Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.
Bug 494852 - Require explicit user's consent to use non-anonymous User-Agent
Summary: Require explicit user's consent to use non-anonymous User-Agent
Status: RESOLVED WONTFIX
Alias: None
Product: Equinox
Classification: Eclipse Project
Component: p2 (show other bugs)
Version: unspecified   Edit
Hardware: All All
: P3 critical (vote)
Target Milestone: ---   Edit
Assignee: P2 Inbox CLA
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on: 490112
Blocks:
  Show dependency tree
 
Reported: 2016-05-29 11:17 EDT by Mykola Nikishov CLA
Modified: 2016-06-02 00:32 EDT (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mykola Nikishov CLA 2016-05-29 11:17:05 EDT
Since bug 490112, any user of Eclipse-based application who is not
willing to share a fine-grained information about his environment has
no way to prevent this.

Make reporting such information in User-Agent HTTP header an opt-in
(rather than the only way).
Comment 1 Antoine THOMAS CLA 2016-06-01 04:13:04 EDT
How would you do that ?
Comment 2 Pascal Rapicault CLA 2016-06-01 08:01:25 EDT
Every single properly behaving tool talking to an http server identifies itself with a specific user agent. I don't see the need for opting out, or asking consent. 
Maybe we can change the Eclipse EULA to cover this, but this is all I would do.
Comment 3 Mykola Nikishov CLA 2016-06-01 13:48:05 EDT
(In reply to Antoine THOMAS from comment #1)

> How would you do that ?

Just a wild guess - in the same way as asking to accept a license when
installing new bundles with p2.
Comment 4 Mykola Nikishov CLA 2016-06-02 00:32:05 EDT
(In reply to Pascal Rapicault from comment #2)

> Every single properly behaving tool talking to an http server

In my, less than ideal world, properly behaving tools:
- by default, don't leak an ID that allows to track _any_ request back
  to the user
- don't send such requests in the clear (eclipse.org p2 repositories
  are not available over HTTPS)
- allows to change a user-agent if user desires

None of these are about p2.

> identifies itself with a specific user agent.

This bug suggested another extreme solution, not better then master in
any way, which you don't like. Totally agree, there is nothing to
discuss because:

> I don't see the need for opting out, or asking consent.

= I don't care to ask if the user is OK to be not in control of his
computer any more.

> Maybe we can change the Eclipse EULA to cover this

Yes, please, give your users a favor.