Discussion:
[devinfo] GDPR - SME Server phoning home
Hsing-Foo Wang
2018-04-24 10:29:26 UTC
Permalink
It seems that contribs.org has a system in place where data is being
submitted back to contribs.org (phone home). I never signed up for any
data being submitted to anyone. Hence I always disable Smolt, and I
wonder why it is still active and present as a service by default, for
there is no receiving end. (See bugzilla) I do not want that!

GDPR is a serious matter.

The files that are included in this phone home system are:

/etc/e-smith/db/configuration/defaults/statusreport
/etc/e-smith/db/configuration/defaults/statusreport/status
/etc/e-smith/db/configuration/defaults/statusreport/type
/etc/e-smith/templates/etc/crontab/statusreport
/sbin/e-smith/statusreport

and the details that are sent without consent are:

          . "ReleaseVersion=" . $db->get_prop('sysconfig',
'ReleaseVersion')
          . "&SystemIDHash="  . $sysid_hash
          . "&CurrentEpoch="  . time
          . "&InstallEpoch="  . $db->get_prop('sysconfig', 'InstallEpoch')
          . "&SystemMode="    . $db->get_value('SystemMode');

It seems that this has been implemented despite the strong objectives
from various users.

GDPR FORBIDS the use of this phone home system and robbing server
details without explicit consent. You need to ASK permission and make
sure you have the permission, not ASSUME you have it.

statusreport and smolt HAVE TO BE removed from the ISO. Any other
statistics can be gathered ONLY with consent.

In other words, SME Server is NOT COMPLIANT to GDPR.

-HF




_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https
John Crisp
2018-04-24 11:36:05 UTC
Permalink
Ah damn. You are still here then.

Please stop SHOUTING. It is unnecessary. And when you are wrong it makes
you look silly.


On 24/04/18 12:29, Hsing-Foo Wang wrote:
> It seems that contribs.org has a system in place where data is being
> submitted back to contribs.org (phone home). I never signed up for any
> data being submitted to anyone. Hence I always disable Smolt, and I
> wonder why it is still active and present as a service by default, for
> there is no receiving end. (See bugzilla) I do not want that!
>

Please, reference your statements. Don't just say 'bugzilla'

Smolt sends nothing as there is nowhere to send it. It can be set
enabled or disabled, and it will still do.... nothing. It would take
more time and trouble to patch it or remove it than it is worth. It is
not installed in SME v10.

Of course, your patches are always welcome if you want it changed or
removed.

There is a separate script that sends anonymised data.

So you are conflating two different things.

> GDPR is a serious matter.
>

It is. But it relates to personal information.

"personal data is any information relating to an individual"

https://www.whitecase.com/publications/article/chapter-5-key-definitions-unlocking-eu-general-data-protection-regulation

"Data that are fully anonymised (i.e., data from which no individuals
can be identified) are outside the scope of both the Directive and the
GDPR."


> and the details that are sent without consent are:
>

Which parts identify an individual ?

ReleaseVersion=9.2
InstallEpoch=1158101533
SystemMode=serveronly

IP address is neither collected nor retained.

> It seems that this has been implemented despite the strong objectives
> from various users.
>

That's you then ?

> GDPR FORBIDS the use of this phone home system and robbing server
> details without explicit consent. You need to ASK permission and make
> sure you have the permission, not ASSUME you have it.
>

See above.

> statusreport and smolt HAVE TO BE removed from the ISO. Any other
> statistics can be gathered ONLY with consent.
>

I would argue that they do not. Again, patches are welcome.

> In other words, SME Server is NOT COMPLIANT to GDPR.
>

Your case is not proven.

Show that Personal Information is being sent and it will be looked.

Of course you can always go and use another distribution if you feel
that strongly.

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Hsing-Foo Wang
2018-04-24 12:09:20 UTC
Permalink
On 24-04-18 13:36, John Crisp wrote:
> Ah damn. You are still here then.
Excuse me?
> Please stop SHOUTING. It is unnecessary. And when you are wrong it makes
> you look silly.
Where is the shouting? Maybe I emphasize important topics, but SHOUTING?
>
>
> On 24/04/18 12:29, Hsing-Foo Wang wrote:
>> It seems that contribs.org has a system in place where data is being
>> submitted back to contribs.org (phone home). I never signed up for any
>> data being submitted to anyone. Hence I always disable Smolt, and I
>> wonder why it is still active and present as a service by default, for
>> there is no receiving end. (See bugzilla) I do not want that!
>>
> Please, reference your statements. Don't just say 'bugzilla'
As easy as looking for smolt in bugzilla
>
> Smolt sends nothing as there is nowhere to send it. It can be set
> enabled or disabled, and it will still do.... nothing. It would take
> more time and trouble to patch it or remove it than it is worth. It is
> not installed in SME v10.
Smolt is enabled and active by default. Can you prove that 'nowhere' is
'nowhere' and that 'nowhere' is doing 'nothing'?
>
> Of course, your patches are always welcome if you want it changed or
> removed.
I did, missed it?
> There is a separate script that sends anonymised data.
>
> So you are conflating two different things.
Nope, both smolt and the 'secret' script is what I am talking about.
>
>> GDPR is a serious matter.
>>
> It is. But it relates to personal information.
Nope, it is related to freedom of choice to hare any data that can be
related to a person.
>
> "personal data is any information relating to an individual"
>
> https://www.whitecase.com/publications/article/chapter-5-key-definitions-unlocking-eu-general-data-protection-regulation
>
> "Data that are fully anonymised (i.e., data from which no individuals
> can be identified) are outside the scope of both the Directive and the
> GDPR."
BS. An IP address from where data is submitted can be related to a
person. Hence I noticed you are so interested in GeoIP.

Many court cases in the EU and beyond have concluded that an IP address
is to be considered as personal data. Please get your facts together.

>
>
>> and the details that are sent without consent are:
>>
> Which parts identify an individual ?
>
> ReleaseVersion=9.2
> InstallEpoch=1158101533
> SystemMode=serveronly
>
> IP address is neither collected nor retained.
BS. the data is being submitted from E.T., the moon? or an IP?
>
>> It seems that this has been implemented despite the strong objectives
>> from various users.
>>
> That's you then ?
And various others. But as you seem to advice others and it is included
in your forum signature is the suggestion to search first
>
>> GDPR FORBIDS the use of this phone home system and robbing server
>> details without explicit consent. You need to ASK permission and make
>> sure you have the permission, not ASSUME you have it.
>>
> See above.
>
>> statusreport and smolt HAVE TO BE removed from the ISO. Any other
>> statistics can be gathered ONLY with consent.
>>
> I would argue that they do not. Again, patches are welcome.
A patch has NOTHING to do with awareness. If Awareness shows things have
to change, then the skilled ones are to blame for blaming th non skilled
ones.
>
>> In other words, SME Server is NOT COMPLIANT to GDPR.
>>
> Your case is not proven.
It is proven. See above.
>
> Show that Personal Information is being sent and it will be looked.
By who and why shall it be looked. The only answer is 'show me the code.
I am simply broadcasting the reality, not if I can code.
>
> Of course you can always go and use another distribution if you feel
> that strongly.
Many did, only 75 active visitors a day for contribs.org. I can choose
whatever I may.
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
John Crisp
2018-04-24 13:47:20 UTC
Permalink
On 24/04/18 14:09, Hsing-Foo Wang wrote:
> On 24-04-18 13:36, John Crisp wrote:
>> Ah damn. You are still here then.
> Excuse me?
>> Please stop SHOUTING. It is unnecessary. And when you are wrong it makes
>> you look silly.
> Where is the shouting? Maybe I emphasize important topics, but SHOUTING?

You know Caps are considered shouting. They are unnecessary. Emphasis
can be done in other ways.

>>>
>> Please, reference your statements. Don't just say 'bugzilla'
> As easy as looking for smolt in bugzilla

CBA. More important things to do.

> Smolt is enabled and active by default. Can you prove that 'nowhere' is
> 'nowhere' and that 'nowhere' is doing 'nothing'?

The service runs but has nothing to connect to.

You know full well that there is no smolt collation server and hasn't
been for years. You equally know that this is just 'noise' with no
relevance. Stop playing ridiculous games.

>>
>> So you are conflating two different things.
> Nope, both smolt and the 'secret' script is what I am talking about.

You are not very clear then, but I haven't time to correct your grammar.

As above, Smolt is not 'active' as it has nowhere to send anything. You
know that.

The status script sends anonymised data as I displayed.

>>> GDPR is a serious matter.
>>>
>> It is. But it relates to personal information.
> Nope, it is related to freedom of choice to hare any data that can be
> related to a person.

Still not sure you get the point of it.

It is only relevant if you are going to collect personally identifiable
information and process it. But that does not happen.

>> "Data that are fully anonymised (i.e., data from which no individuals
>> can be identified) are outside the scope of both the Directive and the
>> GDPR."
> BS. An IP address from where data is submitted can be related to a
> person. Hence I noticed you are so interested in GeoIP.
>

And you can retract your unsubstantiated claim which I find childish and
immensely offensive in equal measure. And don't give me any of that 'oh
I didn't mean it like that' nonsense.

GeoIP is used to block incoming mails, but you know that.

My own interest in GeoIP is in blocking junk mail to my company, and the
fact that the old v1 databases are EOL rendering GeoIP less useful in
time. You most likely know that too.

I have done zero coding on smolt or the status script. Until today I
don't think that I had never even looked at them.

There is zero connection between the two.

You are trying to add 2 and 2 and make them equal your preferred answer
of 42, whilst libelling me. My 'whataboutery' meter is off the scale.


> Many court cases in the EU and beyond have concluded that an IP address
> is to be considered as personal data. Please get your facts together.
>

There have been no court cases on GDPR yet......

However, as I said... it is irrelevant if an IP address is not
collected. So this is a fallacious argument.

>>
>> IP address is neither collected nor retained.
> BS. the data is being submitted from E.T., the moon? or an IP?

If it is neither tracked nor stored it is irrelevant where it comes from.

>> That's you then ?
> And various others. But as you seem to advice others and it is included
> in your forum signature is the suggestion to search first

Yours is to state and prove your case first. I can choose to defend at
my leisure.

>>> statusreport and smolt HAVE TO BE removed from the ISO. Any other
>>> statistics can be gathered ONLY with consent.
>>>
>> I would argue that they do not. Again, patches are welcome.
> A patch has NOTHING to do with awareness. If Awareness shows things have
> to change, then the skilled ones are to blame for blaming th non skilled
> ones.

Patches are welcome in that if you feel this is the case and you are
concerned about it you are more than welcome to do something about it
rather than sitting there and pontificating and expecting everyone to do
it for you. Before you start haranguing me, note that I don't have the
knowledge to do it. But then I have nave no issue with any of it.

You can always go somewhere else if you don't like the situation.

>>> In other words, SME Server is NOT COMPLIANT to GDPR.
>>>
>> Your case is not proven.
> It is proven. See above.

There is no personally identifiable information logged, processed or
stored. Which is the end of your case.

>> Of course you can always go and use another distribution if you feel
>> that strongly.
> Many did, only 75 active visitors a day for contribs.org. I can choose
> whatever I may.

Yes, probably they got fed up listening to you and your incessant
arguing and complaining I should imagine. I really wish you would and go
annoy someone else rather than those of us who are left here. It's been
peaceful the few months since your last outbursts when you stomped off
after throwing all your toys from your pram.

You are a time sink. Nothing but shouting and arguing and moaning and
whining and winding others up which does nothing but waste time trying
to pacify you or shut you up.

I have better things to do with my time quite frankly, but equally can't
see you start throwing nonsense around unanswered and accusing me of
things which are blatantly untrue.

You have cost this project more good developers, and users, than I care
to think about. You are the root cause of a lot of the decline of SME.

My guess is you will only be happy when there is no one left and you are
king by default.

You'll be the Emperor. With new clothes.
_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Hsing-Foo Wang
2018-04-24 14:07:38 UTC
Permalink
On 24-04-18 15:47, John Crisp wrote:
> On 24/04/18 14:09, Hsing-Foo Wang wrote:
>> On 24-04-18 13:36, John Crisp wrote:
>>> Ah damn. You are still here then.
>> Excuse me?
>>> Please stop SHOUTING. It is unnecessary. And when you are wrong it makes
>>> you look silly.
>> Where is the shouting? Maybe I emphasize important topics, but SHOUTING?
> You know Caps are considered shouting. They are unnecessary. Emphasis
> can be done in other ways.
I chose to CAPS (IF any) within the correct context. Obviously you take
offence on CAPS?

>
>>> Please, reference your statements. Don't just say 'bugzilla'
>> As easy as looking for smolt in bugzilla
> CBA. More important things to do.

Like responding to this thread? Backing off fro this now are we?
>
>> Smolt is enabled and active by default. Can you prove that 'nowhere' is
>> 'nowhere' and that 'nowhere' is doing 'nothing'?
> The service runs but has nothing to connect to.
>
> You know full well that there is no smolt collation server and hasn't
> been for years. You equally know that this is just 'noise' with no
> relevance. Stop playing ridiculous games.
Not true, did you check, really?

>
>>> So you are conflating two different things.
>> Nope, both smolt and the 'secret' script is what I am talking about.
> You are not very clear then, but I haven't time to correct your grammar.
>
> As above, Smolt is not 'active' as it has nowhere to send anything. You
> know that.
>
> The status script sends anonymised data as I displayed.

Where did you display anything please?
>
>>>> GDPR is a serious matter.
>>>>
>>> It is. But it relates to personal information.
>> Nope, it is related to freedom of choice to hare any data that can be
>> related to a person.
> Still not sure you get the point of it.
>
> It is only relevant if you are going to collect personally identifiable
> information and process it. But that does not happen.

Are you really sure. Maybe it is because the UK will leave the EU soon.
But rules still apply. Please read and understand the gravity of GDPR.
>
>>> "Data that are fully anonymised (i.e., data from which no individuals
>>> can be identified) are outside the scope of both the Directive and the
>>> GDPR."
>> BS. An IP address from where data is submitted can be related to a
>> person. Hence I noticed you are so interested in GeoIP.
>>
> And you can retract your unsubstantiated claim which I find childish and
> immensely offensive in equal measure. And don't give me any of that 'oh
> I didn't mean it like that' nonsense.
No idea what you are talking about.
>
> GeoIP is used to block incoming mails, but you know that.
Nope, GeoIP is there for many purposes.
>
> My own interest in GeoIP is in blocking junk mail to my company, and the
> fact that the old v1 databases are EOL rendering GeoIP less useful in
> time. You most likely know that too.
Fine, you may do whatever you want to do.
>
> I have done zero coding on smolt or the status script. Until today I
> don't think that I had never even looked at them.
I know that, it was somebody else that slipped it in.
>
> There is zero connection between the two.
Wrong. Did you check?
>
> You are trying to add 2 and 2 and make them equal your preferred answer
> of 42, whilst libelling me. My 'whataboutery' meter is off the scale.
Sorry, I'll pass on this.
>
>
>> Many court cases in the EU and beyond have concluded that an IP address
>> is to be considered as personal data. Please get your facts together.
>>
> There have been no court cases on GDPR yet......
>
> However, as I said... it is irrelevant if an IP address is not
> collected. So this is a fallacious argument.
Wrong again, double time. There ARE court cases regarding GDPR for it
has been in effect since 2016. IP addresses are being collected.
>
>>> IP address is neither collected nor retained.
>> BS. the data is being submitted from E.T., the moon? or an IP?
> If it is neither tracked nor stored it is irrelevant where it comes from.
IP addresses are stored, how the heck do you thing a fancy map can be
produced of installed servers around the globe?
>
>>> That's you then ?
>> And various others. But as you seem to advice others and it is included
>> in your forum signature is the suggestion to search first
> Yours is to state and prove your case first. I can choose to defend at
> my leisure.
No idea what you are saying here
>
>>>> statusreport and smolt HAVE TO BE removed from the ISO. Any other
>>>> statistics can be gathered ONLY with consent.
>>>>
>>> I would argue that they do not. Again, patches are welcome.
>> A patch has NOTHING to do with awareness. If Awareness shows things have
>> to change, then the skilled ones are to blame for blaming th non skilled
>> ones.
> Patches are welcome in that if you feel this is the case and you are
> concerned about it you are more than welcome to do something about it
> rather than sitting there and pontificating and expecting everyone to do
> it for you. Before you start haranguing me, note that I don't have the
> knowledge to do it. But then I have nave no issue with any of it.
>
> You can always go somewhere else if you don't like the situation.
I DO care and am trying to something about 'it'. The old fashioned
answer of 'then code it' is not up to par. Didn;t I say that mentioning
or creating awareness, is doing something about it. Why do so many
people thing that you have to be a coder before you can have a voice??
>
>>>> In other words, SME Server is NOT COMPLIANT to GDPR.
>>>>
>>> Your case is not proven.
>> It is proven. See above.
> There is no personally identifiable information logged, processed or
> stored. Which is the end of your case.
Nope, IP is traceable, please check EU court verdicts on this.

