[jitsi-users] Fwd: default settings - ever questioned...?!


#1

Hello everybody,
new here so first a quick and big thanks to this great piece of
software. Ever since Sky** was swallowed and now even changed it's
policies, I try to convince as many as friends as I can to use Jitsi :slight_smile:
Now, to the point:
For many users which are not as 'comfortable' with the computer, I think
some options on the default install should be changed - or discussed :slight_smile:
These are:
1.: !!Backup Resolver: Due to privacy reasons, I very much dislike this
"Google option" - now, by default, ALL THE TIME I start up
Jitsi / make a call / invite a friend, Google knows where I am and to
what domain I want to call - as this option is enabled by default! There
are a lot of other, un- logged/filtered public DNS servers out there
(e.g. see http://www.wikileaks.org/wiki/Alternative_DNS) to use. This is
the a very critical issue for privacy reasons, and probably most of the
users haven't even seen that / looked up the IP's of "your" Backup
resolver.

2.:Autostart: is generally disabled. If I want to reach people, they
have to have Jitsi running, but at the beginning I jumped over the
"Autostart on startup" option - so now, many users are simply only
reachable on Sky**. Bugger! I vouch that it is switched to "enabled" by
default, so that people are reachable. I don't see a downside for this,
just positives.

3.: Automatically initiate private messaging: Also something I have
overseen at first. I'm going through all the "hassle" of setting up
encryption, but every time I have to be sure that I turn it on? I don't
think there's that much CPU/additional bandwidth involved that this
couldn't be turned on by default (as, when I don't have the contact
verified, it obviously works as a normal chat anyways)? If we can
encrypt, I think we should.

4.: Logging: I have seen (at least on the Linux version) that logging is
enabled for all protocols by default. I think this is an unnecessary
risk(if also not big, but it's there - IP addresses etc. are stored) and
performance/disk usage factor (again, not big, but - how many users even
know what that data is?). If I do have an issue and know how to decipher
the logs, then I also know where to enable it...?!

I hope that's not too much in one post and thanks in advance for
consideration,
Cheers Chris

路路路

---------- Forwarded message ----------
From: Chris Kaspro <kaspro@web.de>
Date: Sun, Apr 27, 2014 at 7:07 AM
Subject: default settings - ever questioned...?!
To: users@jitsi.org


#2

From: Chris Kaspro <kaspro@web.de>
Date: Sun, Apr 27, 2014 at 7:07 AM
Subject: default settings - ever questioned...?!
To: users@jitsi.org

Hello everybody,
new here so first a quick and big thanks to this great piece of
software. Ever since Sky** was swallowed and now even changed it's
policies, I try to convince as many as friends as I can to use
Jitsi :slight_smile: Now, to the point:
For many users which are not as 'comfortable' with the computer, I
think some options on the default install should be changed - or
discussed :slight_smile: These are:
1.: !!Backup Resolver: Due to privacy reasons, I very much dislike
this "Google option" - now, by default, ALL THE TIME I start up
Jitsi / make a call / invite a friend, Google knows where I am and to
what domain I want to call - as this option is enabled by default!
There are a lot of other, un- logged/filtered public DNS servers out
there (e.g. see http://www.wikileaks.org/wiki/Alternative_DNS) to
use. This is the a very critical issue for privacy reasons, and
probably most of the users haven't even seen that / looked up the
IP's of "your" Backup resolver.

I very much agree with this point. I think that many users of
jitsi are privacy-conscious and use it because they do not want to use
skype for privacy and security reasons. Those people also don't like to
provide information to a company that makes its money with the users
private data. Google can easily be avoided, so please do it.

Thanks Chris, I was not aware of this and switched to a different DNS
server, but this is something my not so tech-savy friends won't do.

2.:Autostart: is generally disabled. If I want to reach people, they
have to have Jitsi running, but at the beginning I jumped over the
"Autostart on startup" option - so now, many users are simply only
reachable on Sky**. Bugger! I vouch that it is switched to "enabled"
by default, so that people are reachable. I don't see a downside for
this, just positives.

3.: Automatically initiate private messaging: Also something I have
overseen at first. I'm going through all the "hassle" of setting up
encryption, but every time I have to be sure that I turn it on? I
don't think there's that much CPU/additional bandwidth involved that
this couldn't be turned on by default (as, when I don't have the
contact verified, it obviously works as a normal chat anyways)? If we
can encrypt, I think we should.

I agree, encryption should automatically be enabled if possible.

