{"package": "openjet_runtime (the runtime in the 9B model repository)", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a runtime library", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "apus-openjev-v1-82c9c56c-9b-repository/none", "product": "APUS-OpenJev-v1", "slug": "apus-openjev-v1", "version": "82c9c56c", "version_read_utc": "2026-10-10", "build": "the 9B model repository on Hugging Face at revision 82c9c56c", "os": "not run: the runtime is Python", "arch": "any", "install_method": "not installed: the repository's code files read at revision 82c9c56c", "group": "research engines and model repositories we read", "sends_by_default": "none_found", "answer_cell": "none found · code read at 82c9c56c: its runtime loads only local files", "look_depth": "code_read_call_sites", "licence": {"name": "apache-2.0", "source": "the licence in the repository's model card metadata", "read_utc": "2026-10-10"}, "grade": "read", "method": "every network call enumerated in openjet_runtime/ and examples.py at revision 82c9c56c (Python requests, httpx, urllib, aiohttp, socket, grpc, websockets, huggingface_hub downloads): none; its imports are torch, transformers and the standard library, and it loads with local_files_only", "receipts": [{"label": "the model and tokenizer load local files only", "url": "https://huggingface.co/apus-ailab/APUS-OpenJev-v1-9B/blob/82c9c56cfa9de8d36704ed91948d4726ef111635/openjet_runtime/runtime.py#L48-L62", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "ComfyUI (core)", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-09-28", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": {"value": "partly", "text": "Its README makes one statement about the core's network use: \"Works fully offline: core will never download anything unless you want to.\" We did not read the code against it.", "links": ["https://github.com/Comfy-Org/ComfyUI/blob/b0d9708974f50fce7d2448ac84e9260c87f7ade3/README.md?plain=1#L110"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "comfyui-b0d97089-source/core-none", "product": "ComfyUI", "slug": "comfyui", "version": "b0d97089", "version_read_utc": "2026-09-28", "build": "the core at commit b0d97089", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at commit b0d97089", "group": "servers and apps you run", "sends_by_default": "not_read", "answer_cell": "not read · a keyword search found nothing", "look_depth": "code_read_keyword", "licence": {"name": "GPL-3.0", "source": "the licence GitHub reads for Comfy-Org/ComfyUI (formerly comfyanonymous/ComfyUI)", "read_utc": "2026-10-10"}, "grade": "read", "method": "a search of the core's Python files for telemetry names at b0d97089; its network calls were not enumerated", "receipts": [{"label": "the core at b0d97089", "url": "https://github.com/Comfy-Org/ComfyUI/tree/b0d9708974f50fce7d2448ac84e9260c87f7ade3", "kind": "primary"}], "last_read_utc": "2026-09-28"}
{"package": "comfyui-frontend-package 1.37.11 (the frontend the core pins)", "condition": "in a browser that opens ComfyUI's web UI", "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "error events, if the SDK captures any (its automatic integrations are off in this build, and no capture call outside it was found)", "class": "diagnostics"}], "when": "Your browser, from the tool's web UI: the SDK starts when the page loads, if a build flag is on (its value in the shipped package was not read); whether it sends anything without a capture call was not read. Not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "error tracker", "hosts": [{"name": "<vendor's project>.ingest.us.sentry.io", "provenance": "asked"}], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": "none found", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": ["the frontend's sign-in features, whose start-up code was not read for calls", "opening the UI in a browser (the browser arm is owed)"], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": null, "none_found": "none found in the frontend's README at v1.37.11 and the core's README at b0d97089, read 2026-10-10", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "none_found", "text": "None found in the frontend's README at v1.37.11 or the core's README at b0d97089, read 2026-10-10.", "links": ["https://github.com/Comfy-Org/ComfyUI_frontend/blob/4bf6a1960028cc5cda57d48f9fb01a74dfaade43/README.md", "https://github.com/Comfy-Org/ComfyUI/blob/b0d9708974f50fce7d2448ac84e9260c87f7ade3/README.md"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [{"text": "Outside the cloud build, the SDK starts with its default integrations off, so it adds no global error handlers.", "source": "https://github.com/Comfy-Org/ComfyUI_frontend/blob/4bf6a1960028cc5cda57d48f9fb01a74dfaade43/src/main.ts#L55-L62", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "The SDK's start takes its on-or-off from a build-time flag that is on only when the build had an error-tracker address set and was not a development build; the value in the shipped package was not read for this row.", "source": "https://github.com/Comfy-Org/ComfyUI_frontend/blob/4bf6a1960028cc5cda57d48f9fb01a74dfaade43/vite.config.mts#L489-L492", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "comfyui-b0d97089-source/frontend-sentry", "product": "ComfyUI", "slug": "comfyui", "version": "b0d97089", "version_read_utc": "2026-10-10", "build": "the core at commit b0d97089 with the frontend it pins, 1.37.11", "os": "not run: the frontend runs in your browser", "arch": "any", "install_method": "not installed: the frontend's source read at tag v1.37.11", "group": "servers and apps you run", "sends_by_default": "unclear", "answer_cell": "unclear · read in code: an error tracker's SDK starts in your browser when you open the UI, if a build flag is on (its value in the shipped package was not read); no call that sends a report was found outside the SDK", "look_depth": "code_read_keyword", "licence": {"name": "GPL-3.0", "source": "the licence GitHub reads for Comfy-Org/ComfyUI_frontend", "read_utc": "2026-10-10"}, "grade": "read", "method": "the frontend's src/main.ts read at tag v1.37.11, and the core's requirements.txt at b0d97089 for the pin; our read of the bundled JavaScript on 2026-09-28 found no capture call outside the SDK", "receipts": [{"label": "the SDK's start, with default integrations off outside the cloud build", "url": "https://github.com/Comfy-Org/ComfyUI_frontend/blob/4bf6a1960028cc5cda57d48f9fb01a74dfaade43/src/main.ts#L46-L62", "kind": "primary"}, {"label": "the build-time flag", "url": "https://github.com/Comfy-Org/ComfyUI_frontend/blob/4bf6a1960028cc5cda57d48f9fb01a74dfaade43/vite.config.mts#L489-L492", "kind": "primary"}, {"label": "the core's pin on the frontend", "url": "https://github.com/Comfy-Org/ComfyUI/blob/b0d9708974f50fce7d2448ac84e9260c87f7ade3/requirements.txt#L1", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "ComfyUI-Manager (a custom node, at commit e11e9034)", "condition": "when the Manager loads its node lists; its README says a setting decides whether the channel's database is retrieved at startup, and the code leaves that setting off by default; whether anything else at ComfyUI's start triggers it was not read", "call_kind": ["fetches"], "trigger": "on_request", "sends": [{"field": "requests for its channel's node lists", "class": "request"}], "when": "The code at e11e9034 reads its node lists from its channel URL while network_mode is 'public', its default; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "code host", "hosts": [{"name": "raw.githubusercontent.com", "provenance": "asked"}], "switch": {"name": "network_mode = offline", "value": "offline", "accepted_values": ["public", "private", "offline"], "values_tested": [], "kind": "a line in ComfyUI-Manager's config.ini", "where_set": "in ComfyUI-Manager's config.ini, then restart ComfyUI", "other_spellings": [], "also_turns_off": ["installing and updating custom nodes from the channel"], "cost_of_off": "custom-node installs and updates use only the copy of the node list already on disk (its README: \"Uses cache if available\")"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "`Channel (1day cache)` utilizes Channel cache information with a validity period of one day to quickly display the list.", "source": "https://github.com/ltdrdata/ComfyUI-Manager/blob/e11e9034ce7b3b27380f0467bbe242416198e41e/README.md?plain=1#L103", "where": "its README at e11e9034, the installer dialog's database modes (a whole list item)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its README describes the channel, the three database modes with the one-day channel cache, the network_mode setting with its three values, and a setting that decides whether the channel's database is retrieved at startup; it does not name the host.", "links": ["https://github.com/ltdrdata/ComfyUI-Manager/blob/e11e9034ce7b3b27380f0467bbe242416198e41e/README.md?plain=1#L102-L110", "https://github.com/ltdrdata/ComfyUI-Manager/blob/e11e9034ce7b3b27380f0467bbe242416198e41e/README.md?plain=1#L265-L283"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "comfyui-b0d97089-source/manager-channel", "product": "ComfyUI", "slug": "comfyui", "version": "b0d97089", "version_read_utc": "2026-10-10", "build": "ComfyUI at b0d97089 with ComfyUI-Manager at commit e11e9034", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: ComfyUI-Manager's source read at commit e11e9034", "group": "servers and apps you run", "sends_by_default": "yes", "answer_cell": "yes · read in code: in its default mode it reads its node lists from GitHub", "look_depth": "code_read_keyword", "licence": {"name": "GPL-3.0", "source": "the licence GitHub reads for ltdrdata/ComfyUI-Manager", "read_utc": "2026-10-10"}, "grade": "read", "method": "glob/manager_core.py read at commit e11e9034 (the commit of the copy we read on 2026-09-28, named on 2026-10-10)", "receipts": [{"label": "the default channel", "url": "https://github.com/ltdrdata/ComfyUI-Manager/blob/e11e9034ce7b3b27380f0467bbe242416198e41e/glob/manager_core.py#L51", "kind": "primary"}, {"label": "the default network mode", "url": "https://github.com/ltdrdata/ComfyUI-Manager/blob/e11e9034ce7b3b27380f0467bbe242416198e41e/glob/manager_core.py#L1747", "kind": "primary"}, {"label": "the node list fetched from the channel", "url": "https://github.com/ltdrdata/ComfyUI-Manager/blob/e11e9034ce7b3b27380f0467bbe242416198e41e/glob/manager_core.py#L846-L857", "kind": "primary"}, {"label": "the startup setting's default (off)", "url": "https://github.com/ltdrdata/ComfyUI-Manager/blob/e11e9034ce7b3b27380f0467bbe242416198e41e/glob/manager_core.py#L1737", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "ds4", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "Its download script fetches model files from Hugging Face when you run it.", "source": "https://github.com/antirez/ds4/blob/0aaea5a238fb41a35106a551e73c8409dfb751ac/download_model.sh#L562", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "dwarfstar-0aaea5a2-source/none", "product": "DwarfStar (ds4)", "slug": "dwarfstar", "version": "0aaea5a2", "version_read_utc": "2026-10-10", "build": "the source at commit 0aaea5a2", "os": "not run: the source applies to every platform it builds", "arch": "any", "install_method": "not installed: source read at commit 0aaea5a2", "group": "research engines and model repositories we read", "sends_by_default": "none_found", "answer_cell": "none found · code read at 0aaea5a2: the engine and its server make no call out; the multi-machine modes and the agent's browser connect only when you turn them on", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for antirez/ds4", "read_utc": "2026-10-10"}, "grade": "read", "method": "every network call enumerated at 0aaea5a2 (C connect, getaddrinfo, gethostbyname, socket, libcurl, NSURL; Python requests, httpx, urllib, aiohttp, socket, grpc, websockets, huggingface_hub downloads): connect() appears only in the agent's browser driver and the opt-in tensor-parallel and distributed modes; the server's socket is its own listener; maintainer scripts and tests are not on the run path", "receipts": [{"label": "the agent's browser driver", "url": "https://github.com/antirez/ds4/blob/0aaea5a238fb41a35106a551e73c8409dfb751ac/ds4_web.c#L178-L190", "kind": "primary"}, {"label": "the tensor-parallel connect", "url": "https://github.com/antirez/ds4/blob/0aaea5a238fb41a35106a551e73c8409dfb751ac/ds4_tp.c#L419-L424", "kind": "primary"}, {"label": "the distributed connect", "url": "https://github.com/antirez/ds4/blob/0aaea5a238fb41a35106a551e73c8409dfb751ac/ds4_distributed.c#L1344-L1411", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "flashinfer-python", "condition": "when a compiled kernel it needs is not already on disk", "call_kind": ["fetches"], "trigger": "on_request", "sends": [{"field": "a download request for the missing kernel file", "class": "request"}], "when": "The code at v0.6.18.post1 downloads a kernel binary at run time, each time one it needs is not on disk; we did not run it.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "download server", "hosts": [{"name": "edge.urm.nvidia.com", "provenance": "asked"}], "switch": {"name": "FLASHINFER_NO_DOWNLOAD", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": [], "also_turns_off": ["any kernel not already on disk: the library refuses to download it and stops with an error"], "cost_of_off": "it fails closed: stage the kernels first with the flashinfer-cubin package"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "Core package that compiles/downloads kernels on first use", "source": "https://github.com/flashinfer-ai/flashinfer/blob/8bc3b578027791336c6ae87db5c9d76f82cef8bc/README.md?plain=1#L97", "where": "README at v0.6.18.post1, the line for flashinfer-python (a list item, quoted whole)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "The README says the core package downloads kernels on first use and how to pre-install them; it does not name the host or the switch.", "links": ["https://github.com/flashinfer-ai/flashinfer/blob/8bc3b578027791336c6ae87db5c9d76f82cef8bc/README.md?plain=1#L95-L106"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": ["vllm-0.30.0-source/usage-report"], "installed_by_packages": [], "also_know": [{"text": "vLLM 0.30.0 pins this version in its CUDA requirements; SGLang 0.5.20 pins FlashInfer 0.6.18, one release earlier.", "source": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/requirements/cuda.txt#L13-L18", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "flashinfer-0.6.18.post1-source/kernel-download", "product": "FlashInfer", "slug": "flashinfer", "version": "0.6.18.post1", "version_read_utc": "2026-10-10", "build": "the source at tag v0.6.18.post1", "os": "not run: the source applies to Linux with an NVIDIA card", "arch": "x86-64 and aarch64 with CUDA", "install_method": "not installed: source read at tag v0.6.18.post1", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · read in code: when a kernel binary it needs is missing", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for flashinfer-ai/flashinfer", "read_utc": "2026-10-10"}, "grade": "read", "method": "flashinfer/jit/cubin_loader.py read at tag v0.6.18.post1. The source at the tag; we did not check that the released wheel matches it.", "receipts": [{"label": "the default download address", "url": "https://github.com/flashinfer-ai/flashinfer/blob/8bc3b578027791336c6ae87db5c9d76f82cef8bc/flashinfer/jit/cubin_loader.py#L35-L38", "kind": "primary"}, {"label": "the switch, and the download when a file is missing", "url": "https://github.com/flashinfer-ai/flashinfer/blob/8bc3b578027791336c6ae87db5c9d76f82cef8bc/flashinfer/jit/cubin_loader.py#L215-L230", "kind": "primary"}, {"label": "the README's install options", "url": "https://github.com/flashinfer-ai/flashinfer/blob/8bc3b578027791336c6ae87db5c9d76f82cef8bc/README.md?plain=1#L95-L106", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "fwupd (fwupd-refresh.timer)", "condition": "where fwupd is installed: Ubuntu 26.04's desktop and server metapackages recommend it, and Ubuntu's packaging enables its refresh timer at install", "call_kind": ["checks"], "trigger": "background", "sends": [{"field": "a download of the firmware service's metadata", "class": "request"}], "when": "Its timer runs fwupdmgr refresh every hour, with a random delay of up to an hour, except inside containers; the refresh downloads the metadata of the Linux Vendor Firmware Service (LVFS) from cdn.fwupd.org. How often a run finds the metadata old enough to download again was not read. Not wire-checked.