Acknowledgement sent
to Michael Stapelberg <stapelberg@debian.org>:
New Bug report received and forwarded. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Sun, 09 Apr 2017 12:09:04 GMT) (full text, mbox, link).
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: enable captive portal checking by default
Date: Sun, 09 Apr 2017 14:04:53 +0200
Source: network-manager
Version: 1.6.2-3
Severity: wishlist
Filing this issue to get the discussion started.
I recently noticed that NetworkManager as distributed by Debian does
not do captive portal checks by default. I.e., when using an Airport
WiFi (or similar), users are left in the dark about how to connect to
the internet. Given that more and more websites go https-only, users
will just be presented with a hard-to-understand error message about
security issues.
I think having NetworkManager detect captive portals is a clear
improvement in user experience.
In technical terms:
• You can check what NetworkManager thinks of your connectivity using
e.g. “nmcli networking connectivity”, which will result in either
“full” or “portal”.
• In Debian, regardless of the network type, I always see “full”,
because we don’t specify the connectivity.uri setting.
• Fedora ships the following configuration fragment to enable
connectivity checking:
https://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/contrib/fedora/rpm/20-connectivity-fedora.conf
• Not all frontends make use of the connectivity status. E.g.,
nm-applet does not seem to do anything, whereas I’m told that GNOME
shell will make use of the status.
Aside from the technicalities of enabling the feature, there are a
couple of open questions to answer:
1. Does enabling connectivity checking pose a privacy issue? No user
data is transmitted in the connectivity checks, but merely making
such a request implies that the user is running a Debian(-based)
operating system with NetworkManager.
2. I’m assuming the ideal URL to configure as connectivity.uri is a
Debian-specific URI (as opposed to re-using Fedora’s), and that URI
would likely point to a vhost configured on Debian’s static
mirroring infrastructure. Extrapolating from network-manager’s
71874 popcon votes and a default connectivity check interval of 300
seconds, we’d place an additional load of at least 239
requests/second on our infrastructure. Are we equipped to handle
this load now and in the future? Note that we could easily disable
the feature by removing the DNS record of a single-purpose vhost
for this feature (e.g. nm-connectivity-check.debian.org).
I’d be happy to talk to DSA to get point ② clarified, but I’m not
quite sure who can help with clarifying point ①. Any thoughts?
-- System Information:
Debian Release: 9.0
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386, armel, mipsel, arm64
Kernel: Linux 4.9.0-2-amd64 (SMP w/8 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>: Bug#859934; Package src:network-manager.
(Sun, 09 Apr 2017 12:51:02 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Biebl <biebl@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Sun, 09 Apr 2017 12:51:02 GMT) (full text, mbox, link).
[CCed the full message so Jeremy has all context]
Hi Michael
Am 09.04.2017 um 14:04 schrieb Michael Stapelberg:
>
> I recently noticed that NetworkManager as distributed by Debian does
> not do captive portal checks by default. I.e., when using an Airport
> WiFi (or similar), users are left in the dark about how to connect to
> the internet. Given that more and more websites go https-only, users
> will just be presented with a hard-to-understand error message about
> security issues.
>
> I think having NetworkManager detect captive portals is a clear
> improvement in user experience.
>
> In technical terms:
>
> • You can check what NetworkManager thinks of your connectivity using
> e.g. “nmcli networking connectivity”, which will result in either
> “full” or “portal”.
>
> • In Debian, regardless of the network type, I always see “full”,
> because we don’t specify the connectivity.uri setting.
>
> • Fedora ships the following configuration fragment to enable
> connectivity checking:
> https://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/contrib/fedora/rpm/20-connectivity-fedora.conf
>
> • Not all frontends make use of the connectivity status. E.g.,
> nm-applet does not seem to do anything, whereas I’m told that GNOME
> shell will make use of the status.
>
> Aside from the technicalities of enabling the feature, there are a
> couple of open questions to answer:
>
> 1. Does enabling connectivity checking pose a privacy issue? No user
> data is transmitted in the connectivity checks, but merely making
> such a request implies that the user is running a Debian(-based)
> operating system with NetworkManager.
>
> 2. I’m assuming the ideal URL to configure as connectivity.uri is a
> Debian-specific URI (as opposed to re-using Fedora’s), and that URI
> would likely point to a vhost configured on Debian’s static
> mirroring infrastructure. Extrapolating from network-manager’s
> 71874 popcon votes and a default connectivity check interval of 300
> seconds, we’d place an additional load of at least 239
> requests/second on our infrastructure. Are we equipped to handle
> this load now and in the future? Note that we could easily disable
> the feature by removing the DNS record of a single-purpose vhost
> for this feature (e.g. nm-connectivity-check.debian.org).