4.: Logging: I have seen (at least on the Linux version) that logging
is enabled for all protocols by default. I think this is an
unnecessary risk(if also not big, but it's there - IP addresses etc.
are stored) and performance/disk usage factor (again, not big, but -
how many users even know what that data is?). If I do have an issue
and know how to decipher the logs, then I also know where to enable
it...?!

I hope that's not too much in one post and thanks in advance for
consideration,
Cheers Chris

I don't have strong opinions, one way or the other, on the other points.

Regards,
Philipp

路路路

On Thu, 1 May 2014 17:01:29 +0200 Jitsi Mailman <mailman@sip-communicator.org> wrote:

---------- Forwarded message ----------


#3

From: Chris Kaspro <kaspro@web.de>
Date: Sun, Apr 27, 2014 at 7:07 AM
Subject: default settings - ever questioned...?!
To: users@jitsi.org

Hello everybody,
new here so first a quick and big thanks to this great piece of
software. Ever since Sky** was swallowed and now even changed it's
policies, I try to convince as many as friends as I can to use Jitsi :slight_smile:
Now, to the point:
For many users which are not as 'comfortable' with the computer, I think
some options on the default install should be changed - or discussed :slight_smile:
These are:
1.: !!Backup Resolver: Due to privacy reasons, I very much dislike this
"Google option" - now, by default, ALL THE TIME I start up
Jitsi / make a call / invite a friend, Google knows where I am and to
what domain I want to call - as this option is enabled by default! There
are a lot of other, un- logged/filtered public DNS servers out there
(e.g. see http://www.wikileaks.org/wiki/Alternative_DNS) to use. This is
the a very critical issue for privacy reasons, and probably most of the
users haven't even seen that / looked up the IP's of "your" Backup
resolver.

+ 1
since security and going "off the corporate rail鈥 is essential, especially for OSS users, this should definitely be changed, to be 鈥減rivate by default鈥, even if it mean to leave the comfort-zone :wink:
thx. chris for pointing that out!

2.:Autostart: is generally disabled. If I want to reach people, they
have to have Jitsi running, but at the beginning I jumped over the
"Autostart on startup" option - so now, many users are simply only
reachable on Sky**. Bugger! I vouch that it is switched to "enabled" by
default, so that people are reachable. I don't see a downside for this,
just positives.

+1

3.: Automatically initiate private messaging: Also something I have
overseen at first. I'm going through all the "hassle" of setting up
encryption, but every time I have to be sure that I turn it on? I don't
think there's that much CPU/additional bandwidth involved that this
couldn't be turned on by default (as, when I don't have the contact
verified, it obviously works as a normal chat anyways)? If we can
encrypt, I think we should.

+1 again, "private by default"

4.: Logging: I have seen (at least on the Linux version) that logging is
enabled for all protocols by default. I think this is an unnecessary
risk(if also not big, but it's there - IP addresses etc. are stored) and
performance/disk usage factor (again, not big, but - how many users even
know what that data is?). If I do have an issue and know how to decipher
the logs, then I also know where to enable it...?!

I hope that's not too much in one post and thanks in advance for
consideration,
Cheers Chris

cheers
g眉nter

路路路

Am Donnerstag, 1. Mai 2014, 17:01:29 schrieb Jitsi Mailman:

---------- Forwarded message ----------


#4

Hey Chris,

Apologies for the delay. Comments inline.

From: Chris Kaspro <kaspro@web.de>
Date: Sun, Apr 27, 2014 at 7:07 AM
Subject: default settings - ever questioned...?!
To: users@jitsi.org

Hello everybody,
new here so first a quick and big thanks to this great piece of
software. Ever since Sky** was swallowed and now even changed it's
policies, I try to convince as many as friends as I can to use
Jitsi :slight_smile: Now, to the point:
For many users which are not as 'comfortable' with the computer, I
think some options on the default install should be changed - or
discussed :slight_smile: These are:
1.: !!Backup Resolver: Due to privacy reasons, I very much dislike
this "Google option" - now, by default, ALL THE TIME I start up
Jitsi / make a call / invite a friend, Google knows where I am and to
what domain I want to call

This is quite inaccurate.

1. The backup resolver only kicks in if your primary DNS server is misbehaving. If you have a valid DNS then queries to 8.8.8.8 would never be sent.

2. Such queries are only made when you are connecting to a specific account. Resolution for the actual addresses you are calling is handled by the server.

