Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.
Bug 357433 - Usage data collector is reporting user file names (personally identifiable)
Summary: Usage data collector is reporting user file names (personally identifiable)
Status: RESOLVED WONTFIX
Alias: None
Product: EPP
Classification: Technology
Component: Usage Data Collector (show other bugs)
Version: unspecified   Edit
Hardware: PC Windows 7
: P3 normal (vote)
Target Milestone: ---   Edit
Assignee: Wayne Beaton CLA
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-09-12 22:54 EDT by dphaynes CLA
Modified: 2021-05-07 10:23 EDT (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description dphaynes CLA 2011-09-12 22:54:41 EDT
Build Identifier: 20110615-0604

I expected that all my project information like class names would _not_ be publicized/reported as part of the usage data collecting. Subclipse is reporting class names when javahl fails to load. 

Shouldn't Eclipse be scrubbing the data so that buggy plugins don't expose user information like this?

While doing a Windows search for files on my PC I discovered that 
E:\EclipseWorkspace\.metadata\.plugins\org.eclipse.epp.usagedata.recording\upload1.csv includes the names of my class files in messages like this:


org.tigris.subversion.javahl.ClientException: svn: Commit failed (details follow):\nsvn: Aborting commit: 'E:\\EclipseWorkspace\\MyRedactedProject\\src\\myredactedpackage\\anotherredactedpackage\\MyClassIDoNotWantToPublish.java' remains in conflict

I checked in the UDC preview page and the class names are included.

I've disabled the usage collection and plan to leave it disabled so it's no longer a problem for me. If I can't trust plugins not to send data they shouldn't then I have to opt out of the usage reporting.

Reproducible: Always

Steps to Reproduce:
1. Install subclipse on clean Windows install but without sliksvn or other javahl provider
2. Try to commit file with conflict.
Comment 1 Wayne Beaton CLA 2011-09-13 10:05:50 EDT
This, frankly, is one of the reasons why we're shutting down the usage data collector in the Juno time-frame. My current plan is shut down collection on the server at the end of September (clients will continue to work, believing that the server is doing what it is supposed to do until they are removed). We haven't started screaming this from the rooftops yet, but will start to do so in the next couple of weeks.

Other than that, all I have are reassurances that the Eclipse Foundation takes your privacy very seriously. Before any of the collected data is provided to researches, we scrub it to make sure that information like this is not made available. Removing entries like the one you cite is relatively easy: we scrub out all error messages as these have proven to be the most problematic.
Comment 2 Jonah Graham CLA 2021-05-07 10:23:39 EDT
The Usage Data Collector was decommissioned a long time ago. Therefore any
remaining bugs are now being closed as WONTFIX. If this bug is still relevant,
please make a comment and we'll move it to the correct project/component for
further investigation.

This change was made as part of a bulk change.