Third Parties Used in Loomio.org - Implications for Users

I appreciate the very strong concerns and feelings in this thread. When we express strong concerns through asynchronous written exchanges, it's easy IMO for negative reactions to escalate due to divergent views on each other's terminology and phrasings.

I hope and believe there's sufficient common ground here. I agree with you @strypey and @robertguthrie that the Loomio privacy policy is currently misleading, although it does contain most if not all of the info that users technically need. Loomio.org , as a service, is often going to attract users who are rightfully and intensely concerned about privacy. I think their potential concerns can be addressed without alienating the vast majority of potential users, who use proprietary communications and networking software (both directly and indirectly) with scarcely a second thought.

One thing that jumps out at me in the current privacy policy, and would be easy to edit, is that the "Third Parties" section should perhaps come right after "User Content and Personally Identifiable Information". However, any potential update of the privacy policy is a serious matter which should IMO consult key stakeholders. I think it would be a very worthwhile goal.

@robertguthrie

I don’t share the same views as you on this stuff and I feel like you’re not allowing space for that.

Ok, I hear that. Please keep in mind that I'm not demanding you personally engage with this discussion. I believe someone from the Loomio coop should, but it may be that you are not the best person, for the reasons you've given.

If you do decide to return to his discussion, if we can work out precisely where we agree and disagree, we can focus the discussion in a more constructive way. Can you be more specific than "this stuff"?

For me, the issues implicit in this discussion include:
* software freedom: the principle that violations of basic and important user rights are inherent in software being proprietary
* net neutrality: the principle that all internet users and transactions should be treated equally, and without discrimination, by every intermediary involved in routing internet traffic
* open standards: the principle that the architecture of the internet, and subsystems like the web, should be kept open and uncapturable, by defining protocols that any software or organisation can implement without discrimination
* full disclosure: the principle that people are entitled to know, for example, what ingredients are in food they are being served, or what they are agreeing to if they sign a legal contract or create a user account on a server
* privacy: the principle that people have a right to go about their private business without being subject to unwarranted surveillance, or unreasonable search and seizure, whether of their person, their homes and businesses, or their belongings, including information about them. Neither governmental nor private entities should violate people's privacy, whether actively, or passively.
* accurate advertising: the principle that entities offering goods and services to the public should use promotional language which gives users an accurate overall impression of the nature of those goods or service, without having to research the details (eg one should not claim a food product is "organic" if only a small proportion of the ingredients were grown organically)
* organisational integrity: the principle that if an entity makes claims and/ or promises, it's actions should always be consistent with those claims and promises, or if not, it should explicitly and publicly disavow the claim or promise affected
* user trust: the principle that when a user installs software on their computer, or stores their information using a service running on someone else's computer, they should be able to pick software/ service vendors that will not abuse the access this gives them to users' information
* social enterprise: the principle that it's possible to run businesses, and make living as co-owners or employees, while making ethical consideration a higher priority than financial ones
* host responsibility: the principle that when entities are running infrastructure that potentially allows the violation of any of the above principles, every reasonable measure should be taken to prevent such violation, and certainly no action should be taken that facilitates it

It one or more of these the stuff you disagree with? Or is it something else? Every one of these principles is a generalization, and every one has exceptions. For example, most people accept that if police get a warrant from a judge to bug someone's car, or use their mobile phone as a bug, then that's a reasonable exception to the principle of privacy. Another example, if you're being DDOSed, nobody is obliged to treat those packets equally to those of genuine users :) This is a reasonable exception to the principle of net neutrality.

However, there are two key points about exceptions to ethical principles. They need to be very specific, and the onus is on those arguing for the exception to prove that it's justified, on a case-by-case basis. If the police get a warrant to bug you, but find no evidence of any offence it was granted to investigate by the time the warrant runs out, they should have to apply for a new warrant from scratch. Otherwise such warrants risk becoming carte blanche permission to bug people for the rest of their lives, just because a police officer once claimed to be suspicious of them. Using DDOS as the justification for a system that also catches TOR users engaged in normal user behaviour means the exception is not specific enough.

Bringing more issues into this does not make it easier for me to engage. I can't debate like that, and I find big lists of serious stuff to be boring so I switch off. I reckon that's how most users of proprietary software think too.

Finding out "precisely where we agree and disagree" is not something I want to do.

