Privacy Issues

[Twinkle]

I plan on going with SageTV for my HTPC, however, I don't like any information being collected about me - whether they claim that it's personally identifiable or not.

Is there any way to opt-out, or better yet, prevent this info from being sent in the first place?

[PGPfan]

This has been discussed MANY times already. It's not an issue, there is no personally identifiable info sent to the Sage mothership - just info on things like OS flavor, etc. They DO NOT collect any viewing info or anything like that.

Sage relies on their users - there is no compelling reason to jeopordize this relationship.

-PGPfan

[Twinkle]

Originally Posted by PGPfan

This has been discussed MANY times already. It's not an issue, there is no personally identifiable info sent to the Sage mothership - just info on things like OS flavor, etc. They DO NOT collect any viewing info or anything like that.

Sage relies on their users - there is no compelling reason to jeopordize this relationship.

-PGPfan

With respect, it's not your place to decide what is or is not an issue for others. If you're comfortable with the info they collect, that's fine. That doesn't mean that others have to be.

I haven't found any official explicit and specific list of data items collected by them, so I can't make any detail judgement. But aside from that, customers have the right to not want *any* info sent back to them - including what OS they use.


It's in light of that that I'm asking about blocking or disabling this.

[MeInMaui]

I'm not entirely sure about this, but I think the only time SageTV contacts 'the mothership' is for EPG updates. If that is the case, you can switch over to using xmltv data instead of the SageTV supplied EPG data. Otherwise, I'm afraid you're stuck with it.

Aloha,
Mike

[GKusnick]

Originally Posted by Twinkle

But aside from that, customers have the right to not want *any* info sent back to them - including what OS they use.

You told them what OS you use when you bought the license. You tell them again each time you download an updated installer.

And as Mike points out, if you want to use their EPG service, you must tell them your postal code and your TV provider info. Similarly, if you want to use the Placeshifter locator service, you must periodically tell them the IP address of your SageTV server.

If you ever want to submit a bug report, they're going to want to know a lot of details about your setup for the report to be useful.

They're not collecting this information for some nefarious purpose that threatens your privacy. They need it to provide the service and product support you paid for. That's why there isn't an option to disable it (short of isolating your Sage system from the Internet).

[Twinkle]

Originally Posted by GKusnick

You told them what OS you use when you bought the license. You tell them again each time you download an updated installer.

And as Mike points out, if you want to use their EPG service, you must tell them your postal code and your TV provider info. Similarly, if you want to use the Placeshifter locator service, you must periodically tell them the IP address of your SageTV server.

If you ever want to submit a bug report, they're going to want to know a lot of details about your setup for the report to be useful.

The difference is that that information is provided voluntarily, which is a far cry from a call home routine that sends who-knows-what back to them. Unless you use a packet sniffer and decrypt/decode the information sent, the fact of the matter is that customers can only take their word on what is and isn't sent. I prefer to make it a non-issue by not having anything sent whatsoever unless I specifically choose to - for example, if I submit a bug report.

Originally Posted by GKusnick

They're not collecting this information for some nefarious purpose that threatens your privacy. They need it to provide the service and product support you paid for. That's why there isn't an option to disable it (short of isolating your Sage system from the Internet).

With all due respect, you don't know what they collect or why they collect it - you only know what they tell you they collect and why they tell you they collect it. How many times have there been cases of companies saying one thing and doing another? I'm sorry, but the choices of people over time have broken that trust model. Like it or not, nowadays, if you want your privacy you have to fight for it.

I've been in IT for years, and I've seen plenty of this. And don't for a moment believe the whole "not personally identifiable" BS that companies feed you. What that means is that they're not saving a specific set of data with your name attached. Which means they can say "See? We know what they watch, how many times they've watched it, where they pause and where they rewind - but there's no name attached to this information". What they don't tell you is that the information has an IP attached to it, or some other tag which can be backtraced to the person that dataset originated from. "Not personally identifiable" means that there's no *obvious* link. It does *not* mean that there is no *possible* link.

If you allow an application to call home, you have no idea what information it sends (except the 0.001% of the populace that have the skills and have bothered to spend the time and effort to find out). Seperately, even if you might be okay with what is being sent, it's almost never properly encrypted - which means that the better question is whether you're okay with anyone/everyone else seeing what's sent. So it's not enough to say "well, they know my name, address, and whether I have an HDTV from when I ordered - so it's nothing new to them". The question is whether you're okay with *other* people knowing your name, address, and the fact that you have a nice expensive HDTV. And before you ask, yes, there are now criminals who use the internet to select their targets.

I really wish I could just chalk all of this up to paranoia, but I've been around the block too many times to do so. The phrase "Oh, come on! Who would ever guess that my password is on a post-it note underneath my keyboard!" is almost always followed, eventually, by "How the hell did someone get into my account?!?"

