Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
While Ubuntu’s upcoming phone and tablet dominate the headlines, an existing controversy is threatening to flare up again as the 13.04 release nears. The display of Amazon search results in the dash, which first became an issue in the 12.10 release, is erupting again as Ubuntu plans to extend the feature to dozens of other websites. The company also plans to add direct payments from the dash and more suggestions.
Ubuntu has been displaying music search results in the dash for several releases. However, the music results were drawn from Ubuntu’s own music store, and those who use the dash to search for applications on their hard drive may have never noticed them.
What changed in the 12.10 release was that, as a result of an affiliate deal, Amazon results appeared by default when users did even a local search. The results are forwarded to Ubuntu, which passes them on to Amazon.
Security and Privacy Concerns
Ubuntu responded to user concerns about privacy by promising that data would be encrypted during transmission, and by adding to the system settings a control to toggle off the results and data collection. Users can also remove the feature with the command sudo apt-get remove unity-lens-shipping. However, these changes only partially answered concerns that many expressed.
To start with, while the affiliate deal potentially benefits Ubuntu, it’s much less obvious how the feature benefits users. Opening the dash to search is not noticeably more convenient than opening a Web browser. In fact, the default behavior is considerably less convenient when all you want is to search for a locally installed app, because most of what is displayed is irrelevant to you.
Moreover, while one of the points of Ubuntu’s Unity interface is supposed to be its elegance and freedom from clutter, many of the changes created by these external results work against these design principles. In the nightly release of 13.04 that I am using as a reference, three of eleven icons on the launcher are for commercial services — or three and a half if you include the Ubuntu Software Centre, which includes commercial items.
Similarly, of the six lenses for filtering searches on the dash, all but five include commercial results by default. Although it is an exaggeration to claim, as some critics have, that Ubuntu is degenerating into adware, the point is understandable. At best, Ubuntu appears to be imitating one of the more unpleasant features of Windows, one that most Linux users are glad to have escaped.
However, by far the greatest concerns center on security and privacy. Any competent sysadmin knows that it is a basic premise of security to have unnecessary features shut down by default and enabled only as needed. For this reason, to ship with the feature enabled is simply poor security.
Anyone who is security conscious might also criticize using Ubuntu as an unnecessary go-between. From an accounting viewpoint, that might make sense, but from a security perspective, the unnecessary distribution of private information is always something to be avoided. The problem is not that users have any particular reason to mistrust Ubuntu or its commercial arm Canonical; it is that the practice violates basic security principles.
Nor do Ubuntu’s legal notice or privacy statements do anything to reassure users. The legal notice about searches in the dash (available from /usr/share/unity/6/searchingthedashlegalnotice.html on a 13.04 Ubuntu system) makes clear that Canonical reserves the right to share information, including your IP Address, with third parties.
Similarly, Canonical’s privacy policy includes mention of the Marketo Munchkin cookie that it uses. According to the description in the privacy policy:
Marketo’s cookie allows us to track repeated visits to the website, and link each visit to the information voluntarily provided by the visitor. For example, if the visitor is asked to provide us with their name, company name and email address, we will know the identity of the visitor when they visit the site at a later date, or when we send them email.
Admittedly, the privacy policy also makes clear that Canonical attempts to handle this information securely. On the Canonical blog, Cristian Parrino, vice president online services stated, “we automatically anonymize user logs and that information is never available to the teams delivering services to end users.”
However, the IP addresses that may be shared could, in many cases, be enough to identify an otherwise anonymous person. At any rate, given that both the legal notice and privacy policy are subject to change “at Canonical’s sole discretion,” such statements are less than reassuring. In the end, Ubuntu and Canonical are asking users to trust their unnamed representatives. While there may not be a particular reason to distrust them, no particular reason exists to trust them, either.
Problems with Canonical’s Responses
To a degree, Canonical has responded credibly to such concerns. For instance, the ability to turn off the external search results might never have been added except for early criticism of the 12.10 release.
But at the same time, parts of Canonical’s response have only made the concerns seem more practical and less like paranoia about the hypothetical. These parts may reflect a misjudgment among Canonical’s executives about the company’s popularity, or perhaps an impatience with what must sometimes seem like an endless barrage of criticism. But whatever the reason, they do nothing to foster the trust that Canonical expects from its users.
Soon after the controversy began in September 2012, Shuttleworth responded to initial comments on his blog. However, instead of explaining how the changes would improve the desktop, he simply stated that it would, hinting ominously that, without it, Ubuntu “won’t be relevant.”
