News for hackers. Stuff that matters.

A comment on Focalboard open source, self-hosted alternative to Trello, Notion, and Asana.

Re:Focalboard open source, self-hosted alternative to Trello... by sneak on Friday January 21, 2022 @03:13AM (#30020630)
Focalboard is made by the Mattermost people.

Mattermost embed silent, nonconsensual phone-home spyware from segment.io in their open source server app! I was astounded when I discovered this (nearly totally undocumented) misfeature that, in some ways, defeats the point of selfhosting an open source project.

I don't think I trust software from them without a significant audit for data leaks/spyware/phone-home, as it seems to me that they don't really care about user privacy even in selfhosted versions.

[ Parent | on HN ]
Re:Focalboard open source, self-hosted alternative to Trello... by th4s on Friday January 21, 2022 @03:38AM (#30020791)
https://github.com/mattermost/focalboard/blob/main/server/se...
[ Parent | on HN ]
Re:Focalboard open source, self-hosted alternative to Trello... by robertlagrant on Friday January 21, 2022 @03:16AM (#30020647)
Citation needed.
[ Parent | on HN ]
Re:Focalboard open source, self-hosted alternative to Trello... by sneak on Friday January 21, 2022 @03:28AM (#30020732)
The relevant env vars to disable are:

Disable silent phone-home for usage tracking:

    MM_LOGSETTINGS_ENABLEDIAGNOSTICS: 'false'
(The fact as to why marketing spyware is termed "diagnostics" is left to the reader to discover.)

Disable silent phone-home for version freshness check:

    MM_SERVICESETTINGS_ENABLESECURITYFIXALERT: 'false'
Grep the released binary for 'api.segment.io' if you don't believe me. I use a Dockerfile along the lines of:

    FROM mattermost/mattermost-team-edition@$$cap_mattermost_version
    RUN sed -i 's#api.segment.io#xx.example.com#gI' /mattermost/bin/mattermost
    RUN sed -i 's#securityupdatecheck.mattermost.com#xxxxxxxxxxxxxxxxxxxxxx.example.com#gI' /mattermost/bin/mattermost
[ Parent | on HN ]
Re:Focalboard open source, self-hosted alternative to Trello... by oarsinsync on Friday January 21, 2022 @03:23AM (#30020699)
https://github.com/mattermost/mattermost-server/blob/master/...

Which at time of writing states:

## segmentio/analytics-go

This product contains 'analytics-go' by Segment.

Segment analytics client for Go

* HOMEPAGE: * https://github.com/segmentio/analytics-go

[ Parent | on HN ]