[QGIS-Developer] plugins and reporting to author-controlled sites

[Greg Troxel]

Tim Sutton <tim at qgis.org> writes:

> my intention is first to build tooling to let us tag plugins with
> things like "Requires Subscription", "Made predominatly using an LLD",
> "Uses networking calls" etc. and first start with a self reporting
> system so that users can decide if they are happy with the grants that
> a plugin asks of them.

First, having tags like that sounds great.

I get it that the plugin page says "Plugins are developed by independent
organizations and developers, the QGIS organization does not take any
responsibility for them." and that makes sense.

But, surely there are some rules about how plugins must behave in order
to be listed in the directory.  A plugin that uploaded all of a user's
files, or even the current project, or one that deleted things, would be
judged malware and summarily removed from the repo.


I would suggest that in addition to the antifeatures/uses-network tags,
the plugin system adopt a rule that plugins must not engage in tracking
at all.  This means no plugin hit counters, and it means even more
strongly no transmission of information about the user's data, including
viewport coordinates.

Probably, the rule should be plugins that lead to loading TMS/WFS/etc.,
which involves viewport disclosure, should refrain from doing so until
the user has added a layer and thus given perhaps-consent.  I'm thinking
of QuickMapServices, which while it configures TMS that then receive
information, does so in way that is straightforward and expected.  I
would not be happy if merely installing a plugin led to network fetches.


I really don't know how many plugins would run afoul of this.  I see it
as an important security property.



All that said, I realize that qgis downloads new versions of plugin
metadata at startup and probably periodically.  I don't find that
concerning as:
  - it's from qgis.org
  - it discloses that the IP address is running qgis, and not more

(If there is more sent, I would suggest fixing that.)