[Bug 1255165] Re: make it clearer that crash files may contain private data and make it easier to opt out

[Gary Houston]

I think this is really a request for apport, which shows the error
dialog, instead of Whoopsie, which if I understand it correctly just
uploads anything dumped in /var/crash to daisy.ubuntu.com. It's quite a
neat system, and I may find these crash reports in /var/crash useful now
that I know how to unpack them.

I have some other suggestions (I'm assuming that the crash reports are
still useful without the core dump included):

* Add a second checkbox in the crash dialog for "include core dump". 
* Add a warning beside this checkbox like "The core dump contains the program and the data it was working with. It's size is 4032MB which may take some time to upload."
* If the core dump is larger than a given size (configurable somewhere, maybe a couple of MB by default) then untick the option in the dialog so that it's not included by default. Or maybe untick the box by default in every case.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to whoopsie in Ubuntu.
https://bugs.launchpad.net/bugs/1255165

Title:
  make it clearer that crash files may contain private data and make it
  easier to opt out

Status in “whoopsie” package in Ubuntu:
  Confirmed

Bug description:
  As far as I understand the whoopsie error report procedure, the coredump will be sent to ubuntu servers if daisy.ubuntu.com requests this after the initial report upload.
  However, I consider uploading a coredump across the network (although its https) to be a secuity risk. For instance gtk applications contain a lot of private information in their coredump such as last opened filenames. The coredump is used to extract additional information which may help to fix the bug, which is fine but any information should be extracted from the core *locally* (i.e. on the machine, where the crash happened) instead of extracting them on ubuntu servers. The text of the error upload dialog states something like "do you want to help fixing the problem?" which indicates to me that sending the error is something positive. I haven't found any hint that says "do you want to expose private data to canonical?" in this dialog.
  Altogether, I see no reason for sending a coredump.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/whoopsie/+bug/1255165/+subscriptions