focus for a general purpose OS is hurting our whole community.
    Uncertainty: that we can trust Canonical to make appropriate technical decisions[1].
    Doubt: that Ubuntu is still the best solution to meet our computing needs.

    1: Did no one at Canonical think “maybe we shouldn’t broadcast every search the user does in plaintext” until they released it? That doesn’t give me warm fuzzies about their competency.

  • Richard

    There are two things that bother me about the Shopping lens:

    1. That they launched it without SSL, even though it was a planned element. Really, the security goes in after the launch? Not the ordinary order of operations, I would think.

    2. That the other lenses are still buggy. Photo lens crashes for me on a regular basis, I often get no results at all for Applications, Music often fails to find songs I know are in my Music folder . . . and many of these flaws seem to be getting worse after the Shopping lens was installed. I’ll concede that correlation is not causation, but I’m likely going to remove the Shopping lens to test the hypothesis, and I feel no great urge to restore it afterword, at this point.

    Here’s a thought for Canonical: get the lenses that people want, use and even need on their local machines (Applications, Files & Folders, etc.) working cleanly and consistently before you quick-launch an incomplete Shopping lens. Otherwise, expect the backlash you’re currently getting to increase, rather than abate.

  • http://www.brossmanit.com/ Tom Brossman

    Using the term ‘FUD’ in the title of your post hurts your credibility and reinforces the idea that bloggers are not to be taken seriously. I know you have ‘…Ramblings of a beautiful mind’ up there at the top banner but you are really highlighting this. You are inviting criticism when you should be directing readers to focus on your community participation advice. Never mind that in this instance community participation was circumvented, it’s generally how things work with Ubuntu so a solid recommendation.

    I’d like to see someone address the root problem which is HOW this is being handled and not WHAT is happening. Ramming this change through post-freeze, then doing a maladroit blog post (referring to Mark’s Sunday post) which glossed over basic privacy questions and contained factually incorrect responses is the problem. Nobody at Canonical has addressed this effectively yet, and there will be no confidence in the product until this happens.

    I’ll likely remove the lens when I install 12.10 because this looks to be an early Alpha product in it’s infancy. It’s inner workings are cloaked in secrecy which does not appeal to me.

    I’d like to support Canonical and have no problem with affiliate revenue schemes but this is a non-starter. I buy pressed discs from their store to hand out and pay for Ubuntu One storage so my support will be limited to that for now. Too bad, because I use Amazon frequently and now I feel that potential affiliate revenue is being wasted.

    • Benjamin Kerensa

      I think my colleagues, the communities I’m involved with and the sites I write for respect me as a credible source.

      Just because you think some action needs to take place doesn’t mean your right. This is not how things work in open source especially in a meritocracy.

      Sabdfl has the right to add features to Ubuntu regardless of his financial investment simply put he guides Ubuntu.

      Being overly concerned about new features is Fear. Feeling like things are not going to work out is uncertainty. Not trusting in the talented developers and dedicated community of contributors is Doubt.

      There you have it FUD.

      • http://www.brossmanit.com/ Tom Brossman

        Thanks for the reply, but your response contains several logical fallacies. I’ll point them out and I hope you can either retract the statements above, or reply with facts supporting your position.

        I do respect you but I’m going to disagree with your headline and other references to FUD, it’s bias and it looks like trolling to me.

        For example, I am not alone in thinking this should be changed. I don’t need to tell you to look at all the bugs filed against this on Launchpad, you filed at least one and brought them to my attention in your earlier post. You’ve likely seen the negative coverage in some of the tech press by now, it’s hardly just my opinion.

        Mark claimed this was covered by a ‘privacy policy’ that neither he nor anyone at Canonical can produce any evidence of (Bug #1054741 – reported by you).

        Nor did Mark ‘trust the dedicated community of contributors’ you refer to, this was arbitrarily forced through from the top. (Confirmed in the description of Bug #1053470). In a true meritocracy this isn’t how things are done. Maybe he’s the one with doubts or uncertainty?

        Results include NSFW images (Bug #1054282) that are a bona fide concern for parents with children using Ubuntu, along with believers of different faiths.

        There are loads more, these three are cause enough for concern.

        To say ‘Being overly concerned with new features is fear’ may be your opinion, but I don’t think the community is actually feeling fearful. This is a wild embellishment. Disabling the lens takes a few seconds, it’s easy and we know it.

        You are being dismissive of multiple valid concerns raised by the community, and doing so is a disservice to those of us that read your columns and respect you. Maybe we just agree to disagree here but I’d like to see less drama and more focus on covering the facts and legitimate concerns of end users.

        • Benjamin Kerensa

          Tom,

          So far I have only seen one two bugs filed by Community Members remember being a user does not imply Ubuntu Membership which is a process of peer approval. Yes I did file Bug #1054741 in relation to the lack of an adequate privacy policy and I do not think Mark was trying to mislead when he said there was one already covering this. You have to remember Mark is a very busy businessman who travels a lot and works on a lot of projects and because there was failure somewhere along the way that prevented a privacy policy from being generated which he assumed took place is not a major reason for concern especially since it is being addressed.