Much of the rest of his blog was a collection of non-sequiturs like “It makes perfect sense to integrate Amazon search results in the Dash, because the Home Lens of the Desktop should let you find *anything* anywhere” and verbal quibbles such as “we’re not putting ads in Ubuntu. We’re integrating online scope results into the home lens of the dash.”
As for the issue of trust, Shuttleworth wrote:
Don’t trust us? Erm, we have root. You do trust us with your data already. You trust us not to screw up on your machine with every update. You trust Debian, and you trust a large swathe of the open source community. And most importantly, you trust us to address it when, being human, we err.
No doubt he was trying to be humorous, but the combination of the cavalier tone and the false analogy between basic security and open source development models mean that his response utterly failed to offer the reassurance that he was most likely intending.
Efforts by community manager Jono Bacon were equally ineffective. Bacon’s first effort was an unusually rambling entry about how operating systems were for both producers and consumers, and the external search results were a feature for consumers. It ended with an insistence that Canonical needed to make money on Ubuntu in order to continue to improve it — a point that few critics would contest, which makes you wonder why he brought it up.
Bacon did do a thorough job of keeping his readers informed about improvements to the feature. However, in response to Richard Stallman’s criticism, in December 2012 he wrote an evasive-sounding entry in which he claimed, “I am not here to convince you” (making you wonder why he was writing at all) and urging “respectful dialogue” while calling Stallman’s comments “childish” and “FUD.” The inconsistency was so obvious that Bacon saw it himself, and, to his credit, he apologized in another entry a few days later — although in doing so, he managed to imply that Stallman’s comments were still childish.
I interpret these responses as well intentioned, and not as efforts at manipulation or deceit. But they should have been vetted by someone with marketing experience before being published. They omitted many of the concerns, which not only gave the appearance of avoiding the issues, but of making light of them. Consequently, the concerns they tried to address looked more justified than ever.
From an Issue to a Position Statements
The critiques gained even more credibility when they were taken up by non-profit organizations that focus on security and privacy.
The first was made by Micah Lee of the Electronic Frontier Foundation. After summarizing the issues, Lee concluded his blog entry with a list of demands. Online search results, he wrote, should be turned off by default. Canonical should explain in more detail how the feature works and give users more options for controlling it. Lee ends with a plea to Ubuntu and Canonical to “please make sure that you respect your users’ privacy and security.”
To date, Canonical has given a few more details about how the feature works, but it ignored Lee’s other demands — and, by extension, his final plea as well.
An even more widely reported response came from Richard Stallman. Referring to search in the dash as “spyware” of the sort more often associated with proprietary operating systems than with free software, Stallman suggests that simply turning it off is not enough.
Instead, Stallman states that Ubuntu has let the rest of the free software community down by lowering its standards. “It behooves us to give Canonical whatever rebuff is needed to make it stop this,” Stallman said. “Any excuse Canonical offers is inadequate; even if it used all the money it gets from Amazon to develop free software, that can hardly overcome what free software will lose if it ceases to offer an effective way to avoid abuse of the users.”
Stallman closed by calling for a boycott against Ubuntu. “Tell people that Ubuntu is shunned for spying,” he concluded, adding that everyone should also mention that it contains non-free software as well.
Two months later, no sign of a boycott exists — but, most likely, only because those likely to listen to Stallman were already unlikely to use Ubuntu. Still, the widespread reporting of his views was the sort of publicity that most companies would prefer to avoid. After all, being called to task by two of the most trusted non-profits in the field is hardly something that any company in open source would care to face.
Making a Small Crisis Worse
Since Stallman’s response, the concerns about Ubuntu’s search functionality have quieted somewhat. However, there has been a steady trickle of discussion, and the flood seems to be returning now that the 13.04 release candidates are about a month away. The 13.04 release is likely to be seen as Ubuntu’s response to criticisms, and it is almost frighteningly easy to interpret the expansion of the feature as total disregard for users’ concerns.
The security and privacy issues involved matter in themselves. However, there is also the morbid fascination of watching a company mismanaging a PR crisis into an even greater one.
Ubuntu can undoubtedly weather this crisis, especially if it can keep the media focused on the promised phone and tablet. Still, when I compare the promise that Ubuntu seemed to have when it was founded to its handling of this community crisis, I can’t help thinking, Something has gone wrong, and no one in Canonical is quite sure what or why.
