Security and Privacy Concern about Logos4 Phonning Home

Peace to you, Jonathan!  

Well-spoken!   *smile*

And my comments should extended not only to MVP's but all users for that matter. 

Andrew, the question in my mind that you have not addressed is the appropriate response to incorrect "information." My concern is that a number of forum users will not recognize it as the personal opinion of the poster rather than a fact about Logos. To me this is similar to providing accurate information about Logos features and their use. What response do you see as appropriate?

MJ I did want to comment no longer but you have brought me back into.  My primary concern is with MVP's attitudes in their response and not if they are responding to mis-information, but those concerns about attitude  should and do extend to all posters.

1) Right or Wrong, fair or not, MVP'S are seen as representatives of this company

2) The way in which they respond should be inline with point #3 of the forum guidelines.  If they are not inline with those guidelines how can then place that expectation upon ordinary forums members. I'm not suggesting strict perfection in adherence to these guidelines.  None of us perfect and there are few who could claim complete adherence to them at all times.

However I think #3 is a big one because it is based upon sound scriptural principles and we ALL should be aiming to follow for this very reason.

The following is an example  of the sort of response by an MVP that is not inline with point #3 and  or the way Christ expects us to treat one another.  Claiming forum user mis-information is not a justification for this sort of response from an MVP.

It may be appropriate to say this sort of thing to a friend in jest about a situation but is not appropriate to say to someone who is a paying customer of the company whom you are representing.  If I had ever spoken to a customer of any company that I have worked for I would be soon no longer working for that company.

3) Laying aside for a moment, this response is from a designated leader of this community, the response is an absolute disgrace and right now my spirit is grieved to see people speaking to one-another in this manner on a forum where we all claim we are here to study the Word of God. Nobody else seems to have the courage of conviction to call this for what it is, and that also concerns me, but is another matter.  Instead they just want to say justify the first wrong and say look at that fellow over there he's much worse, or they join in and extend on these sort of baited comments picking up and throwing stones. In the garden the serpent was very clever and turned the question around on someone else to hide his own departure from the truth.  There is nothing new under the sun, once again we are seeing humanity following the serpent's lead and trying to turn the light away from a very poor attitude displayed by some sections of the leadership of this community, by pointing the finger at another. The leadership of this community (like it or not MVP's that you) need to get their house in order,and I am sorry I know this doesn't apply to all MVP's, some of you do a fabulous job of trying to meet guideline #3, despite having your own personal convictions and desires on some of the issues under discussion.

So my mind I have addressed is the appropriate response to incorrect "information." in terms of how you go about responding to it. If you missed it do it in grace, with love, humility and devoid of your own personal philosophy or desires when you are specifically dealing with an instance of clear incorrect information, and preferably have information that you can readily refer the person.   Surely it is not up to me to give the "What" to say in these instances.  If Logos has placed MVP's in this position of responsibility surely they have instructed you, after all MVP's are representing Logos Bible Software, and they given you appropriate contacts to which you can escalate a thread if you feel if you don't have the correct information on hand to back up what you are saying in your own word.  If they haven't then I am sorry you are in this situation, but it is still is no justification for the sort of response I use as an example above.

This will be my last post on this thread (I hope). And simply to say that when I originally read the MVPs post referenced above, it did not occur to me at all that it could be construed as violating the forum guidelines, or of being rude, etc. It still doesn't look that way to me. (And in fairness to the MVP, it does need to be read in the context of the two threads, and viewed in the light of some pretty harsh things that were said there.)

That said, I understand why some took it another way. Yesterday I told my wife that she'd just made the best gravy I'd tasted for months. That's a pretty big compliment. Did she take it that way? Not a hope - apparently I'd insulted the last six months worth of her gravy-making!! In web forums, it's even harder to get nuance across.

For those reasons, you're right to point out the need for grace as we formulate our replies. But there's also a real need for grace in the way that we need replies.

Russ, I agree no analogy is perfect. But an analogy can function as support for an argument without being perfect. Your analogy cannot function as support for your argument, because on the very points at which it was supposed to represent Logos accurately, it did not represent Logos accurately.