Only the fact that you STATE that I am wrong shows that you are not
aware of current situations and verdicts. But then again, the UK is not
EU for very long, so I undestand the lack of interest and understanding.
>
>>> Of course you can always go and use another distribution if you feel
>>> that strongly.
>> Many did, only 75 active visitors a day for contribs.org. I can choose
>> whatever I may.
> Yes, probably they got fed up listening to you and your incessant
> arguing and complaining I should imagine. I really wish you would and go
> annoy someone else rather than those of us who are left here. It's been
> peaceful the few months since your last outbursts when you stomped off
> after throwing all your toys from your pram.
>
> You are a time sink. Nothing but shouting and arguing and moaning and
> whining and winding others up which does nothing but waste time trying
> to pacify you or shut you up.
>
> I have better things to do with my time quite frankly, but equally can't
> see you start throwing nonsense around unanswered and accusing me of
> things which are blatantly untrue.
>
> You have cost this project more good developers, and users, than I care
> to think about. You are the root cause of a lot of the decline of SME.
>
> My guess is you will only be happy when there is no one left and you are
> king by default.
>
> You'll be the Emperor. With new clothes.
That is well put how the contribs.org community is falling apart.
Blaming and shaming, selfish and no contributing.

You can blame me for whatever you want, and if you give me the credit of
reducing forums users dropping to less then 75, cherio! Was it that easy
with so many senior and skilled developers and cimmunity members present.

Please get a life. The decline of enthusiasm for SME Server is a given
fact for many years. Not due to me. It is a fact that the board does
nothing to recognize the issue at hand and does nothing to correct
anything. Not under your leadership, nor the current 'leadership' (if
there was any).
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Hsing-Foo Wang
2018-04-24 12:12:12 UTC
Permalink
I had another look at the below expression. I'm not really sure what it
means, but it certainly does not sound friendly.

With what authority or from perspective are you responding 'that
strongly' For you can always choose to not to respond.

You are just you. You are not contribs.org

On 24-04-18 13:36, John Crisp wrote:

> Ah damn. You are still here then.

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
David Harper
2018-04-24 14:02:48 UTC
Permalink
Recital 26, which covers anonymous data collection, says in part:



The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.



Source: http://www.privacy-regulation.eu/en/recital-26-GDPR.htm



According to your post, the data in question is:



. "ReleaseVersion=" . $db->get_prop('sysconfig',
'ReleaseVersion')
. "&SystemIDHash=" . $sysid_hash
. "&CurrentEpoch=" . time
. "&InstallEpoch=" . $db->get_prop('sysconfig', 'InstallEpoch')
. "&SystemMode=" . $db->get_value('SystemMode');

The closest we get to unique data is therefore the system ID (hash) and the install time. I note that potentially identifiable data such as IP address and domain name are not shared.



So long as there is no secondary collection with which the system ID could be matched, I don't see a problem. By way of an example, the SMEOptimizer contrib requires registration (https://wiki.contribs.org/SMEOptimizer), so the maintainer may have additional responsibilities under GDPR if the script sends additional data to the maintainer’s server during initialisation.



-----
David Harper
Phone: 0421 550 063



________________________________
From: devinfo-***@lists.contribs.org <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com>
Sent: Tuesday, April 24, 2018 10:12:12 PM
To: ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home

I had another look at the below expression. I'm not really sure what it
means, but it certainly does not sound friendly.

With what authority or from perspective are you responding 'that
strongly' For you can always choose to not to respond.

You are just you. You are not contribs.org

On 24-04-18 13:36, John Crisp wrote:

> Ah damn. You are still here then.

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C0d6ed2d87eb54b51e63d08d5a9dca915%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601687551939217&sdata=lAqhsuBmKWZOywEfLz0SP%2F3jdKH%2FwINjkP5B5aedBFY%3D&reserved=0
Hsing-Foo Wang
2018-04-24 14:13:12 UTC
Permalink
Why does everybody forget about the IP number, the info is submitted
from an IP number that is not transferred but logged on the receiving
end. ? And that EU courts have ruled that IP numbers can be related to
persones???

Lack of knowledge????


On 24-04-18 16:02, David Harper wrote:
>
> Recital 26, which covers anonymous data collection, says in part:
>
> The principles of data protection should therefore not apply to
> anonymous information, namely information which does not relate to an
> identified or identifiable natural person or to personal data rendered
> anonymous in such a manner that the data subject is not or no longer
> identifiable.
>
> Source: http://www.privacy-regulation.eu/en/recital-26-GDPR.htm
> <http://www.privacy-regulation.eu/en/recital-26-GDPR.htm>
>
> According to your post, the data in question is:
>
>            . "ReleaseVersion=" . $db->get_prop('sysconfig',
> 'ReleaseVersion')
>            . "&SystemIDHash="  . $sysid_hash
>            . "&CurrentEpoch="  . time
>            . "&InstallEpoch="  . $db->get_prop('sysconfig',
> 'InstallEpoch')
>            . "&SystemMode="    . $db->get_value('SystemMode');
>
> The closest we get to unique data is therefore the system ID (hash)
> and the install time. I note that potentially identifiable data such
> as IP address and domain name are not shared.
>
> So long as there is no secondary collection with which the system ID
> could be matched, I don't see a problem. By way of an example, the
> SMEOptimizer contrib requires registration
> (https://wiki.contribs.org/SMEOptimizer), so the maintainer may have
> additional responsibilities under GDPR if the script sends additional
> data to the maintainer’s server during initialisation.
>
> -----
> David Harper
> Phone: 0421 550 063
>
> ------------------------------------------------------------------------
> *From:* devinfo-***@lists.contribs.org
> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
> <***@gmail.com>
> *Sent:* Tuesday, April 24, 2018 10:12:12 PM
> *To:* ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
> I had another look at the below expression. I'm not really sure what it
> means, but it certainly does not sound friendly.
>
> With what authority or from perspective are you responding 'that
> strongly' For you can always choose to not to respond.
>
> You are just you. You are not contribs.org
>
> On 24-04-18 13:36, John Crisp wrote:
>
> > Ah damn. You are still here then.
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at
> https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C0d6ed2d87eb54b51e63d08d5a9dca915%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601687551939217&sdata=lAqhsuBmKWZOywEfLz0SP%2F3jdKH%2FwINjkP5B5aedBFY%3D&reserved=0
David Harper
2018-04-24 14:24:12 UTC
Permalink
It depends on whether the receiving server is logging incoming data pushes by IP address, whether permanently or temporarily.

-----
David Harper
Phone: 0421 550 063

________________________________
From: Hsing-Foo Wang <***@gmail.com>
Sent: Wednesday, April 25, 2018 12:13:12 AM
To: David Harper; ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home


Why does everybody forget about the IP number, the info is submitted from an IP number that is not transferred but logged on the receiving end. ? And that EU courts have ruled that IP numbers can be related to persones???

Lack of knowledge????

On 24-04-18 16:02, David Harper wrote:

Recital 26, which covers anonymous data collection, says in part:



The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.



Source: http://www.privacy-regulation.eu/en/recital-26-GDPR.htm<https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.privacy-regulation.eu%2Fen%2Frecital-26-GDPR.htm&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=D%2BkU1qzmhR97o38mPjQR0jBTzv7FTyRQ9Tx%2FgvJUGjA%3D&reserved=0>



According to your post, the data in question is:



. "ReleaseVersion=" . $db->get_prop('sysconfig',
'ReleaseVersion')
. "&SystemIDHash=" . $sysid_hash
. "&CurrentEpoch=" . time
. "&InstallEpoch=" . $db->get_prop('sysconfig', 'InstallEpoch')
. "&SystemMode=" . $db->get_value('SystemMode');

The closest we get to unique data is therefore the system ID (hash) and the install time. I note that potentially identifiable data such as IP address and domain name are not shared.



So long as there is no secondary collection with which the system ID could be matched, I don't see a problem. By way of an example, the SMEOptimizer contrib requires registration (https://wiki.contribs.org/SMEOptimizer<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.contribs.org%2FSMEOptimizer&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=Gdc%2BfPZIXVKpboHNcIi7lHOWN7XfRgHDHi0xyCednPc%3D&reserved=0>), so the maintainer may have additional responsibilities under GDPR if the script sends additional data to the maintainer’s server during initialisation.



-----
David Harper
Phone: 0421 550 063



________________________________
From: devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org> <devinfo-***@lists.contribs.org><mailto:devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com><mailto:***@gmail.com>
Sent: Tuesday, April 24, 2018 10:12:12 PM
To: ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home

I had another look at the below expression. I'm not really sure what it
means, but it certainly does not sound friendly.

With what authority or from perspective are you responding 'that
strongly' For you can always choose to not to respond.

You are just you. You are not contribs.org

On 24-04-18 13:36, John Crisp wrote:

> Ah damn. You are still here then.

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
Searchable archive at https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C0d6ed2d87eb54b51e63d08d5a9dca915%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601687551939217&sdata=lAqhsuBmKWZOywEfLz0SP%2F3jdKH%2FwINjkP5B5aedBFY%3D&reserved=0
Hsing-Foo Wang
2018-04-24 14:53:24 UTC
Permalink
Good question, the Koozali board could provide an answer to this.


On 24-04-18 16:24, David Harper wrote:
>
> It depends on whether the receiving server is logging incoming data
> pushes by IP address, whether permanently or temporarily.
>
> -----
> David Harper
> Phone: 0421 550 063
>
> ------------------------------------------------------------------------
> *From:* Hsing-Foo Wang <***@gmail.com>
> *Sent:* Wednesday, April 25, 2018 12:13:12 AM
> *To:* David Harper; ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>
> Why does everybody forget about the IP number, the info is submitted
> from an IP number that is not transferred but logged on the receiving
> end. ? And that EU courts have ruled that IP numbers can be related to
> persones???
>
> Lack of knowledge????
>
>
> On 24-04-18 16:02, David Harper wrote:
>>
>> Recital 26, which covers anonymous data collection, says in part:
>>
>> The principles of data protection should therefore not apply to
>> anonymous information, namely information which does not relate to an
>> identified or identifiable natural person or to personal data
>> rendered anonymous in such a manner that the data subject is not or
>> no longer identifiable.
>>
>> Source: http://www.privacy-regulation.eu/en/recital-26-GDPR.htm
>> <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.privacy-regulation.eu%2Fen%2Frecital-26-GDPR.htm&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=D%2BkU1qzmhR97o38mPjQR0jBTzv7FTyRQ9Tx%2FgvJUGjA%3D&reserved=0>
>>
>>
>> According to your post, the data in question is:
>>
>>            . "ReleaseVersion=" . $db->get_prop('sysconfig',
>> 'ReleaseVersion')
>>            . "&SystemIDHash="  . $sysid_hash
>>            . "&CurrentEpoch="  . time
>>            . "&InstallEpoch="  . $db->get_prop('sysconfig',
>> 'InstallEpoch')
>>            . "&SystemMode="    . $db->get_value('SystemMode');
>>
>> The closest we get to unique data is therefore the system ID (hash)
>> and the install time. I note that potentially identifiable data such
>> as IP address and domain name are not shared.
>>
>> So long as there is no secondary collection with which the system ID
>> could be matched, I don't see a problem. By way of an example, the
>> SMEOptimizer contrib requires registration
>> (https://wiki.contribs.org/SMEOptimizer
>> <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.contribs.org%2FSMEOptimizer&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=Gdc%2BfPZIXVKpboHNcIi7lHOWN7XfRgHDHi0xyCednPc%3D&reserved=0>),
>> so the maintainer may have additional responsibilities under GDPR if
>> the script sends additional data to the maintainer’s server during
>> initialisation.
>>
>> -----
>> David Harper
>> Phone: 0421 550 063
>>
>> ------------------------------------------------------------------------
>> *From:* devinfo-***@lists.contribs.org
>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>> <***@gmail.com>
>> *Sent:* Tuesday, April 24, 2018 10:12:12 PM
>> *To:* ***@lists.contribs.org
>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>> I had another look at the below expression. I'm not really sure what it
>> means, but it certainly does not sound friendly.
>>
>> With what authority or from perspective are you responding 'that
>> strongly' For you can always choose to not to respond.
>>
>> You are just you. You are not contribs.org
>>
>> On 24-04-18 13:36, John Crisp wrote:
>>
>> > Ah damn. You are still here then.
>>
>> _______________________________________________
>> Server Development Discussion
>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>> Searchable archive at
>> https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C0d6ed2d87eb54b51e63d08d5a9dca915%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601687551939217&sdata=lAqhsuBmKWZOywEfLz0SP%2F3jdKH%2FwINjkP5B5aedBFY%3D&reserved=0
>
Jean-Philippe PIALASSE
2018-04-24 15:29:35 UTC
Permalink
David,
thanks for the exact reference.

No IP is logged, IP is discarded.
The more sensible data logged is the country associated to the IP
submitting the data, which even if you live in Vatican leave 836 people
for 17920 addresses, so still pretty anonymous data.

Even system id (which can be changed whenever you want) is sent hashed
by the server itself. System id hash allow to update the data of the
same server. Release allow us to know the amount of server for every
release. Country allow us to focus to country using more SME and push
for translation for instance.
Time of update, allow us to filter data to active server, if it has not
update for more than one month we consider it removed from service.
Install Epoch is usually not that useful as old server tends to have a
not up to date clock at the moment of installation, but could have been
useful to guess if a server has been updated through versions or if it a
fresh install. Or even if outdated version has just been installed in
the last months.


If you want to opt out:
config setprop statusreport status disabled
expand-template /etc/crontab

or alternatively migrate to another project.

Le 2018-04-24 à 10:24, David Harper a écrit :
>
> It depends on whether the receiving server is logging incoming data
> pushes by IP address, whether permanently or temporarily.
>
>  
>
> -----
> David Harper
> Phone: 0421 550 063
>
>  
>
> ------------------------------------------------------------------------
> *From:* Hsing-Foo Wang <***@gmail.com>
> *Sent:* Wednesday, April 25, 2018 12:13:12 AM
> *To:* David Harper; ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>  
>
> Why does everybody forget about the IP number, the info is submitted
> from an IP number that is not transferred but logged on the receiving
> end. ? And that EU courts have ruled that IP numbers can be related to
> persones???
>
> Lack of knowledge????
>
>
> On 24-04-18 16:02, David Harper wrote:
>>
>> Recital 26, which covers anonymous data collection, says in part:
>>
>>  
>>
>> The principles of data protection should therefore not apply to
>> anonymous information, namely information which does not relate to an
>> identified or identifiable natural person or to personal data
>> rendered anonymous in such a manner that the data subject is not or
>> no longer identifiable.
>>
>>  
>>
>> Source: http://www.privacy-regulation.eu/en/recital-26-GDPR.htm
>> <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.privacy-regulation.eu%2Fen%2Frecital-26-GDPR.htm&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=D%2BkU1qzmhR97o38mPjQR0jBTzv7FTyRQ9Tx%2FgvJUGjA%3D&reserved=0>
>>
>>
>>  
>>
>> According to your post, the data in question is:
>>
>>  
>>
>>            . "ReleaseVersion=" . $db->get_prop('sysconfig',
>> 'ReleaseVersion')
>>            . "&SystemIDHash="  . $sysid_hash
>>            . "&CurrentEpoch="  . time
>>            . "&InstallEpoch="  . $db->get_prop('sysconfig',
>> 'InstallEpoch')
>>            . "&SystemMode="    . $db->get_value('SystemMode');
>>
>> The closest we get to unique data is therefore the system ID (hash)
>> and the install time. I note that potentially identifiable data such
>> as IP address and domain name are not shared.
>>
>>  
>>
>> So long as there is no secondary collection with which the system ID
>> could be matched, I don't see a problem. By way of an example, the
>> SMEOptimizer contrib requires registration
>> (https://wiki.contribs.org/SMEOptimizer
>> <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.contribs.org%2FSMEOptimizer&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=Gdc%2BfPZIXVKpboHNcIi7lHOWN7XfRgHDHi0xyCednPc%3D&reserved=0>),
>> so the maintainer may have additional responsibilities under GDPR if
>> the script sends additional data to the maintainer’s server during
>> initialisation.
>>
>>  
>>
>> -----
>> David Harper
>> Phone: 0421 550 063
>>
>>  
>>
>> ------------------------------------------------------------------------
>> *From:* devinfo-***@lists.contribs.org
>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>> <***@gmail.com>
>> *Sent:* Tuesday, April 24, 2018 10:12:12 PM
>> *To:* ***@lists.contribs.org
>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>  
>> I had another look at the below expression. I'm not really sure what it
>> means, but it certainly does not sound friendly.
>>
>> With what authority or from perspective are you responding 'that
>> strongly' For you can always choose to not to respond.
>>
>> You are just you. You are not contribs.org
>>
>> On 24-04-18 13:36, John Crisp wrote:
>>
>> > Ah damn. You are still here then.
>>
>> _______________________________________________
>> Server Development Discussion
>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>> Searchable archive at
>> https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C0d6ed2d87eb54b51e63d08d5a9dca915%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601687551939217&sdata=lAqhsuBmKWZOywEfLz0SP%2F3jdKH%2FwINjkP5B5aedBFY%3D&reserved=0
>
>
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Hsing-Foo Wang
2018-04-24 18:24:26 UTC
Permalink
This should all be in a privacy statement and vouched for by the board
of The Koozali Foundation Inc. Bettre hurry up, it is almost May 25th, 2018.