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "update service", "hosts": [{"name": "cdn.fwupd.org", "provenance": "asked"}], "switch": {"name": "disable fwupd-refresh.timer", "value": "disabled", "accepted_values": ["disabled"], "values_tested": [], "kind": "a systemd timer", "where_set": "systemctl disable --now fwupd-refresh.timer", "other_spellings": [], "also_turns_off": ["automatic discovery of firmware updates"], "cost_of_off": "you no longer hear about firmware updates, security fixes included, until you refresh by hand"}, "switch_verdict": "not_tested", "switch_verdict_how": "documented behaviour of systemd; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a system service: not a server you reach", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "Refresh fwupd metadata and update motd", "source": "https://github.com/fwupd/fwupd/blob/0a3ee12574d05af621c1c0add6b2df73ac66eaca/data/motd/fwupd-refresh.service.in#L2", "where": "the unit's own Description line at 2.1.1 (quoted whole)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "The unit describes the refresh, and the firmware service's privacy page says what it records for each request (the address and the method requested).", "links": ["https://github.com/fwupd/fwupd/blob/0a3ee12574d05af621c1c0add6b2df73ac66eaca/data/motd/fwupd-refresh.service.in#L1-L24", "https://lvfs.readthedocs.io/en/latest/privacy.html"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "fwupd-2.1.1-1ubuntu3.1-ubuntu-26.04/metadata-refresh", "product": "fwupd", "slug": "fwupd", "version": "2.1.1-1ubuntu3.1", "version_read_utc": "2026-10-10", "build": "the Ubuntu 26.04 package", "os": "Ubuntu 26.04 desktop, x86-64 (a machine of ours, not a stock install)", "arch": "x86-64", "install_method": "the distro's package fwupd 2.1.1-1ubuntu3.1", "group": "Ubuntu and the network software around them", "sends_by_default": "yes", "answer_cell": "yes · read in its unit files, its packaging and the firmware service's documents", "look_depth": "vendor_doc", "licence": {"name": "LGPL-2.1", "source": "the licence GitHub reads for fwupd/fwupd", "read_utc": "2026-10-10"}, "grade": "read", "method": "the refresh unit, its timer, the build file that installs it and the default remote read at tag 2.1.1; Ubuntu's packaging at 2.1.1-1ubuntu3.1 and debhelper's handling of units; the firmware service's privacy page read 2026-10-10", "receipts": [{"label": "the refresh unit", "url": "https://github.com/fwupd/fwupd/blob/0a3ee12574d05af621c1c0add6b2df73ac66eaca/data/motd/fwupd-refresh.service.in#L1-L24", "kind": "primary"}, {"label": "the firmware service's privacy page", "url": "https://lvfs.readthedocs.io/en/latest/privacy.html", "kind": "primary"}, {"label": "the package", "url": "https://launchpad.net/ubuntu/+source/fwupd/2.1.1-1ubuntu3.1", "kind": "primary"}, {"label": "the refresh timer: hourly, with a random delay, not in containers", "url": "https://github.com/fwupd/fwupd/blob/0a3ee12574d05af621c1c0add6b2df73ac66eaca/data/motd/fwupd-refresh.timer#L1-L11", "kind": "primary"}, {"label": "the build installs the timer", "url": "https://github.com/fwupd/fwupd/blob/0a3ee12574d05af621c1c0add6b2df73ac66eaca/data/motd/meson.build#L2-L7", "kind": "primary"}, {"label": "the default remote's metadata address", "url": "https://github.com/fwupd/fwupd/blob/0a3ee12574d05af621c1c0add6b2df73ac66eaca/data/remotes.d/lvfs.conf#L6", "kind": "primary"}, {"label": "the default remote is installed switched on", "url": "https://github.com/fwupd/fwupd/blob/0a3ee12574d05af621c1c0add6b2df73ac66eaca/meson_options.txt#L99-L105", "kind": "primary"}, {"label": "Ubuntu's packaging leaves debhelper's unit handling at its default", "url": "https://git.launchpad.net/ubuntu/+source/fwupd/tree/debian/rules?h=import/2.1.1-1ubuntu3.1#n44", "kind": "primary"}, {"label": "debhelper (13.31ubuntu1, Ubuntu 26.04) enables every installed unit that has an install section", "url": "https://git.launchpad.net/ubuntu/+source/debhelper/tree/dh_installsystemd?h=import/13.31ubuntu1#n408", "kind": "primary"}, {"label": "Ubuntu 26.04's desktop metapackage recommends fwupd", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-meta/tree/desktop-recommends-amd64?h=import/1.570.4#n24", "kind": "primary"}, {"label": "and so does its server metapackage", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-meta/tree/server-recommends-amd64?h=import/1.570.4#n1", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "gradio", "condition": null, "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "the interface's components, inputs, outputs and events, the Gradio version, and whether sign-in is used, in the request's user agent", "class": "usage"}, {"field": "error messages, when an error is reported", "class": "diagnostics"}], "when": "The code at 6.2.0 sends an event when an app is created, when it launches, and on errors, each in a background thread, through huggingface_hub's telemetry sender: a request to huggingface.co whose path names the event; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor telemetry collector", "hosts": [{"name": "huggingface.co", "provenance": "asked"}], "switch": {"name": "GRADIO_ANALYTICS_ENABLED", "value": "False", "accepted_values": ["False"], "values_tested": [], "kind": "environment variable", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": ["analytics_enabled=False when the app builds its interface"], "also_turns_off": ["its version check", "Hugging Face Hub telemetry for that process (it sets HF_HUB_DISABLE_TELEMETRY)"], "cost_of_off": "you are no longer warned that a newer Gradio exists"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code and documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": null, "none_found": "none found in Gradio's environment-variables guide (https://www.gradio.app/guides/environment-variables), read 2026-10-10", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its environment-variables guide names the variable and its default \"True\"; its description line reads only \"Whether Gradio should provide\", and it names neither the version check nor the fields. huggingface_hub's own code notes that Gradio calls its internal sender directly: \"This function is called directly in gradio's analytics because it is not possible to send telemetry from a daemon thread.\"", "links": ["https://www.gradio.app/guides/environment-variables", "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/src/huggingface_hub/utils/_telemetry.py#L102-L109"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "Many model demos and Hugging Face Spaces run on Gradio, and a copy you run yourself carries the same default.", "source": "https://github.com/gradio-app/gradio/blob/94ae32f3dd1c7710eed8a84f5a6d2a77f627139c/gradio/analytics.py#L42-L46", "read_utc": "2026-10-10"}, {"text": "Gradio hands these events to an internal sender in huggingface_hub, which at 1.27.0 does not read HF_HUB_DISABLE_TELEMETRY; Gradio's own switch is the one that stops them.", "source": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/src/huggingface_hub/utils/_telemetry.py#L95-L120", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "gradio-6.2.0-source/analytics", "product": "Gradio", "slug": "gradio", "version": "6.2.0", "version_read_utc": "2026-10-10", "build": "the source at tag gradio@6.2.0", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag gradio@6.2.0", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · read in code", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for gradio-app/gradio", "read_utc": "2026-10-10"}, "grade": "read", "method": "gradio/analytics.py and gradio/blocks.py read at tag gradio@6.2.0. The source at the tag; we did not check that the released wheel matches it.", "receipts": [{"label": "the switch's default 'True'", "url": "https://github.com/gradio-app/gradio/blob/94ae32f3dd1c7710eed8a84f5a6d2a77f627139c/gradio/analytics.py#L42-L46", "kind": "primary"}, {"label": "each event handed to huggingface_hub's telemetry sender", "url": "https://github.com/gradio-app/gradio/blob/94ae32f3dd1c7710eed8a84f5a6d2a77f627139c/gradio/analytics.py#L49-L68", "kind": "primary"}, {"label": "the event the launch sends, and its fields", "url": "https://github.com/gradio-app/gradio/blob/94ae32f3dd1c7710eed8a84f5a6d2a77f627139c/gradio/analytics.py#L117-L180", "kind": "primary"}, {"label": "where an app reads the switch", "url": "https://github.com/gradio-app/gradio/blob/94ae32f3dd1c7710eed8a84f5a6d2a77f627139c/gradio/blocks.py#L1081-L1091", "kind": "primary"}, {"label": "huggingface_hub's sender at v1.27.0: a request to the Hub's telemetry path", "url": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/src/huggingface_hub/utils/_telemetry.py#L95-L120", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "gradio", "condition": "while analytics are on (the default)", "call_kind": ["checks"], "trigger": "background", "sends": [{"field": "a request for the newest Gradio version", "class": "request"}], "when": "The code at 6.2.0 checks for a newer version in a background thread each time an app builds its interface with analytics on; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "update service", "hosts": [{"name": "api.gradio.app", "provenance": "asked"}], "switch": {"name": "GRADIO_ANALYTICS_ENABLED", "value": "False", "accepted_values": ["False"], "values_tested": [], "kind": "environment variable", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": ["analytics_enabled=False when the app builds its interface"], "also_turns_off": ["its version check", "Hugging Face Hub telemetry for that process (it sets HF_HUB_DISABLE_TELEMETRY)"], "cost_of_off": "you are no longer warned that a newer Gradio exists"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": null, "none_found": "none found in Gradio's environment-variables guide (https://www.gradio.app/guides/environment-variables), read 2026-10-10", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its environment-variables guide names the variable and its default \"True\"; its description line reads only \"Whether Gradio should provide\", and it names neither the version check nor the fields.", "links": ["https://www.gradio.app/guides/environment-variables"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "gradio-6.2.0-source/version-check", "product": "Gradio", "slug": "gradio", "version": "6.2.0", "version_read_utc": "2026-10-10", "build": "the source at tag gradio@6.2.0", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag gradio@6.2.0", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · read in code", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for gradio-app/gradio", "read_utc": "2026-10-10"}, "grade": "read", "method": "gradio/analytics.py and gradio/blocks.py read at tag gradio@6.2.0", "receipts": [{"label": "the version check", "url": "https://github.com/gradio-app/gradio/blob/94ae32f3dd1c7710eed8a84f5a6d2a77f627139c/gradio/analytics.py#L88-L103", "kind": "primary"}, {"label": "run only while analytics are on", "url": "https://github.com/gradio-app/gradio/blob/94ae32f3dd1c7710eed8a84f5a6d2a77f627139c/gradio/blocks.py#L1087-L1091", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "huggingface_hub (the hf command-line tool)", "condition": "when you run the hf command-line tool, at most once every 24 hours", "call_kind": ["checks"], "trigger": "on_request", "sends": [{"field": "a request to PyPI for the newest release", "class": "request"}], "when": "Read in code at v1.27.0: at the hf command's start, at most once every 24 hours (a marker file records the last check); a Homebrew install asks Homebrew's registry instead of PyPI; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "update service", "hosts": [{"name": "pypi.org", "provenance": "asked"}], "switch": {"name": "HF_HUB_DISABLE_UPDATE_CHECK", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": [], "also_turns_off": ["the hint about the hf-cli skill"], "cost_of_off": "you are no longer told that a newer hf release exists"}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a command-line tool", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [{"path": ".cache/huggingface/.check_for_update_done (or under $HF_HOME)", "what": "an empty marker file whose age dates the last check", "receipt": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/src/huggingface_hub/cli/_cli_utils.py#L960-L1011"}], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "By default, the `hf` CLI checks PyPI for a newer release at startup (at most once every 24 hours) and prints a one-line yellow warning to stderr when one is available, suggesting `hf update`.", "source": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/docs/source/en/package_reference/environment_variables.md?plain=1#L186", "where": "environment_variables.md at v1.27.0", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its environment-variables page describes the check, its frequency and the switch.", "links": ["https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/docs/source/en/package_reference/environment_variables.md?plain=1#L184-L190"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "huggingface-hub-1.27.0-source/cli-update-check", "product": "huggingface_hub", "slug": "huggingface-hub", "version": "1.27.0", "version_read_utc": "2026-10-10", "build": "the source at tag v1.27.0", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag v1.27.0", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · read in code and in its own documents: when you run the hf command", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for huggingface/huggingface_hub", "read_utc": "2026-10-10"}, "grade": "read", "method": "src/huggingface_hub/cli/_cli_utils.py read at tag v1.27.0 (the check, its once-a-day marker and its request), and its environment-variables page", "receipts": [{"label": "its environment-variables page, HF_HUB_DISABLE_UPDATE_CHECK", "url": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/docs/source/en/package_reference/environment_variables.md?plain=1#L184-L190", "kind": "primary"}, {"label": "the check, its 24-hour marker, and its request to PyPI", "url": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/src/huggingface_hub/cli/_cli_utils.py#L960-L1011", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "huggingface_hub", "condition": "on every request to the Hugging Face Hub", "call_kind": ["reports"], "trigger": "on_request", "sends": [{"field": "the calling library's name and version, huggingface_hub's version, the Python version", "class": "software"}, {"field": "the PyTorch version, and the name of an AI agent it detects (both left out when telemetry is off)", "class": "software"}], "when": "Read in code at v1.27.0: on every Hub request, inside the request's user agent; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "model hub", "hosts": [{"name": "huggingface.co", "provenance": "asked"}], "switch": {"name": "HF_HUB_DISABLE_TELEMETRY", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": ["DO_NOT_TRACK=1"], "also_turns_off": ["the telemetry other libraries send through its send_telemetry function"], "cost_of_off": "none known: its documents name no other effect"}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us. The switch changes the content of a request the library makes anyway, so only a run that reads content could decide it.", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "By default, some data is collected by HF libraries (`transformers`, `datasets`, `gradio`,..) to monitor usage, debug issues and help prioritize features.", "source": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/docs/source/en/package_reference/environment_variables.md?plain=1#L179", "where": "environment_variables.md at v1.27.0", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its environment-variables page says data is collected by default, names the switch, and says DO_NOT_TRACK does the same.", "links": ["https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/docs/source/en/package_reference/environment_variables.md?plain=1#L177-L182", "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/docs/source/en/package_reference/environment_variables.md?plain=1#L230-L232"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [{"text": "The switch is documented, and its code reads DO_NOT_TRACK as the same switch for the telemetry sent through its public send_telemetry function; not tested by us.", "source": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/src/huggingface_hub/constants.py#L251-L255", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "HF_HUB_OFFLINE=1 stops every Hub call: no download, no update check of cached files.", "source": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/docs/source/en/package_reference/environment_variables.md?plain=1#L123-L129", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "huggingface-hub-1.27.0-source/user-agent-fields", "product": "huggingface_hub", "slug": "huggingface-hub", "version": "1.27.0", "version_read_utc": "2026-10-10", "build": "the source at tag v1.27.0", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag v1.27.0", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · read in code: fields in the user agent of every Hub request", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for