News for hackers. Stuff that matters.
Re:“I saw that you spun up an Ubuntu image in Azure” by hn_throwaway_99 on Friday February 12, 2021 @11:38AM (#26115457)
But I think that these comments from the Twitter thread are very valid:

> I belive you spun up the VM based on an image from the Azure Marketplace, specifically one from Ubuntu. That is not a microsoft image, you accepted an offer from Ubuntu and now they contact you to follow up. That's my understanding of the situation. Hopefully someone can clarify

> Where exactly it is visible any ToS?! As soon as I clicked on "add new VM", the first option suggested was Ubuntu 18.04. I didn't dig into the Azure Marketplace. I just picked the first option available since I quickly need a linux-based test VM.

I mean, I'm not as familiar with the AWS marketplace, but I use the GCP marketplace, and when I choose an offering from that marketplace it's very clear I'm just buying a prepackaged solution from another vendor, and I'd expect that other vendor gets my info. IMO this is very different from choosing the OS for your VM from a dropdown.

Re:“I saw that you spun up an Ubuntu image in Azure” by btown on Friday February 12, 2021 @04:44PM (#26118915)
I think this is one of the points that the spirit of GDPR and similar legal frameworks gets right: users have the right to opt-in, without service being degraded if they don't, to data sharing unless that data sharing is "necessary" to fulfill the transaction (I believe this is the basis for "legitimate interest").

If I'm buying a SaaS or DBaaS from a vendor over a marketplace, or launching a metrics collector where phoning those metrics home is a core value prop, I'd be fine to be told that sharing information with the end operator, not just the marketplace, is necessary to fulfill the transaction. And there should be contracts in place to ensure my data's not used for unrelated purposes. If the operator breaches those contracts, the operator is liable.

But in what possible way is "using a pre-packaged Linux distribution" a transaction where sharing information with the packager is "necessary?"

I have no doubt that Microsoft's lawyers have covered their posteriors here. But the spirit of these regulations would be that users don't have the expectation that they're opting into Canonical getting their info just because they use a bog-standard Ubuntu distro. Users didn't knowingly consent to this.

(EDIT: not a lawyer, not legal advice)