[Twinkle]

Originally Posted by MeInMaui

I'm not entirely sure about this, but I think the only time SageTV contacts 'the mothership' is for EPG updates. If that is the case, you can switch over to using xmltv data instead of the SageTV supplied EPG data. Otherwise, I'm afraid you're stuck with it.

Aloha,
Mike

Now that's a productive answer! The question now is - is there an easy way to get Sage to use a third party EPG source? When I take a brief glance into this, I find an absolute mess of obsolete information. Can Sage not cleanly be set up to do this?

[stuckless]

While I totally agree with your privacy concerns.... I fail to see how using xmltv solves the problem. xmltv still needs to use a provider. You have to pass information to that provider in order to get listings. That information would include private information such as your postal code, etc.

I guess if you trust your xmltv provider more than sage, then you are doing a little better...

[Twinkle]

Originally Posted by stuckless

While I totally agree with your privacy concerns.... I fail to see how using xmltv solves the problem. xmltv still needs to use a provider. You have to pass information to that provider in order to get listings. That information would include private information such as your postal code, etc.

I guess if you trust your xmltv provider more than sage, then you are doing a little better...

No, there is a difference - with a third party EPG, you know what information you're providing up front. They can't get anything more - because you're using a third-party app (not theirs) to grab the data, and you can choose and change the app you use to do so.

Sage is different because it's integrated - the potential is there for them to grab whatever they want.

[bhyman1]

Why would it matter if Sage knows what OS you use or what your Zip Code is?

Sounds very tinfoil hattish to me.

[Brent]

Oh Crap. I just saw a black Expedition with tinted windows go by the house - and I think I saw Narflex driving it .


Seriously though. If you are concerned about the "phone home" of SageTV I would pose the question directly to SageTV themselves. I would imagine they could tell you exactly what information is received, retained etc. As with most companies I'm sure they have a policy. As a consumer your best bet is to decide whether you are concerned, whether you are okay with them having access to that information and if not unplug. I for one am not overly concerned about my TV watching or other HTPC information. If you're not concerned with MS knowing all of that information, I can't see why you'd be worried about SageTV. Still it's a personal decision that only you can make I suppose.

[matt91]

Originally Posted by bhyman1

Sounds very tinfoil hattish to me.

I feel much more grounded about myself when I see what others spend their time worrying about.

[Twinkle]

Originally Posted by bhyman1

Why would it matter if Sage knows what OS you use or what your Zip Code is?

Sounds very tinfoil hattish to me.

Of course. Nowadays, despite the tremendous number of cases of individuals, companies, or governments who abuse information mining, people who want to protect their privacy are considered paranoid. And people who have the audacity to question the actions of their government are called unpatriotic.

Please.


The concern here isn't them knowing what OS I use or what zip code I'm in. It's the fact that that's not ALL the information they're pulling, you don't know what information they're pulling, and you can't control what information they pull.

Oh, and just to respond a little more directly - do you know why many server apps have configuration options to let you set the handshake messages? It's because simply knowing what OS a server runs, or what app is controlling an open port is enough information for hackers to get a foothold. So, yes, the OS is not an insignificant piece of information.


I've seen companies get hacked because some software app they use called home and sent network/OS info back to them. Did the company who developed the software hack them? No. It was the hackers who sniffed the call home data and extracted the relevant information.

I've seen plenty of tinfoil hat labelers over the years. These are the people who say "Why do I need to lock my doors? I live in a *good* neighborhood." Or "Why do I need to harden my company's network? Who would want to hack *us*? Or "Oh, come on! Do you really think someone's looking over my shoulder when I type in my ATM PIN? You want me to cover the keypad when I do that? You're paranoid!"

I'll let you guess what the majority of them had in common... eventually.

[Twinkle]

Originally Posted by Brent

Seriously though. If you are concerned about the "phone home" of SageTV I would pose the question directly to SageTV themselves. I would imagine they could tell you exactly what information is received, retained etc. As with most companies I'm sure they have a policy.

Aside from the fact that I emailed them two weeks ago and never got a response, the problem with a call home routine is that you can't trust what the company says because you can't verify it, and you can't keep them from changing their policies later. Seriously, if you had called up Verizon or AT&T a couple of years ago and asked them if they're sending information about your communications to the government, what do you think they would have told you? And what do you think others would have said of you? I'm going to guess it would be something involving tin foil. And yet today, that concern isn't a punchline anymore, is it?

Originally Posted by Brent

As a consumer your best bet is to decide whether you are concerned, whether you are okay with them having access to that information and if not unplug. I for one am not overly concerned about my TV watching or other HTPC information. If you're not concerned with MS knowing all of that information, I can't see why you'd be worried about SageTV. Still it's a personal decision that only you can make I suppose.