huggingface/huggingface_hub", "read_utc": "2026-10-10"}, "grade": "read", "method": "src/huggingface_hub/utils/_headers.py and constants.py, and its environment-variables page, read at tag v1.27.0", "receipts": [{"label": "the user agent and the fields telemetry adds", "url": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/src/huggingface_hub/utils/_headers.py#L157-L201", "kind": "primary"}, {"label": "the switch and DO_NOT_TRACK", "url": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/src/huggingface_hub/constants.py#L252-L255", "kind": "primary"}, {"label": "its environment-variables page, HF_HUB_DISABLE_TELEMETRY", "url": "https://github.com/huggingface/huggingface_hub/blob/a7d85da5de06e8b85e94999e7cf985f6e0f9991b/docs/source/en/package_reference/environment_variables.md?plain=1#L177-L182", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "imajev (the code repository; the 4B adapter at revision 11126e8c)", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "imajev-6ee8a2c5-source/none", "product": "imajev", "slug": "imajev", "version": "6ee8a2c5", "version_read_utc": "2026-10-10", "build": "the code repository at commit 6ee8a2c5, its serving path", "os": "not run: the source is Python with a browser playground", "arch": "any", "install_method": "not installed: source read at commit 6ee8a2c5", "group": "research engines and model repositories we read", "sends_by_default": "none_found", "answer_cell": "none found · code read at 6ee8a2c5: its server and playground talk only to your own machine", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for mohit67890/imajev", "read_utc": "2026-10-10"}, "grade": "read", "method": "every network call enumerated at 6ee8a2c5 (Python requests, httpx, urllib, aiohttp, socket, grpc, websockets, huggingface_hub downloads; JS fetch, XMLHttpRequest, net, https, dgram, WebSocket, axios); on the serving path only the playground's requests to its own server and an optional reasoning engine you point at a server you run; the other hits are its benchmark harness and training-data scripts", "receipts": [{"label": "the optional reasoning engine posts to the address you give it", "url": "https://github.com/mohit67890/imajev/blob/6ee8a2c555ca6a3d1de9eceb33f1bd1cfeb268a2/scripts/thought_engine.py#L40-L42", "kind": "primary"}, {"label": "the playground calls its own server", "url": "https://github.com/mohit67890/imajev/blob/6ee8a2c555ca6a3d1de9eceb33f1bd1cfeb268a2/scripts/playground/static/app.js#L716", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "lev", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "lev-0ea955f5-source/none", "product": "lev", "slug": "lev", "version": "0ea955f5", "version_read_utc": "2026-10-10", "build": "the source at commit 0ea955f5", "os": "not run: the source is Python", "arch": "any", "install_method": "not installed: source read at commit 0ea955f5", "group": "research engines and model repositories we read", "sends_by_default": "none_found", "answer_cell": "none found · code read at 0ea955f5: it reaches Hugging Face only when you give it a Hub ID instead of a local folder", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for InterfazeAI/lev", "read_utc": "2026-10-10"}, "grade": "read", "method": "every network call enumerated at 0ea955f5 (Python requests, httpx, urllib, aiohttp, socket, grpc, websockets, huggingface_hub downloads): a checkpoint download when you name a Hub ID, a benchmark-data download, and its training setup on a cloud service", "receipts": [{"label": "the checkpoint download, only for a Hub ID", "url": "https://github.com/InterfazeAI/lev/blob/0ea955f5aee0d56d906121d1779af20fa8b922ed/packages/lev/src/lev/train/checkpoints.py#L37-L39", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "llama-server", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "loopback", "listens_source": "its server README at b11312: the --host flag binds the loopback address by default (tools/server/README.md, line 192)", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-01", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "Downloads by name (-hf) reach Hugging Face by design; --offline (LLAMA_ARG_OFFLINE) forces the cache and prevents network access.", "source": "https://github.com/ggml-org/llama.cpp/blob/0c1e57098bba43ac29e6e3b677cdceebdd22334f/common/arg.cpp#L3932-L3937", "read_utc": "2026-10-10"}, {"text": "The browser arm that would load the web UI and count what it asks for has not run.", "source": "row:llama-cpp-b11312-source/webui-model-browser", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "llama-cpp-b11312-source/server-none", "product": "llama.cpp", "slug": "llama-cpp", "version": "b11312", "version_read_utc": "2026-10-01", "build": "the source at b11312 (commit 0c1e5709)", "os": "not run: the source applies to every platform it builds", "arch": "any", "install_method": "not installed: source read at b11312", "group": "servers and apps you run", "sends_by_default": "not_read", "answer_cell": "not read · a keyword search found nothing in the server", "look_depth": "code_read_keyword", "licence": {"name": "MIT", "source": "the licence GitHub reads for ggml-org/llama.cpp", "read_utc": "2026-10-10"}, "grade": "read", "method": "the server's source searched by name for telemetry at b11312; its own network calls were not enumerated", "receipts": [{"label": "--offline: 'forces use of cache, prevents network access'", "url": "https://github.com/ggml-org/llama.cpp/blob/0c1e57098bba43ac29e6e3b677cdceebdd22334f/common/arg.cpp#L3932-L3937", "kind": "primary"}, {"label": "the server README's flag table", "url": "https://github.com/ggml-org/llama.cpp/blob/0c1e57098bba43ac29e6e3b677cdceebdd22334f/tools/server/README.md?plain=1#L110", "kind": "primary"}, {"label": "the --host flag's default", "url": "https://github.com/ggml-org/llama.cpp/blob/0c1e57098bba43ac29e6e3b677cdceebdd22334f/tools/server/README.md?plain=1#L192", "kind": "primary"}], "last_read_utc": "2026-10-01"}
{"package": "llama-server's web UI", "condition": "when the web UI's model browser is used; the web UI is on by default", "call_kind": ["fetches"], "trigger": "you_asked", "sends": [{"field": "model searches, file lists and model details", "class": "request"}, {"field": "a request for a model catalogue", "class": "request"}], "when": "Your browser, from the tool's web UI: the code at b11312 fetches a model catalogue and Hugging Face model data when its model browser asks; downloads then run through the server. Not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "model hub", "hosts": [{"name": "huggingface.co", "provenance": "asked"}, {"name": "llama.app", "provenance": "asked"}], "switch": {"name": "--no-webui", "value": "set", "accepted_values": ["set"], "values_tested": [], "kind": "command-line flag (env LLAMA_ARG_UI)", "where_set": "on the server's command line", "other_spellings": [], "also_turns_off": ["the whole web UI"], "cost_of_off": "no web UI; the API still answers"}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": ["loading the web UI in a browser (the browser arm is owed)"], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "Adds a stateless Hugging Face Hub data layer: `HuggingFaceService` (GGUF repo search, file tree, model details), its constants/enums/types in `$lib`, GGUF filename analysis (quant + sidecar metadata, shard-set collapsing, size/param parsing) and an `orgOf()` helper on the model name utils.", "source": "https://github.com/ggml-org/llama.cpp/pull/27947", "where": "pull request #27947 (merged 2026-09-30)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "The pull requests describe the model browser and its download pipeline; the server README names the web UI flag but not the browser's requests.", "links": ["https://github.com/ggml-org/llama.cpp/pull/27947", "https://github.com/ggml-org/llama.cpp/pull/27959"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "llama-cpp-b11312-source/webui-model-browser", "product": "llama.cpp", "slug": "llama-cpp", "version": "b11312", "version_read_utc": "2026-10-10", "build": "the source at b11312 (commit 0c1e5709)", "os": "not run: the web UI runs in your browser", "arch": "any", "install_method": "not installed: source read at b11312", "group": "servers and apps you run", "sends_by_default": "unclear", "answer_cell": "unclear · read in code: the web UI's model browser asks Hugging Face and llama.app from your browser; whether opening the UI alone asks was not read", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for ggml-org/llama.cpp", "read_utc": "2026-10-10"}, "grade": "read", "method": "the web UI's Hub service and its constants read at b11312; pull requests #27947 and #27959 (merged 2026-09-30) added them", "receipts": [{"label": "the catalogue address", "url": "https://github.com/ggml-org/llama.cpp/blob/0c1e57098bba43ac29e6e3b677cdceebdd22334f/tools/ui/src/lib/constants/models-discover.constants.ts#L8", "kind": "primary"}, {"label": "the Hugging Face address", "url": "https://github.com/ggml-org/llama.cpp/blob/0c1e57098bba43ac29e6e3b677cdceebdd22334f/tools/ui/src/lib/constants/huggingface.constants.ts#L10", "kind": "primary"}, {"label": "the catalogue fetch", "url": "https://github.com/ggml-org/llama.cpp/blob/0c1e57098bba43ac29e6e3b677cdceebdd22334f/tools/ui/src/lib/services/huggingface.service.ts#L447-L452", "kind": "primary"}, {"label": "the web UI's default and its flag", "url": "https://github.com/ggml-org/llama.cpp/blob/0c1e57098bba43ac29e6e3b677cdceebdd22334f/tools/server/README.md?plain=1#L209", "kind": "primary"}, {"label": "pull request #27947", "url": "https://github.com/ggml-org/llama.cpp/pull/27947", "kind": "pointer"}], "last_read_utc": "2026-10-10"}
{"package": "llama.cpp (a CMake build from source)", "condition": "during a CMake build with the default options, when no web UI files were built or placed locally", "call_kind": ["fetches"], "trigger": "on_request", "sends": [{"field": "a request for the web UI archive's checksum file, then for the archive, for the build's version and, failing that, for 'latest'", "class": "request"}, {"field": "your Hugging Face token, as an Authorization header, when HF_TOKEN is set in the build's environment", "class": "credential"}], "when": "During the build, when no web UI files were built or placed locally: the default CMake option downloads a prebuilt web UI from a Hugging Face bucket, the checksum file first and then the archive, skipping the archive when a copy already on disk matches the checksum; a later build of the same version whose stamp matches skips the request.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "model hub", "hosts": [{"name": "huggingface.co", "provenance": "asked"}], "switch": {"name": "-DLLAMA_USE_PREBUILT_UI=OFF", "value": "set", "accepted_values": ["set"], "values_tested": [], "kind": "CMake option", "where_set": "on the cmake command line", "other_spellings": [], "also_turns_off": ["the prebuilt web UI: unless you place the UI files in tools/ui/dist or build them with -DLLAMA_BUILD_UI=ON (npm), the server is built without an embedded web UI"], "cost_of_off": null}, "switch_verdict": "not_tested", "switch_verdict_how": "found in the build file; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a build step", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "llama: use prebuilt UI from HF Bucket when available", "source": "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/CMakeLists.txt#L138", "where": "the option's own description in CMakeLists.txt (quoted whole)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "The option's description and the provisioning script's own comments describe the download and the token header; the project's README was not read for it.", "links": ["https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/CMakeLists.txt#L138", "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/scripts/ui-assets.cmake#L1-L7", "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/scripts/ui-assets.cmake#L437-L441"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "A binary built this way then depends on what the bucket contained that day.", "source": "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/CMakeLists.txt#L138", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "llama-cpp-3cf03257-source-cmake-build/prebuilt-ui-download", "product": "llama.cpp", "slug": "llama-cpp", "version": "3cf03257", "version_read_utc": "2026-10-10", "build": "a CMake build from source at commit 3cf03257", "os": "not run: the build files apply to every CMake build", "arch": "any", "install_method": "not installed: the build files read at commit 3cf03257", "group": "servers and apps you run", "sends_by_default": "yes", "answer_cell": "yes · read in code: during the build, its default option downloads the web UI", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for ggml-org/llama.cpp", "read_utc": "2026-10-10"}, "grade": "read", "method": "tools/ui/CMakeLists.txt and scripts/ui-assets.cmake read at 3cf03257 (the provisioning step, its order of preference, its requests and its token header), with the option in CMakeLists.txt", "receipts": [{"label": "the build option and its default", "url": "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/CMakeLists.txt#L138", "kind": "primary"}, {"label": "the provisioning step the build runs", "url": "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/tools/ui/CMakeLists.txt#L44-L58", "kind": "primary"}, {"label": "the order of preference: local files, an npm build, then the bucket", "url": "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/scripts/ui-assets.cmake#L1-L7", "kind": "primary"}, {"label": "the requests, the fallback to 'latest' and the token header", "url": "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/scripts/ui-assets.cmake#L431-L456", "kind": "primary"}, {"label": "the archive's download, skipped when a copy on disk matches", "url": "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/scripts/ui-assets.cmake#L477-L500", "kind": "primary"}, {"label": "the stamp that skips a repeat request", "url": "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/scripts/ui-assets.cmake#L546-L575", "kind": "primary"}, {"label": "with no UI files, the build goes on without an embedded UI", "url": "https://github.com/ggml-org/llama.cpp/blob/3cf03257f219afbe7334045ff7c6a06ac68c627d/scripts/ui-assets.cmake#L577-L590", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "LM Studio (desktop app)", "condition": "when you search for or download a model", "call_kind": ["reports", "fetches"], "trigger": "you_asked", "sends": [{"field": "your search query, which its policy calls anonymized", "class": "content"}], "when": "Per its privacy policy: when you search for or download an AI model; the host was not stated. Its source is not public; this row rests on its privacy policy, read on 2026-10-10.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [], "switch": {"name": "do not search in the app", "value": "download models yourself", "accepted_values": ["download models yourself"], "values_tested": [], "kind": "a choice in the app", "where_set": "in how you get models", "other_spellings": [], "also_turns_off": [], "cost_of_off": null}, "switch_verdict": "not_tested", "switch_verdict_how": "documented behaviour; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [], "read_source": "vendor_doc", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": ["To help you find the AI models you're looking for", "To facilitate downloading the AI models you requested to download", "To determine the popularity and frequency of various searches and model downloads, but without tying this information to you"], "source": "https://lmstudio.ai/app-privacy", "where": "the policy's three 'Why' lines under 'When Searching for, or Downloading AI Models', quoted whole as the list they are", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its privacy policy says model searches send anonymized queries, gives the three reasons above, and adds: \"We do not track individual search patterns nor create user profiles based on your model preferences.\"", "links": ["https://lmstudio.ai/app-privacy"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "lm-studio-0.4.26-desktop/model-search", "sends_by_default": "when_chosen", "answer_cell": "when chosen · read in its own privacy policy", "look_depth": "vendor_doc", "method": "its desktop app privacy policy read whole on 2026-10-10", "receipts": [{"label": "its desktop app privacy policy, 'When Searching for, or Downloading AI Models'", "url": "https://lmstudio.ai/app-privacy", "kind": "primary"}], "product": "LM Studio", "slug": "lm-studio", "version": "0.4.26 (the newest release on its changelog on 2026-10-10; its policy names no version)", "version_read_utc": "2026-10-10", "build": "the desktop app (0.4.26 is the newest release on its changelog on 2026-10-10; the policy names no version)", "os": "not run: its privacy policy applies to the desktop app", "arch": "any", "install_method": "not installed: its privacy policy (effective June 2026) read on 2026-10-10", "group": "servers and apps you run", "licence": {"name": "not read: its source is not public", "source": "LM Studio's website", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-10"}