I'm aware that you don't want to turn Logos into a Word processor. I'm aware that you want it to be made secure in the way you want it to be secure. I can sympathize with that, even though it is completely irrelevant to my needs because I just don't have a need for Logos to be a program which stores my personal private data. I have other programs which already store my personal private data, so I don't need another one. If I needed Logos to store my personal private data securely, I'd be asking for it too. But I don't have a need to store personal private data in the cloud.

I have no objection to you making your case for Logos to add a function to secure private data that you think it should keep for you. I have an objection to you referring to the entire program as 'broken' simply because it doesn't have a non-core feature you would prefer it to have.

I believe there's a far stronger case to be made for referring to Logos as 'broken' on the grounds that it doesn't contain what were core features in previous iterations, but absence of non-core features appearing on a personal wishlist? That's not 'broken'. Logos lacks a long list of non-core features I'd like to see it have, but that doesn't mean it's 'broken'.

I have no objection to you making your case for Logos to add a function to secure private data that you think it should keep for you. I have an objection to you referring to the entire program as 'broken' simply because it doesn't have a non-core feature you would prefer it to have.

1. Your objections to my analogies missed the point.

2. You don't consider security and privacy to be "core features." I do.

My point about the door locks is the same thing --in some communities door locks are not considered a "core feature" of the house. In others, buying a house without door locks would be tantamount to putting a sign on your front porch that says, "rob me please." Some people seem to think that the Internet is the sort of community where people won't rob you because you don't think the item is of value. The reality is people will rob you of data you don't think is important on the Internet in a heartbeat. One man's junk is another man's treasure.

The link to your mother on a social networking site is valuable information. In fact, all your links on a social networking site are valuable information to someone. Your birthdate on a social networking site, or anyplace else, is valuable information. The place you were born is valuable information. Yes, even that sort of "minor" stuff is valuable. I'll be glad to explain how, if you're really interested.

That person X is having marital trouble is extremely valuable information to someone, somewhere --in fact, it might even be actionable information that could be subpoenaed in a court of law. And the way the law currently reads, and is implemented, when a Pastor's prayer list from Logos is placed in a court record, everything on the hard drive that contained that prayer record is also placed in the court record, in full public view. Not many people realize that, I know, but that's simply the way it is. I'm pretty certain I actually pointed to a specific case somewhere in this thread.

So, the bottom line is just what I said above --you don't consider privacy a core feature. I do. When a company makes a piece of software that really only works as advertised if I enter my data into it, I expect that software to provide me the means to protect that data, whether or not you, or anyone else, thinks the information I'm entering is valuable.

It's that simple.

Oh yes, Facebook, email, and twitter. But the core point of those systems is to share information.The core purpose of Logos is a research tool, not an alternative to Facebook. I understand, fully, how a community on the notes side would be interesting and useful --think of the application in a theology class --but I'm not going to go there until I have control over my notes.

But anyway, this is my last post on the topic --I've said these things a hundred times over, and yet people still don't understand how valuable data about you is. The only "safe" way to operate on the Internet is to assume that someone, somewhere, will find a use for anything you put there, store there, or say there, and that someone will stand ready to acquire that data, legally or otherwise, when that use is found. Protect what you can, no matter whether or not you think it's "valuable," because the Internet's memory is permanent, and the number of eyes looking practically infinite.

If the Logos community doesn't want to take this threat seriously, even though it's coming from someone who really ought to know (a network engineer who works extensively in the security space, and deals with private data on a regular basis) --well, at least I've posted the warning signs.

I'm happy that Bob is considering the features he is in this space.

Russ

P.S. It seems what people want to beat me up over is calling Logos 4 "broken" because it doesn't take privacy into account. "Just don't use the notes and prayer lists." What bothers me about this response is that if you go to the Logos web site the resources and searches aren't the only things advertised and promoted. Notes are as well. Notes are not just an "add on," that happened to be thrown in there, they're an integral part of the software. For instance --notes allow you to link to, and link from, Scriptures to other resources. You can place individual notes on the toolbar. The feature, overall, is well thought out, and well integrated. Notes are actually more like the seats in the car than the radio. While you might be able to drive the car without the seats (I know people who have, actually), it's not a comfortable or optimal experience. If Logos hadn't made the notes a core piece of the software themselves, I would say there's an argument to be made --but they did, and hence your perception of how "broken" the software is without notes will vary.

Logos have made it clear time and time again that their program is not intended to be a repository for personal and private data, and have warned against using it for that purpose. It's that simple.