Why advise me to migrate to another project when asking questions like
this? I have the right to ask and I can ask. It is up to The Koozali
Foundation to comply.


On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
> David,
> thanks for the exact reference.
>
> No IP is logged, IP is discarded.
> The more sensible data logged is the country associated to the IP
> submitting the data, which even if you live in Vatican leave 836
> people for 17920 addresses, so still pretty anonymous data.
>
> Even system id (which can be changed whenever you want) is sent hashed
> by the server itself. System id hash allow to update the data of the
> same server. Release allow us to know the amount of server for every
> release. Country allow us to focus to country using more SME and push
> for translation for instance.
> Time of update, allow us to filter data to active server, if it has
> not update for more than one month we consider it removed from service.
> Install Epoch is usually not that useful as old server tends to have a
> not up to date clock at the moment of installation, but could have
> been useful to guess if a server has been updated through versions or
> if it a fresh install. Or even if outdated version has just been
> installed in the last months.
>
>
> If you want to opt out:
> config setprop statusreport status disabled
> expand-template /etc/crontab
>
> or alternatively migrate to another project.
>
> Le 2018-04-24 à 10:24, David Harper a écrit :
>>
>> It depends on whether the receiving server is logging incoming data
>> pushes by IP address, whether permanently or temporarily.
>>
>> -----
>> David Harper
>> Phone: 0421 550 063
>>
>> ------------------------------------------------------------------------
>> *From:* Hsing-Foo Wang <***@gmail.com>
>> *Sent:* Wednesday, April 25, 2018 12:13:12 AM
>> *To:* David Harper; ***@lists.contribs.org
>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>
>> Why does everybody forget about the IP number, the info is submitted
>> from an IP number that is not transferred but logged on the receiving
>> end. ? And that EU courts have ruled that IP numbers can be related
>> to persones???
>>
>> Lack of knowledge????
>>
>>
>> On 24-04-18 16:02, David Harper wrote:
>>>
>>> Recital 26, which covers anonymous data collection, says in part:
>>>
>>> The principles of data protection should therefore not apply to
>>> anonymous information, namely information which does not relate to
>>> an identified or identifiable natural person or to personal data
>>> rendered anonymous in such a manner that the data subject is not or
>>> no longer identifiable.
>>>
>>> Source: http://www.privacy-regulation.eu/en/recital-26-GDPR.htm
>>> <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.privacy-regulation.eu%2Fen%2Frecital-26-GDPR.htm&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=D%2BkU1qzmhR97o38mPjQR0jBTzv7FTyRQ9Tx%2FgvJUGjA%3D&reserved=0>
>>>
>>>
>>> According to your post, the data in question is:
>>>
>>>            . "ReleaseVersion=" . $db->get_prop('sysconfig',
>>> 'ReleaseVersion')
>>>            . "&SystemIDHash="  . $sysid_hash
>>>            . "&CurrentEpoch="  . time
>>>            . "&InstallEpoch="  . $db->get_prop('sysconfig',
>>> 'InstallEpoch')
>>>            . "&SystemMode="    . $db->get_value('SystemMode');
>>>
>>> The closest we get to unique data is therefore the system ID (hash)
>>> and the install time. I note that potentially identifiable data such
>>> as IP address and domain name are not shared.
>>>
>>> So long as there is no secondary collection with which the system ID
>>> could be matched, I don't see a problem. By way of an example, the
>>> SMEOptimizer contrib requires registration
>>> (https://wiki.contribs.org/SMEOptimizer
>>> <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.contribs.org%2FSMEOptimizer&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=Gdc%2BfPZIXVKpboHNcIi7lHOWN7XfRgHDHi0xyCednPc%3D&reserved=0>),
>>> so the maintainer may have additional responsibilities under GDPR if
>>> the script sends additional data to the maintainer’s server during
>>> initialisation.
>>>
>>> -----
>>> David Harper
>>> Phone: 0421 550 063
>>>
>>> ------------------------------------------------------------------------
>>> *From:* devinfo-***@lists.contribs.org
>>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>>> <***@gmail.com>
>>> *Sent:* Tuesday, April 24, 2018 10:12:12 PM
>>> *To:* ***@lists.contribs.org
>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>> I had another look at the below expression. I'm not really sure what it
>>> means, but it certainly does not sound friendly.
>>>
>>> With what authority or from perspective are you responding 'that
>>> strongly' For you can always choose to not to respond.
>>>
>>> You are just you. You are not contribs.org
>>>
>>> On 24-04-18 13:36, John Crisp wrote:
>>>
>>> > Ah damn. You are still here then.
>>>
>>> _______________________________________________
>>> Server Development Discussion
>>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>>> Searchable archive at
>>> https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C0d6ed2d87eb54b51e63d08d5a9dca915%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601687551939217&sdata=lAqhsuBmKWZOywEfLz0SP%2F3jdKH%2FwINjkP5B5aedBFY%3D&reserved=0
>>
>>
>>
>> _______________________________________________
>> Server Development Discussion
>> To unsubscribe, e-maildevinfo-***@lists.contribs.org
>> Searchable archive athttps://lists.contribs.org/mailman/public/devinfo/
>
>
>
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
David Harper
2018-04-24 18:29:41 UTC
Permalink
EU data privacy isn't my area, but in Australian data privacy, which is, a privacy policy would not have this sort of technical data. It would also typically declare what is collected, and how it is used, rather than have an interminable list of things that are not relevant.

I have reviewed https://wiki.contribs.org/SME_Server:Privacy_policy and it looks sufficient to me.

-----
David Harper
Phone: 0421 550 063

________________________________
From: devinfo-***@lists.contribs.org <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com>
Sent: Wednesday, April 25, 2018 4:24:26 AM
To: ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home


This should all be in a privacy statement and vouched for by the board of The Koozali Foundation Inc. Bettre hurry up, it is almost May 25th, 2018.

Why advise me to migrate to another project when asking questions like this? I have the right to ask and I can ask. It is up to The Koozali Foundation to comply.

On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
David,
thanks for the exact reference.

No IP is logged, IP is discarded.
The more sensible data logged is the country associated to the IP submitting the data, which even if you live in Vatican leave 836 people for 17920 addresses, so still pretty anonymous data.

Even system id (which can be changed whenever you want) is sent hashed by the server itself. System id hash allow to update the data of the same server. Release allow us to know the amount of server for every release. Country allow us to focus to country using more SME and push for translation for instance.
Time of update, allow us to filter data to active server, if it has not update for more than one month we consider it removed from service.
Install Epoch is usually not that useful as old server tends to have a not up to date clock at the moment of installation, but could have been useful to guess if a server has been updated through versions or if it a fresh install. Or even if outdated version has just been installed in the last months.


If you want to opt out:
config setprop statusreport status disabled
expand-template /etc/crontab

or alternatively migrate to another project.

Le 2018-04-24 à 10:24, David Harper a écrit :
It depends on whether the receiving server is logging incoming data pushes by IP address, whether permanently or temporarily.

-----
David Harper
Phone: 0421 550 063

________________________________
From: Hsing-Foo Wang <***@gmail.com><mailto:***@gmail.com>
Sent: Wednesday, April 25, 2018 12:13:12 AM
To: David Harper; ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home


Why does everybody forget about the IP number, the info is submitted from an IP number that is not transferred but logged on the receiving end. ? And that EU courts have ruled that IP numbers can be related to persones???

Lack of knowledge????

On 24-04-18 16:02, David Harper wrote:

Recital 26, which covers anonymous data collection, says in part:



The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.



Source: http://www.privacy-regulation.eu/en/recital-26-GDPR.htm<https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.privacy-regulation.eu%2Fen%2Frecital-26-GDPR.htm&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=D%2BkU1qzmhR97o38mPjQR0jBTzv7FTyRQ9Tx%2FgvJUGjA%3D&reserved=0>



According to your post, the data in question is:



. "ReleaseVersion=" . $db->get_prop('sysconfig',
'ReleaseVersion')
. "&SystemIDHash=" . $sysid_hash
. "&CurrentEpoch=" . time
. "&InstallEpoch=" . $db->get_prop('sysconfig', 'InstallEpoch')
. "&SystemMode=" . $db->get_value('SystemMode');

The closest we get to unique data is therefore the system ID (hash) and the install time. I note that potentially identifiable data such as IP address and domain name are not shared.



So long as there is no secondary collection with which the system ID could be matched, I don't see a problem. By way of an example, the SMEOptimizer contrib requires registration (https://wiki.contribs.org/SMEOptimizer<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.contribs.org%2FSMEOptimizer&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=Gdc%2BfPZIXVKpboHNcIi7lHOWN7XfRgHDHi0xyCednPc%3D&reserved=0>), so the maintainer may have additional responsibilities under GDPR if the script sends additional data to the maintainer’s server during initialisation.



-----
David Harper
Phone: 0421 550 063



________________________________
From: devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org> <devinfo-***@lists.contribs.org><mailto:devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com><mailto:***@gmail.com>
Sent: Tuesday, April 24, 2018 10:12:12 PM
To: ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home

I had another look at the below expression. I'm not really sure what it
means, but it certainly does not sound friendly.

With what authority or from perspective are you responding 'that
strongly' For you can always choose to not to respond.

You are just you. You are not contribs.org

On 24-04-18 13:36, John Crisp wrote:

> Ah damn. You are still here then.

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
Searchable archive at https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C0d6ed2d87eb54b51e63d08d5a9dca915%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601687551939217&sdata=lAqhsuBmKWZOywEfLz0SP%2F3jdKH%2FwINjkP5B5aedBFY%3D&reserved=0




_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/<https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C4e5ac52b41b441544fbf08d5aa10b053%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601911013806618&sdata=%2F1Y5LlwMV%2FtyhtGqs8LWwzQGhlNHEVJY52JKYeRbrvA%3D&reserved=0>




_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/<https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C4e5ac52b41b441544fbf08d5aa10b053%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601911013806618&sdata=%2F1Y5LlwMV%2FtyhtGqs8LWwzQGhlNHEVJY52JKYeRbrvA%3D&reserved=0>
Hsing-Foo Wang
2018-04-24 18:28:02 UTC
Permalink
ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
please.


On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
> If you want to opt out:
> config setprop statusreport status disabled
> expand-template /etc/crontab

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
David Harper
2018-04-24 18:31:05 UTC
Permalink
But only when private information is collected, which apparently it is not. Anonymous data collection is not covered by GDPR.



-----
David Harper
Phone: 0421 550 063



________________________________
From: devinfo-***@lists.contribs.org <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com>
Sent: Wednesday, April 25, 2018 4:28:02 AM
To: ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home

ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
please.


On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
> If you want to opt out:
> config setprop statusreport status disabled
> expand-template /etc/crontab

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
Hsing-Foo Wang
2018-04-24 18:40:53 UTC
Permalink
*Privacy by Design*
Privacy by design as a concept has existed for years now, but it is only
just becoming part of a legal requirement with the GDPR. At it’s core,
privacy by design calls for the inclusion of data protection from the
onset of the designing of systems, rather than an addition. More
specifically -/'The controller shall..implement appropriate technical
and organisational measures..in an effective way.. in order to meet the
requirements of this Regulation and protect the rights of data
subjects'./ Article 23 calls for controllers to hold and process only
the data absolutely necessary for the completion of its duties (data
minimisation), as well as limiting the access to personal data to those
needing to act out the processing.

data subjects <> private information
data minimisation <> collect 'anonymous' 'vatican' data

On 24-04-18 20:31, David Harper wrote:
>
> But only when private information is collected, which apparently it is
> not. Anonymous data collection is not covered by GDPR.
>
> -----
> David Harper
> Phone: 0421 550 063
>
> ------------------------------------------------------------------------
> *From:* devinfo-***@lists.contribs.org
> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
> <***@gmail.com>
> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
> *To:* ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
> please.
>
>
> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
> > If you want to opt out:
> > config setprop statusreport status disabled
> > expand-template /etc/crontab
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
Hsing-Foo Wang
2018-04-24 18:49:30 UTC
Permalink
Ah, makes me think of the 'cookie' thing...

Contribs.org is placing cookies without explicit consent of the visitor,
any visitor, logged in or out.

The Koozali Foundation Inc. knows this for a long time now, but
apparently chose to be NOT compliant in that area too.


On 24-04-18 20:40, Hsing-Foo Wang wrote:
>
> *Privacy by Design*
> Privacy by design as a concept has existed for years now, but it is
> only just becoming part of a legal requirement with the GDPR. At it’s
> core, privacy by design calls for the inclusion of data protection
> from the onset of the designing of systems, rather than an addition.
> More specifically -/'The controller shall..implement appropriate
> technical and organisational measures..in an effective way.. in order
> to meet the requirements of this Regulation and protect the rights of
> data subjects'./ Article 23 calls for controllers to hold and process
> only the data absolutely necessary for the completion of its duties
> (data minimisation), as well as limiting the access to personal data
> to those needing to act out the processing.
>
> data subjects <> private information
> data minimisation <> collect 'anonymous' 'vatican' data
>
> On 24-04-18 20:31, David Harper wrote:
>>
>> But only when private information is collected, which apparently it
>> is not. Anonymous data collection is not covered by GDPR.
>>
>> -----
>> David Harper
>> Phone: 0421 550 063
>>
>> ------------------------------------------------------------------------
>> *From:* devinfo-***@lists.contribs.org
>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>> <***@gmail.com>
>> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
>> *To:* ***@lists.contribs.org
>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
>> please.
>>
>>
>> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
>> > If you want to opt out:
>> > config setprop statusreport status disabled
>> > expand-template /etc/crontab
>>
>> _______________________________________________
>> Server Development Discussion
>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>> Searchable archive at
>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
>
David Harper
2018-04-24 19:11:27 UTC
Permalink
Can we install the Cookie Warning MediaWiki extension and make this nuisance problem go away? I imagine this is already on a list someplace but I also imagine it's understandably a fairly low priority.

-----
David Harper
Phone: 0421 550 063

________________________________
From: Hsing-Foo Wang <***@gmail.com>
Sent: Wednesday, April 25, 2018 4:49:30 AM
To: David Harper; ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home


Ah, makes me think of the 'cookie' thing...

Contribs.org is placing cookies without explicit consent of the visitor, any visitor, logged in or out.

The Koozali Foundation Inc. knows this for a long time now, but apparently chose to be NOT compliant in that area too.

On 24-04-18 20:40, Hsing-Foo Wang wrote:

Privacy by Design
Privacy by design as a concept has existed for years now, but it is only just becoming part of a legal requirement with the GDPR. At it’s core, privacy by design calls for the inclusion of data protection from the onset of the designing of systems, rather than an addition. More specifically - 'The controller shall..implement appropriate technical and organisational measures..in an effective way.. in order to meet the requirements of this Regulation and protect the rights of data subjects'. Article 23 calls for controllers to hold and process only the data absolutely necessary for the completion of its duties (data minimisation), as well as limiting the access to personal data to those needing to act out the processing.

data subjects <> private information
data minimisation <> collect 'anonymous' 'vatican' data

On 24-04-18 20:31, David Harper wrote:

But only when private information is collected, which apparently it is not. Anonymous data collection is not covered by GDPR.



-----
David Harper
Phone: 0421 550 063



________________________________
From: devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org> <devinfo-***@lists.contribs.org><mailto:devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com><mailto:***@gmail.com>
Sent: Wednesday, April 25, 2018 4:28:02 AM
To: ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home

ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
please.


On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
> If you want to opt out:
> config setprop statusreport status disabled
> expand-template /etc/crontab

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
Searchable archive at https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
Hsing-Foo Wang
2018-04-24 19:17:36 UTC
Permalink
I don't think law compliance is not a fairly low priority. Especially
when these laws are already in effect for many years. The Koozali
Foundation Inc. is breaking the law willingly for they know the issue
and had all the time in world to be compliant.

Board members are personally liable. I'm not making this up, just saying.

Just like a smolt cron entry is always there, even if the smolt service
is disabled. Anybody can spoof an URL...

Smolt itself has been long gone from the internet, but Koozali
Foundation finds it suitable to keep it in the code for whatever reason.
Even if there is a bugzilla report on the issue and the advise to remove
it from a long time ago.