{"package": "LM Studio (desktop app)", "condition": null, "call_kind": ["reports", "checks"], "trigger": "background", "sends": [{"field": "app version and build, operating system", "class": "software"}, {"field": "your IP address, which its policy says its content delivery network adds", "class": "network"}], "when": "Per its privacy policy: when the app checks for updates; how often, and to which host, was not stated. Its source is not public; this row rests on its privacy policy, read on 2026-10-10.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "update service", "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": "none documented", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [{"name": "cloud models and web search, processed on its providers' servers once you buy and use them", "switch": "do not buy or use the cloud features", "source": "https://lmstudio.ai/app-privacy"}], "read_source": "vendor_doc", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "To help deliver the right app updates for your specific device configuration and to give us an understanding of the software and hardware spread of our user-base.", "source": "https://lmstudio.ai/app-privacy", "where": "the policy's 'Why' line under 'When the App Checks for Updates' (quoted whole)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its privacy policy says what the update check carries and why; it names no switch.", "links": ["https://lmstudio.ai/app-privacy"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "lm-studio-0.4.26-desktop/update-check", "sends_by_default": "yes", "answer_cell": "yes · read in its own privacy policy", "look_depth": "vendor_doc", "method": "its desktop app privacy policy read whole on 2026-10-10 (a private digest of the fetched bytes is kept)", "receipts": [{"label": "its desktop app privacy policy, 'When the App Checks for Updates'", "url": "https://lmstudio.ai/app-privacy", "kind": "primary"}], "product": "LM Studio", "slug": "lm-studio", "version": "0.4.26 (the newest release on its changelog on 2026-10-10; its policy names no version)", "version_read_utc": "2026-10-10", "build": "the desktop app (0.4.26 is the newest release on its changelog on 2026-10-10; the policy names no version)", "os": "not run: its privacy policy applies to the desktop app", "arch": "any", "install_method": "not installed: its privacy policy (effective June 2026) read on 2026-10-10", "group": "servers and apps you run", "licence": {"name": "not read: its source is not public", "source": "LM Studio's website", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-10"}
{"package": "base-files (the script); motd-news-config (its default setting)", "condition": "only where /etc/default/motd-news sets ENABLED=1, which the motd-news-config package does; Ubuntu 26.04's server metapackage depends on that package, its desktop metapackages do not", "call_kind": ["reports", "checks"], "trigger": "background", "sends": [{"field": "a user agent naming the wget version, the distribution release, the kernel and architecture, the processor model, and a cloud ID where one exists", "class": "system"}], "when": "Its timer runs the script twice a day on the timer's calendar, each run delayed at random by up to 12 hours, and once, a minute after boot; the script then fetches the news. Not wire-checked.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [{"name": "motd.ubuntu.com", "provenance": "asked"}], "switch": {"name": "ENABLED=0", "value": "0", "accepted_values": ["0"], "values_tested": [], "kind": "a line in /etc/default/motd-news", "where_set": "in /etc/default/motd-news, and the motd-news timer disabled", "other_spellings": [], "also_turns_off": ["the news lines printed at login"], "cost_of_off": "you no longer see the short news lines at login"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a login script", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "50-motd-news - print the live news from the Ubuntu wire", "source": "https://git.launchpad.net/ubuntu/+source/base-files/plain/motd/50-motd-news?h=import/14ubuntu6.2", "where": "the script's own header line at 14ubuntu6.2 (quoted whole)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "The script's own comments describe it, and the motd-news-config package's description says to install that package if you want motd-news enabled; a user document was not read.", "links": ["https://git.launchpad.net/ubuntu/+source/base-files/plain/motd/50-motd-news?h=import/14ubuntu6.2", "https://git.launchpad.net/ubuntu/+source/base-files/tree/debian/control?h=import/14ubuntu6.2#n39"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "motd-news-base-files-14ubuntu6.2/news-fetch", "product": "motd-news (Ubuntu's login news)", "slug": "motd-news", "version": "14ubuntu6.2", "version_read_utc": "2026-10-10", "build": "the script in Ubuntu 26.04's base-files package", "os": "not run: the script applies to Ubuntu installs that carry motd-news-config", "arch": "any", "install_method": "not installed: the base-files source package read at 14ubuntu6.2", "group": "Ubuntu and the network software around them", "sends_by_default": "yes", "answer_cell": "yes · read in code: where motd-news-config is installed, as Ubuntu Server's metapackage installs it", "look_depth": "code_read_call_sites", "licence": {"name": "GPL-2.0-or-later (the script's own header)", "source": "https://git.launchpad.net/ubuntu/+source/base-files/plain/motd/50-motd-news?h=import/14ubuntu6.2", "read_utc": "2026-10-10"}, "grade": "read", "method": "the script, its default setting, its timer and its unit read in the base-files source package at 14ubuntu6.2", "receipts": [{"label": "the script: its switch, its address and its user agent", "url": "https://git.launchpad.net/ubuntu/+source/base-files/plain/motd/50-motd-news?h=import/14ubuntu6.2", "kind": "primary"}, {"label": "the switch: the script exits unless ENABLED=1", "url": "https://git.launchpad.net/ubuntu/+source/base-files/tree/motd/50-motd-news?h=import/14ubuntu6.2#n37", "kind": "primary"}, {"label": "the default setting ENABLED=1, shipped by motd-news-config", "url": "https://git.launchpad.net/ubuntu/+source/base-files/tree/debian/motd-news?h=import/14ubuntu6.2#n5", "kind": "primary"}, {"label": "motd-news-config installs that file as /etc/default/motd-news", "url": "https://git.launchpad.net/ubuntu/+source/base-files/plain/debian/motd-news-config.install?h=import/14ubuntu6.2", "kind": "primary"}, {"label": "motd-news-config's description: 'Install this package if you want motd-news to be enabled.'", "url": "https://git.launchpad.net/ubuntu/+source/base-files/tree/debian/control?h=import/14ubuntu6.2#n39", "kind": "primary"}, {"label": "the timer: twice a day with a random delay, and a minute after boot", "url": "https://git.launchpad.net/ubuntu/+source/base-files/plain/debian/motd-news.timer?h=import/14ubuntu6.2", "kind": "primary"}, {"label": "Ubuntu 26.04's server metapackage depends on motd-news-config", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-meta/tree/server-amd64?h=import/1.570.4#n14", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "network-manager with network-manager-config-connectivity-ubuntu", "condition": "where network-manager-config-connectivity-ubuntu is installed; Ubuntu 26.04's desktop metapackages recommend it", "call_kind": ["checks"], "trigger": "background", "sends": [{"field": "a plain HTTP request to Ubuntu's check address", "class": "request"}], "when": "Per its manual: every 300 s while a network connection exists (the default when no interval is set); the Ubuntu package sets the address. Not wire-checked.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [{"name": "connectivity-check.ubuntu.com", "provenance": "asked"}], "switch": {"name": "[connectivity] enabled=false", "value": "false", "accepted_values": ["false"], "values_tested": [], "kind": "a setting in NetworkManager's configuration", "where_set": "in a file under /etc/NetworkManager/conf.d/, or at run time over D-Bus", "other_spellings": [], "also_turns_off": ["captive-portal detection: the desktop no longer offers a login page on hotel or café networks"], "cost_of_off": "you lose captive-portal detection, and a device behind a portal is no longer ranked below one with real connectivity"}, "switch_verdict": "not_tested", "switch_verdict_how": "set over D-Bus, read back; not wire-checked", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "network software: not a server you reach", "cloud_features": [], "read_source": "vendor_doc", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "This allows NetworkManager to detect whether or not the system can actually access the internet or whether it is behind a captive portal.", "source": "https://github.com/NetworkManager/NetworkManager/blob/8caccc6bed0b56528ef3d880af1c217bb8d24419/man/NetworkManager.conf.xml#L1464-L1466", "where": "NetworkManager.conf's manual at 1.54.3, 'connectivity section'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its manual describes the check, its default interval and the switch.", "links": ["https://github.com/NetworkManager/NetworkManager/blob/8caccc6bed0b56528ef3d880af1c217bb8d24419/man/NetworkManager.conf.xml#L1462-L1517"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "network-manager-1.54.3-2ubuntu3.1-ubuntu-26.04/connectivity-check", "product": "NetworkManager", "slug": "network-manager", "version": "1.54.3-2ubuntu3.1", "version_read_utc": "2026-10-10", "build": "the Ubuntu 26.04 packages", "os": "Ubuntu 26.04 desktop, x86-64 (a machine of ours, not a stock install)", "arch": "x86-64", "install_method": "the distro's packages network-manager and network-manager-config-connectivity-ubuntu, both 1.54.3-2ubuntu3.1", "group": "Ubuntu and the network software around them", "sends_by_default": "yes", "answer_cell": "yes · read in its config and its manual: where Ubuntu's connectivity package is installed", "look_depth": "vendor_doc", "licence": {"name": "GPL-2.0", "source": "the licence GitHub reads for NetworkManager/NetworkManager", "read_utc": "2026-10-10"}, "grade": "read", "method": "NetworkManager.conf's manual at 1.54.3, and the Ubuntu connectivity package's config and install files at 1.54.3-2ubuntu3.1; the switch set over D-Bus and read back on a machine of ours", "receipts": [{"label": "the manual's connectivity section", "url": "https://github.com/NetworkManager/NetworkManager/blob/8caccc6bed0b56528ef3d880af1c217bb8d24419/man/NetworkManager.conf.xml#L1462-L1517", "kind": "primary"}, {"label": "the Ubuntu package that sets the address", "url": "https://launchpad.net/ubuntu/+source/network-manager/1.54.3-2ubuntu3.1", "kind": "primary"}, {"label": "the Ubuntu connectivity package's config: the check address", "url": "https://git.launchpad.net/ubuntu/+source/network-manager/plain/debian/20-connectivity-ubuntu.conf?h=import/1.54.3-2ubuntu3.1", "kind": "primary"}, {"label": "where that package installs it", "url": "https://git.launchpad.net/ubuntu/+source/network-manager/plain/debian/network-manager-config-connectivity-ubuntu.install?h=import/1.54.3-2ubuntu3.1", "kind": "primary"}, {"label": "Ubuntu 26.04's desktop metapackage recommends that package", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-meta/tree/desktop-recommends-amd64?h=import/1.570.4#n72", "kind": "primary"}, {"label": "and so does its minimal desktop metapackage", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-meta/tree/desktop-minimal-recommends-amd64?h=import/1.570.4#n62", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "ollama", "condition": null, "call_kind": ["fetches"], "trigger": "background", "sends": [{"field": "a request for the list of cloud models, then one request per cloud model for its details, each with the current time in its query", "class": "request"}, {"field": "Ollama's own version, in the X-Ollama-Client-Version header of each request", "class": "software"}, {"field": "the installation's public key, the same on every call from one installation, and a signature over each request and its time made with the installation's private key", "class": "identifier"}], "when": "The code at v0.34.4 fetches the catalogue of Ollama's cloud models at start, in the background; we did not run this version.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [{"name": "ollama.com", "provenance": "asked"}], "switch": {"name": "OLLAMA_NO_CLOUD", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable of the server process", "where_set": "in the server's own environment: a systemd service needs a drop-in, a container needs it on its run line (see Turn them off)", "other_spellings": ["\"disable_ollama_cloud\": true in .ollama/server.json under the home folder of the account the server runs as"], "also_turns_off": ["Ollama's cloud models", "its web search"], "cost_of_off": "you lose Ollama's cloud models and web search, per its FAQ"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code and documented; we have not published a test of it", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "loopback", "listens_source": "its server binds the loopback address by default (envconfig/config.go at v0.34.4); its official Docker image sets every interface (Dockerfile at v0.34.4), and its Docker guide publishes the port on the host; our page 'Ollama or vLLM: which to run, and how' (research hub, 2026-10-08), 'Who can reach it'", "cloud_features": [{"name": "cloud models (tags ending in -cloud) and web search, which run on ollama.com once you pick them", "switch": "do not pick a cloud model; OLLAMA_NO_CLOUD=1 turns the features off", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161-L181"}], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-11", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": ["a-short-history-of-ollama#who-can-talk-to-it", "ollama-or-vllm-which-to-run#what-each-calls-home"], "vendor_purpose": {"quote": "Adds a server-side cache for full `/api/show` responses, aimed at making model capability and metadata lookup fast for launch flows.", "source": "https://github.com/ollama/ollama/pull/15967", "where": "pull request #15967, which added the cache (merged 2026-05-05)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its FAQ names the switch, the file form and what it turns off ('local only mode'), and says it does not see your prompts when you run locally; it does not describe the two fetches at start.", "links": ["https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161-L181"], "read_utc": "2026-10-10"}, "public_discussion": [{"url": "https://research.strata2signal.com/a-short-history-of-ollama/", "by": "us", "opened_utc": "2026-10-02"}, {"url": "https://research.strata2signal.com/ollama-or-vllm-which-to-run/", "by": "us", "opened_utc": "2026-10-08"}], "credit": [{"text": "The switch and its file form are documented in the FAQ.", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L163-L181", "read_utc": "2026-10-10"}], "does_not_send": [{"text": "Ollama's FAQ says: \"Ollama runs locally. We don't see your prompts or data when you run locally.\" The code read at v0.34.4 agrees for these two fetches: neither carries a prompt.", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161", "read_utc": "2026-10-10"}], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "ollama-0.34.4-source/cloud-catalogue", "product": "Ollama", "slug": "ollama", "version": "0.34.4", "version_read_utc": "2026-10-10", "build": "the source at tag v0.34.4 (every platform it builds)", "os": "not run: the source applies to the Linux, macOS and Windows builds", "arch": "any", "install_method": "not installed: source read at tag v0.34.4", "group": "servers and apps you run", "sends_by_default": "yes", "answer_cell": "yes · read in code", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for ollama/ollama", "read_utc": "2026-10-10"}, "grade": "read", "method": "the source at tag v0.34.4: the start-up fetch, its gate on the cloud switch and its signed request. The source at the tag; we did not check that the released build matches it.", "receipts": [{"label": "the gate on the cloud switch, then the list and the details fetched", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/model_show_cache.go#L339-L350", "kind": "primary"}, {"label": "the two requests", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/model_show_cache.go#L397-L440", "kind": "primary"}, {"label": "the signed request to ollama.com", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/model_show_cache.go#L441-L478", "kind": "primary"}, {"label": "Ollama's version set in a header on each catalogue request", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/model_show_cache.go#L471-L473", "kind": "primary"}, {"label": "the default address", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/cloud_proxy.go#L28-L30", "kind": "primary"}, {"label": "the header's name, X-Ollama-Client-Version", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/cloud_proxy.go#L33", "kind": "primary"}, {"label": "how the request is signed: the time added to its query, then the method and the address with that time signed", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/cloud_proxy.go#L372-L394", "kind": "primary"}, {"label": "what the signature carries: the installation's public key, then a signature made with its private key", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/auth/auth.go#L53-L85", "kind": "primary"}, {"label": "Ollama history, 'Who can talk to it'", "url": "https://research.strata2signal.com/a-short-history-of-ollama/#who-can-talk-to-it", "kind": "pointer"}], "last_read_utc": "2026-10-11"}
