Does KSP really have spyware in it?

[JAFO]

Since Redshell is essentially a Steam thing, from what I can see on their website, I'm wondering if this is something only affecting Steam installs?

I bought directly from the KSP website, so I guess I'll soon find out.

[pizzaoverhead]

42 minutes ago, linuxgurugamer said:

Unless, of course, they have totally removed the phone-home code. And then they are more GDPR-compliant, correct?  Why don't you even consider that possibility?

They've specifically said in the licence that they will be collecting data, and they've included the DLL to do so: KSP_x64_Data\Managed\RedShellSDK.dll
Other users have reported firewall requests. I'll gather the network logs later if you need more specific proof.

40 minutes ago, Brikoleur said:

GDPR applies to personally identifying information. If they assign you a unique ID that's not associated with your license key or other way of connecting your real identity to it, it's allowed. Even if someone with a clever data mining algorithm would be able to statistically prove it's you.

The GDPR makes specific reference to online identifiers, IP addresses and cookies being identifying information, under certain circumstances. Check out section (30) of 2016/679.

Edit: More info on Red Shell and GDPR: https://blog.redshell.io/gdpr-and-red-shell-57f9c03b5769

Edited March 9, 2018 by pizzaoverhead

[Van Disaster]

26 minutes ago, JAFO said:

Since Redshell is essentially a Steam thing, from what I can see on their website, I'm wondering if this is something only affecting Steam installs?

I bought directly from the KSP website, so I guess I'll soon find out.

It is present in store-downloaded copies.

[Brainlord Mesomorph]

32 minutes ago, rudi1291 said:

The only "problem" i´ve found with blocking KSP from accessing the internet is that redshell shows a warning about it in the log.

EULA says they "may" gather info offline, and transmit it later.

And as a software developer, if I wanted to turn a game into spyware, I wouldn't do it all at once. I'd put in the EULA and I'd put the components in the app, but I wouldn't activate them all. I'd wait until the hubbub died down and all the privacy advocates had left (say 1.5 or so) and then I would slowly start ramping up the information gathering.

Just say'n.

Edited March 9, 2018 by Brainlord Mesomorph

[pizzaoverhead]

1 minute ago, Brainlord Mesomorph said:

EULA says they "may" gather info offline, and transmit it later.

And as a software developer, if I wanted to turn a game into spyware, I wouldn't do it all at once. I'd put the components in there, but I wouldn't activate them all. I'd wait until the hubbub died work and all the privacy advocates had left (say 1.5 or so) and then I would slowly start ramping up the information gathering.

Just say'n.

Spyware is software that gathers data without telling you. If you've seen the EULA, you've already been told that tracking will be done.

TL;DR: Does KSP v1.4 really have spyware in it? No.

[Guest]

22 minutes ago, pizzaoverhead said:

The GDPR makes specific reference to online identifiers, IP addresses and cookies being identifying information, under certain circumstances. Check out section (30) of 2016/679.

Exactly. As I said, if they use a unique identifier that can't be connected to a natural person, then they're compliant.

[Brainlord Mesomorph]

11 minutes ago, pizzaoverhead said:

Spyware is software that gathers data without telling you. If you've seen the EULA, you've already been told that tracking will be done.

TL;DR: Does KSP v1.4 really have spyware in it? No.

By that definition Windows10 is OK, too. LOL 

/ still uses Win7
// will be moving to Linux

Edited March 9, 2018 by Brainlord Mesomorph

[Poodmund]

I don't know why a fuss is being created about this additional usage info tracking being added to 1.4... what I do see as an important talking point though is the removal of the opt-in/out prompt and no way to disable the tracking.

That's pretty underhanded.

EDIT: But to answer the OP, of course KSP doesn't have spyware. It's more akin to adware... but it's obviously not, it's just data mining.

Edited March 9, 2018 by Poodmund

[JAFO]

15 minutes ago, Van Disaster said:

It is present in store-downloaded copies.

Hmmm.. ok, colour me very unimpressed. Looking through Red Shell's website, they do a lot more than simply integrate with Steam, too. See my next post.

 

15 minutes ago, Brainlord Mesomorph said:

EULA says they "may" gather info offline, and transmit it later.

And as a software developer, if I wanted to turn a game into spyware, I wouldn't do it all at once. I'd put in the EULA and I'd put the components in the app, but I wouldn't activate them all. I'd wait until the hubbub died down and all the privacy advocates had left (say 1.5 or so) and then I would slowly start ramping up the information gathering.