But I agree that it is scary to think what is being done with user data collected by the big orgs so I think it's a fair call to suggest we should better inform users about what data we are sharing with these services.

Also I think it's fair to suggest that we should try to reduce our dependencies on these services and that we should consider free alternatives hosted ethically when selecting a service.

So, as a starting point I'll raise a bucket for funding within Enspiral to install a Piwik server so we can evaluate if it can replace google analytics for the purposes of companies within the network. I'll post an update on how that goes. Maybe there are more opportunities like that to be found.

That sounds like progress @robertguthrie :) Sharing the time/ money/ skills cost of some of these support services across all the Enspiral teams sounds like a really sound approach.

BTW According to Richard Grevers, the webmaster of permaculture.org.nz,

AWStats (which is GNU GPL) does pretty close to the same job [as Google Analytics] but is entirely server-based (sends no extra code to the browser).

So that's another possibility you could evaluate for analytics.

If I understand correctly, what Cloudflare does is cache static copies of Loomio.org pages, and serve them for you, reducing the load on your server, especially the databases. Indymedia sites used to achieve the same thing to some degree by running their own static cache, using software like Squid.

@strypey Given a bit more time I've decided to get super clear about what data we share with third parties.

I'm working on a document that describes, for each party that we share data with:

• who they are
• what data we share with them and what service they provide
• if they share that data with anyone else
• how long they retain the data

I then go on to explain which ones you can block (with Privacy Badger) and of course suggest that people setup their own Loomio installs and help others to do so.

I'm hoping to make this really easy to read and understand and find before you sign up or login.

There are a few that maybe we can run inhouse versions of.. but there are a few others that are totally unavoidable for us. Anyway.. hold tight and I'll have something to share with the thread next week... just wanted to let you know you've prompted me to do some much needed updating of our privacy policy content.

That sounds great @robertguthrie . Thanks for coming to the party, and sorry about the lecture :P

Your extra work on this sounds amazing so far @robertguthrie ; thanks so much for making the most of an especially difficult subject.

BTW If we can figure out how to mark all the Loomio javascript as free code, then running LibreJS would be a way to block any third parties which require client-side scripts.

Woohoo! An exciting update:

@robertguthrie has written up 90% of an amazing blog post explaining what data gets shared with which companies and why.

Please check it out and add your thoughts so we can finalise and publicise this soon :)

I really appreciate the great work that been done through this thread. I'm not technically literate but I found the "amazing blog post" easy to understand and very re-assuring - super transparency and great to invite contributions from others. Thanks @robertguthrie. Thanks everyone who shared concerns and who helped worked this through.

Nice, thanks @simon1 :)

I will say, this kind of work is hard to prioritise in amongst all the other urgent things that take our attention.

So I am very glad to have people in the community prodding us along, so long as it is a kind prod!

indeed! Thanks @simon1.

FYI Everyone: The Piwik server (possible google analytics replacement) is in progress.

"Controversial third parties involved in Loomio.org,"

We want: mumble integartion. Vídeo and chat meetings. Streaming. Scheduelle, Agenda. Mobile apk.

And u want to.... perder tempo.

@kannon I'm not sure I entirely understand your meaning, but it seems like you want to talk about other stuff.

This thread is about third party proprietary software and personal security. If you think that's a waste of time, okay, but that is the topic here.

If you think that other topics need more attention, I suggest that you ask for feedback in other topics, or create a new topic

thanks, nice article! it's too bad this is a non issue for other people :|

what about some practices in loomio's code that may be considered harmful for privacy too? i know this is about proprietary third
parties, but i noticed that, for instance, the login architecture logs user ip addresses, and there's this ahoy thingy that recolects them too.

i was told you were logging ip addresses to be able to block spammers and comply with legal enforcement, but if that's a valid reason for you (i'm not convinced) it would be good to be clear about that too, no?

@fauno it's great to have your input here. I'm really keen to move IP recording (used to be block abusive IP addresses) and the Ahoy stuff (used by us to understand how many active groups we have, and detect growth in the Loomio usage as we improve the software) into a separate repo, leaving the main Loomio repo free of such stuff. I'll update the article to include those things as it will make it easier to prioritise the work of separating them.

^ Thanks for sharing @robertguthrie ; that sounds like great infrastructure for an efficient modular relationship between the development of Loomio open source code and the hosted loomio .org service.

