| Summary: | Metabug: Location-based services that require GeoClue are not correctly disabled in the UI when the service is disabled | ||
|---|---|---|---|
| Product: | [Applications] systemsettings | Reporter: | EpicTux123 <EpicTux123> |
| Component: | general | Assignee: | Plasma Bugs List <plasma-bugs-null> |
| Status: | CONFIRMED --- | ||
| Severity: | task | CC: | ilikefoss, kde, nate, vlad.zahorodnii |
| Priority: | NOR | Keywords: | usability |
| Version First Reported In: | 6.5.5 | ||
| Target Milestone: | --- | ||
| Platform: | Fedora RPMs | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed/Implemented In: | ||
| Sentry Crash Report: | |||
| Bug Depends on: | 515221, 515222, 515223 | ||
| Bug Blocks: | |||
You can configure a manual location so why should we hide those pages. (In reply to David Redondo from comment #1) > You can configure a manual location so why should we hide those pages. I'm not sure that the OP asks to hide those pages. As far as I understand what he wants and based on my personal opinions: 1. For users that are very conscious and informed about dangers pertaining their personal privacy and security, which might have also taken measures to protect them like: - Masking (completely disabling) systemd services - Holding some updates - Using FireJail | BubleWrap sandboxing tools - Using OpenSnitch application firewall To block services, tools, scripts / components, programs from sending information! KDE developers should at least explain how is it possible that KDE Programs like Plasma or other components still work fine! It's a transparency thing. As we cannot have the best privacy and security without knowing all the things that send data from our computers so we are first aware of them and we also know what to block, in case we reach that decision. As a user of OpenSnitch on Plasma, I'm honestly very appalled and disappointed seeing how many KDE-related components want to get past the firewall without explaining what they actually want to do (getting some info, sending some info or both) and for what purpose! And that's after multiple requests of making that potentially-spyware (telemetry) tool optional and uninstallable module, that you still refuse to do. But this will not end well for you as in the future I will write to our EU representatives to make a law about spyware being installed by default, like in your case and not be able to uninstall it completely, like in your case. Hopefully with the shift from the US-based products and services which are full of spyware, we can have these kind of laws for organizations that refuse to properly inform users about everything they do and to make questionable components optional and uninstallable and blockable, when they are nicely asked. It's your choice if you want to do the necessary steps for us to have the best privacy and security, which are: - Make things that send data from our computers as separate modules, that can be unistalled or blocked by masking, FireJail, BubleWrap, OpenSnitch - Respect those masking / blocking decisions if that's what we have taken. - Inform us why those components need to use these modules to send data, what data is sent and for what purpose. Even today I had to block the Mekuro calendar (which I didn't expect to have internet access) from trying access some page, which was a blog of one of your developers! (as I copied the URL in my web browser to see WTF it wants access to) Luckily OpenSnitch caught it and informed me about it and then asked for my permission, which I denied as I saw no point of my personal calendar sending data or needing more data from some web page! So, shame on whoever though that is a good idea to send or get data behind our back from various pages without any transparency! And congrats and many thanks to the OpenSnitch developer for both informing us what is going on and asking for our consent! While I like the KDE organization a lot and I fully support it, my privacy and security is more important than anything and I hate that this organization doesn't treat it at the same level both in transparency / informing me about what is going on and grouping components that send or receive data from outside in specific services or tools that we can block or uninstall, in case we know we don't need them at all. Krunner is also one of the components that contacts some ECB page, which I blocked as I don't need its conversion and I didn't like the idea of not being informed and asked for consent. BTW, this also keeps nagging me a lot (every time I start it) with GeoClue location requests, which I cannot choose NEVER: https://flathub.org/en/apps/app.organicmaps.desktop Please fix it on your side as who knows when they will fix it and other programs and games might do the same in the future! Thanks! EpicTux123: I think there may be a misunderstanding; this page doesn't actually require location services provided by GeoClue. It can use them optionally if they're available, but, as David Redondo mentioned, you can configure a manual location. In this case, GeoClue is not used. So it would not make sense to make the page "not work" in this case. If what you're actually trying to report is "I disabled Geoclue but location-based services that require GeoClue failed to become disabled in the UI" then it would be better to phrase it like that. In general bug reports work best when they're reporting bugs, not when they're asking for details about the software architecture or proposing features. Is that the case? John: this is a bug tracker, not a forum. If you have concerns about issues in KDE software, the best way to express them is in the form of bug reports about those issues; one per issue, phrased neutrally, not writing an essay about why the existence of the issue is a moral catastrophe and maybe illegal. We're pretty much on your side regarding this topic; any issues are mistakes or oversights, not deliberate attempts to be malicious. As such, please try to assume good faith when you bring up the topics. Thanks. Yes, Nate, that is indeed the case. I thought it was using a local copy of GeoClue somehow, but this seems just to be an UI failure to make the option not available. Thanks for the clarification. I've edited the the bug title in order to better reflect that too. To fix that, I think the relevant pages and Plasmoids should check if "geoclue.service" is disabled/masked. If so, gray out the unavailable option, and make only the other option available. In the case of Day Night Cycle, it would be the manual mode. For Night Light, only manual mode too. For Background Services app, the "Global Theme Auto-Switcher" and "Location-based System Time Zone" become disabled and greyed out automatically too (based on the same check of the service status). Thanks. Can you open a separate bug report for every affected page? This isn't something that can be done centrally; each page needs custom code to handle it. We also need to take into account systemd vs non-systemd use cases; any change here can't assume systemd is being used, since we don't make it a hard dependency. Let's turn this into a meta-bug to collect the other bug reports you're about to open. When you do, please mark them as blocking this one using the "Blocks" field. Thanks a lot! Thanks for your help, Nate. I've done exactly that. Great job, thanks! |
Hi there, This is a request for clarification of how Plasma works in regards to the Night Light and Day/Night Cycle features. I opened this against Day/Night Cycle since that is more pertinent, but it also applies to Night Light and other features that use GeoClue. Even with `geoclue.service` (systemd service) disabled+masked, and even with `/etc/xdg/autostart/geoclue-demo-agent.desktop`, Plasma still seems able to present those two pages without any problems at all, which is interesting. What does Plasma do to achieve that when the GeoClue service is masked? I'd propose to make a way so both pages don't work if `geoclue.service` is masked, because. 1. The user has masked it due to security or privacy concerns (e.g. hardening), or; 2. Functionality may be impacted internally if the service is unavailable. I also ask the same question ("What does Plasma do [...]") for the Plasmoids in the "Background Services" app of "Global Theme Auto-Switcher" and "Location-based System Time Zone". What are their relations to `geoclue.service`, and how can they work without it? Thanks.