On 24-04-18 21:11, David Harper wrote:
>
> Can we install the Cookie Warning MediaWiki extension and make this
> nuisance problem go away? I imagine this is already on a list
> someplace but I also imagine it's understandably a fairly low priority.
>
> -----
> David Harper
> Phone: 0421 550 063
>
> ------------------------------------------------------------------------
> *From:* Hsing-Foo Wang <***@gmail.com>
> *Sent:* Wednesday, April 25, 2018 4:49:30 AM
> *To:* David Harper; ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>
> Ah, makes me think of the 'cookie' thing...
>
> Contribs.org is placing cookies without explicit consent of the
> visitor, any visitor, logged in or out.
>
> The Koozali Foundation Inc. knows this for a long time now, but
> apparently chose to be NOT compliant in that area too.
>
>
> On 24-04-18 20:40, Hsing-Foo Wang wrote:
>>
>> *Privacy by Design*
>> Privacy by design as a concept has existed for years now, but it is
>> only just becoming part of a legal requirement with the GDPR. At it’s
>> core, privacy by design calls for the inclusion of data protection
>> from the onset of the designing of systems, rather than an addition.
>> More specifically -/'The controller shall..implement appropriate
>> technical and organisational measures..in an effective way.. in order
>> to meet the requirements of this Regulation and protect the rights of
>> data subjects'./ Article 23 calls for controllers to hold and process
>> only the data absolutely necessary for the completion of its duties
>> (data minimisation), as well as limiting the access to personal data
>> to those needing to act out the processing.
>>
>> data subjects <> private information
>> data minimisation <> collect 'anonymous' 'vatican' data
>>
>> On 24-04-18 20:31, David Harper wrote:
>>>
>>> But only when private information is collected, which apparently it
>>> is not. Anonymous data collection is not covered by GDPR.
>>>
>>> -----
>>> David Harper
>>> Phone: 0421 550 063
>>>
>>> ------------------------------------------------------------------------
>>> *From:* devinfo-***@lists.contribs.org
>>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>>> <***@gmail.com>
>>> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
>>> *To:* ***@lists.contribs.org
>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
>>> please.
>>>
>>>
>>> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
>>> > If you want to opt out:
>>> > config setprop statusreport status disabled
>>> > expand-template /etc/crontab
>>>
>>> _______________________________________________
>>> Server Development Discussion
>>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>>> Searchable archive at
>>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
>>
>
David Harper
2018-04-24 19:28:42 UTC
Permalink
I have to disagree. The cookie notification rule is being reformed (largely retired) by the European Commission. http://europa.eu/rapid/press-release_IP-17-16_en.htm

From the press release:

“The proposal clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history).”

I imagine all of the basic cookies that the various Koozali sites serve to anonymous users will be included in this very broad exception when it is finalised. Other cookies are covered by the existing privacy policy.

-----
David Harper
Phone: 0421 550 063

________________________________
From: Hsing-Foo Wang <***@gmail.com>
Sent: Wednesday, April 25, 2018 5:17:36 AM
To: David Harper; ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home


I don't think law compliance is not a fairly low priority. Especially when these laws are already in effect for many years. The Koozali Foundation Inc. is breaking the law willingly for they know the issue and had all the time in world to be compliant.

Board members are personally liable. I'm not making this up, just saying.

Just like a smolt cron entry is always there, even if the smolt service is disabled. Anybody can spoof an URL...

Smolt itself has been long gone from the internet, but Koozali Foundation finds it suitable to keep it in the code for whatever reason. Even if there is a bugzilla report on the issue and the advise to remove it from a long time ago.

On 24-04-18 21:11, David Harper wrote:
Can we install the Cookie Warning MediaWiki extension and make this nuisance problem go away? I imagine this is already on a list someplace but I also imagine it's understandably a fairly low priority.

-----
David Harper
Phone: 0421 550 063

________________________________
From: Hsing-Foo Wang <***@gmail.com><mailto:***@gmail.com>
Sent: Wednesday, April 25, 2018 4:49:30 AM
To: David Harper; ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home


Ah, makes me think of the 'cookie' thing...

Contribs.org is placing cookies without explicit consent of the visitor, any visitor, logged in or out.

The Koozali Foundation Inc. knows this for a long time now, but apparently chose to be NOT compliant in that area too.

On 24-04-18 20:40, Hsing-Foo Wang wrote:

Privacy by Design
Privacy by design as a concept has existed for years now, but it is only just becoming part of a legal requirement with the GDPR. At it’s core, privacy by design calls for the inclusion of data protection from the onset of the designing of systems, rather than an addition. More specifically - 'The controller shall..implement appropriate technical and organisational measures..in an effective way.. in order to meet the requirements of this Regulation and protect the rights of data subjects'. Article 23 calls for controllers to hold and process only the data absolutely necessary for the completion of its duties (data minimisation), as well as limiting the access to personal data to those needing to act out the processing.

data subjects <> private information
data minimisation <> collect 'anonymous' 'vatican' data

On 24-04-18 20:31, David Harper wrote:

But only when private information is collected, which apparently it is not. Anonymous data collection is not covered by GDPR.



-----
David Harper
Phone: 0421 550 063



________________________________
From: devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org> <devinfo-***@lists.contribs.org><mailto:devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com><mailto:***@gmail.com>
Sent: Wednesday, April 25, 2018 4:28:02 AM
To: ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home

ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
please.


On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
> If you want to opt out:
> config setprop statusreport status disabled
> expand-template /etc/crontab

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
Searchable archive at https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
Jean-Philippe PIALASSE
2018-04-24 19:44:43 UTC
Permalink
Hsing-Foo,

to complete David answer, yes cookie banner are not necessary and are
almost as unpleasant as you are currently behaving once again.

Information about cookies and other information collected and use of
them are as mentioned earlier by David
herehttps://wiki.contribs.org/SME_Server:Privacy_policy
<https://wiki.contribs.org/SME_Server:Privacy_policy> and I would add
here https://forums.contribs.org/index.php?action=register



Le 2018-04-24 à 15:28, David Harper a écrit :
>
> I have to disagree. The cookie notification rule is being reformed
> (largely retired) by the European Commission.
> http://europa.eu/rapid/press-release_IP-17-16_en.htm
>
>  
>
> From the press release:
>
>  
>
> “The proposal clarifies that no consent is needed for non-privacy
> intrusive cookies improving internet experience (e.g. to remember
> shopping cart history).”
>
>  
>
> I imagine all of the basic cookies that the various Koozali sites
> serve to anonymous users will be included in this very broad exception
> when it is finalised. Other cookies are covered by the existing
> privacy policy.
>
>  
>
> -----
> David Harper
> Phone: 0421 550 063
>
>  
>
> ------------------------------------------------------------------------
> *From:* Hsing-Foo Wang <***@gmail.com>
> *Sent:* Wednesday, April 25, 2018 5:17:36 AM
> *To:* David Harper; ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>  
>
> I don't think law compliance is not a fairly low priority. Especially
> when these laws are already in effect for many years. The Koozali
> Foundation Inc. is breaking the law willingly for they know the issue
> and had all the time in world to be compliant.
>
> Board members are personally liable. I'm not making this up, just saying.
>
> Just like a smolt cron entry is always there, even if the smolt
> service is disabled. Anybody can spoof an URL...
>
> Smolt itself has been long gone from the internet, but Koozali
> Foundation finds it suitable to keep it in the code for whatever
> reason. Even if there is a bugzilla report on the issue and the advise
> to remove it from a long time ago.
>
>
> On 24-04-18 21:11, David Harper wrote:
>>
>> Can we install the Cookie Warning MediaWiki extension and make this
>> nuisance problem go away? I imagine this is already on a list
>> someplace but I also imagine it's understandably a fairly low priority.
>>
>>  
>>
>> -----
>> David Harper
>> Phone: 0421 550 063
>>
>>  
>>
>> ------------------------------------------------------------------------
>> *From:* Hsing-Foo Wang <***@gmail.com>
>> *Sent:* Wednesday, April 25, 2018 4:49:30 AM
>> *To:* David Harper; ***@lists.contribs.org
>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>  
>>
>> Ah, makes me think of the 'cookie' thing...
>>
>> Contribs.org is placing cookies without explicit consent of the
>> visitor, any visitor, logged in or out.
>>
>> The Koozali Foundation Inc. knows this for a long time now, but
>> apparently chose to be NOT compliant in that area too.
>>
>>
>> On 24-04-18 20:40, Hsing-Foo Wang wrote:
>>>
>>> *Privacy by Design*
>>> Privacy by design as a concept has existed for years now, but it is
>>> only just becoming part of a legal requirement with the GDPR. At
>>> it’s core, privacy by design calls for the inclusion of data
>>> protection from the onset of the designing of systems, rather than
>>> an addition. More specifically -/ 'The controller shall..implement
>>> appropriate technical and organisational measures..in an effective
>>> way.. in order to meet the requirements of this Regulation and
>>> protect the rights of data subjects'./ Article 23 calls for
>>> controllers to hold and process only the data absolutely necessary
>>> for the completion of its duties (data minimisation), as well as
>>> limiting the access to personal data to those needing to act out the
>>> processing.
>>>
>>> data subjects <> private information
>>> data minimisation <> collect 'anonymous' 'vatican' data
>>>
>>> On 24-04-18 20:31, David Harper wrote:
>>>>
>>>> But only when private information is collected, which apparently it
>>>> is not. Anonymous data collection is not covered by GDPR.
>>>>
>>>>  
>>>>
>>>> -----
>>>> David Harper
>>>> Phone: 0421 550 063
>>>>
>>>>  
>>>>
>>>> ------------------------------------------------------------------------
>>>> *From:* devinfo-***@lists.contribs.org
>>>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>>>> <***@gmail.com>
>>>> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
>>>> *To:* ***@lists.contribs.org
>>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>>>  
>>>> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
>>>> please.
>>>>
>>>>
>>>> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
>>>> > If you want to opt out:
>>>> > config setprop statusreport status disabled
>>>> > expand-template /etc/crontab
>>>>
>>>> _______________________________________________
>>>> Server Development Discussion
>>>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>>>> Searchable archive at
>>>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
>>>
>>
>
>
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Hsing-Foo Wang
2018-04-24 19:53:05 UTC
Permalink
Jean-Philippe,

please stay on the topic at hand and do not try to divert to how you
feel personally about me. That is clear, and I do not care.

That you personally and as president do not like me to speak up, does
not give you the right to classify my behavior as you see fit in your
personal strategy to save your own personal position.

I wrote that wiki page, I know what it says, I know it was never
approved, nor the content. I know it is outdated, and I know it was made
up by me to have *something*, for the board never cared.

Please remove Smolt, please create a valid and compliant privacy
statement and ensure The Koozali Inc. adheres to it.



On 24-04-18 21:44, Jean-Philippe PIALASSE wrote:
> Hsing-Foo,
>
> to complete David answer, yes cookie banner are not necessary and are
> almost as unpleasant as you are currently behaving once again.
>
> Information about cookies and other information collected and use of
> them are as mentioned earlier by David
> herehttps://wiki.contribs.org/SME_Server:Privacy_policy
> <https://wiki.contribs.org/SME_Server:Privacy_policy> and I would add
> here https://forums.contribs.org/index.php?action=register
>
>
>
> Le 2018-04-24 à 15:28, David Harper a écrit :
>>
>> I have to disagree. The cookie notification rule is being reformed
>> (largely retired) by the European Commission.
>> http://europa.eu/rapid/press-release_IP-17-16_en.htm
>>
>> From the press release:
>>
>> “The proposal clarifies that no consent is needed for non-privacy
>> intrusive cookies improving internet experience (e.g. to remember
>> shopping cart history).”
>>
>> I imagine all of the basic cookies that the various Koozali sites
>> serve to anonymous users will be included in this very broad
>> exception when it is finalised. Other cookies are covered by the
>> existing privacy policy.
>>
>> -----
>> David Harper
>> Phone: 0421 550 063
>>
>> ------------------------------------------------------------------------
>> *From:* Hsing-Foo Wang <***@gmail.com>
>> *Sent:* Wednesday, April 25, 2018 5:17:36 AM
>> *To:* David Harper; ***@lists.contribs.org
>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>
>> I don't think law compliance is not a fairly low priority. Especially
>> when these laws are already in effect for many years. The Koozali
>> Foundation Inc. is breaking the law willingly for they know the issue
>> and had all the time in world to be compliant.
>>
>> Board members are personally liable. I'm not making this up, just saying.
>>
>> Just like a smolt cron entry is always there, even if the smolt
>> service is disabled. Anybody can spoof an URL...
>>
>> Smolt itself has been long gone from the internet, but Koozali
>> Foundation finds it suitable to keep it in the code for whatever
>> reason. Even if there is a bugzilla report on the issue and the
>> advise to remove it from a long time ago.
>>
>>
>> On 24-04-18 21:11, David Harper wrote:
>>>
>>> Can we install the Cookie Warning MediaWiki extension and make this
>>> nuisance problem go away? I imagine this is already on a list
>>> someplace but I also imagine it's understandably a fairly low priority.
>>>
>>> -----
>>> David Harper
>>> Phone: 0421 550 063
>>>
>>> ------------------------------------------------------------------------
>>> *From:* Hsing-Foo Wang <***@gmail.com>
>>> *Sent:* Wednesday, April 25, 2018 4:49:30 AM
>>> *To:* David Harper; ***@lists.contribs.org
>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>>
>>> Ah, makes me think of the 'cookie' thing...
>>>
>>> Contribs.org is placing cookies without explicit consent of the
>>> visitor, any visitor, logged in or out.
>>>
>>> The Koozali Foundation Inc. knows this for a long time now, but
>>> apparently chose to be NOT compliant in that area too.
>>>
>>>
>>> On 24-04-18 20:40, Hsing-Foo Wang wrote:
>>>>
>>>> *Privacy by Design*
>>>> Privacy by design as a concept has existed for years now, but it is
>>>> only just becoming part of a legal requirement with the GDPR. At
>>>> it’s core, privacy by design calls for the inclusion of data
>>>> protection from the onset of the designing of systems, rather than
>>>> an addition. More specifically -/'The controller shall..implement
>>>> appropriate technical and organisational measures..in an effective
>>>> way.. in order to meet the requirements of this Regulation and
>>>> protect the rights of data subjects'./ Article 23 calls for
>>>> controllers to hold and process only the data absolutely necessary
>>>> for the completion of its duties (data minimisation), as well as
>>>> limiting the access to personal data to those needing to act out
>>>> the processing.
>>>>
>>>> data subjects <> private information
>>>> data minimisation <> collect 'anonymous' 'vatican' data
>>>>
>>>> On 24-04-18 20:31, David Harper wrote:
>>>>>
>>>>> But only when private information is collected, which apparently
>>>>> it is not. Anonymous data collection is not covered by GDPR.
>>>>>
>>>>> -----
>>>>> David Harper
>>>>> Phone: 0421 550 063
>>>>>
>>>>> ------------------------------------------------------------------------
>>>>> *From:* devinfo-***@lists.contribs.org
>>>>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>>>>> <***@gmail.com>
>>>>> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
>>>>> *To:* ***@lists.contribs.org
>>>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>>>> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR
>>>>> again
>>>>> please.
>>>>>
>>>>>
>>>>> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
>>>>> > If you want to opt out:
>>>>> > config setprop statusreport status disabled
>>>>> > expand-template /etc/crontab
>>>>>
>>>>> _______________________________________________
>>>>> Server Development Discussion
>>>>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>>>>> Searchable archive at
>>>>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
>>>>
>>>
>>
>>
>>
>> _______________________________________________
>> Server Development Discussion
>> To unsubscribe, e-maildevinfo-***@lists.contribs.org
>> Searchable archive athttps://lists.contribs.org/mailman/public/devinfo/
>
>
Jean-Philippe PIALASSE
2018-04-24 20:19:06 UTC
Permalink
Le 2018-04-24 à 15:53, Hsing-Foo Wang a écrit :
>
> Jean-Philippe,
>
> please stay on the topic at hand and do not try to divert to how you
> feel personally about me. That is clear, and I do not care.
>
> That you personally and as president do not like me to speak up, does
> not give you the right to classify my behavior as you see fit in your
> personal strategy to save your own personal position.
>
> I wrote that wiki page, I know what it says, I know it was never
> approved, nor the content. I know it is outdated, and I know it was
> made up by me to have *something*, for the board never cared.
>
> Please remove Smolt, please create a valid and compliant privacy
> statement and ensure The Koozali Inc. adheres to it.
>
Hsing-Foo,

Smolt has already been removed from current SME10 developing branch.


You might also remember of this policy :
https://wiki.contribs.org/Code_of_conduct#Enforcement 
I have to dig more about the Privacy policy for your allegations, but
this code of conduct I can say it has been approved *_unanimously_*.
I warned you saying you are behaving in an unpleasant way in my previous
answer.

I warn you another and last time before taking action.
You are currently trolling and using harassment by
- your number of answer per hours,
- your way of forcing people to think the way you want,
- forcing people in doing what you want,
- your constant opposition to what is answered to you

So please, relax for today, and wait tomorrow morning for your next message.


--

*Jean-Philippe Pialasse
President
*
Hsing-Foo Wang
2018-04-24 22:05:11 UTC
Permalink
On 24-04-18 22:19, Jean-Philippe PIALASSE wrote:
> Le 2018-04-24 à 15:53, Hsing-Foo Wang a écrit :
>>
>> Jean-Philippe,
>>
>> please stay on the topic at hand and do not try to divert to how you
>> feel personally about me. That is clear, and I do not care.
>>
>> That you personally and as president do not like me to speak up, does
>> not give you the right to classify my behavior as you see fit in your
>> personal strategy to save your own personal position.
>>
>> I wrote that wiki page, I know what it says, I know it was never
>> approved, nor the content. I know it is outdated, and I know it was
>> made up by me to have *something*, for the board never cared.
>>
>> Please remove Smolt, please create a valid and compliant privacy
>> statement and ensure The Koozali Inc. adheres to it.
>>
> Hsing-Foo,
>
> Smolt has already been removed from current SME10 developing branch.