On the whole we are currently satisfied with the compromise that we get with 8.8.8.8 so we are unlikely to change this in the near future.

- as this option is enabled by default!

There are a lot of other, un- logged/filtered public DNS servers out
there (e.g. see http://www.wikileaks.org/wiki/Alternative_DNS) to
use. This is the a very critical issue for privacy reasons, and
probably most of the users haven't even seen that / looked up the
IP's of "your" Backup resolver.

I very much agree with this point. I think that many users of
jitsi are privacy-conscious and use it because they do not want to use
skype for privacy and security reasons. Those people also don't like to
provide information to a company that makes its money with the users
private data. Google can easily be avoided, so please do it.

Thanks Chris, I was not aware of this and switched to a different DNS
server, but this is something my not so tech-savy friends won't do.

Your not so tech-savy friends would probably be even more confused if connecting to their SIP or XMPP server fails with a "not found" message, which is what will happen if we remove the backup resolver.

2.:Autostart: is generally disabled. If I want to reach people, they
have to have Jitsi running, but at the beginning I jumped over the
"Autostart on startup" option - so now, many users are simply only
reachable on Sky**. Bugger! I vouch that it is switched to "enabled"
by default, so that people are reachable. I don't see a downside for
this, just positives.

Please open a ticket for this.

3.: Automatically initiate private messaging: Also something I have
overseen at first. I'm going through all the "hassle" of setting up
encryption, but every time I have to be sure that I turn it on? I
don't think there's that much CPU/additional bandwidth involved that
this couldn't be turned on by default (as, when I don't have the
contact verified, it obviously works as a normal chat anyways)? If we
can encrypt, I think we should.

I agree, encryption should automatically be enabled if possible.

We tried this but it created a lot of issues in cases where people were logged in from multiple locations. We don't currently have the time to address them all, so we disabled it.

4.: Logging: I have seen (at least on the Linux version) that logging
is enabled for all protocols by default. I think this is an
unnecessary risk(if also not big, but it's there - IP addresses etc.
are stored) and performance/disk usage factor (again, not big, but -
how many users even know what that data is?). If I do have an issue
and know how to decipher the logs, then I also know where to enable
it...?!

People with issues are often asked to generate log zips through Jitsi's user interface. That feature relies on the logs actually being there and has helped us to uncover a big number of issues. We are therefore unlikely to want to change this.

Note that those logs are automatically deleted three Jitsi runs later.

Thanks for your reports!
Emil

路路路

On 01.05.14, 18:27, Philipp 锟絙erbacher wrote:

On Thu, 1 May 2014 17:01:29 +0200 > Jitsi Mailman <mailman@sip-communicator.org> wrote:

---------- Forwarded message ----------

--
https://jitsi.org


#5

Hey Chris,
Apologies for the delay. Comments inline.

No worries, thanks for your answers - see comments inline, too

1.: !!Backup Resolver

This is quite inaccurate.

1. The backup resolver only kicks in if your primary DNS server is
misbehaving. If you have a valid DNS then queries to 8.8.8.8 would
never be sent.

What about the "Enable parallel DNS resolving" which is also enabled by
default?

2. Such queries are only made when you are connecting to a specific
account. Resolution for the actual addresses you are calling is
handled by the server.

So still, practically every time I start up my computer, Google get's my
ping...?

On the whole we are currently satisfied with the compromise that we
get with 8.8.8.8 so we are unlikely to change this in the near future.

Sorry to nag, but what would be the issue or potential issue in changing
the entries to the 'privacy friendly' ones mentioned?

Your not so tech-savy friends would probably be even more confused if
connecting to their SIP or XMPP server fails with a "not found"
message, which is what will happen if we remove the backup resolver.

Surely, removing is not a good option - but eventually changing them :slight_smile:

2.:Autostart: is generally disabled. If I want to reach people, they

Please open a ticket for this.

Will do, thanks!

3.: Automatically initiate private messaging

We tried this but it created a lot of issues in cases where people were
logged in from multiple locations. We don't currently have the time to
address them all, so we disabled it.

I understand, thanks for making it clear.

4.: Logging:

People with issues are often asked to generate log zips through Jitsi's
user interface. That feature relies on the logs actually being there
and has helped us to uncover a big number of issues. We are therefore
unlikely to want to change this.
Note that those logs are automatically deleted three Jitsi runs later.

I didn't know the "auto-delete" feature. That's a good compromise I
think - thanks.

Thanks for your reports!

Thanks for looking into it!
Cheers,
Chris