The database of hardware

[imschmeg]

Selecting hw-probe from MXPI:

Code: Select all

...
The following NEW packages will be installed:
  acpica-tools cpuid edid-decode hw-probe i2c-tools iw libi2c0 memtester
  vdpauinfo vulkan-tools vulkan-utils

Wow - it's a very needy tool!

[imschmeg]

I disconnected from the network, and ran 'sudo hw-probe -all' without the -upload. It puts its info in /root/HW_PROBE/LATEST/hw.info/ - and there is a lot, if anyone wants to walk through it to figure out if it's already anonymized sufficiently. Or you can just hope the -upload does enough anonymizing. My own preference is to examine it...

[imschmeg]

OK - I'm spooked. There's stuff in /root/HW_PROBE/LATEST/hw.info that I would not want to fall into the wrong hands. So, I'm going to have to see the anonymized output before cooperating further with this request, even though I very much sympathize with the intention.

[JayM]

1. After reading the first two paragraphs of this project's website I see a major flaw in the entire concept: people with incompatible hardware are less-likely to upload their computer's data than are people with systems that are working well, skewing your data and leading to false conclusions.

• They're most likely too busy trying to solve their computer issue or have gone distro-hopping

• If their issues are to do with networking, lock-ups or crashes they can't upload their data even if they wanted to

So if the purpose of this database is to get an idea about the percentage of incompatible hardware out in the wild, you're not going to get accurate data. It's going to be skewed in favor of the number of working systems.

2. I'm still extremely hinky about giving away my information. Under Privacy the site says "Most private info is not collected or hashed." (italics mine.) It doesn't say what private info is collected unhashed. It also doesn't spell out in detail exactly what is being done with the data. I want to see everything spelled out in detail: exactly what data is being collected, which of those items are hashed and which are saved in the clear, and in minute detail who is using this data and for what purposes. I also want to know who is behind this project: name, age location a photo, their background, etc. Right now I see an unknown random stranger on the Internet trying to get me to send him a bunch of data about (and from) my computer, and that's a great big fat red flag!

Lastly, after linuxbuild's recent flood of replies to multiple help request topics trying to convince as many people as possible to run this utility and share their data I'm frankly very suspicious and skeptical. I wonder what his role in the project may be, and exactly why collecting as much information as possible as soon as possible is so important to him at this time. My experience is that when people behave this way they're often up to no good. No disclosure, no privacy agreement, no nothing means no data, no way as far as I'm concerned.

[Stevo]

Selecting hw-probe from MXPI:

Code: Select all

...
The following NEW packages will be installed:
  acpica-tools cpuid edid-decode hw-probe i2c-tools iw libi2c0 memtester
  vdpauinfo vulkan-tools vulkan-utils

Wow - it's a very needy tool!

I changed the Recommends that Debian has to hard dependencies for MX, so it would also pull those in by default on Debian.

[linuxbuild]

OTHO, I do see UUID's in the uploaded data, which are fairly unique to the devices. Wouldn't it be more privacy focused to get those UUID's also hashed or randomized.

Let's hide them. I'll try to prepare a patch tomorrow morning.

Fixed in master: https://github.com/linuxhw/hw-probe/com ... 0fa4cbac43

It will be a part of the 1.5, that will be released on January 15.

[linuxbuild]

Contrast my upload with the one kmathern said was his (post #13), the banner on the top says "MX Hardware" like mine, but under "Host Info" and "System" his says MX 19.

Mine originally said "Debian 10" in the "Host Info" section.

Someone (linuxbuild ?) changed it to "MX 19" after I made post #13.

Yep. MX is detected now by matching related installed packages if failed to detect by lsb_release or /etc/os-release. But this doesn't work for Flatpak package since the list of installed packages is not accessible.

[linuxbuild]

OK - I'm spooked. There's stuff in /root/HW_PROBE/LATEST/hw.info that I would not want to fall into the wrong hands. So, I'm going to have to see the anonymized output before cooperating further with this request, even though I very much sympathize with the intention.

What particular data or files you don't want to share? Probably this is already fixed in master.

[linuxbuild]

In MX18 /stretch lsb_release info comes from /etc/lsb-release
In MX19 /buster they seem to ignore /etc/lsb-release and get it from /usr/lib/os-release
So "lsb_release -a" to get version/release info is currently not reliable in MX-19 as it ignores /etc/lsb-release

Added a patch to hw-probe 1.5 to collect /etc/lsb-release.

Thank you.

[imschmeg]

What particular data or files you don't want to share? Probably this is already fixed in master.

I deleted /root/HW_PROBE. The one thing I saw in the data collected there in particular that spooked me was details about crypto usage, including salt. I didn't bother to look further than that.

It may be that the intention is to have hw-probe gather as much info as it can locally, and then filter it heavily before anonymizing and uploading. But the steps in that have to be made much more transparent.