Calibre connecting to web site

[w_mark]

A recent post on the Calibre web site hinted that every use of Calibre is connecting to and sending information back to the developer of Calibre.

First question on this - what port(s) is this using?

Second question - as the only licence displayed on the installaiton of Calibre is the GNU licence, is it stated anywhere that Calibre is doing this i.e. sending data of any type back to the developer?

And third - exactly what is being sent back? Obviously country (or IP to determine this) from the Calibre web site posted article) - but what else?
Mark

[kovidgoyal]

calibre is open source, read the source to find out what it is sending to me.

[theducks]

Originally Posted by w_mark

A recent post on the Calibre web site hinted that every use of Calibre is connecting to and sending information back to the developer of Calibre.

First question on this - what port(s) is this using?

Second question - as the only licence displayed on the installaiton of Calibre is the GNU licence, is it stated anywhere that Calibre is doing this i.e. sending data of any type back to the developer?

And third - exactly what is being sent back? Obviously country (or IP to determine this) from the Calibre web site posted article) - but what else?
Mark

Calibre also checks for the latest version on connect

[user_none]

http://status.calibre-ebook.com/ details what is sent.

[w_mark]

Originally Posted by user_none

http://status.calibre-ebook.com/ details what is sent.

Thanks - this is what I referred to originally. The response 'read the source' though is - well not sure of the best way to say what I think.

Anyone that isn't up front with this type of data collection usually has some ulterior motive which makes me ask 'Would I trust this person?'

And the answer to that quesiton would usually be 'No'.

[DoctorOhh]

Originally Posted by w_mark

Thanks - this is what I referred to originally. The response 'read the source' though is - well not sure of the best way to say what I think.

This isn't a commercial product it is open source. The very nature of the software being open source means that this is indeed the best answer. How many times have we run into commercial, closed, products giving the end user all kinds of lip service about what they collect only to hear later (I think I read stories on 3 or 4 companies in the last month) that they either lied or their marketing departments didn't have a clue and were exposed as collecting all sorts of info and storing it or selling it.

Originally Posted by w_mark

Anyone that isn't up front with this type of data collection usually has some ulterior motive which makes me ask 'Would I trust this person?'

And the answer to that quesiton would usually be 'No'.

You can't be any more up front than putting your source code out there for everyone to check. But feel free to continue to trust the big corporations that give you the lip service that makes you feel better.

[w_mark]

Not talking about commercial companies here - this is - as you say - an open source program that is collecting informaiton and not being honest and upfront about it. Sure - go read the source code - have you or anyone else here done that?

I asked a simple question as to what is being transferred. For whatever reason the developer won't give an open and honest answer. Therefore I ask - out in the open - what else is being collected and for what purpose?

So now the reverse question to you - do YOU trust big companies that collect information without telling you? I gather the answer to that will be a very definate no - so why defend anyone using open source doing the same thing? The bottom line here is that there is no difference whether you are using a commercial package or open source - if the software developer is collecting informaiton he or she should come out and say so and not hide behind a 'read the code, it is open source after all'.

Just what does Calibre collect information for and just what is being collected - how about an open and honest answer if there is nothing to hide?

[user_none]

The point Kovid and dwanthny trying to make is it doesn't matter what answer your given. It can easily be a lie (often time with commercial software it is). The only way for you to 100% know what is being collected is to audit the source code yourself.

[DoctorOhh]

Originally Posted by w_mark

Sure - go read the source code - have you or anyone else here done that?

Yes, there have easily been dozens of programmers through the source code in the last year. As an open source project the more popular the program the higher degree of confidence you can have that there is nothing below board going on.

Originally Posted by w_mark

I asked a simple question as to what is being transferred. For whatever reason the developer won't give an open and honest answer. Therefore I ask - out in the open - what else is being collected and for what purpose?