I am concerned with microsoft's call home routines. Which is why I block as many of them as I can. Personal information in the internet age is not isolated the way it was a generation ago. Nowadays, each piece of information is something that can cause a chain reaction leading to other pieces of information. The only way to keep your information safe it to guard it vigilantly. It's not different from copyright law, in that respect.

[Twinkle]

Originally Posted by matt91

I feel much more grounded about myself when I see what others spend their time worrying about.

I'm sorry, but that comes across as naive to me - not due to general hypothesizing, but to actual experience. Perhaps if you spent a significant amount of your time doing damage control for others who felt the same way and paid the price for it, you might feel differently.

[PGPfan]

So, I guess in view of what you've posted - Sage will always be spying (how much, nobody knows or will admit to) on you somehow - so it's likely not the PVR software for you.

-PGPfan (yes, there is a 'privacy concern' regarding my forum name - I strongly advocate the use of tools like PGP to protect one's privacy, just never saw the need for concern when I watch TV)

[Twinkle]

Originally Posted by PGPfan

So, I guess in view of what you've posted - Sage will always be spying (how much, nobody knows or will admit to) on you somehow - so it's likely not the PVR software for you.

Just because there's an issue doesn't mean it gets ruled out automatically. That's why I was posting a question asking about methods to prevent that.

Originally Posted by PGPfan

-PGPfan (yes, there is a 'privacy concern' regarding my forum name - I strongly advocate the use of tools like PGP to protect one's privacy, just never saw the need for concern when I watch TV)

It's really a sad state of affairs. But with the current US government taking an interest in what books people borrow at the library, you damned well bet your glutimus maximus that people should care to protect information about what they watch.

[othy]

If you're so worried about privacy, what makes you think you can trust a third party EPG app any more than you can trust the people at SageTV?

As you yourself stated, you have no idea what information is being transmitted by a third-party app unless you investigate the packets it sends, so how do you know their app isn't scanning your system and sending whatever information they want? And if this data-mining is so important, who's to say you're getting a straight answer from any company when you ask?

Microsoft (one of the examples posted here) obsessively insists that no personally identifiable information is collected and many people insist that they're not genuine. I have no real idea who to believe.

My personal choice (and yes, I know it's just my choice) is to trust that Sage isn't collecting anything important. I certainly don't input any personal information into the software, and the data the software would have access to would relate to TV-viewing habits, which doesn't concern me. And again I trust that Sage isn't scanning my HD looking for additional information.

It seems to me that your choices (for PVR and ANY other software) are to only use open source software that you have thoroughly inspected yourself or to isolate your Internet connection. There are open source PVR solutions available, though I don't have any experience with them. I just think it's a slippery slope. Do we eventually get to a point where we won't run anything that's not open source and inspected? Soon I'm in the market for a little cabin in the middle of Montana...

I'm not trying to make light of anyone's privacy concerns--privacy is an important right not to be taken for granted--but I'm much more worried about apps that can directly monitor my Internet usage. Sage just doesn't "feel" very threatening to me. They, as a company, just seem too customer service oriented to pull something that stupid. Call me a fool later if it bites me in the butt.

Tim

[stanger89]

Originally Posted by PGPfan

So, I guess in view of what you've posted - Sage will always be spying (how much, nobody knows or will admit to) on you somehow - so it's likely not the PVR software for you.

Probably no PVR is, software or hardware. All PVRs requires a connection to the internet for guide updates (what sort of info does Schedules Direct collect, XMLTV web scrapers must leave behind a fingerprint as they use the web), Tivo collects viewing/usage data, digital cable boxes have (somewhat) two-way communications, satellite boxes "require" a phone/internet connection. Surely VMC collects/reports some sorts of usage data.

The short of it is, if you want to use a PVR, you're going to have to accept that some information is collected. You're volunarilly using a service (guide data) and there's no way to obtain that without providing some information to the service provider.

Sage is one of the best out there in terms of privacy, they don't collect info on viewing habits, they don't collect personally identifiable information. It's been discused before and the CTO has said as much.

That's good enough for me.

[PGPfan]

Originally Posted by stanger89

Probably no PVR is, software or hardware. All PVRs requires a connection to the internet for guide updates (what sort of info does Schedules Direct collect, XMLTV web scrapers must leave behind a fingerprint as they use the web), Tivo collects viewing/usage data, digital cable boxes have (somewhat) two-way communications, satellite boxes "require" a phone/internet connection. Surely VMC collects/reports some sorts of usage data.

The only exception to this (needing an internet connection) was the Microsoft UltimateTV STB. It was the best of all of the STB PVR's out there and only needed connection to the sat dish (DirectTV ONLY however). Still a great box, but they won't commision new subscribers if using these older boxes.

Frankly, I don't think the OP is a good candidate for any PVR setup if TV viewing habits are that much of a concern to him. But that's just me....

I still recommend using PGP like software on 'real' communications, or areas that warrant real concern over privacy.

-PGPfan