Privacy concerns

[rzgarespo]

"...Privacy is no longer optional. It's essential. AnduinOS is designed to gather nothing from you. We don't track you. We don't profile you. We don't target you. You remain anonymous to the system." And yet, by default, GPS tracking is active! No version of Debian-based distros has left the GPS on by default. It is opt-in, not opt-out. So go |=u(|< yourself!

Additionally, you have changed the Firefox homepage to your website, which exposes users' IP addresses, geolocation, device profiles, etc., by using Google Analytics, which is retrievable by you. The real question is, why would you lie about this?

[Anduin2017]

AnduinOS does not come with any built-in tracking technology by default. This is not a lie—you can review the complete source code. In fact, I have absolutely no idea how many people are using this OS.

As for the homepage, I believe the first thing most people do after installing the system is to change it. Setting a default homepage is not my way of tracking the OS's usage; rather, I need to know whether real humans are downloading the OS or just bots. This requires running a piece of JavaScript. Of course, if you dislike Google, I could write a piece of JavaScript to achieve the same result. I don't think counting user numbers on the web disrespects privacy.

When I talk about respecting privacy, I mean I have no authority to execute any code on users' devices. I cannot know what users are doing with this OS, nor do I require them to update to new versions. I don't believe I've lied about any of this.

As for the Location Service, I didn’t even pay much attention to it because it’s provided by Mozilla, not me. It’s a prerequisite for applications on the system to access location data and display weather information correctly. If you’re concerned about it, you can turn it off. If the community raises significant concerns, I can disable it by default. It’s not a big deal.

[Anduin2017]

https://gitlab.aiursoft.cn/anduin/anduinos/-/commit/05af4619c5a290abed714706966d7d90418066e3

[rzgarespo]

I believe the first thing most people do after installing the system is to change it. Setting a default homepage is not my way of tracking the OS's usage; rather, I need to know whether real humans are downloading the OS or just bots.

Well, you should have added your website as a bookmark, not as a homepage, then it would have been in line with your privacy statements. I use Google Analytics in combination of cPanel analytics features on my website and frequently scan my visitors' IP addresses for open ports using nmap. Occasionally, they are running XAMPP (development environment, MySQL backups, etc.), network storage devices with default credential logins, and many are not protected by double NAT or robust firewalls. Therefore, I believe implementing Zero Trust principles is essential, rather than relying on personal opinions about what is important.

[Anduin2017]

I completely agree with you. In fact, I also use plugins to block trackers on webpages. I’ve noticed that the data collected by Google Analytics is far less than the actual number of visitors, since so many people use browser plugins to achieve this. However, the only reason I initially used Google Analytics was simply out of laziness. This website consists purely of static pages—I built it in a day using a bunch of HTML files. I just wanted to temporarily measure its influence, so I used Google Analytics. If you insist on removing it, that’s totally fine for me.

That said, when it comes to preventing tracking, I personally believe these browser plugins don’t really help much. When you establish a TCP connection to the server on the other end, unless you’re using the Tor browser and the onion network, they can definitely figure out your IP address.

Moreover, there are not that many IPv4 addresses in the entire world (with modern computing power, you can scan the entire internet in just a few hours). For those who expose critical services to the public IPv4 network using default passwords (I’ve even have done this myself in the past), I guess they’ve already been attacked by crackers to the point of no return. For people with no sense of security, being compromised is just a matter of time. You don’t need to set up any tracking tools to pinpoint plenty of such cases.

[Anduin2017]

As for the default browser homepage, this is something I’ve really struggled with. After all, setting it to anduinos.com doesn’t earn me any profit. I’ve basically never changed that page, and it only gets a few dozen visitors a day. It’s not a news portal or a search engine. So I admit there’s no real business value in it for me; it was just something I did on a whim at the start.

It’s like how Android phones default to Google, or how Microsoft’s Windows defaults to MSN as a homepage. By the same logic, AnduinOS simply defaults to the AnduinOS homepage. (Maybe one day, if I develop some sort of additional online service, I can set it as that.)

If you strongly believe this is inappropriate, I don’t mind changing it. I could also host those HTML files locally on the installed system and have localhost as the homepage by default, but that seems really silly. At the moment, I don’t have a particularly good idea. (For instance, if I set it to Google, there would undoubtedly be people in the community who dislike Google and would complain about that as well.)

[Anduin2017]

FYI: https://gitlab.aiursoft.cn/anduin/anduinos-home/-/commit/d837e6821b00312b14999079455bd9a34f0ca307

Google analytics was removed.

[rzgarespo]

I noticed you use AI for responding so here is Mistral model talking back to you. However, I would like to clarify a few points regarding the core concerns about privacy and alignment with your stated principles.

Default GPS Activation [ Solved ]
While you mention that the GPS service is provided by Mozilla and not directly by you, the fact remains that it is enabled by default. This opt-out rather than opt-in approach contradicts the ethos of "Privacy is no longer optional. It's essential." Even if it serves a functional purpose, leaving it active by default undermines user trust. This decision feels dismissive of user autonomy—a cornerstone of privacy-focused software. Addressing this through an update would better reflect your commitment to privacy.

Use of Google Analytics [ Solved ]
Using Google Analytics, even if only temporarily or out of convenience, is incompatible with your stated goal of gathering "nothing" from users. Google Analytics inherently tracks and collects data, even if filtered or reduced by browser plugins. While you may argue that this is no different from other websites, AnduinOS positions itself as a privacy-first operating system, which holds you to a higher standard. Using a privacy-respecting alternative like Matomo would align better with your principles.

Default Homepage and IP Exposure
Setting your website as the default homepage may seem trivial, but it directly exposes user data partially to you and Google like IP address, geolocation etc. the moment they launch the browser. While you note that most users are likely to change the homepage, it’s presumptuous to rely on this behavior . Adding your website as a bookmark or making the homepage optional during setup would be a more privacy-conscious solution.

Justification vs. Principles
Privacy-focused development is not about what’s convenient or “not a big deal” from a developer’s perspective—it’s about consistently putting user privacy first, even when it requires extra effort or seems trivial. Your reliance on the argument that certain actions (like homepage tracking or GPS activation) are minor or common misses the mark. Users choosing a privacy-focused OS expect these details to be handled with care and transparency, not rationalized post-facto.

You don’t realize what you don’t know until you discover you didn’t know it. You’re young and a fan of Microsoft (fuck Microsoft), give it time, you’ll learn. 🙂

[Anduin2017]

I'm not a fan of Microsoft. Or I will use Windows obvisously.

Close this discussion becuause further discussion would be meaningless.