Security and Privacy Concern about Logos4 Phonning Home

At the risk of sounding as if I don't know what I'm talking about, or that I'm trying to get people to move away from using L4...I would like to suggest that perhaps L4 is not the correct software for the OP???

Perhaps there is a software that does not put your private information at risk the way you think L4 does, and perhaps that is the software you should be using, instead of L4.

L4 is very clear about how they operate, and how sync-ing with the cloud is part of the future of the software.  So those who have these privacy concerns might need to reconsider their purchase IF the risk is truly as large as the OP and others on the thread seem to suggest.

Please hear me:  I'm not trying to be confrontational, just wondering why one who holds these opinions concerning their privacy would purchase a software product that they know up front is going to compromise them?

Esther

Yes, there is such a program. It is called Logos version 3. And the neat thing is; it runs 1000 PBBs, imports sermon files, saves notes & runs without internet connections. Not to mention a Portfolio Edition upgrade will add thousands of premium titles to Version 3's library.

If I were a missionary in Indonesia right now, I would definitely run Logos Version 3 to hide from persecutuion.

Letting my sense of humor get the best of me. I'm just saying

After 10 pages we need either humor or perspective or both.

That's funny. [:P] I do think your search results for "privacy" do prove Robert Bork was right....There is no privacy! (I know, I'm twisting things again.) 

How many of the search results would have done what they did had they known the whole world could read about it later?

With an omniscient God how could there be?

Of course Robert Bork was only talking about the US Constitution. It was Calvin, Charnock & Bette Midler who said "God is watching us."

This is isn't a question of whether we can or should trust Logos. I am certain that they are honest and trustworthy both as a Corporation and, in general, as individuals. It's about the fact that storing my data on someone else's system increases the risk of someone accessing my stuff without my consent.

It could be a rogue employee at Logos but, more likely, a server hacker who is looking for personal info. If Logos use a 3rd party 'cloud' to store the data on (and it seems they are/will do) then it makes the data more vulnerable as the 'target', as it were, becomes bigger.

The issue isn't really about whether my data being hacked would lead to embarrassment (or even a lawsuit) - it's about my right to privacy. My data is my data and I should be able to control who sees it. OK, that's idealistic but Logos should, out of plain respect for my privacy, allow me to choose whether or not I want my notes, and eventually resources, to be stored and only accessed from external servers. I think it is phony reasoning to say I have to be careful how I use the program. No. I should be able to configure the program so that I can use it in a way that satisfies my need/desire for privacy.

Andy, I agree with you 100%

I agree with you, for those who use the cloud option, need to know what Logos offers, and we need to do the rest for us.  This being said, if Logos is saying they are backing up our data (for those who use the cloud option - not me), then Logos needs to state how often they backup their data.  All backup software programs that I have used give me options of which file to restore.  They ask which file because the program has multiple files to chose from.  I personally backup certain directories daily, and I back up all of my personal files every Sunday morning while I am at worship.

Therefore, for those who use the cloud option, should also have the option of restoring her/his files from a different date (if Logos is in the business of backing up their user's data).

That's a good point.

I suspect that many of the issues we are raising is to do with the fact that Logos4 cannot yet be described as a mature product. Whether or not they released it too soon is no longer worth debating, although had they released it as a public beta or even a pre-release then some of the messages here would drop in tone to 'suggestion' or 'I would like...' rather than making a complaint.

However, Logos4 was released as 'Generally Available with features yet to come'  although 'Generally available, available features 80%-90% done and others features still to come' would now seem a more accurate description. I think in a different environment - say a financial system for a commercial bank, where efficiency and value for money outweigh patience and tolerance, software released in this fashion would probably be rejected (to put it mildly).

One of the principles of Agile Development (which gets mentioned occasionally in the forums) is that features are not released until they are "DONE DONE" - emphasising that even 99.9% is NOT DONE and that the feature is not ready. It takes incredible discipline to consistently achieve 100% done before releasing a feature but the benefits in customer satisfaction are self evident.

Since Logos4 was released, there has always been, to me, the feeling of it still being in the 'evolution' stage. Many resources have had to be updated because the data structures have changed, rather than the resource content being updated. This is really a sign of a product in (relative) infancy - any software developer will tell you that changing data structures (not adding to them, but changing that which already exists) is both painful for developers and painful for customers. Logos' philosophy has just been to re-download the resources to fit the new data structures, rather than to try to 'massage' the data into the new structures, and this has led to complaints about download size. I have no idea if such downloads could have been avoided. If they could have been I think they should have been.