Hi Jonathan,

This is just my opinion, but this is the area, as it relates to prayer requests, where I see Logos speaking out of both sides of their mouths.  They say the program is not intended to be a place for us to store personal or private data.  My question is, "Isn't prayer requests personal information?"  Speaking from a clergy perspective, prayer requests that clergy receive can also be very private.  Therefore, Logos designed this program to store prayer requests that we receive, and then they turn around and tell us not to put in any private or personal data.  This does not make any sense to me, and thus why I say Logos is speaking out of both sides of their mouth.  Again, this is just my opinion.

Jonathan, you also bring up another good question, what is 'valuable data?'  I am going back to use prayer request as an example.  Prayer request do not contain bank account numbers or passwords.  Therefore, does that imply that this data is not 'valuable?'  I personally believe this information should be considered as being extremely  valuable data, and I believe other people would also consider this data valuable.  For an example, let us say that I have in my prayer list "Linda and John Smith are getting a divorce" and "Mary Jones' husband died."  This information is not only valuable to me.  This information is also valuable to the Smiths, to the Jones, and to anyone who makes a living by scamming people who are in these life circumstances.  

I couldn't agree with you more when you said, "My valuable data stays on my local hard drive, and is backed up with an external hard drive which is then relocated. I don't want it in the cloud, because I value it."  I value this information, what I have stored in L4, and this is why I do not want my data in the cloud.  This is why I have turned sync and the call home function for L4 off.

I also have the sync and call home function turned off for another reason, and this reason comes from possible copyright issues.  Most clergy have a file cabinet (or two or three or four) full of resources that she/he might think will be useful someday for a sermon.  These resources could come from a newspaper article, a page from a journal, or be a photocopy of a page in a book.  I have done something similar with my note files.  I have several note files that I store information from various internet sites (workingpreacher.org, textweek.com, crossings.org, and goodpreacher.com to name a few).  All of this information is copyrighted, and I do not have permission to distribute their works of art.  Therefore, I do not want these note files to be sent to cloud because I feel that this would violate copyright laws, (I would be distributing their copyright items without their approval).

Because I have turned these settings off, I must now deal with the repercussions of turning off setting.  When these settings are turned off, not only do we must manually check for updates for the program, we cannot download any new books.  We must purchase the CD and pay the additional postage for the CD.  This is, of course, only works for books that we can order a CD for.  If the book is only available by download, we cannot purchase the book.  Because I cannot purchase any downloadable books, I consider this program as being broken.

This is just my opinion, but this is the area, as it relates to prayer requests, where I see Logos speaking out of both sides of their mouths.  They say the program is not intended to be a place for us to store personal or private data.  My question is, "Isn't prayer requests personal information?"  Speaking from a clergy perspective, prayer requests that clergy receive can also be very private.  Therefore, Logos designed this program to store prayer requests that we receive, and then they turn around and tell us not to put in any private or personal data.  This does not make any sense to me, and thus why I say Logos is speaking out of both sides of their mouth.  Again, this is just my opinion.

Tom, I appreciate what you're saying and I understand your concern. This particular issue has been discussed before. A number of people pointed out that not all prayer lists are private. Both Logos representatives and other forum members pointed out that Logos provides us with the option of storing prayer lists in Logos 4, and that if anyone has privacy concerns about the vulnerability of that information then they shouldn't upload their private prayer lists to the cloud. A number of us have made the point that we're entirely happy uploading some prayer lists but not others, so those we don't want uploaded we simply don't store in Logos 4.

This is not Logos talking out of both sides of their mouths. It's Logos saying 'We've given you the option of storing prayer lists in Logos 4, but since these prayer lists will be backed up to the cloud you shouldn't store private prayer lists in Logos 4 if you are doubtful of the security of the cloud'. This does not in the least imply that this data is not valuable. On the contrary, it reinforces the value of the data.

It should be remembered that when your data is backed up to the cloud, this does not mean it automatically becomes available to anyone and everyone (reading lists are an exception). People here are talking as if as soon as you move your data to the cloud everyone in the world has access to it, and people can browse your notes and personal prayer lists at will. I don't know why they think that. Perhaps they misunderstand what the cloud actually is.

