[Transparent agreement policy] "Totally offline software" option, and "web clipping" addon monitoring browser's traffic

Joplin’s version 1.0.170 (32bits, I know right)
Windows 7 (64 bits)

There’s an option of synchronizing, and even a “synch status”, for a synch that I never asked the software to perform. If it’s synching or not it is at least unclear as the software’s configuration doesn’t display “NO SYNC TO THE WEB” in the sync alternatives.
Secondly, after installing the firefox addon there’s no announcement to the extent of the addon risking my privacy on the web by having this tool running on the background while the user browses the internet. Since it ports a software executable on the system, the communication between them is a security risk to say the minimum.
I know the source code is available, but eventually this will have to be stated. And my preference was github instead of a personal forum because this can be buried down in the will of the owner and still requires a 3-party registry to ask for an explanation.

Conclusion: Joplin needs some “everything offline without any data sharing ever” in the preferences, and a better explanation on the addon privileges over the disk/OS for web synch through 3party telemetry.

I am a bit lost. If you don't enter any sync information, nothing will leave your machine. (People with personal (internal -> external) firewalls like LittleSnitch (on macOS, don't know about Win) can see that nothing is happening.) There's one option in settings Save geo-location with notes that triggers a request to a public API to retrieve the location.
Oh, and check for updates will connect to github to check for new releases. But you can turn that off too.

When it comes to the add-on, Laurent explained at one point what the permissions are for. But it should be obvious. If you want the clipper to clip web pages, it will need access to those web pages. That's the only permission needed.

What is the 3rd party telemetry you are talking about? There's no tracking in the app, nor does the app transfer any data out of the app to other servers, unless you sync to an external server, but in that case the transfer is wanted.

So what exactly do youi think is missing in the documentation? You can always open a PR with the info you think is missing.

2 Likes

I'm pretty surprised by this question.
Joplin is offline by default.
To configure it as online is a source of majority of troubles discussed on this forum. :slight_smile:

Yes for all these claims, we would need very specific information. For security issues, our policy is that any claim must come with a proof of concept, otherwise we simply can’t do anything about it. We take security issues very seriously and do our own checks, but if you make claims then the burden of proof is on you, otherwise we can’t make the difference between a real issue and a user spreading FUD (which unfortunately is quite common).

As for transparency, we have a privacy policy, which is linked to in various places including app stores: https://joplinapp.org/privacy/ We don’t track any user activity and collect no data.

I think the concern expressed is simply based on the fact that no matter what configuration choices one makes, Joplin appears to be syncing away. This may creep some folks out despite the fact that it’s syncing to nothing and returning an error, which can be seen in the log, which also may creep some folks out as it appears to be very busy doing nothing whatsoever.
I do understand both sides here. Perhaps a delivery more thoughtfully worded as well as the responses would have clarified the issue of a non-syncing process being so busy. As one who appreciates not losing control of one’s data to those who swear they would never take one’s data from a device without one’s consent, I see the point.
I’m going through the process of replacing a note-taking app at the moment and it can be frustrating. Particularly to those who have been deceived by a lack of transparency. Or worse.
Thank you for the work on this app. It seems very nice, particularly compared to my last one.

@andradadad, once you’re unblocked you’re welcome to contribute to the discussion about security issues in Joplin, but aggressive behaviour will not be tolerated.