XF should update resource/add-on developer terms to ban call backs

[Fred.]

How can we find out if they call home and what they send home? Is there an easy way to check this?

 

[Paul B]

Only by inspecting the code or server logs.

 

[3rd AnGle]

The current resource listing should be more explicit in terms of stating the callback scenarios.... I believe there should be a custom field for callback (which started the whole debate on terms and conditions for listing resources inn XF) and let the developer say, in simple manner, why they want to use it

example:

Callback: Yes
Reason: License Validation, Updates requirement


For non technical person like me... i had never suspected anyone to use any mechanism to interact with my servers.. it was all done in good faith... Now that i know a lot of addons has been using such tactics.. i want to know in most simplest form whether to buy an addon or not .. that can be done in the best possible way by letting the customers know what kind of callback and why they are used..

*** this is in line with the comments given above by many people: some say if it is done for license validation purposes it is fine... some say don't buy the addon if they have call backs... Making the addon developers state these information will make them liable for any deviation too (in case they don't disclose the changes), in which case XF can take some action......

 

[Fred.]

I was Inspecting my logs, but i can't find anything. And i'm almost sure there is 1 plugin that calls home. (to check the license)
It's a paid plugin from a well known developer.

 

[Paul B]

Once you find it, report it and action will be taken.

For obvious reasons, we are unaware which add-ons breach the guidelines, especially paid ones.

 

[MattW]

I was Inspecting my logs, but i can't find anything. And i'm almost sure there is 1 plugin that calls home. (to check the license)
It's a paid plugin from a well known developer.

You can capture exactly what the add-on is doing once you know where it's making the call back to, by doing a tcpdump and capturing all traffic destined for that IP address.

 

[Fred.]

Thanks Matt
Found something and reported it.

 

[Paul B]

I am currently discussing your report with the other staff Fred but bear in mind it's Sunday so it may take a while for it to be actioned.

I would however like to point out clause 4 of the guidelines:

If installation depends on an external server (such as for validation), this must be clearly declared in your resource description (and on your site, if appropriate).

So a callback to an external server isn't in itself cause for the add-on to be removed, as long as that is declared.

In this case I think it does breach the guidelines as it isn't declared in the resource itself, only on the site which is linked to, but as this is a new site policy, I want to get confirmation before removing any more add-ons.

 

[3rd AnGle]

So a callback to an external server isn't in itself cause for the add-on to be removed, as long as that is declared.

Brogan, why not insert a new field to state whether they use callbacks or not and reasons... It is very difficult for us to go through a terms and conditions page in other's websites or somewhere inside the description... This information should be more explicit and understandable from the resource item page itself... (Sorry, i know this has been suggested above but just wanted to get your attention in case you missed it)

 

[Paul B]

Brogan, why not insert a new field to state whether they use callbacks or not and reasons...

That would be up to the site owners, not me.

 

[Mike Edge]

That would be up to the site owners, not me.

I think he ment on the RM here.

 

[Paul B]

I know, hence my response.

 

[Daniel Hood]

I think he ment on the RM here.

I think Brogan did as well (meaning it's up to KAM).

[Edit] Brogan Bot'd

 

[Mike Edge]

I know, hence my response.

Opp's I read it as site owners like the site owners of the addon.. Sorry Mr Bot!

 

[Fred.]

I am currently discussing your report with the other staff Fred but bear in mind it's Sunday so it may take a while for it to be actioned.

I would however like to point out clause 4 of the guidelines:

So a callback to an external server isn't in itself cause for the add-on to be removed, as long as that is declared.

In this case I think it does breach the guidelines as it isn't declared in the resource itself, only on the site which is linked to, but as this is a new site policy, I want to get confirmation before removing any more add-ons.

No worries!
I don't mind if it's just to check the license. But I agree they should tell us.

I understand