Hmm. On chimera nothing ..
Maybe i'm holding it wrong ?

No, I just forgot the package name, it's libkuserfeedbackcore1.

apt --no-install-recommends install <package>

Redshift will install without geoclue this way. (Edit: and without avahi-daemon.)

apt rdepends zeitgeist

will show packages that depend on zeitgeist. I don't know an easy way to get Recommends or Suggests.

The list is quite enlarged when using addional wildcards (incl Suggests, Reverse Depends, etc). Just typed it, becasue the original list was to small.

apt rdepends *zeitgeist*

Edit: Typo (hm .. no spell checker when using this computer. There might be more)

Yes, but that will only tell me if any package installed in a system has zeitgeist as a dependancy.

I was referring to a scan of the whole Devuan package database which has that information.
Just have to weed it out but I don't have a clue.

I have never (ever) been able to make any sense of regex but I'm sure there's a way.

Adding a reverse dependency search box to do that would be a great addition to the database page, very useful in instances like this one.
Which I fear will become the norm.

I'll have a look.

Thanks for your input.

Best,

A.

d1thy wrote:

I thought that i would make this thread, just in case any of you would like to make an "honorable mention" of 'whatever package' you see as doing unnessecary datacollection, or having unnessecary dependencies on some tracking/mining/leaking package.

Several KDE apps on Debian have been compiled with a dependency on kuserfeedback, which continues to collect data even when the relevant setting is supposedly turned off.

$ apt rdepends kuserfeedback-bin
kuserfeedback-bin
Reverse Depends:
$ apt search kuserfeedback-bin
Sorting... Done
Full Text Search... Done
kuserfeedback-bin/stable 1.0.0-3 amd64
  user feedback for applications - executables
$ 

Hmm. On chimera nothing ..
Maybe i'm holding it wrong ?

Just like digitally logging your conversations is not recording, nor is it surveillance because noone is listening in real time...But i digress..

Just use equivs to generate "fake" packages to satisfy those dependencies without providing the functionality.

Appreciate that !
Learning something new :-)

A few weeks ago, i installed redshift, in order to change colortemp on my screen.
But.. It wanted to install 'geoclue-2.0' and 'iio-sensor-proxy' too.

Just use equivs to generate "fake" packages to satisfy those dependencies without providing the functionality.

To do this create a file called geoclue-2.0.ctl with this content:

Package: geoclue-2.0-dummy
Provides: geoclue-2.0
Conflicts: geoclue-2.0
Description: geoclue-2.0 dummy package

Then run

equivs-build geoclue-2.0.ctl
dpkg -i geoclue-2.0-dummy*.deb # as root

Use the same technique with any other "fakes" that may be required.

I wonder if there's a way to scan the whole Debian/Devuan package information database to filter the packages that list zeitgeist (or its libraries) as a suggests or depends.
.

apt rdepends zeitgeist

will show packages that depend on zeitgeist. I don't know an easy way to get Recommends or Suggests.

Maybe some good tips here: https://dev1galaxy.org/viewtopic.php?id=511

I thought that i would make this thread, just in case any of you would like to make an "honorable mention" of 'whatever package' you see as doing unnessecary datacollection, or having unnessecary dependencies on some tracking/mining/leaking package.

Several KDE apps on Debian have been compiled with a dependency on kuserfeedback, which continues to collect data even when the relevant setting is supposedly turned off.

KDE have claimed that it's ok to generate the data because it's not uploaded.

I've tried compiling my own version of the relevant library with all data collection functionality actually removed, but the compilation process is a massively over-convoluted mess, and I've not yet been able to get a shared object with a compatible interface.

Good idea, but I think (like in the case of your example) that it may be more a dependency thing.

eg: my box runs Devuan Beowulf with a backported kernel.

~$ uname -a
Linux devuan 5.10.0-0.deb10.16-amd64 #1 SMP Debian 5.10.127-2~bpo10+1 (2022-07-28) x86_64 GNU/Linux
~$ 

I don't have zeitgeist installed.

~$ apt list | grep installed | grep -i zeitgeist
--- snip ---
~$ uname -a

But if I ask aptitude about zeitgeist, I get this information:

~$ aptitude why zeitgeist
i   desktop-base           Suggests gnome | kde-standard | xfce4 | wmaker
p   gnome                  Depends  totem-plugins                        
p   totem-plugins          Suggests totem-plugin-zeitgeist               
p   totem-plugin-zeitgeist Depends  libzeitgeist-2.0-0 (>= 0.3.2)        
p   libzeitgeist-2.0-0     Suggests zeitgeist-core | zeitgeist           
~$ 

I wonder if there's a way to scan the whole Debian/Devuan package information database to filter the packages that list zeitgeist (or its libraries) as a suggests or depends.

It would be really interesting to see what comes up.

Any ideas?
Maybe contacting the database maintainer/s?

Best,

A.

A few weeks ago, i installed redshift, in order to change colortemp on my screen.
But.. It wanted to install 'geoclue-2.0' and 'iio-sensor-proxy' too.
As it is redshift works fine, for me, without them, but i don't want any privacyleaking 'utilities' forced upon me.

Now...
Having read https://dev1galaxy.org/viewtopic.php?id=5406, it is also mentioned that GTK4 has hard dependencies to similar packages.

I did not know that, but luckily pungentweasel did, and chose to share the info.

So.....

I thought that i would make this thread, just in case any of you would like to make an "honorable mention" of 'whatever package' you see as doing unnessecary datacollection, or having unnessecary dependencies on some tracking/mining/leaking package.