>
> I’d be happy to talk to DSA to get point ② clarified, but I’m not
> quite sure who can help with clarifying point ①. Any thoughts?
2) is already solved, we have http://network-test.debian.org/nm, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729783
$ cat /etc/NetworkManager/conf.d/connectivity.conf
[connectivity]
uri=http://network-test.debian.org/nm
Something like this should already work today in Debian.
This feature could be considered "phoning-home", so I'm a bit concerned
in that regard indeed and do not want to enable it unconditionally and
globally for everyone. If this config is shipped in a separate package,
which can be installed (and uninstalled) on demand (and which e.g. the
gnome-core or gnome meta package could depend on), would be a reasonable
compromise I guess.
Fedora named this package NetworkManager-config-connectivity-fedora,
shipping /usr/lib/NetworkManager/conf.d/20-connectivity-fedora.conf. The
package is installed by default in a F25 workstation desktop.
Afair, Ubuntu had/has similar plans. Jeremy, can you comment on that?
Regards,
Michael
--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>: Bug#859934; Package src:network-manager.
(Sun, 09 Apr 2017 23:09:06 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Biebl <biebl@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Sun, 09 Apr 2017 23:09:06 GMT) (full text, mbox, link).
Am 09.04.2017 um 14:47 schrieb Michael Biebl:
> This feature could be considered "phoning-home", so I'm a bit concerned
> in that regard indeed and do not want to enable it unconditionally and
> globally for everyone. If this config is shipped in a separate package,
> which can be installed (and uninstalled) on demand (and which e.g. the
> gnome-core or gnome meta package could depend on), would be a reasonable
> compromise I guess.
>
> Fedora named this package NetworkManager-config-connectivity-fedora,
> shipping /usr/lib/NetworkManager/conf.d/20-connectivity-fedora.conf. The
> package is installed by default in a F25 workstation desktop.
>
> Afair, Ubuntu had/has similar plans. Jeremy, can you comment on that?
I remember that I discussed that briefly with Jeremy on IRC. Such a
separate binary package (even if tiny) seems like an approach to me
which I'd be fine with.
I found this after a bit of searching:
https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/997200https://lists.ubuntu.com/archives/ubuntu-devel/2017-February/039696.html
Next step would be to decide, how we name things, i.e. if we choose
different names for Ubuntu and Debian, like
network-manager-config-connectivity-debian and
network-manager-config-connectivity-ubuntu (quite the mouthful)
or an unbranded name like
network-manager-config-connectivity, but with different content
depending on the distro.
Any preferences?
--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>: Bug#859934; Package src:network-manager.
(Sun, 09 Apr 2017 23:24:02 GMT) (full text, mbox, link).
Acknowledgement sent
to Jeremy Bicha <jbicha@ubuntu.com>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Sun, 09 Apr 2017 23:24:02 GMT) (full text, mbox, link).
Cc: Michael Stapelberg <stapelberg@debian.org>, 859934@bugs.debian.org
Subject: Re: [Pkg-utopia-maintainers] Bug#859934: enable captive portal
checking by default
Date: Sun, 9 Apr 2017 19:20:38 -0400
On Sun, Apr 9, 2017 at 8:47 AM, Michael Biebl <biebl@debian.org> wrote:
> Afair, Ubuntu had/has similar plans. Jeremy, can you comment on that?
I proposed this for Ubuntu GNOME 17.04. There was interest in enabling
the connectivity check in the default Ubuntu install too, but there
wasn't enough time to handle this well before 17.04.
Mathieu Trudel-Lapierre thought it would be better for users if there
was a handy toggle switch (likely in gnome-control-center's Privacy
panel) before this feature was rolled out. At least for Ubuntu
Desktop, it doesn't really matter then whether the implementation is a
separate package or if gnome-control-center writes the config to an
appropriate file itself.
The tracking bug for that is https://bugzilla.gnome.org/737362
Thanks,
Jeremy
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>: Bug#859934; Package src:network-manager.
(Fri, 26 May 2017 15:33:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Biebl <biebl@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Fri, 26 May 2017 15:33:04 GMT) (full text, mbox, link).
Hi there
On Mon, 10 Apr 2017 01:07:52 +0200 Michael Biebl <biebl@debian.org> wrote:
> Am 09.04.2017 um 14:47 schrieb Michael Biebl:
>
> > Fedora named this package NetworkManager-config-connectivity-fedora,
> > shipping /usr/lib/NetworkManager/conf.d/20-connectivity-fedora.conf. The
> > package is installed by default in a F25 workstation desktop.
> >
> > Afair, Ubuntu had/has similar plans. Jeremy, can you comment on that?
>
> I remember that I discussed that briefly with Jeremy on IRC. Such a
> separate binary package (even if tiny) seems like an approach to me
> which I'd be fine with.