I had to search through several pages on Logos' site until I reached a page that said:

"Safe and secure. You can have the peace of mind that all your
documents—notes, clippings, and custom guides—are safely backed up on
our servers. If your computer crashes, just reinstall Logos 4 and all
your data will be restored." (http://www.logos.com/logos4/customize).

Because the Engine is marketed as 'free' I suspect most customers will focus on the resource description pages - after all that's what they are being charged for. Certainly, until this thread I was unaware of the full scope of this feature, but I haven't been an avid V4 user and am only just revisiting it in the last few weeks. That said, I do think, at the very least, Logos4 needs to be much more 'in your face' about what it is doing. During the initial setup it should ask whether or not to turn 'Use Internet' on rather than defaulting to it. It should explain the consequences and it should provide a way to get automatic notification of updates without also turning on synching.

My warning to anyone considering using the program in ways other than designed is "DON'T" and if you do, don't assume the content of forum posts covers every possibility of what could go wrong.

Bob Pritchett quotes "You can turn off Internet Use in the program settings, and get updates by ordering DVD's on occasion. We'll continue to listen to feedback on this, though it's lower on our priority list than missing features."

That would seem to indicate you can do this.

there is nothing illegitimate, unusual or inherently dangerous in what JimT has suggested.

From your strictly "programmer's" point of view maybe. But I was not criticizing JimT for that part of his post. I took issue with Jim saying the previousl posts on the forum are adequate to address all potential eventualities; so well covered that if a user read them all he would have enough information to make a fully informed decision as to all possible outcomes. I maintain that is not the case. The user starts tinkering with the functionality of the program and then wants to hold Logos responsible for any loss resulting from his ill-informed tinkering. Jim's advice constitutes an implied warranty that, if you first read the posts, you may then tinker to your heart's content. That is the "lawyer's hat" that doesn't seem to fit programmers very well. But I bet Bob has a couple of those types hiding in the wings that look good wearing the hat.

there is nothing illegitimate, unusual or inherently dangerous in what JimT has suggested.

From your strictly "programmer's" point of view maybe. But I was not criticizing JimT for that part of his post. I took issue with Jim saying the previousl posts on the forum are adequate to address all potential eventualities; so well covered that if a user read them all he would have enough information to make a fully informed decision as to all possible outcomes. I maintain that is not the case. The user starts tinkering with the functionality of the program and then wants to hold Logos responsible for any loss resulting from his ill-informed tinkering. Jim's advice constitutes an implied warranty that, if you first read the posts, you may then tinker to your heart's content. That is the "lawyer's hat" that doesn't seem to fit programmers very well. But I bet Bob has a couple of those types hiding in the wings that look good wearing the hat.

Sure. I understand. Perhaps I should have said: "there is nothing illegitimate, unusual or inherently dangerous in telling your firewall to block an IP address", as it was that I had referred to. I actually read this whole thread before posting as I didn't want to repeat old points - these threads have seen more than enough repetition and posturing[:)]

But I will repeat: configuring your firewall does not constitute tampering with any program. It has the same effect as running a program without any internet connection and, therefore, the software has to handle it.

A persuasive legal argument can be made that your "warning" to unsavy users who may follow your directions and suffer harm is not adequate and Logos is "negligent" for allowing the instructions to remain on the website. Are you trying to set Logos up for lawsuits or challenge them to protect forum readers from irresponsible advice? 

OK - I give up.

Don't do anything I say, the risk is too high.

It's not irresponsible advice. The officially recommended way of going offline is to set  "Use Internet" to "No".  That will stop data synchronization and update downloads and whatever else.  It will stop data backup from occurring.

