[Asterisk-Users] res_motv: Request for Comment

[Greg Boehnlein]

On Tue, 6 Apr 2004, Mark Spencer wrote:

> I've been considering the nature of Asterisk, its security, the bug
> tracker, and more...  And i've come up with an interesting idea: A
> "message of the version".  The idea is that Asterisk has a compile time
> 32-bit unsigned int version which is incremented whenever some major new
> bug is fixed.  When Asterisk starts up (and periodically, maybe once per
> day), it sends a packet with the version number to a server at Digium,
> along with a message level (INFO,MINOR,MAJOR,CRITICAL) and the Digium
> server replies (if it receives the packet, if not, it might get sent again
> in a day) with any INFO, MINOR, MAJOR, or CRITICAL messages which are
> associated with that version of the code.  In this way, an asterisk
> administrator could easily see if there were any major issues, critical
> security updates, etc, that his system might need to be updated for.
> 
> Now, of course, any time you put a "call home" feature in, there are
> people who will be concerned about privacy.  Clearly it will be able to be
> disabled, but I want to run my idea about deployment by everyone here and
> see if you guys had some ideas.  The idea would be that *new* installs
> ("make samples") would have the feature turned on for MAJOR level by
> default, and that any existing install (e.g. /etc/asterisk/sip.conf
> exists, but not /etc/asterisk/motv.conf) would have the file created at
> the next "make install" based upon prompting the installer.
> 
> Any feedback on:
> 
> a) The idea itself -- is it a good one or is it stupid?

I like the idea, but I'm not one of those people that mind my software 
"calling home" as long as I can review the code and make sure it's not 
shipping off anything other than the version numbers. This will also give 
Digium real-world information about who is using what version of asterisk, 
and from what IP block.

It has a lot of poential benefits, and some drawbacks. Personally, I'd 
like to see that information shared with the community in some fashion. 
For example, a real-time website that shows the percentage breakdown of 
versions in use, and perhaps even a breakdown by country.

The idea of a service, provided by Digium, that informs Asterisk admins of 
major fixes in the code base would be an incredible addition. I can't 
think of one piece of Open Source software that actually does this off the 
top of my head.
 
> b) The way to make it deployed without sneaking a "call home" in on
> anybody that doesn't want it?

Enable by default, and inform people how to shut it off. Either way, 
you'll piss someone off! ;) Might as well go for broke. :)

-- 
    Vice President of N2Net, a New Age Consulting Service, Inc. Company
         http://www.n2net.net Where everything clicks into place!
                             KP-216-121-ST