It is safe to say that if calibre was collecting any more info than needed to function this board would be replete with examples of what, where and how and folks demanding that the practice stop. Your simple question is fine but born out of an ignorance of the sheer size and volume of the community outcry that happens when any open source project steps across that line.

Originally Posted by user_none

The point Kovid and dwanthny trying to make is it doesn't matter what answer your given. It can easily be a lie (often time with commercial software it is). The only way for you to 100% know what is being collected is to audit the source code yourself.

Thanks user_none I thought what I was saying was obvious, I guess not.

[tEmrich]

Originally Posted by user_none

The point Kovid and dwanthny trying to make is it doesn't matter what answer your given. It can easily be a lie (often time with commercial software it is). The only way for you to 100% know what is being collected is to audit the source code yourself.

I totally understand Kovid's point. Nevertheless, a friendly answer to this question would have been nice, I think. Especially a hint to http://status.calibre-ebook.com/ which seems to be a really good overview.

[kovidgoyal]

Your question implies you dont trust calibre. Which in turn implies you dont trust the people that make and release it. What on earth is the point of asking them what calibre does if you dont trust them. Read the source code, or use a network packet sniffer.

And fortunately, I am not a corporate PR department so if someone implies on a public forum that I am doing something underhanded I feel absolutely no obligation to be polite to that person.

[tEmrich]

Originally Posted by kovidgoyal

And fortunately, I am not a corporate PR department so if someone implies on a public forum that I am doing something underhanded I feel absolutely no obligation to be polite to that person.

Sorry, I've not meant to offend you. But I still think the question wasn't meant as offensive as it is interpreted. Maybe I'm wrong - that's just how I interpreted this discussion

[kovidgoyal]

Originally Posted by tEmrich

Sorry, I've not meant to offend you. But I still think the question wasn't meant as offensive as it is interpreted. Maybe I'm wrong - that's just how I interpreted this discussion

You certainly haven't offended me, the OP has. He claims to have read the status page where it states in plain English "Only this ID and the IP address of the computer is stored, no other identifying information is collected. "

And he still feels the need to post asking "what other information calibre collects".

[w_mark]

Having thought about it, yes you are correct - I don;t trust you. Your original answer should have been a straight forward 'This is what is being sent and collected' instead you skirted the question thereby laying a seed of doubt as to what you are doing.

Regardless of whether the informaiton is in the source code or not, the fact you do NOT state you are doing this in the installation of Calibre (or, apart from that stat page) shows that you are prepared to be untruthful in your implementation.

As others here have alluded to, if this were a commercial company people would be all over you like a rash for doing this (collecting data without informing your 'customers) - so why are you any different? Just because you hide behind 'open source' does not give you any protection whatsoever.

Final point to those saying 'read the source' - he is not distributing source code, he is distributing a compiled and working program - once it has bene compiled you have absolutely no idea what changes or additional code he has made to the program over and above the published source code.

Which is why, with no straight answer coming back, the question is still 'what else is Calibre collecting?'

[theducks]

Originally Posted by w_mark

Having thought about it, yes you are correct - I don;t trust you. Your original answer should have been a straight forward 'This is what is being sent and collected' instead you skirted the question thereby laying a seed of doubt as to what you are doing.

Regardless of whether the informaiton is in the source code or not, the fact you do NOT state you are doing this in the installation of Calibre (or, apart from that stat page) shows that you are prepared to be untruthful in your implementation.

As others here have alluded to, if this were a commercial company people would be all over you like a rash for doing this (collecting data without informing your 'customers) - so why are you any different? Just because you hide behind 'open source' does not give you any protection whatsoever.

Final point to those saying 'read the source' - he is not distributing source code, he is distributing a compiled and working program - once it has bene compiled you have absolutely no idea what changes or additional code he has made to the program over and above the published source code.

Which is why, with no straight answer coming back, the question is still 'what else is Calibre collecting?'

There are 2.8 Million Calibre users that don't have your problem.
If you don't like the program, UNINSTALL and leave us in peace please.