{"package": "ollama", "condition": null, "call_kind": ["fetches"], "trigger": "background", "sends": [{"field": "a GET with no body, with the current time in its query", "class": "request"}, {"field": "the installation's public key, the same on every call from one installation, and a signature over the request and that time made with the installation's private key", "class": "identifier"}], "when": "The code at v0.34.4 fetches the list at start and about every 4 hours after, sooner after a failed fetch; we did not run this version.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [{"name": "ollama.com", "provenance": "asked"}], "switch": {"name": "OLLAMA_NO_CLOUD", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable of the server process", "where_set": "in the server's own environment: a systemd service needs a drop-in, a container needs it on its run line (see Turn them off)", "other_spellings": ["\"disable_ollama_cloud\": true in .ollama/server.json under the home folder of the account the server runs as"], "also_turns_off": ["Ollama's cloud models", "its web search"], "cost_of_off": "you lose Ollama's cloud models and web search, per its FAQ"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code and documented; we have not published a test of it", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "loopback", "listens_source": "its server binds the loopback address by default (envconfig/config.go at v0.34.4); its official Docker image sets every interface (Dockerfile at v0.34.4), and its Docker guide publishes the port on the host; our page 'Ollama or vLLM: which to run, and how' (research hub, 2026-10-08), 'Who can reach it'", "cloud_features": [{"name": "cloud models (tags ending in -cloud) and web search, which run on ollama.com once you pick them", "switch": "do not pick a cloud model; OLLAMA_NO_CLOUD=1 turns the features off", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161-L181"}], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [{"path": ".ollama/cache/model-recommendations.json (under the server account's home)", "what": "the last list it fetched", "receipt": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/model_recommendations.go#L268-L315"}], "version_at_witness": null, "measured_on": ["a-short-history-of-ollama#who-can-talk-to-it", "ollama-or-vllm-which-to-run#what-each-calls-home"], "vendor_purpose": {"quote": "The goal is to keep recommendations fresh without breaking launch flows if recommendation fetches fail.", "source": "https://github.com/ollama/ollama/pull/15868", "where": "pull request #15868, which added the fetch (merged 2026-04-29)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its FAQ names the switch, the file form and what it turns off ('local only mode'), and says it does not see your prompts when you run locally; it does not describe the two fetches at start.", "links": ["https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161-L181"], "read_utc": "2026-10-10"}, "public_discussion": [{"url": "https://research.strata2signal.com/a-short-history-of-ollama/", "by": "us", "opened_utc": "2026-10-02"}, {"url": "https://research.strata2signal.com/ollama-or-vllm-which-to-run/", "by": "us", "opened_utc": "2026-10-08"}], "credit": [{"text": "The switch and its file form are documented in the FAQ, and the server logs 'Ollama cloud disabled: true' when it takes.", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L163-L181", "read_utc": "2026-10-10"}], "does_not_send": [{"text": "Ollama's FAQ says: \"Ollama runs locally. We don't see your prompts or data when you run locally.\" The code read at v0.34.4 agrees for these two fetches: neither carries a prompt.", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161", "read_utc": "2026-10-10"}], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "ollama-0.34.4-source/recommended-models", "product": "Ollama", "slug": "ollama", "version": "0.34.4", "version_read_utc": "2026-10-10", "build": "the source at tag v0.34.4 (every platform it builds)", "os": "not run: the source applies to the Linux, macOS and Windows builds", "arch": "any", "install_method": "not installed: source read at tag v0.34.4", "group": "servers and apps you run", "sends_by_default": "yes", "answer_cell": "yes · read in code", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for ollama/ollama", "read_utc": "2026-10-10"}, "grade": "read", "method": "the source at tag v0.34.4: the fetch, its interval, its signature and its gate on the switch. The source at the tag; we did not check that the released build matches it.", "receipts": [{"label": "the address and the 4-hour interval", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/model_recommendations.go#L23-L26", "kind": "primary"}, {"label": "the gate on the switch, and the signed request", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/model_recommendations.go#L188-L202", "kind": "primary"}, {"label": "the last list kept on disk", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/model_recommendations.go#L268-L315", "kind": "primary"}, {"label": "the switch's name", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/envconfig/config.go#L237-L238", "kind": "primary"}, {"label": "how the request is signed: the time added to its query, then the method and the address with that time signed", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/server/cloud_proxy.go#L372-L394", "kind": "primary"}, {"label": "what the signature carries: the installation's public key, then a signature made with its private key", "url": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/auth/auth.go#L53-L85", "kind": "primary"}, {"label": "Ollama history, 'Who can talk to it'", "url": "https://research.strata2signal.com/a-short-history-of-ollama/#who-can-talk-to-it", "kind": "pointer"}], "last_read_utc": "2026-10-11"}
{"package": "ollama", "condition": null, "call_kind": ["fetches"], "trigger": "background", "sends": [{"field": "a request for the list of cloud models, then one request per cloud model for its details, each with the current time in its query", "class": "request"}, {"field": "Ollama's own version, in the X-Ollama-Client-Version header of each request", "class": "software"}, {"field": "the installation's public key, the same on every call from one installation, and a signature over each request and its time made with the installation's private key", "class": "identifier"}], "when": "The code at v0.32.14 fetches the catalogue of Ollama's cloud models at start, in the background; we did not run this version.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [{"name": "ollama.com", "provenance": "asked"}], "switch": {"name": "OLLAMA_NO_CLOUD", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable of the server process", "where_set": "in the server's own environment: a systemd service needs a drop-in, a container needs it on its run line (see Turn them off)", "other_spellings": ["\"disable_ollama_cloud\": true in .ollama/server.json under the home folder of the account the server runs as"], "also_turns_off": ["Ollama's cloud models", "its web search"], "cost_of_off": "you lose Ollama's cloud models and web search, per its FAQ"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code and documented; we have not published a test of it", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "loopback", "listens_source": "its server binds the loopback address by default (envconfig/config.go at v0.34.4); its official Docker image sets every interface (Dockerfile at v0.34.4), and its Docker guide publishes the port on the host; our page 'Ollama or vLLM: which to run, and how' (research hub, 2026-10-08), 'Who can reach it'", "cloud_features": [{"name": "cloud models (tags ending in -cloud) and web search, which run on ollama.com once you pick them", "switch": "do not pick a cloud model; OLLAMA_NO_CLOUD=1 turns the features off", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161-L181"}], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-11", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": ["a-short-history-of-ollama#who-can-talk-to-it", "ollama-or-vllm-which-to-run#what-each-calls-home"], "vendor_purpose": {"quote": "Adds a server-side cache for full `/api/show` responses, aimed at making model capability and metadata lookup fast for launch flows.", "source": "https://github.com/ollama/ollama/pull/15967", "where": "pull request #15967, which added the cache (merged 2026-05-05)", "read_utc": "2026-10-11"}, "vendor_documents_it": {"value": "partly", "text": "Its FAQ names the switch, the file form and what it turns off ('local only mode'), and says it does not see your prompts when you run locally; it does not describe the two fetches at start.", "links": ["https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161-L181"], "read_utc": "2026-10-10"}, "public_discussion": [{"url": "https://research.strata2signal.com/a-short-history-of-ollama/", "by": "us", "opened_utc": "2026-10-02"}, {"url": "https://research.strata2signal.com/ollama-or-vllm-which-to-run/", "by": "us", "opened_utc": "2026-10-08"}], "credit": [{"text": "The switch and its file form are documented in the FAQ.", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L163-L181", "read_utc": "2026-10-10"}], "does_not_send": [{"text": "Ollama's FAQ says: \"Ollama runs locally. We don't see your prompts or data when you run locally.\" The code read at v0.32.14 agrees for these two fetches: neither carries a prompt.", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161", "read_utc": "2026-10-10"}], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "ollama-0.32.14-linux-x86_64/cloud-catalogue", "product": "Ollama", "slug": "ollama", "version": "0.32.14", "version_read_utc": "2026-10-11", "build": "the Linux x86-64 server", "os": "not run: the source applies to the Linux x86-64 server build", "arch": "x86-64", "install_method": "not installed: source read at tag v0.32.14", "group": "servers and apps you run", "sends_by_default": "yes", "answer_cell": "yes · read in code", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for ollama/ollama", "read_utc": "2026-10-10"}, "grade": "read", "method": "the source at tag v0.32.14, read 2026-10-11: the start-up fetch, its gate on the cloud switch, its version header and its signed request. The source at the tag; we did not check that the released build matches it.", "receipts": [{"label": "the server starts its caches as it starts", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/routes.go#L1988", "kind": "primary"}, {"label": "the recommended-models cache and the catalogue cache started together", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/model_caches.go#L19-L32", "kind": "primary"}, {"label": "the catalogue fetched in the background at start", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/model_show_cache.go#L123-L145", "kind": "primary"}, {"label": "the gate on the cloud switch, then the list and the details fetched", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/model_show_cache.go#L339-L350", "kind": "primary"}, {"label": "the two requests", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/model_show_cache.go#L397-L440", "kind": "primary"}, {"label": "the signed request to ollama.com, with Ollama's version in a header", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/model_show_cache.go#L441-L478", "kind": "primary"}, {"label": "the default address, the version header's name and the signing step", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/cloud_proxy.go#L28-L42", "kind": "primary"}, {"label": "how the request is signed: the time added to its query, then the method and the address with that time signed", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/cloud_proxy.go#L372-L394", "kind": "primary"}, {"label": "what the signature carries: the installation's public key, then a signature made with its private key", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/auth/auth.go#L53-L85", "kind": "primary"}, {"label": "the gate reads the cloud switch", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/internal/cloud/policy.go#L9-L13", "kind": "primary"}, {"label": "the switch's name", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/envconfig/config.go#L237-L238", "kind": "primary"}, {"label": "Ollama history, 'Who can talk to it'", "url": "https://research.strata2signal.com/a-short-history-of-ollama/#who-can-talk-to-it", "kind": "pointer"}], "last_read_utc": "2026-10-11"}
{"package": "ollama", "condition": null, "call_kind": ["fetches"], "trigger": "background", "sends": [{"field": "a GET with no body", "class": "request"}], "when": "At start, then about every 4 hours (sooner after a failed fetch). The code at v0.32.14 sets the 4-hour interval.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [{"name": "ollama.com", "provenance": "asked"}], "switch": {"name": "OLLAMA_NO_CLOUD", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable of the server process", "where_set": "in the server's own environment: a systemd service needs a drop-in, a container needs it on its run line (see Turn them off)", "other_spellings": ["\"disable_ollama_cloud\": true in .ollama/server.json under the home folder of the account the server runs as"], "also_turns_off": ["Ollama's cloud models", "its web search"], "cost_of_off": "you lose Ollama's cloud models and web search, per its FAQ"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code and documented; we have not published a test of it", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "loopback", "listens_source": "its server binds the loopback address by default (envconfig/config.go at v0.34.4); its official Docker image sets every interface (Dockerfile at v0.34.4), and its Docker guide publishes the port on the host; our page 'Ollama or vLLM: which to run, and how' (research hub, 2026-10-08), 'Who can reach it'", "cloud_features": [{"name": "cloud models (tags ending in -cloud) and web search, which run on ollama.com once you pick them", "switch": "do not pick a cloud model; OLLAMA_NO_CLOUD=1 turns the features off", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161-L181"}], "read_source": "code", "measured_utc": null, "read_utc": "2026-09-28", "exercised": [], "not_exercised": [], "leaves_on_disk": [{"path": ".ollama/cache/model-recommendations.json (under the server account's home)", "what": "the last list it fetched", "receipt": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/model_recommendations.go#L265-L312"}], "version_at_witness": null, "measured_on": ["a-short-history-of-ollama#who-can-talk-to-it", "ollama-or-vllm-which-to-run#what-each-calls-home"], "vendor_purpose": {"quote": "The goal is to keep recommendations fresh without breaking launch flows if recommendation fetches fail.", "source": "https://github.com/ollama/ollama/pull/15868", "where": "pull request #15868, which added the fetch (merged 2026-04-29)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its FAQ names the switch, the file form and what it turns off ('local only mode'), and says it does not see your prompts when you run locally; it does not describe the two fetches at start.", "links": ["https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161-L181"], "read_utc": "2026-10-10"}, "public_discussion": [{"url": "https://research.strata2signal.com/a-short-history-of-ollama/", "by": "us", "opened_utc": "2026-10-02"}, {"url": "https://research.strata2signal.com/ollama-or-vllm-which-to-run/", "by": "us", "opened_utc": "2026-10-08"}], "credit": [{"text": "The switch and its file form are documented in the FAQ, and the server logs 'Ollama cloud disabled: true' when it takes.", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L163-L181", "read_utc": "2026-10-10"}], "does_not_send": [{"text": "Ollama's FAQ says: \"Ollama runs locally. We don't see your prompts or data when you run locally.\" The code read at v0.34.4 agrees for these two fetches: neither carries a prompt.", "source": "https://github.com/ollama/ollama/blob/b2da9e468af2479058ae18c6d908ed29de410684/docs/faq.mdx?plain=1#L161", "read_utc": "2026-10-10"}], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "ollama-0.32.14-linux-x86_64/recommended-models", "product": "Ollama", "slug": "ollama", "version": "0.32.14", "version_read_utc": "2026-09-28", "build": "the Linux x86-64 server", "os": "not run: the source applies to the Linux x86-64 server build", "arch": "x86-64", "install_method": "not installed: source read at tag v0.32.14", "group": "servers and apps you run", "sends_by_default": "yes", "answer_cell": "yes · read in code", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for ollama/ollama", "read_utc": "2026-10-10"}, "grade": "read", "method": "the source at tag v0.32.14, read 2026-09-28: the fetch, its 4-hour interval and its gate on the switch. The source at the tag; we did not check that the released build matches it.", "receipts": [{"label": "the fetch and its 4-hour interval in the source at v0.32.14", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/model_recommendations.go#L23-L26", "kind": "primary"}, {"label": "the last list kept on disk, in the source at v0.32.14", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/server/model_recommendations.go#L265-L312", "kind": "primary"}, {"label": "the switch in the source at v0.32.14", "url": "https://github.com/ollama/ollama/blob/d67ad83426633195089509347ffd4fe795120198/envconfig/config.go#L237-L238", "kind": "primary"}, {"label": "Ollama history, 'Who can talk to it'", "url": "https://research.strata2signal.com/a-short-history-of-ollama/#who-can-talk-to-it", "kind": "pointer"}], "last_read_utc": "2026-10-11"}