Great to see all the exciting progress on this since I last checked in. @robertguthrie if all the parts of the Loomio codebase which connect with third parties are modularized, can they be moved to the separate Loomio.org repo too? There was an offer from Fauno to submit patches with all the third party stuff removed, which I imagine would speed things up a bit.

A little progress report:

We discontinued our use of Heap Analytics today, so we can strike one more service off the list of Third Parties in use on loomio.org!

Heap is a very cool product because it provides a really powerful and intuitive way for us to answer questions like, 'when we changed the signup form, what affect did that have?'

This thread has prompted us to look really closely at all our third party services though and we decided that Heap is one we can definitely live without.

---

@robertguthrie is making progress working with an Enspiral Craftworks developer to set up a Piwik server, so we are hoping to ax Google Analytics next.

Expect an update about that in the next couple of weeks. Ping me here if that doesn't happen :)

In the meantime, we heartily recommend using Privacy Badger to block any unwanted third parties from tracking your usage of Loomio.

Automattic shows up on this page, but is not listed on https://www.loomio.org/third_parties - nor are any of it's services, that I can see.

It would be nice to add that Privacy Badger recommendation to the third parties page. Perhaps also a note about Disconnect and NoScript as other options, and some clarification that they aren't complete solutions, and a plug for hosting your own Loomio instance.

I think what's likely to happen is that we'll do an overhaul on the privacy policy to make it clearer, and then we'll announce that with some kind of human-readable blog post that can explore some of the challenges of online privacy and what can be done about it. Good idea to name a few options for blockers.

Can you give any more info about the Automattic script? I'm not seeing it.

No, sorry, it just appears in Disconnect's content requests list - no more detail than that. Perhaps it's Gravatar? there are 34 requests, so I guess that might make sense.

That will be it.

For the benefit of other folks reading this: Gravatar stands for "globally recognised avatar". It's a service which allows you to associate a profile photo with your email address, so you can set your photo once and then use it all over the web.

It's an optional feature on Loomio.

On the topic of moving beyond proprietary dependencies, I just found this message from @alanna in my email archives:

On November 15, 2011 we launched this Loomio yammer network. Since then, we’ve had 115 members post 7622 messages (1183 from Rich alone!), all drawn together by passion for this crazy idea to help people make better decisions together. Loomio has come a long way since then. We’ve come so far, in fact, that we’ve organically started doing the bulk of communication for our community using the Loomio platform itself. Once we realized that, it became clear that it’s time to shut this yammer network down.

I remember being really proud of you guys when you hit that milestone of self-hosting your own dev discussions :)

AFAIK Gravatar only shares user data it has been asked by the user to share (mainly profile pics), when the user associates that data with their email address on the Gravatar site. Gravatar is run by Atomattic, the founders of WordPress, so I assume it's all free code, but it would be good to check.

Hey folks, just another update to let you know we're making incremental progress on this =^.^=

We recently deployed a major overhaul of the group settings form, which makes the privacy implications of different configurations much more easy to understand. If you're using the new Loomio interface, you'll see these changes when you edit an existing group or start a new one.

There has been tremendous progress recently to port Loomio to Sandstorm, which makes it super easy to host your own more secure version of Loomio. (Here's a quick video of @juliagra demonstating Loomio working on Sandstorm at a recent meetup.)

We've also making progress to reduce loomio.org's third-party dependencies, and switching from proprietary services to self-hosted open source ones. You can read more about that in this growing document about How loomio.org treats user data.

Once we've settled on the best third-party services to use, we'll run that doc past a lawyer and then update the privacy policy to make it clearer. We're also investigating ways of communicating the privacy implications of creating a loomio.org account more obvious up front.

Please do jump into that doc and add questions and comments - we're keen to make this stuff as transparent as possible.

Thanks friends!

Thanks so much to everyone working on this. I know it takes time away from your core tasks of improving the Loomio software and supporting your users (not to mention finding ways to keep development funded!), but I think it's worth leading from the front, and making the switch.

Any free code project currently using Yammer or a GoogleGroup (or another proprietary platform) for decision-making in their open source communities is now challenged to follow your example, and switch to Loomio (or another free code decision-making platform). The more projects engage in this kind of mutual aid, the more motivation there is for proprietary projects to consider releasing their code, and the more we build the movement to challenge Big Data control (lock-in, surveillance etc), and take back the future of the net for all netizens, not just corporations. I love you all!