Just say'n.

Agreed.. I'm not a software dev, but an IT tech with a heavy interest in computer/network security, and that's exactly what I'd do, too.

 

4 minutes ago, Brainlord Mesomorph said:

By that definition Windows10  is OK, too. LOL 

/ still uses Win7
// will be moving to Linux

Fully agree.. Unfortunately, I need to be familiar with Win10 for work reasons.

[linuxgurugamer]

47 minutes ago, pizzaoverhead said:

They've specifically said in the licence that they will be collecting data, and they've included the DLL to do so: KSP_x64_Data\Managed\RedShellSDK.dll
Other users have reported firewall requests. I'll gather the network logs later if you need more specific proof.

No need, I see the dll, and will assume that it is phoning home somewhere.

But how does that make KSP any different than thousands of other games?

[Brainlord Mesomorph]

5 minutes ago, linuxgurugamer said:

But how does that make KSP any different than thousands of other games?

It doesn't. But KSP used to be. 

/it is a sad day.

[JAFO]

3 minutes ago, Poodmund said:

what I do see as an important talking point though is the removal of the opt-in/out prompt and no way to disable the tracking.

That's pretty underhanded.

EDIT: But to answer the OP, of course KSP doesn't have spyware. It's more akin to adware... but it's obviously not, it's just data mining.

It's very underhanded.. and from where I stand, data-mining skates right on the edge of (and sometimes crosses over into) being spyware.

 

From Red Shell's information page for gamers:

Quote

Frequently Asked Questions For Gamers
What is Red Shell? And what does it mean to me as a gamer?

Red Shell is a software package used by game developers and publishers to help them measure the effectiveness of their marketing campaigns. It works by tying information from marketing campaigns to in-game play.

An example: Imagine a game developer is running an ad on Facebook and working with a popular Twitch channel. The developer wants to know which of those ads is doing a better job of showcasing the game. Red Shell is the tool they use to measure the effectiveness of each of those activities so they can continue to invest in the ones that are working and cut resources from the ones that aren't.

Does Red Shell track my personal information?

No. Red Shell tracks "device" based information about your computer. We do not collect any personal information about gamers. We don't collect names, emails, or addresses. Our service basically says "this computer clicked on a link from this YouTube video and the same computer played your game." We have no interest in tracking people, just computers for the purposes of attribution. All of the data we do collect is hashed for an additional layer of protection.

What type of information does Red Shell track?

Red Shell tracks information about devices. We collect information including operating system, browser version number, IP address, screen resolution, and font profiles.

Does Red Shell track me across games?

No. Red Shell isolates all of our data on a per game basis.

Can I opt out?

Each game that employs Red Shell may offer an opt-out for any type of data/analytics services they use (which could include Red Shell). To opt out of Red Shell specifically please use our opt-out form.

 

The opt-out form allows you to opt out of web-based and cookie-based tracking with a single click.. but if you want to opt out of game-based tracking, they require you to contact them by email.. effectively handing them your email address for free. Unless you do as I intend to, and use a disposable email address for the purpose. But I'm guessing they'd need other potentially identifying info on you, in order to (presumably) remove you from their system. So it stinks whatever way you go..

I get so damn sick of all this "opt-out" BS we're forced to go through. Opt-in should be the default required by law.

1 minute ago, Brainlord Mesomorph said:

It doesn't. But KSP used to be. 

/it is a sad day.

This. Exactly.

[linuxgurugamer]

I am of the opinion that many of the posters in here have an axe to grind against the software publisher, and you're using charged words like "spyware" in a public forum to try to incite and stir up other people. 

As such, it's not really much different than asking a politician in a press conference, "So, have you stopped beating your wife?"

[Brainlord Mesomorph]

8 minutes ago, linuxgurugamer said:

I am of the opinion that many of the posters in here have an axe to grind against the software publisher, and you're using charged words like "spyware" in a public forum to try to incite and stir up other people. 

As such, it's not really much different than asking a politician in a press conference, "So, have you stopped beating your wife?"

WHAT? 

I don't know what you're talking about. I've never even heard of TT before this week when I started read their EULA.

Is not liking that "having an axe to grind?"

/And I would expect a "linuxguru"gamer to understand that. 

EDIT: do you make any money from that streaming you advertise in your sig? That's specifically disallowed in the new EULA.