Nobody uses a development branch for production or stable servers. Only
stable, SME Server 9.2

>
>
> You might also remember of this policy :
> https://wiki.contribs.org/Code_of_conduct#Enforcement
Funny you try to remind me of that page. I wrote it...

> I have to dig more about the Privacy policy for your allegations, but
> this code of conduct I can say it has been approved *_unanimously_*.
> I warned you saying you are behaving in an unpleasant way in my
> previous answer.
Who are you to warn me. I am no subject to anything from you, about you
nor your silly statements
>
> I warn you another and last time before taking action.
> You are currently trolling and using harassment by
> - your number of answer per hours,
> - your way of forcing people to think the way you want,
> - forcing people in doing what you want,
> - your constant opposition to what is answered to you

You are completely talking nonsense in my mind. It sounds like a
dictator speaking to my ears.

This is a free world, and I can speak up freely. Your accusations are
typical for your 'management style', trying to accuse somebody with
bogus arguments, just because I speak up and do not abandon a topic
because you want me to.

That is the core of a discussion, to discuss it, you simply want to
silence somebody with bogus arguments because you don't like the discussion.

What's next?, ban me from the mailing lists like you have done by
deleting my account from the wiki? Even if I did say I won't contribute
to the wiki, things can change, but clearly you saw your 'victory
moment' and deleted my account. Nobody benefits from that, certainly not
our community because the wiki is in a bad and outdated state. Have you
ever had a chat with the doku&wiki team *before* you delete pages,
hijack pages and change structures?

>
> So please, relax for today, and wait tomorrow morning for your next
> message.

I am relaxed, and very comfortable with the topics at hand. I appreciate
the responses from David, for he is willing to discuss the topics in
depth and share his vision. Others are just point to pages I personally
wrote and are trying to silence me trying to by positioning me as a 'bad
guy'.

I see you are now trying to 'pull rank' with a new signature on this
mailing list? It does not impress me, not even a bit. It has no weight
for me whatsoever.

Please fix the long known issues, for it is mandatory to comply to any laws.

Oh and please don't shout your CAPITALIZED last name in your emails. I
scares my cat.


>
>
> --
>
> *Jean-Philippe Pialasse
> President
> *
>
Dan Brown
2018-04-24 19:35:33 UTC
Permalink
On 2018-04-24 15:17, Hsing-Foo Wang wrote:

> Board members are personally liable. I'm not making this up, just
> saying.

No, they aren't. You keep saying this, and it keeps being false. But
this isn't the place for that discussion.

> Smolt itself has been long gone from the internet, but Koozali
> Foundation finds it suitable to keep it in the code for whatever
> reason. Even if there is a bugzilla report on the issue and the advise
> to remove it from a long time ago.

Yep, you submitted the bug over two years ago. You recognized at that
time that the service isn't operational any more (it's been dead for
nearly five years). So what's the privacy impact? That someone's going
to spoof the authoritative DNS servers for smolts.org (remember, SME
acts as its own DNS resolver; it doesn't rely on ISPs' DNS servers),
host a bogus smolt server, and collect anonymous hardware information?
_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Hsing-Foo Wang
2018-04-24 19:42:43 UTC
Permalink
On 24-04-18 21:35, Dan Brown wrote:
> On 2018-04-24 15:17, Hsing-Foo Wang wrote:
>
>> Board members are personally liable. I'm not making this up, just
>> saying.
>
> No, they aren't.  You keep saying this, and it keeps being false. But
> this isn't the place for that discussion.
A nonprofit board must oversee the nonprofit organization's operations
and make sure that its staff and volunteers act _*legally*_ and
_*ethically*_
>
>> Smolt itself has been long gone from the internet, but Koozali
>> Foundation finds it suitable to keep it in the code for whatever
>> reason. Even if there is a bugzilla report on the issue and the
>> advise to remove it from a long time ago.
>
> Yep, you submitted the bug over two years ago.  You recognized at that
> time that the service isn't operational any more (it's been dead for
> nearly five years).  So what's the privacy impact?  That someone's
> going to spoof the authoritative DNS servers for smolts.org (remember,
> SME acts as its own DNS resolver; it doesn't rely on ISPs' DNS
> servers), host a bogus smolt server, and collect anonymous hardware
> information?

Why is any Smolt code not removed from SME Server if it serves no
purpose? Why is there still a cron job even when smolt status in disabled.

Removing Smolt from the core code is MUCH easier then creating a wiki
page or creating a contrib, so the same old 'lack of resources' is non
valid in my view. Setting priorities is.

The Smolt PrivacyStament /usr/share/smolt is very clear about the code
provided with code.
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Dan Brown
2018-04-24 20:02:55 UTC
Permalink
On 2018-04-24 15:42, Hsing-Foo Wang wrote:


> A nonprofit board must oversee the nonprofit organization's operations
> and make sure that its staff and volunteers act LEGALLY and ETHICALLY

...and that duty runs **to the organization**, not to third parties. I
can be personally liable to the foundation if I don't exercise
reasonable care in my duties. I can NOT be personally liable to third
parties for the acts (or omissions) of the foundation. If you're
inclined to continue discussing this subject, consider that my degree
and licenses (admittedly not in Oregon, but one in its southern
neighbor) suggest that I might have some idea of what I'm talking
about--though I'd certainly be interested in citations to authorities
that would be binding on the (US-based) Koozali Foundation that support
your view.

> Why is any Smolt code not removed from SME Server if it serves no
> purpose?

Why are you shifting the goalposts? Your claim was that its presence is
a GDPR violation. Since there's nothing to receive whatever information
it might be sending, that claim seems dubious at best.
_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
David Harper
2018-04-24 20:03:46 UTC
Permalink
I’m not going to go too far into the weeds on this, but as a long term board member and not for profit type, I do have to say that there are often unlimited compliance needs and scarce resources to address them. A good board will, at least in my view, prioritise. In a larger organisation, operational matters like these wouldn't even be in the remit of the board.

I wrote a paper about New South Wales health privacy principles a few years back, and on presenting it to the board of that particular organisation noted the impracticability of complying with the rules. I recommended that the board set the issue aside until such time as the very minimal risks of noncompliance changed and the matter actually important, for example if noncompliance risked the termination of a funding agreement, or if the organisation started actively (versus passively or accidentally) collecting health information.

My conclusion here is similar. On paper, these data privacy issues could certainly become a matter of concern in the future. In practice, I suspect that they are a very low priority indeed, and the board has other things that are much more pressing to worry about.

-----
David Harper
Phone: 0421 550 063

________________________________
From: devinfo-***@lists.contribs.org <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com>
Sent: Wednesday, April 25, 2018 5:42:43 AM
To: ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home



On 24-04-18 21:35, Dan Brown wrote:
On 2018-04-24 15:17, Hsing-Foo Wang wrote:

Board members are personally liable. I'm not making this up, just saying.

No, they aren't. You keep saying this, and it keeps being false. But this isn't the place for that discussion.
A nonprofit board must oversee the nonprofit organization's operations and make sure that its staff and volunteers act legally and ethically

Smolt itself has been long gone from the internet, but Koozali Foundation finds it suitable to keep it in the code for whatever reason. Even if there is a bugzilla report on the issue and the advise to remove it from a long time ago.

Yep, you submitted the bug over two years ago. You recognized at that time that the service isn't operational any more (it's been dead for nearly five years). So what's the privacy impact? That someone's going to spoof the authoritative DNS servers for smolts.org (remember, SME acts as its own DNS resolver; it doesn't rely on ISPs' DNS servers), host a bogus smolt server, and collect anonymous hardware information?

Why is any Smolt code not removed from SME Server if it serves no purpose? Why is there still a cron job even when smolt status in disabled.

Removing Smolt from the core code is MUCH easier then creating a wiki page or creating a contrib, so the same old 'lack of resources' is non valid in my view. Setting priorities is.

The Smolt PrivacyStament /usr/share/smolt is very clear about the code provided with code.
_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C7eec890976ed462af1ad08d5aa1b9948%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601957870918724&sdata=iuuwxYHpfflsuWk5tVKuYaVOs1XKr6yIS1wHx99%2FYNc%3D&reserved=0>
Rob Adams
2018-04-24 22:44:53 UTC
Permalink
On 25/04/2018 05:12, Hsing-Foo Wang wrote:
> A nonprofit board must oversee the nonprofit organization's operations
> and make sure that its staff and volunteers act _*legally*_ and
> _*ethically*_
According to which countries law?


---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus
Hsing-Foo Wang
2018-04-24 22:52:28 UTC
Permalink
This is a statement from the US about a non-profit Inc. It can vary per
state. The Koozali Foundation Inc. is based in the US. So US rules apply
regarding being a board member.

But The Koozali Foundation Inc. stores the user community data in the EU
(Paris, France). So GDPR applies, a) data stored in the EU b) data about
EU citizens. The 'new' register page on the forums is not valid for
accounts that already have been active for a very long time, one can not
go 'back to the future' by simply putting up new 'rules'.



On 25-04-18 00:44, Rob Adams wrote:
>
>
>
> On 25/04/2018 05:12, Hsing-Foo Wang wrote:
>> A nonprofit board must oversee the nonprofit organization's
>> operations and make sure that its staff and volunteers act
>> _*legally*_ and _*ethically*_
> According to which countries law?
>
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>
> Virus-free. www.avast.com
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>
>
>
> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
>
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Dan Brown
2018-04-25 09:43:13 UTC
Permalink
On 4/24/18 3:42 PM, Hsing-Foo Wang wrote:

> The Smolt PrivacyStament /usr/share/smolt is very clear about the code
> provided with code.

So, per that statement, smolt sends (well, would send, if there was
still any place to send it) basic hardware information that's logged
with a randomly-generated UUID. Nothing personally identifying there.
A separate system logs IP addresses, and does not (and cannot) correlate
them to any of the hardware information. Without any correlation to, or
means of correlating to, even the hardware information (much less any
personal data), I don't see that GDPR would be implicated, even if the
service were still operational. And, of course, the service **isn't**
operational, and hasn't been for years, as you know perfectly well, so
none of that data is being collected anyway.

Calling Smolt "malicious code" is pure FUD. Calling it a GDPR violation
is nonsensical, even given the ridiculous overbreadth of the GDPR.

--
Dan Brown, KE6MKS, ***@familybrown.org
"Since all the world is but a story, it were well for thee to buy the
more enduring story rather than the story that is less enduring."
-- The Judgment of St. Colum Cille
Hsing-Foo Wang
2018-04-24 19:17:50 UTC
Permalink
I don't think law compliance is not a fairly low priority. Especially
when these laws are already in effect for many years. The Koozali
Foundation Inc. is breaking the law willingly for they know the issue
and had all the time in world to be compliant.

Board members are personally liable. I'm not making this up, just saying.

Just like a smolt cron entry is always there, even if the smolt service
is disabled. Anybody can spoof an URL...

Smolt itself has been long gone from the internet, but Koozali
Foundation finds it suitable to keep it in the code for whatever reason.
Even if there is a bugzilla report on the issue and the advise to remove
it from a long time ago.


On 24-04-18 21:11, David Harper wrote:
>
> Can we install the Cookie Warning MediaWiki extension and make this
> nuisance problem go away? I imagine this is already on a list
> someplace but I also imagine it's understandably a fairly low priority.
>
> -----
> David Harper
> Phone: 0421 550 063
>
> ------------------------------------------------------------------------
> *From:* Hsing-Foo Wang <***@gmail.com>
> *Sent:* Wednesday, April 25, 2018 4:49:30 AM
> *To:* David Harper; ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>
> Ah, makes me think of the 'cookie' thing...
>
> Contribs.org is placing cookies without explicit consent of the
> visitor, any visitor, logged in or out.
>
> The Koozali Foundation Inc. knows this for a long time now, but
> apparently chose to be NOT compliant in that area too.
>
>
> On 24-04-18 20:40, Hsing-Foo Wang wrote:
>>
>> *Privacy by Design*
>> Privacy by design as a concept has existed for years now, but it is
>> only just becoming part of a legal requirement with the GDPR. At it’s
>> core, privacy by design calls for the inclusion of data protection
>> from the onset of the designing of systems, rather than an addition.
>> More specifically -/'The controller shall..implement appropriate
>> technical and organisational measures..in an effective way.. in order
>> to meet the requirements of this Regulation and protect the rights of
>> data subjects'./ Article 23 calls for controllers to hold and process
>> only the data absolutely necessary for the completion of its duties
>> (data minimisation), as well as limiting the access to personal data
>> to those needing to act out the processing.
>>
>> data subjects <> private information
>> data minimisation <> collect 'anonymous' 'vatican' data
>>
>> On 24-04-18 20:31, David Harper wrote:
>>>
>>> But only when private information is collected, which apparently it
>>> is not. Anonymous data collection is not covered by GDPR.
>>>
>>> -----
>>> David Harper
>>> Phone: 0421 550 063
>>>
>>> ------------------------------------------------------------------------
>>> *From:* devinfo-***@lists.contribs.org
>>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>>> <***@gmail.com>
>>> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
>>> *To:* ***@lists.contribs.org
>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
>>> please.
>>>
>>>
>>> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
>>> > If you want to opt out:
>>> > config setprop statusreport status disabled
>>> > expand-template /etc/crontab
>>>
>>> _______________________________________________
>>> Server Development Discussion
>>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>>> Searchable archive at
>>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
>>
>
Hsing-Foo Wang
2018-04-24 19:18:37 UTC
Permalink
I don't think law compliance is not a fairly low priority. Especially
when these laws are already in effect for many years. The Koozali
Foundation Inc. is breaking the law willingly for they know the issue
and had all the time in world to be compliant.

Board members are personally liable. I'm not making this up, just saying.

Just like a smolt cron entry is always there, even if the smolt service
is disabled. Anybody can spoof an URL...

Smolt itself has been long gone from the internet, but Koozali
Foundation finds it suitable to keep it in the code for whatever reason.
Even if there is a bugzilla report on the issue and the advise to remove
it from a long time ago.


On 24-04-18 21:11, David Harper wrote:
>
> Can we install the Cookie Warning MediaWiki extension and make this
> nuisance problem go away? I imagine this is already on a list
> someplace but I also imagine it's understandably a fairly low priority.
>
> -----
> David Harper
> Phone: 0421 550 063
>
> ------------------------------------------------------------------------
> *From:* Hsing-Foo Wang <***@gmail.com>
> *Sent:* Wednesday, April 25, 2018 4:49:30 AM
> *To:* David Harper; ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>
> Ah, makes me think of the 'cookie' thing...
>
> Contribs.org is placing cookies without explicit consent of the
> visitor, any visitor, logged in or out.
>
> The Koozali Foundation Inc. knows this for a long time now, but
> apparently chose to be NOT compliant in that area too.
>
>
> On 24-04-18 20:40, Hsing-Foo Wang wrote:
>>
>> *Privacy by Design*
>> Privacy by design as a concept has existed for years now, but it is
>> only just becoming part of a legal requirement with the GDPR. At it’s
>> core, privacy by design calls for the inclusion of data protection
>> from the onset of the designing of systems, rather than an addition.
>> More specifically -/'The controller shall..implement appropriate
>> technical and organisational measures..in an effective way.. in order
>> to meet the requirements of this Regulation and protect the rights of
>> data subjects'./ Article 23 calls for controllers to hold and process
>> only the data absolutely necessary for the completion of its duties
>> (data minimisation), as well as limiting the access to personal data
>> to those needing to act out the processing.
>>
>> data subjects <> private information
>> data minimisation <> collect 'anonymous' 'vatican' data
>>
>> On 24-04-18 20:31, David Harper wrote:
>>>
>>> But only when private information is collected, which apparently it
>>> is not. Anonymous data collection is not covered by GDPR.
>>>
>>> -----
>>> David Harper
>>> Phone: 0421 550 063
>>>
>>> ------------------------------------------------------------------------
>>> *From:* devinfo-***@lists.contribs.org
>>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>>> <***@gmail.com>
>>> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
>>> *To:* ***@lists.contribs.org
>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
>>> please.
>>>
>>>
>>> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
>>> > If you want to opt out:
>>> > config setprop statusreport status disabled
>>> > expand-template /etc/crontab
>>>
>>> _______________________________________________
>>> Server Development Discussion
>>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>>> Searchable archive at
>>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
>>
>
Hsing-Foo Wang
2018-04-24 19:21:23 UTC
Permalink
It is not just the wiki, it is all Koozali related sites that place a
cookie.


