Bug 441355 - kioslave5 reports location to mozilla without consent
Summary: kioslave5 reports location to mozilla without consent
Status: RESOLVED FIXED
Alias: None
Product: systemsettings
Classification: Applications
Component: kcm_nightcolor (show other bugs)
Version: 5.22.4
Platform: Arch Linux Linux
: NOR grave
Target Milestone: ---
Assignee: Plasma Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-08-22 11:48 UTC by Krešimir Čohar
Modified: 2021-08-23 18:08 UTC (History)
4 users (show)

See Also:
Latest Commit:
Version Fixed In: 5.23


Attachments
OpenSnitch showing kioslave5 trying to connect without the user's consent (147 bytes, text/plain)
2021-08-22 11:48 UTC, Krešimir Čohar
Details
kioslave5 trying to connect to mozilla without the user's consent (311.80 KB, image/png)
2021-08-22 11:50 UTC, Krešimir Čohar
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Krešimir Čohar 2021-08-22 11:48:29 UTC
Created attachment 140940 [details]
OpenSnitch showing kioslave5 trying to connect without the user's consent

kioslave5 connects to location.services.mozilla.com without asking the user for permission. If I deny the connection, the latitude and longitude read 0, and if I allow it, the latitude and longitude match my location.

STEPS TO REPRODUCE
1. Run System Settings
2. Navigate to Display and Monitor
3. It starts connecting right away, but to confirm that it actually manages to connect, click on Night Color and check the latitude and longitude readings.

OBSERVED RESULT
kioslave5 connects to mozilla without the user's consent

EXPECTED RESULT
kioslave5 should not connect without explicitly asking the user for permission

SOFTWARE/OS VERSIONS
Linux/KDE Plasma: Arch Linux, KDE Plasma 5.22.4
(available in About System)
KDE Plasma Version: 5.22.4
KDE Frameworks Version: 5.85.0
Qt Version: 5.15.2
Comment 1 Krešimir Čohar 2021-08-22 11:50:15 UTC
Created attachment 140941 [details]
kioslave5 trying to connect to mozilla without the user's consent
Comment 2 Krešimir Čohar 2021-08-22 11:51:44 UTC
P.S. It doesn't retain the information (I don't know if it should, seeing as I don't use Night Color). So when I close System Settings, it asks to reconnect.
Comment 3 David Edmundson 2021-08-22 11:59:52 UTC
That's not kioslave at fault. It's akin to wget/curl for all intents and purposes here.

As for nightshift doing that, the geolocation backend has multiple resolving paths. It's nothing technically surprising and is working as expected. 

But we should have some wording before activation.
Comment 4 Krešimir Čohar 2021-08-22 12:07:46 UTC
Yeah I didn't know, sorry :D I was going off of what OpenSnitch told me.

I mean, I think "grave" (the importance) might have been overkill seeing as it doesn't do this unless you click on the kcm (or actually use it I presume).

Yeah, it's just that a little heads up would have been nice.
Aside from the lock screen (media player?) connecting to Spotify, I haven't had Plasma phone home to anyone at all (I don't use Discover).
Comment 5 Krešimir Čohar 2021-08-22 12:08:38 UTC
Also, the media player applet thing connecting to Spotify - that's to be expected imo and I don't think it's an issue.
Comment 6 Bharadwaj Raju 2021-08-22 15:36:40 UTC

*** This bug has been marked as a duplicate of bug 419677 ***
Comment 7 Nate Graham 2021-08-23 17:14:29 UTC
(Re-opening since this is about to be fixed with https://invent.kde.org/plasma/plasma-workspace/-/merge_requests/1016)
Comment 8 Nate Graham 2021-08-23 18:08:04 UTC
Git commit bad72c931e95bfb325ece391e0ffc6e0153d9d51 by Nate Graham, on behalf of Bharadwaj Raju.
Committed on 23/08/2021 at 18:07.
Pushed by ngraham into branch 'master'.

[kcms/nightcolor] Inform user when geolocating, and only do it when needed
Related: bug 419677
FIXED-IN: 5.23

M  +24   -11   kcms/nightcolor/package/contents/ui/LocationsFixedView.qml
M  +37   -4    kcms/nightcolor/package/contents/ui/main.qml

https://invent.kde.org/plasma/plasma-workspace/commit/bad72c931e95bfb325ece391e0ffc6e0153d9d51