{"package": "onnxruntime-node", "condition": null, "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "a device ID, sent as a hash that stays the same across runs and programs", "class": "identifier"}, {"field": "the path the program was launched by (your username is in it when the program lives in your home folder)", "class": "path"}, {"field": "processor model, core count and total memory", "class": "hardware"}, {"field": "operating system and version, device class, network type and cost", "class": "system"}, {"field": "names and metadata of the models you run (graph name, producer name, custom metadata)", "class": "model metadata"}, {"field": "run counts and durations, the accelerator used, process memory and processor use", "class": "usage"}], "when": "Not run. The libraries carry the same collector address and switch name as the Python package.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor telemetry collector", "hosts": [{"name": "mobile.events.data.microsoft.com", "provenance": "asked"}], "switch": {"name": "ORT_DISABLE_TELEMETRY", "value": "1", "accepted_values": ["1", "true", "yes", "on", "y (any case)"], "values_tested": [], "kind": "environment variable, read once when the library first starts (in Python, at import)", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": [], "also_turns_off": ["the persistent device ID file and the event queue are not created"], "cost_of_off": "none known: the privacy file names no other effect"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in the shipped library; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library: it opens no listening port of its own", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-09-28", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "ONNX Runtime collects trace events with the goal of improving product quality.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9", "where": "docs/Privacy.md at v1.30.0, 'Official Builds'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its privacy file, shipped inside the package, says telemetry is on by default in the official builds on Linux, macOS, Android and iOS, and names ORT_DISABLE_TELEMETRY=1 under 'Disabling Telemetry'. The PyPI page and the onnxruntime.ai documentation did not mention it when we checked them for our ONNX Runtime telemetry measurement (2026-09-28).", "links": ["https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9-L30", "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-changed"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "transformers.js (@huggingface/transformers 4.3.0) depends on onnxruntime-node 1.30.0.", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#which-tools-bring-it-in", "read_utc": "2026-09-28"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.30.0-npm-node-linux/telemetry", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.30.0", "version_read_utc": "2026-09-28", "build": "the npm package for Node.js, its Linux libraries", "os": "not run: the shipped libraries were searched, not run", "arch": "x86-64 and arm64 (the package's two Linux libraries)", "install_method": "not installed: the npm package onnxruntime-node 1.30.0 downloaded and its two Linux libraries searched", "group": "libraries other tools install for you", "sends_by_default": "likely", "answer_cell": "likely · read in the shipped libraries: the collector's address and the switch's name are there", "look_depth": "code_read_keyword", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "read", "method": "the shipped package onnxruntime-node-1.30.0.tgz from the npm registry: its two Linux libraries searched for the collector's address and the switch's name (for our ONNX Runtime telemetry measurement, 2026-09-28)", "receipts": [{"label": "the package on npm (registry record)", "url": "https://registry.npmjs.org/onnxruntime-node/1.30.0", "kind": "primary"}, {"label": "the privacy file at v1.30.0", "url": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9-L11", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'Are you affected?'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#are-you-affected", "kind": "pointer"}], "last_read_utc": "2026-09-28"}
{"package": "onnxruntime-gpu", "condition": null, "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "a device ID, sent as a hash that stays the same across runs and programs", "class": "identifier"}, {"field": "the path the program was launched by (your username is in it when the program lives in your home folder)", "class": "path"}, {"field": "processor model, core count and total memory", "class": "hardware"}, {"field": "operating system and version, device class, network type and cost", "class": "system"}, {"field": "names and metadata of the models you run (graph name, producer name, custom metadata)", "class": "model metadata"}, {"field": "run counts and durations, the accelerator used, process memory and processor use", "class": "usage"}], "when": "Not run. The privacy file covers the official builds, and these libraries carry the same collector address as the CPU wheel.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor telemetry collector", "hosts": [{"name": "mobile.events.data.microsoft.com", "provenance": "asked"}], "switch": {"name": "ORT_DISABLE_TELEMETRY", "value": "1", "accepted_values": ["1", "true", "yes", "on", "y (any case)"], "values_tested": [], "kind": "environment variable, read once when the library first starts (in Python, at import)", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": [], "also_turns_off": ["the persistent device ID file and the event queue are not created"], "cost_of_off": "none known: the privacy file names no other effect"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in the shipped library; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library: it opens no listening port of its own", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-09-28", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "ONNX Runtime collects trace events with the goal of improving product quality.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9", "where": "docs/Privacy.md at v1.30.0, 'Official Builds'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its privacy file, shipped inside the package, says telemetry is on by default in the official builds on Linux, macOS, Android and iOS, and names ORT_DISABLE_TELEMETRY=1 under 'Disabling Telemetry'. The PyPI page and the onnxruntime.ai documentation did not mention it when we checked them for our ONNX Runtime telemetry measurement (2026-09-28).", "links": ["https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9-L30", "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-changed"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.30.0-pypi-gpu-linux-x86_64/telemetry", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.30.0", "version_read_utc": "2026-09-28", "build": "the GPU wheel on PyPI, Linux x86-64", "os": "not run: the shipped libraries were searched, not run", "arch": "x86-64", "install_method": "not installed: the PyPI wheel onnxruntime_gpu-1.30.0-cp312-cp312-manylinux_2_28_x86_64.whl downloaded, checked against PyPI's sha256, and its libraries searched", "group": "libraries other tools install for you", "sends_by_default": "likely", "answer_cell": "likely · read in the shipped libraries: the collector's address and the switch's name are there", "look_depth": "code_read_keyword", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "read", "method": "the shipped wheel onnxruntime_gpu-1.30.0-cp312-cp312-manylinux_2_28_x86_64.whl (sha256 6acc0f4b3d5ac5f2984432faa59dd8fcce6775f8b43a7140afa0f322c7a703b1, as PyPI publishes it) carries the collector's address and the switch's name in its libraries (searched for our ONNX Runtime telemetry measurement, 2026-09-28)", "receipts": [{"label": "the wheel on PyPI", "url": "https://pypi.org/project/onnxruntime-gpu/1.30.0/#files", "kind": "primary"}, {"label": "the privacy file at v1.30.0", "url": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9-L11", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'Are you affected?'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#are-you-affected", "kind": "pointer"}], "last_read_utc": "2026-09-28"}
{"package": "onnxruntime", "condition": null, "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "a device ID, sent as a hash that stays the same across runs and programs", "class": "identifier"}, {"field": "the path the program was launched by (your username is in it when the program lives in your home folder)", "class": "path"}, {"field": "processor model, core count and total memory", "class": "hardware"}, {"field": "operating system and version, device class, network type and cost", "class": "system"}, {"field": "names and metadata of the models you run (graph name, producer name, custom metadata)", "class": "model metadata"}, {"field": "run counts and durations, the accelerator used, process memory and processor use", "class": "usage"}], "when": "First attempt 9.2 s after launch (observed 9.150 to 9.232 s at the listener's TCP accept, in 5 runs: 3 pre-registered and 2 audit re-runs), on a laptop on mains power. The library's source sets this timer to 9 s when it reads the machine as charging on an unmetered network, and 18 s otherwise (read, not run). When it cannot connect, it tried 4 more times within 120 s, with growing gaps, the last 77.4 to 90.3 s after launch in the same 5 runs. What follows a successful upload was not observed.", "when_observed_s": [9.15, 9.232], "when_anchor": "from_launch", "when_condition": "every handshake hung up", "when_state": "on mains power", "host_class": "vendor telemetry collector", "hosts": [{"name": "mobile.events.data.microsoft.com", "provenance": "asked"}], "switch": {"name": "ORT_DISABLE_TELEMETRY", "value": "1", "accepted_values": ["1", "true", "yes", "on", "y (any case)"], "values_tested": ["1"], "kind": "environment variable, read once when the library first starts (in Python, at import)", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": [], "also_turns_off": ["the persistent device ID file and the event queue are not created"], "cost_of_off": "none known: the privacy file names no other effect"}, "switch_verdict": "proven", "switch_verdict_how": "no lookup, no connection and no file in 3 of 3 pre-registered runs with the switch set at launch, each from launch to 120 s, on a fresh install; 2 more audit runs agreed. The cadence past 120 s was not observed.", "switch_verdict_version": "1.30.0", "switch_verdict_window": "from launch to 120 s", "switch_verdict_n": 3, "steps_not_met": ["3: the switch was set in the environment the program started with; it was not read back from the running process", "5: a queue left on disk by an earlier run without the switch was not seeded and re-run with it"], "listens_default": "n/a", "listens_source": "a library: it opens no listening port of its own", "cloud_features": [], "read_source": null, "measured_utc": {"from": "2026-09-28T08:45:25Z", "to": "2026-09-28T09:07:54Z"}, "read_utc": null, "exercised": ["import, a one-addition model built in memory, loaded and run once on the processor, then 120 s alive"], "not_exercised": ["a second launch from the same home", "a working network (every attempt was cut off)", "battery power", "the cadence past 120 s"], "leaves_on_disk": [{"path": ".cache/Microsoft/DeveloperTools/.onnxruntime/deviceid", "what": "the device ID file", "receipt": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort130-default-r1/result.json"}, {"path": ".cache/Microsoft/DeveloperTools/.onnxruntime/onnxruntime.db", "what": "the queue of events waiting to be sent", "receipt": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort130-default-r1/result.json"}, {"path": "/tmp/.ses (or $TMPDIR/.ses)", "what": "the telemetry library's own ID file", "receipt": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort130-default-r1/result.json"}, {"path": "/tmp/mat-debug-<process number>.log (or under $TMPDIR)", "what": "an empty debug-log file made as the uploader starts", "receipt": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort130-default-r1/result.json"}], "version_at_witness": null, "measured_on": ["onnx-runtime-telemetry-on-linux#what-we-measured"], "vendor_purpose": {"quote": "ONNX Runtime collects trace events with the goal of improving product quality.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9", "where": "docs/Privacy.md at v1.30.0, 'Official Builds'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its privacy file, shipped inside the package, says telemetry is on by default in the official builds on Linux, macOS, Android and iOS, and names ORT_DISABLE_TELEMETRY=1 under 'Disabling Telemetry'. The PyPI page and the onnxruntime.ai documentation did not mention it when we checked them for our ONNX Runtime telemetry measurement (2026-09-28).", "links": ["https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9-L30", "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-changed"], "read_utc": "2026-10-10"}, "public_discussion": [{"url": "https://github.com/immich-app/immich/issues/30729", "by": "others", "opened_utc": "2026-08-12"}, {"url": "https://github.com/microsoft/onnxruntime/issues/32173", "by": "others", "opened_utc": "2026-08-19"}, {"url": "https://github.com/OHF-Voice/wyoming-piper/issues/64", "by": "others", "opened_utc": "2026-09-04"}, {"url": "https://github.com/jonn-smith/claude-docker-sandbox/pull/21", "by": "others", "opened_utc": "2026-09-16"}, {"url": "https://github.com/microsoft/onnxruntime/issues/32771", "by": "others", "opened_utc": "2026-09-23"}, {"url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/", "by": "us", "opened_utc": "2026-09-28"}], "credit": [{"text": "The default and the switch are documented in the package's own privacy file.