On 24-04-18 21:11, David Harper wrote:
>
> Can we install the Cookie Warning MediaWiki extension and make this
> nuisance problem go away? I imagine this is already on a list
> someplace but I also imagine it's understandably a fairly low priority.
>
> -----
> David Harper
> Phone: 0421 550 063
>
> ------------------------------------------------------------------------
> *From:* Hsing-Foo Wang <***@gmail.com>
> *Sent:* Wednesday, April 25, 2018 4:49:30 AM
> *To:* David Harper; ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>
> Ah, makes me think of the 'cookie' thing...
>
> Contribs.org is placing cookies without explicit consent of the
> visitor, any visitor, logged in or out.
>
> The Koozali Foundation Inc. knows this for a long time now, but
> apparently chose to be NOT compliant in that area too.
>
>
> On 24-04-18 20:40, Hsing-Foo Wang wrote:
>>
>> *Privacy by Design*
>> Privacy by design as a concept has existed for years now, but it is
>> only just becoming part of a legal requirement with the GDPR. At it’s
>> core, privacy by design calls for the inclusion of data protection
>> from the onset of the designing of systems, rather than an addition.
>> More specifically -/'The controller shall..implement appropriate
>> technical and organisational measures..in an effective way.. in order
>> to meet the requirements of this Regulation and protect the rights of
>> data subjects'./ Article 23 calls for controllers to hold and process
>> only the data absolutely necessary for the completion of its duties
>> (data minimisation), as well as limiting the access to personal data
>> to those needing to act out the processing.
>>
>> data subjects <> private information
>> data minimisation <> collect 'anonymous' 'vatican' data
>>
>> On 24-04-18 20:31, David Harper wrote:
>>>
>>> But only when private information is collected, which apparently it
>>> is not. Anonymous data collection is not covered by GDPR.
>>>
>>> -----
>>> David Harper
>>> Phone: 0421 550 063
>>>
>>> ------------------------------------------------------------------------
>>> *From:* devinfo-***@lists.contribs.org
>>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>>> <***@gmail.com>
>>> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
>>> *To:* ***@lists.contribs.org
>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
>>> please.
>>>
>>>
>>> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
>>> > If you want to opt out:
>>> > config setprop statusreport status disabled
>>> > expand-template /etc/crontab
>>>
>>> _______________________________________________
>>> Server Development Discussion
>>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>>> Searchable archive at
>>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
>>
>
Hsing-Foo Wang
2018-04-24 19:23:39 UTC
Permalink
David, thank you for your willingness to give these topics your sincere
attention. It is a breath of fresh air to me.


On 24-04-18 21:11, David Harper wrote:
>
> Can we install the Cookie Warning MediaWiki extension and make this
> nuisance problem go away? I imagine this is already on a list
> someplace but I also imagine it's understandably a fairly low priority.
>
> -----
> David Harper
> Phone: 0421 550 063
>
> ------------------------------------------------------------------------
> *From:* Hsing-Foo Wang <***@gmail.com>
> *Sent:* Wednesday, April 25, 2018 4:49:30 AM
> *To:* David Harper; ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>
> Ah, makes me think of the 'cookie' thing...
>
> Contribs.org is placing cookies without explicit consent of the
> visitor, any visitor, logged in or out.
>
> The Koozali Foundation Inc. knows this for a long time now, but
> apparently chose to be NOT compliant in that area too.
>
>
> On 24-04-18 20:40, Hsing-Foo Wang wrote:
>>
>> *Privacy by Design*
>> Privacy by design as a concept has existed for years now, but it is
>> only just becoming part of a legal requirement with the GDPR. At it’s
>> core, privacy by design calls for the inclusion of data protection
>> from the onset of the designing of systems, rather than an addition.
>> More specifically -/'The controller shall..implement appropriate
>> technical and organisational measures..in an effective way.. in order
>> to meet the requirements of this Regulation and protect the rights of
>> data subjects'./ Article 23 calls for controllers to hold and process
>> only the data absolutely necessary for the completion of its duties
>> (data minimisation), as well as limiting the access to personal data
>> to those needing to act out the processing.
>>
>> data subjects <> private information
>> data minimisation <> collect 'anonymous' 'vatican' data
>>
>> On 24-04-18 20:31, David Harper wrote:
>>>
>>> But only when private information is collected, which apparently it
>>> is not. Anonymous data collection is not covered by GDPR.
>>>
>>> -----
>>> David Harper
>>> Phone: 0421 550 063
>>>
>>> ------------------------------------------------------------------------
>>> *From:* devinfo-***@lists.contribs.org
>>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>>> <***@gmail.com>
>>> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
>>> *To:* ***@lists.contribs.org
>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
>>> please.
>>>
>>>
>>> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
>>> > If you want to opt out:
>>> > config setprop statusreport status disabled
>>> > expand-template /etc/crontab
>>>
>>> _______________________________________________
>>> Server Development Discussion
>>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>>> Searchable archive at
>>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
>>
>
Greg Zartman
2018-04-25 04:52:45 UTC
Permalink
On Tue, Apr 24, 2018 at 5:57 PM, Charlie Brady <
charlieb-***@budge.apana.org.au> wrote:

>
> This "nuisance problem" has already said multiple times "goodbye - I won't
> be back".


+1
David Harper
2018-04-24 18:54:44 UTC
Permalink
https://fpf.org/wp-content/uploads/2016/11/M-Hintze-GDPR-Through-the-De-Identification-Lens-31-Oct-2016-002.pdf

See the table on page 3. On page 4, the author notes:

Only Anonymous/Aggregate data is completely outside the scope of... the law.

This Anonymous/Aggregate data is defined as:


* Not directly linked to identifying data
* No known systematic way to reidentify
* Not related to a specific person

If all that is being collected is the country and the server install date, plus a random hash ID, that meets all three criteria.

-----
David Harper
Phone: 0421 550 063

________________________________
From: Hsing-Foo Wang <***@gmail.com>
Sent: Wednesday, April 25, 2018 4:40:53 AM
To: David Harper; ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home


Privacy by Design
Privacy by design as a concept has existed for years now, but it is only just becoming part of a legal requirement with the GDPR. At it’s core, privacy by design calls for the inclusion of data protection from the onset of the designing of systems, rather than an addition. More specifically - 'The controller shall..implement appropriate technical and organisational measures..in an effective way.. in order to meet the requirements of this Regulation and protect the rights of data subjects'. Article 23 calls for controllers to hold and process only the data absolutely necessary for the completion of its duties (data minimisation), as well as limiting the access to personal data to those needing to act out the processing.

data subjects <> private information
data minimisation <> collect 'anonymous' 'vatican' data

On 24-04-18 20:31, David Harper wrote:

But only when private information is collected, which apparently it is not. Anonymous data collection is not covered by GDPR.



-----
David Harper
Phone: 0421 550 063



________________________________
From: devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org> <devinfo-***@lists.contribs.org><mailto:devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com><mailto:***@gmail.com>
Sent: Wednesday, April 25, 2018 4:28:02 AM
To: ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home

ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
please.


On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
> If you want to opt out:
> config setprop statusreport status disabled
> expand-template /etc/crontab

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
Searchable archive at https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
Hsing-Foo Wang
2018-04-24 18:59:32 UTC
Permalink
No idea who or what fpf.org is, who's behind it and what they post. It's
simpler to just go to https://www.eugdpr.org/

and read the source of the law.


On 24-04-18 20:54, David Harper wrote:
>
> https://fpf.org/wp-content/uploads/2016/11/M-Hintze-GDPR-Through-the-De-Identification-Lens-31-Oct-2016-002.pdf
>
> See the table on page 3. On page 4, the author notes:
>
> Only Anonymous/Aggregate data is completely outside the scope of...
> the law.
>
> This Anonymous/Aggregate data is defined as:
>
> * Not directly linked to identifying data
> * No known systematic way to reidentify
> * Not related to a specific person
>
> If all that is being collected is the country and the server install
> date, plus a random hash ID, that meets all three criteria.
>
> -----
> David Harper
> Phone: 0421 550 063
>
> ------------------------------------------------------------------------
> *From:* Hsing-Foo Wang <***@gmail.com>
> *Sent:* Wednesday, April 25, 2018 4:40:53 AM
> *To:* David Harper; ***@lists.contribs.org
> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>
> *Privacy by Design*
> Privacy by design as a concept has existed for years now, but it is
> only just becoming part of a legal requirement with the GDPR. At it’s
> core, privacy by design calls for the inclusion of data protection
> from the onset of the designing of systems, rather than an addition.
> More specifically -/'The controller shall..implement appropriate
> technical and organisational measures..in an effective way.. in order
> to meet the requirements of this Regulation and protect the rights of
> data subjects'./ Article 23 calls for controllers to hold and process
> only the data absolutely necessary for the completion of its duties
> (data minimisation), as well as limiting the access to personal data
> to those needing to act out the processing.
>
> data subjects <> private information
> data minimisation <> collect 'anonymous' 'vatican' data
>
> On 24-04-18 20:31, David Harper wrote:
>>
>> But only when private information is collected, which apparently it
>> is not. Anonymous data collection is not covered by GDPR.
>>
>> -----
>> David Harper
>> Phone: 0421 550 063
>>
>> ------------------------------------------------------------------------
>> *From:* devinfo-***@lists.contribs.org
>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>> <***@gmail.com>
>> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
>> *To:* ***@lists.contribs.org
>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
>> please.
>>
>>
>> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
>> > If you want to opt out:
>> > config setprop statusreport status disabled
>> > expand-template /etc/crontab
>>
>> _______________________________________________
>> Server Development Discussion
>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>> Searchable archive at
>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
>
Hsing-Foo Wang
2018-04-24 19:02:02 UTC
Permalink
Or this https://ec.europa.eu/info/law/law-topic/data-protection_en


On 24-04-18 20:59, Hsing-Foo Wang wrote:
>
> No idea who or what fpf.org is, who's behind it and what they post.
> It's simpler to just go to https://www.eugdpr.org/
>
> and read the source of the law.
>
>
> On 24-04-18 20:54, David Harper wrote:
>>
>> https://fpf.org/wp-content/uploads/2016/11/M-Hintze-GDPR-Through-the-De-Identification-Lens-31-Oct-2016-002.pdf
>>
>> See the table on page 3. On page 4, the author notes:
>>
>> Only Anonymous/Aggregate data is completely outside the scope of...
>> the law.
>>
>> This Anonymous/Aggregate data is defined as:
>>
>> * Not directly linked to identifying data
>> * No known systematic way to reidentify
>> * Not related to a specific person
>>
>> If all that is being collected is the country and the server install
>> date, plus a random hash ID, that meets all three criteria.
>>
>> -----
>> David Harper
>> Phone: 0421 550 063
>>
>> ------------------------------------------------------------------------
>> *From:* Hsing-Foo Wang <***@gmail.com>
>> *Sent:* Wednesday, April 25, 2018 4:40:53 AM
>> *To:* David Harper; ***@lists.contribs.org
>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>
>> *Privacy by Design*
>> Privacy by design as a concept has existed for years now, but it is
>> only just becoming part of a legal requirement with the GDPR. At it’s
>> core, privacy by design calls for the inclusion of data protection
>> from the onset of the designing of systems, rather than an addition.
>> More specifically -/'The controller shall..implement appropriate
>> technical and organisational measures..in an effective way.. in order
>> to meet the requirements of this Regulation and protect the rights of
>> data subjects'./ Article 23 calls for controllers to hold and process
>> only the data absolutely necessary for the completion of its duties
>> (data minimisation), as well as limiting the access to personal data
>> to those needing to act out the processing.
>>
>> data subjects <> private information
>> data minimisation <> collect 'anonymous' 'vatican' data
>>
>> On 24-04-18 20:31, David Harper wrote:
>>>
>>> But only when private information is collected, which apparently it
>>> is not. Anonymous data collection is not covered by GDPR.
>>>
>>> -----
>>> David Harper
>>> Phone: 0421 550 063
>>>
>>> ------------------------------------------------------------------------
>>> *From:* devinfo-***@lists.contribs.org
>>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>>> <***@gmail.com>
>>> *Sent:* Wednesday, April 25, 2018 4:28:02 AM
>>> *To:* ***@lists.contribs.org
>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>> ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
>>> please.
>>>
>>>
>>> On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
>>> > If you want to opt out:
>>> > config setprop statusreport status disabled
>>> > expand-template /etc/crontab
>>>
>>> _______________________________________________
>>> Server Development Discussion
>>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>>> Searchable archive at
>>> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
>>
>
David Harper
2018-04-24 19:08:35 UTC
Permalink
The Future of Privacy Forum is a US based think tank. Advisory Board members include university professors, lawyers, and industry privacy professionals.

Reading the law properly requires good lawyers. The paper cited was authored by the former Chief Privacy Counsel for Microsoft, now a professor at the Washington School of Law. I think that means he knows more than either of us.

-----
David Harper
Phone: 0421 550 063

________________________________
From: Hsing-Foo Wang <***@gmail.com>
Sent: Wednesday, April 25, 2018 4:59:32 AM
To: David Harper; ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home


No idea who or what fpf.org is, who's behind it and what they post. It's simpler to just go to https://www.eugdpr.org/<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.eugdpr.org%2F&data=02%7C01%7C%7C55e915be8e11485ceef608d5aa1584fd%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601931757218696&sdata=KXxBa8xZWKyEcQQFjpsNs33g7IqK3t3wDlPi0y9p2B0%3D&reserved=0>

and read the source of the law.

On 24-04-18 20:54, David Harper wrote:
https://fpf.org/wp-content/uploads/2016/11/M-Hintze-GDPR-Through-the-De-Identification-Lens-31-Oct-2016-002.pdf<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffpf.org%2Fwp-content%2Fuploads%2F2016%2F11%2FM-Hintze-GDPR-Through-the-De-Identification-Lens-31-Oct-2016-002.pdf&data=02%7C01%7C%7C55e915be8e11485ceef608d5aa1584fd%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601931757218696&sdata=2mTVvqRNUn9nknRt6J0bisjgkRKIJLPD1JmWYhOUnr4%3D&reserved=0>

See the table on page 3. On page 4, the author notes:

Only Anonymous/Aggregate data is completely outside the scope of... the law.

This Anonymous/Aggregate data is defined as:


* Not directly linked to identifying data
* No known systematic way to reidentify
* Not related to a specific person

If all that is being collected is the country and the server install date, plus a random hash ID, that meets all three criteria.

-----
David Harper
Phone: 0421 550 063

________________________________
From: Hsing-Foo Wang <***@gmail.com><mailto:***@gmail.com>
Sent: Wednesday, April 25, 2018 4:40:53 AM
To: David Harper; ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home


Privacy by Design
Privacy by design as a concept has existed for years now, but it is only just becoming part of a legal requirement with the GDPR. At it’s core, privacy by design calls for the inclusion of data protection from the onset of the designing of systems, rather than an addition. More specifically - 'The controller shall..implement appropriate technical and organisational measures..in an effective way.. in order to meet the requirements of this Regulation and protect the rights of data subjects'. Article 23 calls for controllers to hold and process only the data absolutely necessary for the completion of its duties (data minimisation), as well as limiting the access to personal data to those needing to act out the processing.

data subjects <> private information
data minimisation <> collect 'anonymous' 'vatican' data

On 24-04-18 20:31, David Harper wrote:

But only when private information is collected, which apparently it is not. Anonymous data collection is not covered by GDPR.



-----
David Harper
Phone: 0421 550 063



________________________________
From: devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org> <devinfo-***@lists.contribs.org><mailto:devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com><mailto:***@gmail.com>
Sent: Wednesday, April 25, 2018 4:28:02 AM
To: ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home

ps. The general privacy rule is to opt IN, not OUT.... Read GDPR again
please.


On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
> If you want to opt out:
> config setprop statusreport status disabled
> expand-template /etc/crontab

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
Searchable archive at https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C016dac758a694b9f6ef208d5aa112781%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601913013118432&sdata=Y0fa9oIF%2FymXpoUCgkA1MFagXMwKsiZGO%2FM%2F8W0my7Q%3D&reserved=0
John Crisp
2018-04-24 21:58:45 UTC
Permalink
On 24/04/18 20:31, David Harper wrote:
> But only when private information is collected, which apparently it is
> not. Anonymous data collection is not covered by GDPR.
>

Thanks David.

I concur entirely, and so do the lawyers who I have consulted.

The reporting script is anonymised so holds no PII, the data is not
linked to the IP, nor is the IP stored.

AFAIAA data for geo location is converted to the country only, the IP
dropped, and therefore anonymised because there is nothing personally
identifiable from geo data. (I had no involvement with any coding of
this, and it produces no maps currently. I am only aware as another
member tried a voluntary based system years back and discussions were
had about automating it, but it was never finished).

Smolt is a total red herring as it does nothing. See Dans comments. It
is more trouble than it is worth to remove, although anyone is welcome
to code it's removal and test that. The service itself can be disabled
if anyone is really bothered.

Either way, it does not collect any data anywhere, so is irrelevant for
GDPR.

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Hsing-Foo Wang
2018-04-24 22:38:11 UTC
Permalink
GDPR is about any data, not personalized or personal data.

So to sum things up in this thread:

1. Cookie compliance - not in place

2. GDPR compliance - not in place

3. GDPR compliance officer - not in place

4. Malicious code e.g. Smolt - Very obsolete code abandoned by RedHat a
long time ago, yet still present in stable SME Server version 9.2

5. StatusReport - Without explicit consent, a cron job calling
StatusReport is sending data every week to an external server

The Koozali Foundation Inc. is holding usernames, passwords and other
data about IP's and persons across various systems.

To see what is in place, by the power of GDPR I would like to request
The Koozali Foundation Inc, a complete copy of all data that can be
related to me or my IP to be sent to me in a human readable form within
2 weeks to my personal email account.