Edited March 9, 2018 by Brainlord Mesomorph

[severedsolo]

Spyware? Absolutely not. It is a bit naughty that the opt out system doesn't work now though. On the other hand, I never turned it off anyway so vOv really no change

[JAFO]

5 minutes ago, linuxgurugamer said:

I am of the opinion that many of the posters in here have an axe to grind against the software publisher

No axe to grind against T2 at all..

What I have an issue with is the entire business of tracking everything we do and turning that information into a commodity. It's bad enough with so-called "free" services like gmail and farcebook.. at least you know that if it's "free", the real product is YOU.

But it's especially insulting when you pay for something, and companies still think they have the right to as much information about you as they can legally get away with.

Edited March 9, 2018 by JAFO

[MaxwellsDemon]

7 minutes ago, JAFO said:

But it's especially insulting when you pay for something, and companies still think they have the right to as much information about you as they can legally get away with.

Even when you know that before you buy?

[Brainlord Mesomorph]

Even when you know that before you buy?

A. yes

B.when I bought this it wasn't that way.

Edited March 9, 2018 by Brainlord Mesomorph

[pizzaoverhead]

46 minutes ago, Brikoleur said:

Exactly. As I said, if they use a unique identifier that can't be connected to a natural person, then they're compliant.

Very true. It all depends on what other data is captured for a given profile, and whether they've hashed the IPs as Red Shell allows.

The GDPR mentions a profile identifying a person. It's not clear to me whether they mean uniquely identifying a person, or connecting a profile to sensitive personal data (real name for example). For an example of the former, I'm the only person who both operates a computer at a specific IP address and owns a licence for KSP. Does combined knowledge of KSP licence ownership and IP address usage constitute personal identifying information as it uniquely identifies me? I'd be interested to hear from anyone who knows more about this.

[MaxwellsDemon]

Pardon me, but nobody's forcing you to upgrade.  Your copy of (say) 1.0.5 will still run just as well as it did before.

I also don't understand the paranoia about information collection.  In a nutshell, people expect companies to anticipate their needs and wants and respond to them, but they don't want the companies to know what their needs and wants are?   

What do you imagine companies do with this information?   The way some people talk, it's like they expect TT staff to break into their house and rearrange their furniture in the middle of the night....

[Johnny Wishbone]

For those of you up in arms about RedShell tracking you, simply block the following domains at your firewall or in your hosts file:

api.redshell.io

in.treasuredata.com

 

Very clever on their part naming the company RedShell. That way, a Google search for things like "block redshell" and "redshell tracking" just turns up a bunch of links on  MarioKart and little to nothing on them. 

 

 

[JAFO]

3 minutes ago, MaxwellsDemon said:

Even when you know that before you buy?

Absolutely.. it's why I pay cash whenever possible, never sign up for "loyalty" cards or programs, and never enter competitions.. because all the data they collect (and usually on-sell) on you is worth far more to them than what they give you in return.. certainly it's never done from the goodness of their hearts. Where do you think all that "personalised" junkmail you get comes from? On-selling of your personal information.

If I go into a store and buy a product, what the hell makes that store think it's entitled to personal information about me, like a phone number, name, address, or anything else? They have my money, they don't need to know about my life as well.. that's none of their goddamn business.

[MaxwellsDemon]

Just now, JAFO said:

If I go into a store and buy a product, what the hell makes that store think it's entitled to personal information about me, like a phone number, name, address, or anything else? They have my money, they don't need to know about my life as well.. that's none of their goddamn business.

The fact that you can avoid it indicates that it's entirely voluntary to begin with.

[Stone Blue]

4 hours ago, JAFO said:

To the best of my knowledge, any game developed on Unity phones home to Unity by default. Heck, there's even a mod available for The Long Dark that prevents said phoning home from happening.

Yes, with some digging, it seems they added Unity Analytics to 1.4.0...

https://unity3d.com/solutions/analytics

It looks like a game using Unity may not automatically phone home... Seems the developers have to actually add in Analytics

[JAFO]

1 minute ago, Johnny Wishbone said:

For those of you up in arms about RedShell tracking you, simply block the following domains at your firewall or in your hosts file:

api.redshell.io

in.treasuredata.com

Believe me, I'm about to do just that. But I am seriously liquided off that I need to.

1 minute ago, MaxwellsDemon said:

The fact that you can avoid it indicates that it's entirely voluntary to begin with.

I'm guessing you haven't run into one of the more obnoxious places where they insist that it's a necessary part of the sales process.. Usually they'll try to pass it off as needed for warranty purposes or something. I know of cases where they came very close to refusing to complete the sale unless the customer complied.