The unsupported way talked about here is to use a firewall to block a subset of the communications that "Use Internet = No" will block (The hostname to block is sync.logos.com). This too will block data synchronization and data backup.  So for those items it is no different that setting "Use Internet" to "No".  But it will allow Logos4 to connect to other backend services such as resource updates, program updates and metadata updates. Another benefit to using firewall blocking is the constant visual reminder that your data isn't being sync'd or backed up: the sync arrows turn into a yellow caution sign when the sync fails:

Note that setting  "Use Internet" to "No" lacks this visual
feedback that syncing has stopped. It's happened several times on the forum where someone has forgotten they set it to "No". The sync arrows are gone when "Use Internet" is "No", but there is no caution sign telling you that data isn't being backed up:

So, all in all, I think that firewall blocking is a better solution than turning off all internet for those who are concerned about their data (not me, of course, I like the backup [Y]), plus it has no practical downfalls.

Not to bring a 'dead horse' back to life, but after all the discussion back in April/May concerning privacy concerns, I'd concluded that the setting 'Use Internet' = NO and 'Automatically Download Updates' = NO and 'Send Feedback' = NONE would mean no internet traffic back to Logos (absent a manual update). But recently I've noticed L4 happpily autoomatically connecting to Logos with these settings. I know Bob's famous quote 'If you care enough that you want to know which algorithms, etc. then you're probably wiser to just disconnect your computer from the Internet physically. ' is pretty  much the bottom line for Logos & Co. But I'd been comfortable with these settings until now. Luckily I can also set my virus protector to block Logos (which I've done), but it just seems like courtesy would dictate otherwise. I have 4.0d SR2. Do the settings actually work?

So far my solution is to simply remove my data from Logos, and put it into a piece of software that allows me both to encrypt the data I sync onto a cloud server and to specifically choose which data to sync. That cripples the functionality of Logos, so I'm not getting all the value I can from my roughly $5k or more investment, but, well, Logos has decided that they either can't code this functionality, or can't support it.

I, personally, would gladly rebuy all the resources I have in another piece of software if I could actually use the software as designed and still keep my privacy.I understand a lot of folk here are willing to sell their privacy for money, counting privacy to be of little value, but you should hear the gasps when I start showing the high school kids in my networking class what someone can figure out about you with what you put online every day.

For anyone who's said, on this board, that privacy just isn't important, I hear they have a perfect new piece of software that will tweet your location from the GPS embedded on your phone every minute or so. How convenient would that be? Your spouse and kids can just follow your tweets to figure out where you are at any given time! If you are ever injured, or attacked, think about how fast someone could find out where you are, and come to your aid! What a wonderful idea, right?

As Logos is the only game in town resource wise, I just have to live with crippled software because I value my privacy. But don't let me stand in the way of "progress."

Russ

I guess everyone's mileage varies, but, for me, the disabling of Logos's Internet features doesn't 'cripple' it. It restricts it, sure, but my main purpose for using it - Bible study, remains relatively unaffected. Logos4 in that scenario, for me, is at about the same level of effectiveness as Logos3. But with a much nicer interface.

Actually, my current strategy is to:

• Let Logos have Internet access
• Not allow it to auto-update - it lets me know when they are available but I choose when it updates
• I do not use Notes or Prayer lists or allow Logos to send report of how I use it. I only highlight things that would never embarrass me if other people knew what I had highlighed

These 'restrictions' are offset by the fact that I use Logos (3 & 4) 99% of the time for Greek studies, comparing translations etc, so it's more 'academic' than 'personal'. Also, now that the COM API is getting more usable (in the current Beta at least) I am able to write a pretty decent Notes system of my own that uses Logos but is not tied into Logos. And yes, that involves writing my own Word Processor. But I'm a programmer and actually enjoy doing these things[H]

That doesn't mean that I think Logos's current strategy is 'right', 'best' or even 'good'. Far from it. But I have found a way, for me, that ignores the bits I don't like and still allows me to use the bits that I do like. But I have the advantage of literally being able to 'code around' the deficiencies this strategy causes.

When my program is 'finished' (as if programs are ever really finished) it is my intention to make it freely available... But my secular work is busy at the moment, so I can't say when that might be...

Andy

Ok, put the dead horse back in the ground. I figured out the problem. Logos responds to turning ON the internet session without leaving. But turning it OFF seems to require exiting the program. Since L4 is not exactly the young whippersnapper of software, I rarely exit the program. I'm no privacy addict, but I did spend many years in high-end data mining and was a speaker at various conferences. And so just as good manners, I sort of expect software to not demand intrusiveness, no matter 'the world is changing'.