On 24-04-18 23:58, John Crisp wrote:
> On 24/04/18 20:31, David Harper wrote:
>> But only when private information is collected, which apparently it is
>> not. Anonymous data collection is not covered by GDPR.
>>
> Thanks David.
>
> I concur entirely, and so do the lawyers who I have consulted.
>
> The reporting script is anonymised so holds no PII, the data is not
> linked to the IP, nor is the IP stored.
>
> AFAIAA data for geo location is converted to the country only, the IP
> dropped, and therefore anonymised because there is nothing personally
> identifiable from geo data. (I had no involvement with any coding of
> this, and it produces no maps currently. I am only aware as another
> member tried a voluntary based system years back and discussions were
> had about automating it, but it was never finished).
>
> Smolt is a total red herring as it does nothing. See Dans comments. It
> is more trouble than it is worth to remove, although anyone is welcome
> to code it's removal and test that. The service itself can be disabled
> if anyone is really bothered.
>
> Either way, it does not collect any data anywhere, so is irrelevant for
> GDPR.
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
David Harper
2018-04-24 23:02:40 UTC
Permalink
> by the power of GDPR I would like to request



Good luck with that. The maximum fine possible under any circumstances for noncompliance is 4% of global revenue, and that is for the worst of cases which frankly this is nothing close to. I’m not even sure you’re entitled to copies of everything without paying for the associated administration costs. So if I were on the board of Koozali I would vote to ignore this request and leave the entire process of complaining and enforcement for the applicant to pursue ad infinitum.



-----
David Harper
Phone: 0421 550 063



________________________________
From: devinfo-***@lists.contribs.org <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com>
Sent: Wednesday, April 25, 2018 8:38:11 AM
To: ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home

GDPR is about any data, not personalized or personal data.

So to sum things up in this thread:

1. Cookie compliance - not in place

2. GDPR compliance - not in place

3. GDPR compliance officer - not in place

4. Malicious code e.g. Smolt - Very obsolete code abandoned by RedHat a
long time ago, yet still present in stable SME Server version 9.2

5. StatusReport - Without explicit consent, a cron job calling
StatusReport is sending data every week to an external server

The Koozali Foundation Inc. is holding usernames, passwords and other
data about IP's and persons across various systems.

To see what is in place, by the power of GDPR I would like to request
The Koozali Foundation Inc, a complete copy of all data that can be
related to me or my IP to be sent to me in a human readable form within
2 weeks to my personal email account.




On 24-04-18 23:58, John Crisp wrote:
> On 24/04/18 20:31, David Harper wrote:
>> But only when private information is collected, which apparently it is
>> not. Anonymous data collection is not covered by GDPR.
>>
> Thanks David.
>
> I concur entirely, and so do the lawyers who I have consulted.
>
> The reporting script is anonymised so holds no PII, the data is not
> linked to the IP, nor is the IP stored.
>
> AFAIAA data for geo location is converted to the country only, the IP
> dropped, and therefore anonymised because there is nothing personally
> identifiable from geo data. (I had no involvement with any coding of
> this, and it produces no maps currently. I am only aware as another
> member tried a voluntary based system years back and discussions were
> had about automating it, but it was never finished).
>
> Smolt is a total red herring as it does nothing. See Dans comments. It
> is more trouble than it is worth to remove, although anyone is welcome
> to code it's removal and test that. The service itself can be disabled
> if anyone is really bothered.
>
> Either way, it does not collect any data anywhere, so is irrelevant for
> GDPR.
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C27ffd6f14a8b4a4e2c4108d5aa3421fb%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636602063245130518&sdata=8%2BTA%2F5NgxvcmvXKPHfhDjpYYufI66E1BL0s%2FDPGAGzg%3D&reserved=0

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C27ffd6f14a8b4a4e2c4108d5aa3421fb%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636602063245130518&sdata=8%2BTA%2F5NgxvcmvXKPHfhDjpYYufI66E1BL0s%2FDPGAGzg%3D&reserved=0
David Harper
2018-04-24 23:21:16 UTC
Permalink
Have fun then, mate. I’m not sure you’ll get satisfaction, either on the issue at hand or with regards to whatever underlying issue you're so cranky about, but that’s not my business at the end of the day.

-----
David Harper
Phone: 0421 550 063

________________________________
From: Hsing-Foo Wang <***@gmail.com>
Sent: Wednesday, April 25, 2018 9:08:48 AM
To: David Harper; ***@lists.contribs.org
Subject: Re: [devinfo] GDPR - SME Server phoning home


Not the best advise in the world. The request is enforceable by law. I simply have to report that The Koozali Foundation Inc. is not complying or not responding. I don't have to prove anything else. The rest will be local law enforcement adhering to the local law.

That could mean that The Koozali Foundation Inc. infra in France will be shut down and taken off-line. I did not make these laws, just voicing the importance to be compliant. Fine of 4% of the global revenue OR other measurements. Stopping violation (taking off-line infra) is just one of them.

On 25-04-18 01:02, David Harper wrote:

> by the power of GDPR I would like to request



Good luck with that. The maximum fine possible under any circumstances for noncompliance is 4% of global revenue, and that is for the worst of cases which frankly this is nothing close to. I’m not even sure you’re entitled to copies of everything without paying for the associated administration costs. So if I were on the board of Koozali I would vote to ignore this request and leave the entire process of complaining and enforcement for the applicant to pursue ad infinitum.



-----
David Harper
Phone: 0421 550 063



________________________________
From: devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org> <devinfo-***@lists.contribs.org><mailto:devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang <***@gmail.com><mailto:***@gmail.com>
Sent: Wednesday, April 25, 2018 8:38:11 AM
To: ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home

GDPR is about any data, not personalized or personal data.

So to sum things up in this thread:

1. Cookie compliance - not in place

2. GDPR compliance - not in place

3. GDPR compliance officer - not in place

4. Malicious code e.g. Smolt - Very obsolete code abandoned by RedHat a
long time ago, yet still present in stable SME Server version 9.2

5. StatusReport - Without explicit consent, a cron job calling
StatusReport is sending data every week to an external server

The Koozali Foundation Inc. is holding usernames, passwords and other
data about IP's and persons across various systems.

To see what is in place, by the power of GDPR I would like to request
The Koozali Foundation Inc, a complete copy of all data that can be
related to me or my IP to be sent to me in a human readable form within
2 weeks to my personal email account.




On 24-04-18 23:58, John Crisp wrote:
> On 24/04/18 20:31, David Harper wrote:
>> But only when private information is collected, which apparently it is
>> not. Anonymous data collection is not covered by GDPR.
>>
> Thanks David.
>
> I concur entirely, and so do the lawyers who I have consulted.
>
> The reporting script is anonymised so holds no PII, the data is not
> linked to the IP, nor is the IP stored.
>
> AFAIAA data for geo location is converted to the country only, the IP
> dropped, and therefore anonymised because there is nothing personally
> identifiable from geo data. (I had no involvement with any coding of
> this, and it produces no maps currently. I am only aware as another
> member tried a voluntary based system years back and discussions were
> had about automating it, but it was never finished).
>
> Smolt is a total red herring as it does nothing. See Dans comments. It
> is more trouble than it is worth to remove, although anyone is welcome
> to code it's removal and test that. The service itself can be disabled
> if anyone is really bothered.
>
> Either way, it does not collect any data anywhere, so is irrelevant for
> GDPR.
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
> Searchable archive at https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C27ffd6f14a8b4a4e2c4108d5aa3421fb%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636602063245130518&sdata=8%2BTA%2F5NgxvcmvXKPHfhDjpYYufI66E1BL0s%2FDPGAGzg%3D&reserved=0

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org<mailto:devinfo-***@lists.contribs.org>
Searchable archive at https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C27ffd6f14a8b4a4e2c4108d5aa3421fb%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636602063245130518&sdata=8%2BTA%2F5NgxvcmvXKPHfhDjpYYufI66E1BL0s%2FDPGAGzg%3D&reserved=0
John Crisp
2018-04-25 01:59:40 UTC
Permalink
On 25/04/18 00:38, Hsing-Foo Wang wrote:
> GDPR is about any data, not personalized or personal data.

No, you have been told numerous times, and given sources, that it is
about personally identifiable data.

>
> 4. Malicious code e.g. Smolt - Very obsolete code abandoned by RedHat a
> long time ago, yet still present in stable SME Server version 9.2
>

Ah 'malicious' now. As you have been told, code that doesn't actually do
anything. You are scaremongering and ramping up the rhetoric.

> 5. StatusReport - Without explicit consent, a cron job calling
> StatusReport is sending data every week to an external server
>

It's anonymous. GDPR does not apply. Get over it.

If you really don't like it, disable it.

> The Koozali Foundation Inc. is holding usernames, passwords and other
> data about IP's and persons across various systems.
>

They may well be, but that had nothing to do with your original points.

The only details likely to be held are username, email, and password or
forums, wiki and mailing lists. IPs may be logged in the forums to
assist preventing spam. Not exactly unusual is it?

But you have been on the Board. You know all this already.

> To see what is in place, by the power of GDPR I would like to request
> The Koozali Foundation Inc, a complete copy of all data that can be
> related to me or my IP to be sent to me in a human readable form within
> 2 weeks to my personal email account.
>

"By the power of GDPR" said the Emperor (in his nice new clothes) "I
command the seas to part"

Ahhhh, so now you get to the rub. This is actually about making waves,
annoying people, and trying to take some form of revenge. SNAFU.

Make an official request in writing to the Foundation.

I'm sure they can supply you with the usual stuff - name, forum/wiki
username, and linked email address. Whether they have bothered to store
any of your other ramblings I have no idea. Probably the various IP
addresses you logged into the forums with.

After that I sincerely hope they delete the lot and we never hear from
you again.

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Jean-Philippe Pialasse
2018-04-25 02:59:25 UTC
Permalink
Gentlemen,

Can we, please, remain professional and avoid provocation? HF is on moderation so this is not fair to throw more wood in the fire.

Let's either forgot the side issue, or focus on the point:
we have to be ready for GDPR
- inform about cookies and data collection
- popup for this is not mandatory and rather annoying
- we have to be ready to erase data if asked, provide access to data if asked, ease migration of personal data to a different provider if asked
- avoid collection of personal data without prior authorization, unless it serves some purposes like legal obligation or security of the platform.
- if personal data is collected means to protect it should be enforced.

Some of those obligations are rather not well defined by the legislator and leave to interpretation, until some court rules a case.

Jean-Philippe Pialasse

> Le 24 avr. 2018 à 21:59, John Crisp <***@safeandsoundit.co.uk> a écrit :
>
>> On 25/04/18 00:38, Hsing-Foo Wang wrote:
>> GDPR is about any data, not personalized or personal data.
>
> No, you have been told numerous times, and given sources, that it is
> about personally identifiable data.
>
>>
>> 4. Malicious code e.g. Smolt - Very obsolete code abandoned by RedHat a
>> long time ago, yet still present in stable SME Server version 9.2
>>
>
> Ah 'malicious' now. As you have been told, code that doesn't actually do
> anything. You are scaremongering and ramping up the rhetoric.
>
>> 5. StatusReport - Without explicit consent, a cron job calling
>> StatusReport is sending data every week to an external server
>>
>
> It's anonymous. GDPR does not apply. Get over it.
>
> If you really don't like it, disable it.
>
>> The Koozali Foundation Inc. is holding usernames, passwords and other
>> data about IP's and persons across various systems.
>>
>
> They may well be, but that had nothing to do with your original points.
>
> The only details likely to be held are username, email, and password or
> forums, wiki and mailing lists. IPs may be logged in the forums to
> assist preventing spam. Not exactly unusual is it?
>
> But you have been on the Board. You know all this already.
>
>> To see what is in place, by the power of GDPR I would like to request
>> The Koozali Foundation Inc, a complete copy of all data that can be
>> related to me or my IP to be sent to me in a human readable form within
>> 2 weeks to my personal email account.
>>
>
> "By the power of GDPR" said the Emperor (in his nice new clothes) "I
> command the seas to part"
>
> Ahhhh, so now you get to the rub. This is actually about making waves,
> annoying people, and trying to take some form of revenge. SNAFU.
>
> Make an official request in writing to the Foundation.
>
> I'm sure they can supply you with the usual stuff - name, forum/wiki
> username, and linked email address. Whether they have bothered to store
> any of your other ramblings I have no idea. Probably the various IP
> addresses you logged into the forums with.
>
> After that I sincerely hope they delete the lot and we never hear from
> you again.
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at
David Harper
2018-04-25 04:47:21 UTC
Permalink
I've been thinking further about the data request situation. I suspect that most the of the personal information collected by Koozali can be user accessed without any administrative overhead.


* Wiki:
* User profile page
* User history page
* Forums:
* User profile page
* User post search
* Mailing list: mailman archive

The exceptions this general principle of user access on demand would probably be where there is additional personal data from internal sources like membership rolls, donation / payment receipts, and board minutes (the latter is probably subject to an exception). So we are talking about a pretty small number of people.

-----
David Harper
Phone: 0421 550 063

From: Jean-Philippe PIALASSE<mailto:***@pialasse.com>
Sent: Wednesday, 25 April 2018 12:59 PM
To: John Crisp<mailto:***@safeandsoundit.co.uk>
Cc: ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home

Gentlemen,

Can we, please, remain professional and avoid provocation? HF is on moderation so this is not fair to throw more wood in the fire.

Let's either forgot the side issue, or focus on the point:
we have to be ready for GDPR
- inform about cookies and data collection
- popup for this is not mandatory and rather annoying
- we have to be ready to erase data if asked, provide access to data if asked, ease migration of personal data to a different provider if asked
- avoid collection of personal data without prior authorization, unless it serves some purposes like legal obligation or security of the platform.
- if personal data is collected means to protect it should be enforced.

Some of those obligations are rather not well defined by the legislator and leave to interpretation, until some court rules a case.

Jean-Philippe Pialasse

> Le 24 avr. 2018 à 21:59, John Crisp <***@safeandsoundit.co.uk> a écrit :
>
>> On 25/04/18 00:38, Hsing-Foo Wang wrote:
>> GDPR is about any data, not personalized or personal data.
>
> No, you have been told numerous times, and given sources, that it is
> about personally identifiable data.
>
>>
>> 4. Malicious code e.g. Smolt - Very obsolete code abandoned by RedHat a
>> long time ago, yet still present in stable SME Server version 9.2
>>
>
> Ah 'malicious' now. As you have been told, code that doesn't actually do
> anything. You are scaremongering and ramping up the rhetoric.
>
>> 5. StatusReport - Without explicit consent, a cron job calling
>> StatusReport is sending data every week to an external server
>>
>
> It's anonymous. GDPR does not apply. Get over it.
>
> If you really don't like it, disable it.
>
>> The Koozali Foundation Inc. is holding usernames, passwords and other
>> data about IP's and persons across various systems.
>>
>
> They may well be, but that had nothing to do with your original points.
>
> The only details likely to be held are username, email, and password or
> forums, wiki and mailing lists. IPs may be logged in the forums to
> assist preventing spam. Not exactly unusual is it?
>
> But you have been on the Board. You know all this already.
>
>> To see what is in place, by the power of GDPR I would like to request
>> The Koozali Foundation Inc, a complete copy of all data that can be
>> related to me or my IP to be sent to me in a human readable form within
>> 2 weeks to my personal email account.
>>
>
> "By the power of GDPR" said the Emperor (in his nice new clothes) "I
> command the seas to part"
>
> Ahhhh, so now you get to the rub. This is actually about making waves,
> annoying people, and trying to take some form of revenge. SNAFU.
>
> Make an official request in writing to the Foundation.
>
> I'm sure they can supply you with the usual stuff - name, forum/wiki
> username, and linked email address. Whether they have bothered to store
> any of your other ramblings I have no idea. Probably the various IP
> addresses you logged into the forums with.
>
> After that I sincerely hope they delete the lot and we never hear from
> you again.
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C7f042c1faa3e4370662e08d5aa589d93%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636602219932856001&sdata=FFatVSuig3SoAjyOkgSBc1vYrLiNodDNl7JVqB180Sk%3D&reserved=0

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C7f042c1faa3e4370662e08d5aa589d93%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636602219932856001&sdata=FFatVSuig3SoAjyOkgSBc1vYrLiNodDNl7JVqB180Sk%3D&reserved=0
David Harper
2018-04-25 06:12:13 UTC
Permalink
Sorry to reply to my own post, but of course that leaves the issue of IP addresses unresolved. (HSF apparently is in my head!)

Fortunately there has already been very helpful litigation over this. See https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases

The upshot is that if the data controller can link IPs to other information it has legal access to and then use the combined data set to identify a person, the IP is within the scope of GDPR. However, in other cases it is what Hintze refers to as “Article 11 deidentified data” which is not accessible to claimants. So in our case, we probably are on the hook once a user logs in for IP addresses (as already logged by the various web systems) but arguably not before.

-----
David Harper
Phone: 0421 550 063

________________________________
From: David Harper <***@hotmail.com>
Sent: Wednesday, April 25, 2018 2:47:21 PM
To: Jean-Philippe PIALASSE; John Crisp
Cc: ***@lists.contribs.org
Subject: RE: [devinfo] GDPR - SME Server phoning home

I've been thinking further about the data request situation. I suspect that most the of the personal information collected by Koozali can be user accessed without any administrative overhead.