>
> I found this after a bit of searching:
> https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/997200
> https://lists.ubuntu.com/archives/ubuntu-devel/2017-February/039696.html
>
> Next step would be to decide, how we name things, i.e. if we choose
> different names for Ubuntu and Debian, like
> network-manager-config-connectivity-debian and
Unless someone complains loudly, I intend to go ahead using the package
name network-manager-config-connectivity-debian.
The package will provide
/usr/lib/NetworkManager/conf.d/20-connectivity-debian.conf
Enabling the feature is then as simple as installing the package,
disabling it can be achieved by uninstalling it. That's why I don't want
to install the file in /etc/NetworkManager/conf.d, as we then would have
the known issue of conffiles not being removed on "remove".
It is planned that at least the gnome (or gnome-core) meta package will
pull in this package. Other desktop environments which provide captive
portal detection can do the same.
I guess we'll make that a Recommends, so users can uninstall the package
if they so prefer (e.g. due to privacy concerns)
> Mathieu Trudel-Lapierre thought it would be better for users if there
> was a handy toggle switch (likely in gnome-control-center's Privacy
> panel) before this feature was rolled out. At least for Ubuntu
> Desktop, it doesn't really matter then whether the implementation is a
> separate package or if gnome-control-center writes the config to an
> appropriate file itself.
>
> The tracking bug for that is https://bugzilla.gnome.org/737362
This seems like a nice alternative solution which apparently is kinda
stuck though atm.
So for the time being a separate config package it is.
If we have support in gnome-control-center one day to write out that
config snippet (or NM providing a D-Bus API for setting that), we can
revisit that decision and drop the package again.
Regards,
Michael
--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
Merged 838711859934
Request was from Michael Biebl <biebl@debian.org>
to control@bugs.debian.org.
(Fri, 26 May 2017 15:51:05 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>: Bug#859934; Package src:network-manager.
(Fri, 26 May 2017 16:09:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Biebl <biebl@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Fri, 26 May 2017 16:09:04 GMT) (full text, mbox, link).
Am 26.05.2017 um 17:31 schrieb Michael Biebl:
> Unless someone complains loudly, I intend to go ahead using the package
> name network-manager-config-connectivity-debian.
>
> The package will provide
> /usr/lib/NetworkManager/conf.d/20-connectivity-debian.conf
I pushed
https://anonscm.debian.org/cgit/pkg-utopia/network-manager.git/commit/?h=experimental&id=292772f681
Feedback welcome. Especially regarding the package description.
--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>: Bug#859934; Package src:network-manager.
(Wed, 31 May 2017 09:39:02 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Stapelberg <stapelberg@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Wed, 31 May 2017 09:39:02 GMT) (full text, mbox, link).
Thank you very much for working on this.
One nit regarding the package long description: we should mention the
privacy implications of this package. My suggestion:
No user data is transmitted in the connectivity checks, but merely
contacting the Debian connectivity check servers reveals that the user is
running a Debian(-based) operating system with NetworkManager.
On Fri, May 26, 2017 at 6:04 PM, Michael Biebl <biebl@debian.org> wrote:
> Am 26.05.2017 um 17:31 schrieb Michael Biebl:
> > Unless someone complains loudly, I intend to go ahead using the package
> > name network-manager-config-connectivity-debian.
> >
> > The package will provide
> > /usr/lib/NetworkManager/conf.d/20-connectivity-debian.conf
>
> I pushed
> https://anonscm.debian.org/cgit/pkg-utopia/network-manager.git/commit/?h=
> experimental&id=292772f681
>
> Feedback welcome. Especially regarding the package description.
>
> --
> Why is it that all of the instruments seeking intelligent life in the
> universe are pointed away from Earth?
>
>
--
Best regards,
Michael
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>: Bug#859934; Package src:network-manager.
(Wed, 31 May 2017 10:09:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Biebl <biebl@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Wed, 31 May 2017 10:09:04 GMT) (full text, mbox, link).
Am 31.05.2017 um 11:36 schrieb Michael Stapelberg:
> One nit regarding the package long description: we should mention the
> privacy implications of this package. My suggestion:
>
> No user data is transmitted in the connectivity checks, but merely
> contacting the Debian connectivity check servers reveals that the user
> is running a Debian(-based) operating system with NetworkManager.
Nod. Will add this paragraph. Thanks for the suggestion.
--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
Reply sent
to Michael Biebl <biebl@debian.org>:
You have taken responsibility.
(Fri, 09 Jun 2017 14:03:07 GMT) (full text, mbox, link).
Notification sent
to Michael Stapelberg <stapelberg@debian.org>:
Bug acknowledged by developer.
(Fri, 09 Jun 2017 14:03:07 GMT) (full text, mbox, link).
Debbugs is free software and licensed under the terms of the GNU General
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.