          Mark does need to run every decision he makes by the community and notably it was not Mark who pushed the feature it was someone from the Unity Team and they went through the proper procedure and got a Freeze Exception from the Release Team.

          Results include NSFW images (Bug #1053470) if you search for questionably NSFW queries and lets remember that 12.10 is not a released product so you cannot expect everything to be ready or working properly until its released and I am sure this will be addressed before release like the other issues.

          If users got concerned and had doubt every time any software application in any project was in Alpha or Beta there would be a mountain hypothetically speaking of FUD. I think users have unreal expectations that everything should be perfect by the Beta milestone when in reality work is put in up to the last minute before a release.

          Although you think I am being dismissive I have been very pro-active in addressing the privacy concern (I was the one who initiated the conversation with Canonical Legal) and I have also been critical of the plaintext bug.

          I would call my position “being understanding” not “dismissive” in that I understand how a development cycle works and how features are decided upon by Canonical and the Community.

          • http://www.brossmanit.com/ Tom Brossman

            Thanks again for the reply. I wasn’t going to post another comment but after re-reading everything here I feel obliged to point out that much of the frustrations are with Mark, and not directed at you. I’m speaking for myself but it’s probably a majority opinion.

            Keep the posts coming and don’t ever hesitate to fairly criticise decisions, wherever they come from.

      • xg

        So, you’re (un)ironically misusing the term “FUD” to describe and dismiss things that have nothing to do with actual FUD? To be a good evangelist? You’re not embarrassed by that naively literal logical slogan?

        On top of which you were the one who posted incorrect information in your last post? So it was FUD then because it wasn’t true that there were ads, but it’s FUD now because the ads are there, but they’re not ads.

        This, “don’t think, download Ubuntu,” is clever marketing. You guys should tell Apple that their 1984 campaign should have said, “stay calm, we have root.”

        • Benjamin Kerensa

          No it was not FUD in my previous post on the matter because there were not ads…. I consider them to be product suggests that are highly tailored and targeted to what people are seeking. Don’t search for “Ubuntu Books” and you wont be provided some suggestions dont search for “Kindle Fire HD” and you surely wont get a suggestion.

          Why else would one search for “Kindle Fire HD” on their desktop?

          • xg

            So, searching for “system” and receiving a suggestion for “Olay Pro-X” skin cleaning brush is “highly tailored and targeted”? Link: http://youtu.be/NazShyyXlL0?t=41m39s

            I’ve said this before, maybe they’re not ads for Amazon per se, but they’re ads for Ubuntu’s Amazon affiliate program.

            “Kindle Fire HD” is very specific. Search for “K” or “A” or “U”, “FUD”, “FU A and U” or any letter combination and you still receive “suggestions”.

  • http://attheedgeoftime.blogspot.com/ Luís de Sousa

    Hi Benjamin,

    I believe you are playing down some serious concerns raised by the community over the past few days. This feature can be a complete game changer in the way users relate to their DE.

    Apart from that, I believe Canonical is underestimating the legal embroilment it is emerging itself into. Legally, the Lens is collecting personal usage data, a practice that without a clear consent is already dicey enough. The problem is that it then uses these data to fetch information from a third party, Amazon in this case. Legally this is called “data crossing” a practice that is forbidden by law in many countries.

    Canonical can be posited to get a wide ban on the sales of hardware with Ubuntu pre-installed. Before dismissing this as sensationalism, please reflect a bit on the sort of competitors Ubuntu has in the pre-installed OS world.

  • Gary Mellor

    This is the final nail in Ubuntu’s coffin for me. I’ve been using Ubuntu since Karmic. I think since Unity came in things have got worse. This is a great shame. It seems with this ‘solution’ that no online lens searches will be possible. How does this fit with Linux being about choice? Why not have this lens as a PPA (or Synaptic package) so that if users want the ads and so forth they ‘opt in’ and pull it down. Some internet searches are useful but I’ll aver the vast majority of Ubuntu’s core users do not want ‘sell-out’ ads appearing on their desktop. Whilst I’m sure it’s true that users could download the source and remove this feature if they wished, this is not something that the vast majority of hobbyists or newbie’s will be able to do easily. It seems to me that Cananical and Ubuntu are fast becoming Linux’s equivalent of Microsoft and Windows: starting to restrict choice and foist what it thinks is best upon the community. It’s sad but I have now switched distros. I’m now running Linux Mint Debian 64-bit. If you look at Distro Watch Mint has had the higher page hit ranking for quite some time. Linux Mint allows me to keep my productivity up while Ubuntu seems to hinder me now more than when I first started using Karmic and was getting to know this OS. A newbie coming to Ubuntu now has to figure out how to use the Unity metaphor and HUD further complicates things in my opinion. Lenses are not pretty or functional for me – they simply get in the way. I sincerely hope Ubuntu changes the way it does things and if they fail to do so then I hope the community votes with their feet and abandon it and get another distro on their machines. Ubuntu has dropped the ball and lost its way. It is interesting that in the latest edition of Ubuntu User their was some feedback on Unity – there wasn’t much positive about it. Come on Ubuntu, please start listening to the community.