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L24-L30", "read_utc": "2026-10-10"}, {"text": "The device ID is sent as a hash, and the library blanks the program's name and your timezone from the events' shared context.", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-is-in-the-events", "read_utc": "2026-09-28"}, {"text": "conda-forge's recipe passes --no_telemetry to the build; the package itself was not inspected.", "source": "https://github.com/conda-forge/onnxruntime-feedstock/blob/16066d0b6738fd8881e83943fec398febd980e9b/recipe/build.sh#L109", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": [], "installed_by": ["onnx-runtime-1.30.0-via-python-packages/telemetry"], "installed_by_packages": [], "also_know": [{"text": "Calling onnxruntime.disable_telemetry_events() did not stop the uploader in the sealed test (3 of 3 runs with the call made).", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/SUMMARY.md", "read_utc": "2026-09-28"}, {"text": "The library's runtime switch is ORT_DISABLE_TELEMETRY; the name DO_NOT_TRACK appears nowhere in its own source at v1.30.0 (a name search of the release's source, not of the telemetry SDK it builds in).", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/onnxruntime/core/platform/telemetry_environment.h#L110-L115", "read_utc": "2026-10-10"}, {"text": "If it ran before you set the switch, delete the .onnxruntime folder the 'has it already run' check finds; whether the switch also stops an old queue from being sent is not tested.", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#how-to-turn-it-off", "read_utc": "2026-09-28"}, {"text": "Blocking the collector's name on your network keeps the events from leaving through that network, but the library still collects and queues them; the switch stops collection. (In every default run the queue filled while every attempt was cut off.)", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort130-default-r1/result.json", "read_utc": "2026-09-28"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.30.0-pypi-linux-x86_64/telemetry", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.30.0", "version_read_utc": "2026-09-28", "build": "the PyPI wheel for Linux x86-64", "os": "Debian 12 container, x86-64", "arch": "x86-64", "install_method": "pip, the official PyPI wheel (onnxruntime-1.30.0-cp312-cp312-manylinux_2_28_x86_64.whl, CPython 3.12.13)", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · measured", "look_depth": "run", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "measured", "method": "a sealed Docker container with no route out: a name server that answered every lookup with a local address and logged it, a listener that logged the server name each connection asked for and hung up, and strace on every system call; a planted caller showed the instruments could see; predictions frozen before the first run (the kit published with our ONNX Runtime telemetry measurement, research hub, 2026-09-28)", "receipts": [{"label": "the kit's run summary", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/SUMMARY.md", "kind": "primary"}, {"label": "run 1, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort130-default-r1/result.json", "kind": "primary"}, {"label": "run 2, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort130-default-r2/result.json", "kind": "primary"}, {"label": "run 3, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort130-default-r3/result.json", "kind": "primary"}, {"label": "the audit's first re-run, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/audit/runs/ort130-default-raudit1/result.json", "kind": "primary"}, {"label": "the audit's second re-run, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/audit/runs/ort130-default-raudit2/result.json", "kind": "primary"}, {"label": "the predictions, frozen before the first run", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/PREREG-probe.md", "kind": "primary"}, {"label": "the audit's re-runs", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/PROBE-AUDIT.md", "kind": "primary"}, {"label": "the collector's address in the source at v1.30.0", "url": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/onnxruntime/core/platform/posix/telemetry.cc#L463", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'What we measured'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-we-measured", "kind": "pointer"}], "last_read_utc": "2026-09-28"}
{"package": "onnxruntime, brought in by another package", "condition": "once a program built on one of these packages imports ONNX Runtime", "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "a device ID, sent as a hash that stays the same across runs and programs", "class": "identifier"}, {"field": "the path the program was launched by (your username is in it when the program lives in your home folder)", "class": "path"}, {"field": "processor model, core count and total memory", "class": "hardware"}, {"field": "operating system and version, device class, network type and cost", "class": "system"}, {"field": "names and metadata of the models you run (graph name, producer name, custom metadata)", "class": "model metadata"}, {"field": "run counts and durations, the accelerator used, process memory and processor use", "class": "usage"}], "when": "As the 1.30.0 row, from the moment the program imports ONNX Runtime; pulling it in is not the same as running it.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor telemetry collector", "hosts": [{"name": "mobile.events.data.microsoft.com", "provenance": "asked"}], "switch": {"name": "ORT_DISABLE_TELEMETRY", "value": "1", "accepted_values": ["1", "true", "yes", "on", "y (any case)"], "values_tested": [], "kind": "environment variable, read once when the library first starts (in Python, at import)", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": [], "also_turns_off": ["the persistent device ID file and the event queue are not created"], "cost_of_off": "none known: the privacy file names no other effect"}, "switch_verdict": "not_tested", "switch_verdict_how": "proven on ONNX Runtime 1.30.0 itself (its own row); not tested inside these packages", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "libraries: none opens a listening port through ONNX Runtime", "cloud_features": [], "read_source": null, "measured_utc": null, "read_utc": "2026-09-28", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "ONNX Runtime collects trace events with the goal of improving product quality.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9", "where": "docs/Privacy.md at v1.30.0, 'Official Builds'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its privacy file, shipped inside the package, says telemetry is on by default in the official builds on Linux, macOS, Android and iOS, and names ORT_DISABLE_TELEMETRY=1 under 'Disabling Telemetry'. The PyPI page and the onnxruntime.ai documentation did not mention it when we checked them for our ONNX Runtime telemetry measurement (2026-09-28).", "links": ["https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9-L30", "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-changed"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [{"text": "insightface 2.0 sets the switch itself when imported, before it loads ONNX Runtime (insightface/__init__.py, line 10, in the shipped wheel insightface-2.0-py3-none-any.whl, sha256 7b44c9ef8cfa80d0446285f048d1816a9326c87e7615f04625a1f277adbc4f19 as PyPI publishes it).", "source": "https://pypi.org/project/insightface/2.0/#files", "read_utc": "2026-10-10"}, {"text": "markitdown's Docker image sets the switch for its users (its Dockerfile at v0.1.8); a pip install does not.", "source": "https://github.com/microsoft/markitdown/blob/b8f79c57ebc0044be41323d89b2a45d3fda8460e/Dockerfile#L6", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": ["onnx-runtime-1.30.0-pypi-linux-x86_64/telemetry"], "installed_by": [], "installed_by_packages": [{"name": "chromadb", "version": "1.5.9", "note": null}, {"name": "kokoro-onnx", "version": "0.6.1", "note": null}, {"name": "faster-whisper", "version": "1.2.1", "note": "starts it only when its voice-activity filter is used"}, {"name": "whisperx", "version": "3.8.6", "note": "through faster-whisper"}, {"name": "markitdown", "version": "0.1.8", "note": "its Docker image sets the switch; a pip install does not"}, {"name": "insightface", "version": "2.0", "note": "sets the switch itself when imported, before it loads ONNX Runtime"}, {"name": "fastembed", "version": "0.8.1", "note": null}, {"name": "piper-tts", "version": "1.8.0", "note": null}, {"name": "unstructured-inference", "version": "1.6.13", "note": "also brought in by unstructured[all-docs] 0.27.10"}, {"name": "openwakeword", "version": "0.6.0", "note": null}, {"name": "funasr-onnx", "version": "0.4.3", "note": null}, {"name": "kittentts", "version": "0.1.3", "note": null}, {"name": "rapidocr-onnxruntime", "version": "1.4.4", "note": null}, {"name": "onnxruntime-genai", "version": "0.17.0", "note": "requires 1.30.0 or newer"}, {"name": "rembg[cpu]", "version": "2.0.85", "note": null}, {"name": "silero-vad[onnx-cpu]", "version": "6.2.3", "note": null}, {"name": "optimum[onnxruntime]", "version": "2.3.0", "note": null}, {"name": "onnx-asr[cpu]", "version": "0.12.0", "note": null}, {"name": "txtai[pipeline]", "version": "9.13.0", "note": null}], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.30.0-via-python-packages/telemetry", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.30.0", "version_read_utc": "2026-09-28", "build": "the PyPI wheel, as a fresh install of one of 19 named Python packages resolved it", "os": "not run: an install resolution for Linux x86-64", "arch": "x86-64", "install_method": "pip or uv: a fresh install of each package named below, resolved for Python 3.12 on Linux x86-64 on 2026-09-28 with uv pip compile", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · inferred: through ONNX Runtime 1.30.0, once the program loads it; the packages' own code not read", "look_depth": "dependency_only", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "inferred", "method": "a dependency's behaviour carried to the packages that bring it in, from an install resolution on a named day; a later install may resolve differently", "receipts": [{"label": "the row it carries from", "url": "row:onnx-runtime-1.30.0-pypi-linux-x86_64/telemetry", "kind": "primary"}, {"label": "the resolution, published with its date, Python version and platform", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#which-tools-bring-it-in", "kind": "pointer"}], "last_read_utc": "2026-09-28"}
{"package": "the C and C++ library archives on GitHub", "condition": null, "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "a device ID, sent as a hash that stays the same across runs and programs", "class": "identifier"}, {"field": "the path the program was launched by (your username is in it when the program lives in your home folder)", "class": "path"}, {"field": "processor model, core count and total memory", "class": "hardware"}, {"field": "operating system and version, device class, network type and cost", "class": "system"}, {"field": "names and metadata of the models you run (graph name, producer name, custom metadata)", "class": "model metadata"}, {"field": "run counts and durations, the accelerator used, process memory and processor use", "class": "usage"}], "when": "As 1.29.0: the code at v1.29.1 starts the same uploader; we did not run this build.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor telemetry collector", "hosts": [{"name": "mobile.events.data.microsoft.com", "provenance": "asked"}], "switch": {"name": "ORT_DISABLE_TELEMETRY", "value": "1", "accepted_values": ["1", "true", "yes", "on", "y (any case)"], "values_tested": [], "kind": "environment variable, read once when the library first starts (in Python, at import)", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": [], "also_turns_off": ["the persistent device ID file and the event queue are not created"], "cost_of_off": "none known: the privacy file names no other effect"}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library: it opens no listening port of its own", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "ONNX Runtime collects trace events with the goal of improving product quality.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9", "where": "docs/Privacy.md at v1.30.0, 'Official Builds'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its privacy file, shipped inside the package, says telemetry is on by default in the official builds on Linux, macOS, Android and iOS, and names ORT_DISABLE_TELEMETRY=1 under 'Disabling Telemetry'. The PyPI page and the onnxruntime.ai documentation did not mention it when we checked them for our ONNX Runtime telemetry measurement (2026-09-28).", "links": ["https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9-L30", "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-changed"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [{"text": "The default and the switch are documented in the package's own privacy file.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L24-L30", "read_utc": "2026-10-10"}, {"text": "The device ID is sent as a hash, and the library blanks the program's name and your timezone from the events' shared context.", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-is-in-the-events", "read_utc": "2026-09-28"}], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.29.1-github-c-cpp-archives/telemetry", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.29.1", "version_read_utc": "2026-10-10", "build": "the C and C++ library archives released on GitHub (1.29.1 was never on PyPI, npm, NuGet or Maven)", "os": "not run: the source applies to the official native builds for Linux, macOS, Android and iOS", "arch": "as each archive names", "install_method": "not installed: source read at tag v1.29.1", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · read in code: the same telemetry code and privacy file as 1.29.0", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "read", "method": "the telemetry source and the privacy file at v1.29.1 compared with v1.29.0's and v1.30.0's; our ONNX Runtime telemetry measurement made the same comparison on 2026-09-28. The source at v1.29.1; we did not check that the released archives match it.", "receipts": [{"label": "the collector's address in the source at v1.29.1", "url": "https://github.com/microsoft/onnxruntime/blob/d9d3b2fc25558db20900cb71865ffeb2348a3385/onnxruntime/core/platform/posix/telemetry.cc#L463", "kind": "primary"}, {"label": "the privacy file at v1.29.1", "url": "https://github.com/microsoft/onnxruntime/blob/d9d3b2fc25558db20900cb71865ffeb2348a3385/docs/Privacy.md?plain=1#L9-L30", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'What changed, and when'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-changed", "kind": "pointer"}], "last_read_utc": "2026-10-10"}
{"package": "onnxruntime (conda-forge)", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library: it opens no listening port of its own", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [{"text": "conda-forge's recipe passes --no_telemetry to the build; the package itself was not inspected.", "source": "https://github.com/conda-forge/onnxruntime-feedstock/blob/16066d0b6738fd8881e83943fec398febd980e9b/recipe/build.sh#L109", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.29.0-and-1.30.0-conda-forge/none", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.29.0 and 1.30.0", "version_read_utc": "2026-10-10", "build": "the conda-forge builds", "os": "not run: the recipe applies to every platform conda-forge builds", "arch": "as each conda-forge build names", "install_method": "not installed: the conda-forge recipe read at its 1.29.0 and 1.30.0 commits", "group": "libraries other tools install for you", "sends_by_default": "not_read", "answer_cell": "not read · the build recipe, read at two commits, passes --no_telemetry, which leaves the telemetry out of the build; the package itself was not run", "look_depth": "dependency_only", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "read", "method": "conda-forge's recipe/build.sh read at the commit that built each version; the packages were not run", "receipts": [{"label": "recipe/build.sh at the 1.29.0 commit", "url": "https://github.com/conda-forge/onnxruntime-feedstock/blob/8fc2a8e09971dc72668ad638e7a44fdb3c895ad9/recipe/build.sh#L105", "kind": "primary"}, {"label": "recipe/build.sh at the 1.30.0 commit", "url": "https://github.com/conda-forge/onnxruntime-feedstock/blob/16066d0b6738fd8881e83943fec398febd980e9b/recipe/build.sh#L109", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'Are you affected?'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#are-you-affected", "kind": "pointer"}], "last_read_utc": "2026-10-10"}