* Wiki:
* User profile page
* User history page
* Forums:
* User profile page
* User post search
* Mailing list: mailman archive

The exceptions this general principle of user access on demand would probably be where there is additional personal data from internal sources like membership rolls, donation / payment receipts, and board minutes (the latter is probably subject to an exception). So we are talking about a pretty small number of people.

-----
David Harper
Phone: 0421 550 063

From: Jean-Philippe PIALASSE<mailto:***@pialasse.com>
Sent: Wednesday, 25 April 2018 12:59 PM
To: John Crisp<mailto:***@safeandsoundit.co.uk>
Cc: ***@lists.contribs.org<mailto:***@lists.contribs.org>
Subject: Re: [devinfo] GDPR - SME Server phoning home

Gentlemen,

Can we, please, remain professional and avoid provocation? HF is on moderation so this is not fair to throw more wood in the fire.

Let's either forgot the side issue, or focus on the point:
we have to be ready for GDPR
- inform about cookies and data collection
- popup for this is not mandatory and rather annoying
- we have to be ready to erase data if asked, provide access to data if asked, ease migration of personal data to a different provider if asked
- avoid collection of personal data without prior authorization, unless it serves some purposes like legal obligation or security of the platform.
- if personal data is collected means to protect it should be enforced.

Some of those obligations are rather not well defined by the legislator and leave to interpretation, until some court rules a case.

Jean-Philippe Pialasse

> Le 24 avr. 2018 à 21:59, John Crisp <***@safeandsoundit.co.uk> a écrit :
>
>> On 25/04/18 00:38, Hsing-Foo Wang wrote:
>> GDPR is about any data, not personalized or personal data.
>
> No, you have been told numerous times, and given sources, that it is
> about personally identifiable data.
>
>>
>> 4. Malicious code e.g. Smolt - Very obsolete code abandoned by RedHat a
>> long time ago, yet still present in stable SME Server version 9.2
>>
>
> Ah 'malicious' now. As you have been told, code that doesn't actually do
> anything. You are scaremongering and ramping up the rhetoric.
>
>> 5. StatusReport - Without explicit consent, a cron job calling
>> StatusReport is sending data every week to an external server
>>
>
> It's anonymous. GDPR does not apply. Get over it.
>
> If you really don't like it, disable it.
>
>> The Koozali Foundation Inc. is holding usernames, passwords and other
>> data about IP's and persons across various systems.
>>
>
> They may well be, but that had nothing to do with your original points.
>
> The only details likely to be held are username, email, and password or
> forums, wiki and mailing lists. IPs may be logged in the forums to
> assist preventing spam. Not exactly unusual is it?
>
> But you have been on the Board. You know all this already.
>
>> To see what is in place, by the power of GDPR I would like to request
>> The Koozali Foundation Inc, a complete copy of all data that can be
>> related to me or my IP to be sent to me in a human readable form within
>> 2 weeks to my personal email account.
>>
>
> "By the power of GDPR" said the Emperor (in his nice new clothes) "I
> command the seas to part"
>
> Ahhhh, so now you get to the rub. This is actually about making waves,
> annoying people, and trying to take some form of revenge. SNAFU.
>
> Make an official request in writing to the Foundation.
>
> I'm sure they can supply you with the usual stuff - name, forum/wiki
> username, and linked email address. Whether they have bothered to store
> any of your other ramblings I have no idea. Probably the various IP
> addresses you logged into the forums with.
>
> After that I sincerely hope they delete the lot and we never hear from
> you again.
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C7f042c1faa3e4370662e08d5aa589d93%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636602219932856001&sdata=FFatVSuig3SoAjyOkgSBc1vYrLiNodDNl7JVqB180Sk%3D&reserved=0

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C7f042c1faa3e4370662e08d5aa589d93%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636602219932856001&sdata=FFatVSuig3SoAjyOkgSBc1vYrLiNodDNl7JVqB180Sk%3D&reserved=0
Jean-Philippe PIALASSE
2018-04-25 22:08:15 UTC
Permalink
Le 2018-04-25 à 02:12, David Harper a écrit :
>
>  
>
> Fortunately there has already been very helpful litigation over this.
> See
> https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases
>
>  
>
> The upshot is that if the data controller can link IPs to other
> information it has legal access to and then use the combined data set
> to identify a person, the IP is within the scope of GDPR.
>
this is where the GDPR enforce that even if you have those information,
you do not have the right to mine them together if they were not collect
for that purpose. This was already the case in France as it was already
enforced by the CNIL.

> However, in other cases it is what Hintze refers to as “Article 11
> deidentified data” which is not accessible to claimants. So in our
> case, we probably are on the hook once a user logs in for IP addresses
> (as already logged by the various web systems) but arguably not before.
>
>  
>
>
If you refer to server log about httpd or sshd connection, we are
covered by a legal obligation. We have to keep those logs with IP and
can not delete them before 1 year. This is because of a French law as
the server is in France : "La loi du 21 juin 2004 pour la confiance dans
l'économie numérique et le décret  du 25 février 2011".

We then can keep those logs but without the IP. Usually this occurs via
an analysis with a script like awstats or similar.


>  
>
> ------------------------------------------------------------------------
> *From:* David Harper <***@hotmail.com>
> *Sent:* Wednesday, April 25, 2018 2:47:21 PM
> *To:* Jean-Philippe PIALASSE; John Crisp
> *Cc:* ***@lists.contribs.org
> *Subject:* RE: [devinfo] GDPR - SME Server phoning home
>  
>
> I've been thinking further about the data request situation. I suspect
> that most the of the personal information collected by Koozali can be
> user accessed without any administrative overhead.
>
>  
>
> * Wiki:
> o User profile page
> o User history page
> * Forums:
> o User profile page
> o User post search
> * Mailing list: mailman archive
>
indeed everything here is accessible by user without other intervention.
Only element that need to be requested and are not already accessible
could be :
- moderation information
- ban list
- server log with IP.

>  
>
> The exceptions this general principle of user access on demand would
> probably be where there is additional personal data from internal
> sources like membership rolls, donation / payment receipts,
>
those are accessible through the forum membership module.

> and board minutes (the latter is probably subject to an exception). So
> we are talking about a pretty small number of people.
>
>  
>
>
Those indeed fall under other laws, and one could not argue the right to
be forgotten to be removed from minutes as they are required legally.



--

*Jean-Philippe Pialasse DC PhD*
Hsing-Foo Wang
2018-04-24 18:56:38 UTC
Permalink
The GDPR is in effect since 2016. Only as of upcoming may 25t will it be
enforceable. The Koozali Foundation Inc. had 2 years of prep time to
comply, just like everybody else.

You still don't get it I think. You need my explicit permission to log
anything of me, around me or from me.

Your Vatican excuse is useless and childish excuse for not being
compliant as responsible president of The Koozali Foundation Inc. So is
the complete board.


On 24-04-18 17:29, Jean-Philippe PIALASSE wrote:
> David,
> thanks for the exact reference.
>
> No IP is logged, IP is discarded.
> The more sensible data logged is the country associated to the IP
> submitting the data, which even if you live in Vatican leave 836
> people for 17920 addresses, so still pretty anonymous data.
>
> Even system id (which can be changed whenever you want) is sent hashed
> by the server itself. System id hash allow to update the data of the
> same server. Release allow us to know the amount of server for every
> release. Country allow us to focus to country using more SME and push
> for translation for instance.
> Time of update, allow us to filter data to active server, if it has
> not update for more than one month we consider it removed from service.
> Install Epoch is usually not that useful as old server tends to have a
> not up to date clock at the moment of installation, but could have
> been useful to guess if a server has been updated through versions or
> if it a fresh install. Or even if outdated version has just been
> installed in the last months.
>
>
> If you want to opt out:
> config setprop statusreport status disabled
> expand-template /etc/crontab
>
> or alternatively migrate to another project.
>
> Le 2018-04-24 à 10:24, David Harper a écrit :
>>
>> It depends on whether the receiving server is logging incoming data
>> pushes by IP address, whether permanently or temporarily.
>>
>> -----
>> David Harper
>> Phone: 0421 550 063
>>
>> ------------------------------------------------------------------------
>> *From:* Hsing-Foo Wang <***@gmail.com>
>> *Sent:* Wednesday, April 25, 2018 12:13:12 AM
>> *To:* David Harper; ***@lists.contribs.org
>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>
>> Why does everybody forget about the IP number, the info is submitted
>> from an IP number that is not transferred but logged on the receiving
>> end. ? And that EU courts have ruled that IP numbers can be related
>> to persones???
>>
>> Lack of knowledge????
>>
>>
>> On 24-04-18 16:02, David Harper wrote:
>>>
>>> Recital 26, which covers anonymous data collection, says in part:
>>>
>>> The principles of data protection should therefore not apply to
>>> anonymous information, namely information which does not relate to
>>> an identified or identifiable natural person or to personal data
>>> rendered anonymous in such a manner that the data subject is not or
>>> no longer identifiable.
>>>
>>> Source: http://www.privacy-regulation.eu/en/recital-26-GDPR.htm
>>> <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.privacy-regulation.eu%2Fen%2Frecital-26-GDPR.htm&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=D%2BkU1qzmhR97o38mPjQR0jBTzv7FTyRQ9Tx%2FgvJUGjA%3D&reserved=0>
>>>
>>>
>>> According to your post, the data in question is:
>>>
>>>            . "ReleaseVersion=" . $db->get_prop('sysconfig',
>>> 'ReleaseVersion')
>>>            . "&SystemIDHash="  . $sysid_hash
>>>            . "&CurrentEpoch="  . time
>>>            . "&InstallEpoch="  . $db->get_prop('sysconfig',
>>> 'InstallEpoch')
>>>            . "&SystemMode="    . $db->get_value('SystemMode');
>>>
>>> The closest we get to unique data is therefore the system ID (hash)
>>> and the install time. I note that potentially identifiable data such
>>> as IP address and domain name are not shared.
>>>
>>> So long as there is no secondary collection with which the system ID
>>> could be matched, I don't see a problem. By way of an example, the
>>> SMEOptimizer contrib requires registration
>>> (https://wiki.contribs.org/SMEOptimizer
>>> <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.contribs.org%2FSMEOptimizer&data=02%7C01%7C%7C615b485151694cf3725108d5a9ed852c%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601759962998636&sdata=Gdc%2BfPZIXVKpboHNcIi7lHOWN7XfRgHDHi0xyCednPc%3D&reserved=0>),
>>> so the maintainer may have additional responsibilities under GDPR if
>>> the script sends additional data to the maintainer’s server during
>>> initialisation.
>>>
>>> -----
>>> David Harper
>>> Phone: 0421 550 063
>>>
>>> ------------------------------------------------------------------------
>>> *From:* devinfo-***@lists.contribs.org
>>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>>> <***@gmail.com>
>>> *Sent:* Tuesday, April 24, 2018 10:12:12 PM
>>> *To:* ***@lists.contribs.org
>>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>>> I had another look at the below expression. I'm not really sure what it
>>> means, but it certainly does not sound friendly.
>>>
>>> With what authority or from perspective are you responding 'that
>>> strongly' For you can always choose to not to respond.
>>>
>>> You are just you. You are not contribs.org
>>>
>>> On 24-04-18 13:36, John Crisp wrote:
>>>
>>> > Ah damn. You are still here then.
>>>
>>> _______________________________________________
>>> Server Development Discussion
>>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>>> Searchable archive at
>>> https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C0d6ed2d87eb54b51e63d08d5a9dca915%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601687551939217&sdata=lAqhsuBmKWZOywEfLz0SP%2F3jdKH%2FwINjkP5B5aedBFY%3D&reserved=0
>>
>>
>>
>> _______________________________________________
>> Server Development Discussion
>> To unsubscribe, e-maildevinfo-***@lists.contribs.org
>> Searchable archive athttps://lists.contribs.org/mailman/public/devinfo/
>
>
>
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Rob Adams
2018-04-24 22:36:17 UTC
Permalink
IP address may or may not be logged, it also may or may not be stored,
logs are rotated....

But you knew that.


On 24/04/2018 23:43, Hsing-Foo Wang wrote:
>
> Why does everybody forget about the IP number, the info is submitted
> from an IP number that is not transferred but logged on the receiving
> end. ? And that EU courts have ruled that IP numbers can be related to
> persones???
>
> Lack of knowledge????
>
>
> On 24-04-18 16:02, David Harper wrote:
>>
>> Recital 26, which covers anonymous data collection, says in part:
>>
>> The principles of data protection should therefore not apply to
>> anonymous information, namely information which does not relate to an
>> identified or identifiable natural person or to personal data
>> rendered anonymous in such a manner that the data subject is not or
>> no longer identifiable.
>>
>> Source: http://www.privacy-regulation.eu/en/recital-26-GDPR.htm
>> <http://www.privacy-regulation.eu/en/recital-26-GDPR.htm>
>>
>> According to your post, the data in question is:
>>
>>            . "ReleaseVersion=" . $db->get_prop('sysconfig',
>> 'ReleaseVersion')
>>            . "&SystemIDHash="  . $sysid_hash
>>            . "&CurrentEpoch="  . time
>>            . "&InstallEpoch="  . $db->get_prop('sysconfig',
>> 'InstallEpoch')
>>            . "&SystemMode="    . $db->get_value('SystemMode');
>>
>> The closest we get to unique data is therefore the system ID (hash)
>> and the install time. I note that potentially identifiable data such
>> as IP address and domain name are not shared.
>>
>> So long as there is no secondary collection with which the system ID
>> could be matched, I don't see a problem. By way of an example, the
>> SMEOptimizer contrib requires registration
>> (https://wiki.contribs.org/SMEOptimizer), so the maintainer may have
>> additional responsibilities under GDPR if the script sends additional
>> data to the maintainer’s server during initialisation.
>>
>> -----
>> David Harper
>> Phone: 0421 550 063
>>
>> ------------------------------------------------------------------------
>> *From:* devinfo-***@lists.contribs.org
>> <devinfo-***@lists.contribs.org> on behalf of Hsing-Foo Wang
>> <***@gmail.com>
>> *Sent:* Tuesday, April 24, 2018 10:12:12 PM
>> *To:* ***@lists.contribs.org
>> *Subject:* Re: [devinfo] GDPR - SME Server phoning home
>> I had another look at the below expression. I'm not really sure what it
>> means, but it certainly does not sound friendly.
>>
>> With what authority or from perspective are you responding 'that
>> strongly' For you can always choose to not to respond.
>>
>> You are just you. You are not contribs.org
>>
>> On 24-04-18 13:36, John Crisp wrote:
>>
>> > Ah damn. You are still here then.
>>
>> _______________________________________________
>> Server Development Discussion
>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>> Searchable archive at
>> https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.contribs.org%2Fmailman%2Fpublic%2Fdevinfo%2F&data=02%7C01%7C%7C0d6ed2d87eb54b51e63d08d5a9dca915%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636601687551939217&sdata=lAqhsuBmKWZOywEfLz0SP%2F3jdKH%2FwINjkP5B5aedBFY%3D&reserved=0
>
>
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/



---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus
Hsing-Foo Wang
2018-04-24 22:40:17 UTC
Permalink
IP addresses are considered to be personal details. Many court cases
over the last few years about this.


On 25-04-18 00:36, Rob Adams wrote:
>
> IP address may or may not be logged, it also may or may not be stored,
> logs are rotated....
>
> But you knew that.
>

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Rob Adams
2018-04-24 22:50:52 UTC
Permalink
cite please...


On 25/04/2018 08:10, Hsing-Foo Wang wrote:
> IP addresses are considered to be personal details. Many court cases
> over the last few years about this.
>
>
> On 25-04-18 00:36, Rob Adams wrote:
>>
>> IP address may or may not be logged, it also may or may not be
>> stored, logs are rotated....
>>
>> But you knew that.
>>
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/


---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Hsing-Foo Wang
2018-04-24 22:53:55 UTC
Permalink
Fair enough, just not tonight. I have to look them up.


On 25-04-18 00:50, Rob Adams wrote:
> cite please...
>
>
> On 25/04/2018 08:10, Hsing-Foo Wang wrote:
>> IP addresses are considered to be personal details. Many court cases
>> over the last few years about this.
>>
>>
>> On 25-04-18 00:36, Rob Adams wrote:
>>>
>>> IP address may or may not be logged, it also may or may not be
>>> stored, logs are rotated....
>>>
>>> But you knew that.
>>>
>>
>> _______________________________________________
>> Server Development Discussion
>> To unsubscribe, e-mail devinfo-***@lists.contribs.org
>> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
>
>
> ---
> This email has been checked for viruses by Avast antivirus software.
> https://www.avast.com/antivirus
>
> _______________________________________________
> Server Development Discussion
> To unsubscribe, e-mail devinfo-***@lists.contribs.org
> Searchable archive at https://lists.contribs.org/mailman/public/devinfo/

_______________________________________________
Server Development Discussion
To unsubscribe, e-mail devinfo-***@lists.contribs.org
Searchable archive at https://lists.contribs.org/mailman/public/devinfo/
Loading...