Nor is our data uploaded to an completely unsecured location. It is uploaded to Amazon's servers, which are recognized in the industry as well secured. In fact their servers are more secure than the average home computer.Your home computer is more vulnerable than their servers.

By warning people that storing personal information on the cloud is inherently risky, Logos are taking the absolutely most conservative and paranoid stance, specifically out of concern for their customers. The fact is that neither your computer nor my computer are as well secured as Amazon's cloud servers, yet both you and I feel our data is safer on our own computer. One reason for this is that Amazon's servers are more likely to be a target for hackers than your or my computer. But this doesn't change the fact that when our information is uploaded to the cloud, it isn't publicly distributed and it isn't uploaded to an unsecured location.

As for copyright concerns, the use of the cloud by Logos to back up your data does not breach copyright. The copyrighted information in your notes is backed up to a remote location. It is not distributed publicly. This does not breach copyright, because you are not breaching the terms of fair use; you are not distributing their data at all. This is no different to backing up your data on a local hard drive.

It should also be pointed out that your decision to switch off the download feature of Logos does not constitute the program being broken. it means you've chosen not to download books. Choosing to use a feature of a program does not mean the program is broken, even if that feature has its inconveniences. In reality there is no reason for you to switch off the internet connection. You are not distributing copyrighted material, and no one is forcing you to store private prayer lists in Logos if you believe that Amazon's servers are insufficiently secure.

Wow!  I have read through most of this  v e r y  l o n g  thread and I am amazed at some people's ability to reason (or lack thereof).  To me this is very simple.  If you are concerned about the security and privacy of your information, then don't store it on L4.  I personally don't have concerns with this issue so it doesn't matter as much to me as it does to some of you.  That's not to say that I don't respect your position.  I do.  It's just that you are using software that has been designed for a specific purpose and it seems that you are trying to go beyond the scope of this purpose (bible study). 

Mark has shown that when you turn internet and updates off, L4 does not phone home.  So those that want to store personal info shouldn't be alarmed about the security of their info if these settings are turned off.  Again, I don't understand what the problem is.  If L4 isn't phoning home when the settings are off, then there is no security issue.

As for the problem of not being able to download new books when these settings are turned off, how about this.  Can you not turn internet off and updating off, and then manually enter the command to update resources without your personal files being synced?  That would seem to solve the problem (at least in my understanding of things).

I would like to add my 2c to this topic.

I do not like having any personal data stored on anyone elses' servers.  The reasons are my own and do not require my explanation to you in this thread.

I have been trying to decide whether to update to L4 or not, and I guess this just made the decision for me.  Let me simply say that I was shocked to find that my data was being sent to Logos servers without my knowledge (ok, it was in the EULA, but most never read that document any more... they are so long and verbose... I know I probably should read each eula for each of the 100 programs installed on my machine, but I have work to do...)....

As long as there is no CHOICE to store my notes on the Logos servers or not, I will choose to stay with Libronix 3...

I sincerely hope that they provide an option in the future...

Till then, it's L3 for me..

Thanks, I am a OneNote junkie, but I love having my notes in my bible program, and the little indications that I have a note attached with a passage...

Logos 3 for me...

1) Make your actual use of L4 on a computer that's never on the internet. Do your program and resource updates on a computer that is on the internet. Use the techniques described on the wiki to move your updated program / resources from the internet PC to the offline PC.

That sounds like a really good option, for those who are concerned about such things. Assuming they can afford to have two computers, that is.

Of course, while you're doing sermon prep, there will probably be times when you want to go out to the Web to Google something. In that case, if you want to do it all from the same computer (to be able to easily copy/paste into a Word document that you're working on your sermon in), you'd have to close Logos first to be sure no sync took place while you were connected to the Internet. Then be sure to unplug your Internet connection before starting Logos back up again. This method (if you're going to allow yourself some occasional Internet connection on that computer) is prone to human error, though. It would be easy to forget to shut down Logos sometime.

Donnie, thanks for your suggestions, all are great and creative, technically I appreciated the use of the dyndns method... . However they cripple the rest of the software in the process. The best possible option is still for logos to fix this properly.
One of the difficulties is that logos could start using another server at any time and several of these methods would suddenly allow data to be sync'd without the user's knowledge.
The safest option for me is to use l3 whilst I wait for a "fix" for L4..