G8 Privacy stance
- Area
- G — Cross-cutting UX
- Audience
- both
- Kind
- feature
- Status
- accepted
- Maturity
- building
- Labels
- security
The feature in the specification · Read at
Requirements
lemonfiber MUST NOT collect or transmit usage data, analytics, or crash reports.
- locked by
- 0.10.0 met
- recorded done
- lemonfibercrates/lemonfiber/tests/architecture/nothing_reports_on_you.rsdeny.tomlcrates/lemonfiber/tests/integration/where_a_request_goes.rsCargo.lockcrates/lemonfiber/tests/architecture/where_the_outside_world_is_reached.rs
- cited by
- lemonfiber@e6e430186blemonfiber@0fc2585cd0lemonfiber-web@b8f30d1922lemonfiber-web@041ad0a774
lemonfiber MUST NOT generate or transmit any persistent installation identifier.
Every outbound request lemonfiber makes MUST have a documented purpose and MUST be enumerable by the operator.
- locked by
- 0.10.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/outbound.rscrates/lemonfiber-core/src/config/reaching.rs
- cited by
- lemonfiber@2a1472c24alemonfiber@01579a458alemonfiber@8d312584bflemonfiber@7b46a9bc7alemonfiber@ae1d031f8alemonfiber@e8792d57cdlemonfiber-web@0a0b9aecd7lemonfiber-web@a3ca9e06e2
The update check MUST transmit no identifier, configuration, or usage information.
All outbound requests MUST be individually disableable, and the consequence of disabling each MUST be stated.
- locked by
- 0.10.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/outbound.rscrates/lemonfiber-core/src/config/reaching.rs
- cited by
- lemonfiber@2a1472c24alemonfiber@01579a458alemonfiber@8d312584bflemonfiber@ae1d031f8alemonfiber@e8792d57cdlemonfiber@4ccc9f6bf1lemonfiber-web@0a0b9aecd7lemonfiber-web@a3ca9e06e2
Support bundles, backups and logs MUST remain local and MUST NOT be transmitted automatically.
- locked by
- 0.10.0 met
- recorded done
- lemonfibercrates/lemonfiber/tests/architecture/nothing_leaves_on_its_own.rs
- cited by
- lemonfiber@0fc2585cd0
lemonfiber MUST disclose what it stores locally, where, and why.
- locked by
- 0.10.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/stored.rscrates/lemonfiber-core/src/stored/run.rscrates/lemonfiber-core/src/config/paths.rscrates/lemonfiber-ports/src/filesystem.rscrates/lemonfiber/tests/architecture/nothing_is_kept_beside_the_configuration_unsaid.rs::every_file_kept_beside_the_configuration_is_one_the_layout_discloses
- cited by
- lemonfiber@78b6a30871lemonfiber@e8792d57cdlemonfiber-web@8f5b1c1ce6
Uninstall MUST remove all locally stored lemonfiber data.
An automated test MUST verify that no unexpected outbound connection occurs.
Repeatedly failing update checks MUST stop being attempted and MUST NOT report noisily.
Dependencies introducing telemetry MUST be rejected, and dependency review MUST check for it.
Requests made by stack services MUST be documented as theirs, not attributed to lemonfiber.
Operator visibility of household watch history MUST be disclosed to household members.
- locked by
- 0.11.0 met
- recorded done
- lemonfibercrates/lemonfiber/src/render/invitation.rs
- cited by
- lemonfiber@30c8d55110
Outbound requests MUST be logged locally so the operator can verify what was sent.
The account of what leaves this machine MUST distinguish lemonfiber's own requests, the stack services' own requests, and requests lemonfiber makes on an installed plugin's behalf, and MUST attribute each of the third kind to the plugin that declared it.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/outbound.rscrates/lemonfiber-core/src/outbound/behalf.rscrates/lemonfiber-core/src/outbound/theirs.rscrates/lemonfiber/src/render/outbound.rscontract/web-api/defs/OnBehalf.jsoncrates/lemonfiber-core/src/outbound/behalf/tests.rs::a_host_a_plugins_recipes_declare_is_sent_to_on_its_behalf_and_one_inside_the_stack_is_notcrates/lemonfiber-core/tests/integration/outbound.rs::what_a_plugin_brings_is_in_the_account_and_says_it_is_the_pluginscrates/lemonfiber/src/render/outbound/tests.rs::what_lemonfiber_sends_for_a_plugin_names_the_plugin_apart_from_the_stacks_requests
- cited by
- lemonfiber@cc1b83cf00lemonfiber-companion@f5189d5071
A plugin's declared reach MUST be refusable on its own, the consequence MUST be stated as what stops working, and a refused reach MUST be reported as nothing having been asked rather than as a failure of the destination.
- locked by
- 0.18.0 open
The test that verifies no unexpected outbound connection MUST measure against lemonfiber's documented set together with the declared reach of installed plugins, and MUST separately verify that with no plugin installed the set is exactly the documented one.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/tests/integration/outbound.rs::a_whole_diagnosis_reaches_nowhere_the_operator_was_not_told_aboutcrates/lemonfiber-core/tests/integration/outbound.rs::a_diagnosis_with_a_plugin_installed_is_measured_against_its_declared_reach_too
- cited by
- lemonfiber@cc1b83cf00
lemonfiber MUST NOT transmit anything on a plugin's behalf that the operator has not approved, and approval MUST be of the specific value and destination rather than of the installation as a whole.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/plugin/running/bounding.rscrates/lemonfiber-core/src/plugin/recipes.rscrates/lemonfiber-core/src/app/plugins/offering.rscrates/lemonfiber-core/src/plugin/running/bounding/tests.rs::outside_a_value_needs_its_pair_and_its_approvalcrates/lemonfiber-core/src/plugin/running/tests/holding.rs::a_value_outside_without_its_approval_is_withheldcrates/lemonfiber-core/src/plugin/running/tests/holding.rs::an_answer_goes_elsewhere_only_by_an_approved_releasecrates/lemonfiber-core/src/app/plugins/offering/tests.rs::a_pair_not_approved_is_refused_by_namecrates/lemonfiber-core/src/app/plugins/tests/demanding.rs::an_approval_from_another_act_and_a_moved_offer_are_refused
- cited by
- lemonfiber@78b6a30871