[arch-dev-public] [draft] pkgstats round two: take your vote and help improving Arch

[Pierre Schmitz]

On Thu, 23 Sep 2010 15:25:46 +0200, Dieter Plaetinck
<dieter at plaetinck.be> wrote:
> On Thu, 23 Sep 2010 19:55:45 +0800
> Ray Rashif <schiv at archlinux.org> wrote:
> 
>> On 23 September 2010 19:34, Dieter Plaetinck <dieter at plaetinck.be>
>> wrote:
>> > Shouldn't we add something like "all information is anonymous, we
>> > collect no information that can identify you" or something?
>>
>> Good point. In that case, a revision of the above:
>>
>> Two years ago, we introduced <a
>> href="http://www.archlinux.org/news/pkgstats-contribution-was-never-that-easy/">pkgstats</a>.
>> This time, after a major revamp, we are re-introducing it to you!
>>
>> Contributing is as easy as installing the package - a weekly cron job
>> will take care of the rest. You will be sending us a list of packages
>> installed on your system, along with the architecture and mirror you
>> use. This information is anonymous and cannot be used to identify you,
>> but it will help us prioritize our efforts and make Arch even better.
>> So, go ahead and spread the word!
>>
>> For more details see pkgstats -h or just read the simple source code.
>> You can view the collected data at the <a
>> href="https://www.archlinux.de/?page=Statistics">Statistics page</a>.
> 
> Looks better.
> 
> Btw, about the "cannot be used to identify you" thing; what was
> ultimately decided on identification of a system?
> I just checked the pkgstats 2.1 code, and I don't see anything about
> ip/disk UUID/.. whatever was decided.
> 
> Dieter

I wont add any tracking information or collect more data than really
needed. To give an overview:

Data that are sent by pkgstats:
* list of installed packages without version numbers
* the architecture
* the mirror used (without any username/password scheme)
* the version of pkgstats in use

Data that are saved on the server:
* sha1 hash of the IP
* number of packages submitted
* package occurrence is counted but not connected to the IP hash
* time of submission
* Country of the sender IP (determined by geoIP)

Submissions are limited to 10 by IP and day. (note: we only save the
hash of an ip though)

I hope this makes everything clear.

-- 
Pierre Schmitz, https://users.archlinux.de/~pierre