{"package": "onnxruntime (macOS, Android, iOS), Microsoft.ML.OnnxRuntime (NuGet), com.microsoft.onnxruntime (Maven)", "condition": null, "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "a device ID, sent as a hash that stays the same across runs and programs", "class": "identifier"}, {"field": "the path the program was launched by (your username is in it when the program lives in your home folder)", "class": "path"}, {"field": "processor model, core count and total memory", "class": "hardware"}, {"field": "operating system and version, device class, network type and cost", "class": "system"}, {"field": "names and metadata of the models you run (graph name, producer name, custom metadata)", "class": "model metadata"}, {"field": "run counts and durations, the accelerator used, process memory and processor use", "class": "usage"}], "when": "Not run. The privacy file says these platforms send the same trace events over HTTPS.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor telemetry collector", "hosts": [{"name": "mobile.events.data.microsoft.com", "provenance": "asked"}], "switch": {"name": "ORT_DISABLE_TELEMETRY", "value": "1", "accepted_values": ["1", "true", "yes", "on", "y (any case)"], "values_tested": [], "kind": "environment variable, read once when the library first starts (in Python, at import)", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": [], "also_turns_off": ["the persistent device ID file and the event queue are not created"], "cost_of_off": "none known: the privacy file names no other effect"}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library: it opens no listening port of its own", "cloud_features": [], "read_source": "vendor_doc", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "ONNX Runtime collects trace events with the goal of improving product quality.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9", "where": "docs/Privacy.md at v1.30.0, 'Official Builds'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its privacy file, shipped inside the package, says telemetry is on by default in the official builds on Linux, macOS, Android and iOS, and names ORT_DISABLE_TELEMETRY=1 under 'Disabling Telemetry'. The PyPI page and the onnxruntime.ai documentation did not mention it when we checked them for our ONNX Runtime telemetry measurement (2026-09-28).", "links": ["https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9-L30", "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-changed"], "read_utc": "2026-10-10"}, "public_discussion": [{"url": "https://github.com/microsoft/onnxruntime/issues/32173", "by": "others", "opened_utc": "2026-08-19"}, {"url": "https://github.com/microsoft/onnxruntime/issues/32771", "by": "others", "opened_utc": "2026-09-23"}], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.29.0-and-1.30.0-official-other-builds/telemetry", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.29.0 and 1.30.0", "version_read_utc": "2026-10-10", "build": "the official builds for macOS, Android and iOS, and the C# (NuGet) and Java (Maven) packages", "os": "not run: the vendor's privacy file applies to these builds", "arch": "as each build names", "install_method": "not installed: the vendor's privacy file read at v1.29.0 and v1.30.0", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · read in its own privacy file", "look_depth": "vendor_doc", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "read", "method": "docs/Privacy.md read at v1.29.0 and v1.30.0 (the two files are identical)", "receipts": [{"label": "the privacy file at v1.30.0, 'Non-Windows'", "url": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L20", "kind": "primary"}, {"label": "the privacy file at v1.29.0", "url": "https://github.com/microsoft/onnxruntime/blob/2e2543fbe9fae542f921d47a72d21d5a4ef0b710/docs/Privacy.md?plain=1#L20", "kind": "primary"}, {"label": "the collector's address in the non-Windows telemetry source at v1.30.0", "url": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/onnxruntime/core/platform/posix/telemetry.cc#L463", "kind": "primary"}, {"label": "the same address at v1.29.0", "url": "https://github.com/microsoft/onnxruntime/blob/2e2543fbe9fae542f921d47a72d21d5a4ef0b710/onnxruntime/core/platform/posix/telemetry.cc#L463", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'Are you affected?'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#are-you-affected", "kind": "pointer"}], "last_read_utc": "2026-10-10"}
{"package": "onnxruntime-web", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library running in a browser", "cloud_features": [], "read_source": "vendor_doc", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [{"text": "Its privacy file says targets without a supported telemetry provider, \"including WebAssembly\", \"do not include telemetry\".", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9", "read_utc": "2026-10-10"}], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.29.0-and-1.30.0-web/none", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.29.0 and 1.30.0", "version_read_utc": "2026-10-10", "build": "the WebAssembly build for browsers", "os": "not run: a browser build", "arch": "WebAssembly", "install_method": "not installed: the vendor's privacy file read at v1.29.0 and v1.30.0", "group": "libraries other tools install for you", "sends_by_default": "not_read", "answer_cell": "not read · its privacy file says the WebAssembly builds carry no telemetry; we did not read or run them", "look_depth": "vendor_doc", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "read", "method": "docs/Privacy.md read at v1.29.0 and v1.30.0", "receipts": [{"label": "the privacy file at v1.30.0", "url": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "onnxruntime", "condition": null, "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "a device ID, sent as a hash that stays the same across runs and programs", "class": "identifier"}, {"field": "the path the program was launched by (your username is in it when the program lives in your home folder)", "class": "path"}, {"field": "processor model, core count and total memory", "class": "hardware"}, {"field": "operating system and version, device class, network type and cost", "class": "system"}, {"field": "names and metadata of the models you run (graph name, producer name, custom metadata)", "class": "model metadata"}, {"field": "run counts and durations, the accelerator used, process memory and processor use", "class": "usage"}], "when": "First attempt 9.2 s after launch (observed 9.186 to 9.222 s at the listener's TCP accept, in 4 runs: 3 pre-registered and 1 audit re-run), on a laptop on mains power. The library's source sets this timer to 9 s when it reads the machine as charging on an unmetered network, and 18 s otherwise (read, not run). When it cannot connect, it tried 4 more times within 120 s, with growing gaps, the last 69.1 to 85.6 s after launch in the same 4 runs. What follows a successful upload was not observed.", "when_observed_s": [9.186, 9.222], "when_anchor": "from_launch", "when_condition": "every handshake hung up", "when_state": "on mains power", "host_class": "vendor telemetry collector", "hosts": [{"name": "mobile.events.data.microsoft.com", "provenance": "asked"}], "switch": {"name": "ORT_DISABLE_TELEMETRY", "value": "1", "accepted_values": ["1", "true", "yes", "on", "y (any case)"], "values_tested": ["1"], "kind": "environment variable, read once when the library first starts (in Python, at import)", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": [], "also_turns_off": ["the persistent device ID file and the event queue are not created"], "cost_of_off": "none known: the privacy file names no other effect"}, "switch_verdict": "undecided", "switch_verdict_how": "one run with the switch set, made by the audit outside the pre-registered plan, was silent (n = 1). The privacy file names the same switch for this version. That run: 2026-09-28, 09:10:11Z to 09:12:14Z (UTC).", "switch_verdict_version": "1.29.0", "switch_verdict_window": "from launch to 120 s", "switch_verdict_n": 1, "steps_not_met": ["2: silence with the switch rests on one run, not on every pre-registered rep", "5: a queue left on disk by an earlier run without the switch was not seeded and re-run with it"], "listens_default": "n/a", "listens_source": "a library: it opens no listening port of its own", "cloud_features": [], "read_source": null, "measured_utc": {"from": "2026-09-28T08:45:25Z", "to": "2026-09-28T09:12:14Z"}, "read_utc": null, "exercised": ["import, a one-addition model built in memory, loaded and run once on the processor, then 120 s alive"], "not_exercised": ["a second launch from the same home", "a working network (every attempt was cut off)", "battery power", "the cadence past 120 s"], "leaves_on_disk": [{"path": ".cache/Microsoft/DeveloperTools/.onnxruntime/deviceid", "what": "the device ID file", "receipt": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort129-default-r1/result.json"}, {"path": ".cache/Microsoft/DeveloperTools/.onnxruntime/onnxruntime.db", "what": "the queue of events waiting to be sent", "receipt": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort129-default-r1/result.json"}, {"path": "/tmp/.ses (or $TMPDIR/.ses)", "what": "the telemetry library's own ID file", "receipt": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort129-default-r1/result.json"}, {"path": "/tmp/mat-debug-<process number>.log (or under $TMPDIR)", "what": "an empty debug-log file made as the uploader starts", "receipt": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort129-default-r1/result.json"}], "version_at_witness": null, "measured_on": ["onnx-runtime-telemetry-on-linux#what-we-measured"], "vendor_purpose": {"quote": "ONNX Runtime collects trace events with the goal of improving product quality.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9", "where": "docs/Privacy.md at v1.30.0, 'Official Builds'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its privacy file, shipped inside the package, says telemetry is on by default in the official builds on Linux, macOS, Android and iOS, and names ORT_DISABLE_TELEMETRY=1 under 'Disabling Telemetry'. The PyPI page and the onnxruntime.ai documentation did not mention it when we checked them for our ONNX Runtime telemetry measurement (2026-09-28).", "links": ["https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9-L30", "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-changed"], "read_utc": "2026-10-10"}, "public_discussion": [{"url": "https://github.com/immich-app/immich/issues/30729", "by": "others", "opened_utc": "2026-08-12"}, {"url": "https://github.com/microsoft/onnxruntime/issues/32173", "by": "others", "opened_utc": "2026-08-19"}, {"url": "https://github.com/OHF-Voice/wyoming-piper/issues/64", "by": "others", "opened_utc": "2026-09-04"}, {"url": "https://github.com/jonn-smith/claude-docker-sandbox/pull/21", "by": "others", "opened_utc": "2026-09-16"}, {"url": "https://github.com/microsoft/onnxruntime/issues/32771", "by": "others", "opened_utc": "2026-09-23"}, {"url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/", "by": "us", "opened_utc": "2026-09-28"}], "credit": [{"text": "The default and the switch are documented in the package's own privacy file.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L24-L30", "read_utc": "2026-10-10"}, {"text": "The device ID is sent as a hash, and the library blanks the program's name and your timezone from the events' shared context.", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-is-in-the-events", "read_utc": "2026-09-28"}, {"text": "conda-forge's recipe passes --no_telemetry to the build; the package itself was not inspected.", "source": "https://github.com/conda-forge/onnxruntime-feedstock/blob/16066d0b6738fd8881e83943fec398febd980e9b/recipe/build.sh#L109", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "Calling onnxruntime.disable_telemetry_events() did not stop the uploader in the sealed test on 1.30.0 (3 of 3 runs with the call made).", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/SUMMARY.md", "read_utc": "2026-09-28"}, {"text": "The library's runtime switch is ORT_DISABLE_TELEMETRY; the name DO_NOT_TRACK appears nowhere in its own source at v1.30.0 (a name search of the release's source, not of the telemetry SDK it builds in).", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/onnxruntime/core/platform/telemetry_environment.h#L110-L115", "read_utc": "2026-10-10"}, {"text": "If it ran before you set the switch, delete the .onnxruntime folder the 'has it already run' check finds; whether the switch also stops an old queue from being sent is not tested.", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#how-to-turn-it-off", "read_utc": "2026-09-28"}, {"text": "Blocking the collector's name on your network keeps the events from leaving through that network, but the library still collects and queues them; the switch stops collection. (In every default run the queue filled while every attempt was cut off.)", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort129-default-r1/result.json", "read_utc": "2026-09-28"}, {"text": "Step 3 of the switch rule was shown outside the sandbox on this version: the switch read from a running program's environment after its first log line.", "source": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-we-did-about-ours", "read_utc": "2026-09-28"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.29.0-pypi-linux-x86_64/telemetry", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.29.0", "version_read_utc": "2026-09-28", "build": "the PyPI wheel for Linux x86-64", "os": "Debian 12 container, x86-64", "arch": "x86-64", "install_method": "pip, the official PyPI wheel (onnxruntime-1.29.0-cp312-cp312-manylinux_2_28_x86_64.whl, CPython 3.12.13)", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · measured", "look_depth": "run", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "measured", "method": "the same sealed Docker probe as the 1.30.0 row (the kit published with our ONNX Runtime telemetry measurement, research hub, 2026-09-28); 1.29.0 is the first version with this telemetry on by default on Linux", "receipts": [{"label": "the kit's run summary", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/SUMMARY.md", "kind": "primary"}, {"label": "run 1, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort129-default-r1/result.json", "kind": "primary"}, {"label": "run 2, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort129-default-r2/result.json", "kind": "primary"}, {"label": "run 3, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort129-default-r3/result.json", "kind": "primary"}, {"label": "the audit's re-run without the switch, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/audit/runs/ort129-default-raudit3/result.json", "kind": "primary"}, {"label": "the audit's run with the switch", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/audit/runs/ort129-envoff-raudit3/result.json", "kind": "primary"}, {"label": "the predictions, frozen before the first run", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/PREREG-probe.md", "kind": "primary"}, {"label": "the audit's re-runs (check 4)", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/PROBE-AUDIT.md", "kind": "primary"}, {"label": "the privacy file at v1.29.0", "url": "https://github.com/microsoft/onnxruntime/blob/2e2543fbe9fae542f921d47a72d21d5a4ef0b710/docs/Privacy.md?plain=1#L24-L30", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'What we measured'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-we-measured", "kind": "pointer"}], "last_read_utc": "2026-09-28"}
{"package": "onnxruntime (Windows builds)", "condition": "events are recorded only while an external trace session is collecting; Windows then sends them under its own consent setting", "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "the same trace events, recorded through Windows' own event tracing", "class": "usage"}], "when": "Not run. Per the privacy file, events are recorded only while an external trace session collects them.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "OS telemetry", "hosts": [], "switch": {"name": "DisableTelemetryEvents", "value": "a call in the C API (and its C#, Python and Java bindings)", "accepted_values": ["a call in the C API (and its C#, Python and Java bindings)"], "values_tested": [], "kind": "API call", "where_set": "in the program's own code (the environment switch does not apply on Windows)", "other_spellings": [], "also_turns_off": [], "cost_of_off": null}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library: it opens no listening port of its own", "cloud_features": [], "read_source": "vendor_doc", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "ONNX Runtime collects trace events with the goal of improving product quality.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9", "where": "docs/Privacy.md at v1.30.0, 'Official Builds'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its privacy file, shipped inside the package, says telemetry is on by default in the official builds on Linux, macOS, Android and iOS, and names ORT_DISABLE_TELEMETRY=1 under 'Disabling Telemetry'. The PyPI page and the onnxruntime.ai documentation did not mention it when we checked them for our ONNX Runtime telemetry measurement (2026-09-28).", "links": ["https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L9-L30", "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-changed"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "Its privacy file says ONNX Runtime may already have emitted a minimal initialization event before the API switch can be called.", "source": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L30", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.28.0-1.29.0-1.30.0-windows/etw-trace-events", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.28.0, 1.29.0 and 1.30.0", "version_read_utc": "2026-10-10", "build": "the official Windows builds", "os": "not run: the vendor's privacy file applies to Windows", "arch": "as each build names", "install_method": "not installed: the vendor's privacy file read at v1.28.0, v1.29.0 and v1.30.0", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · read in its own privacy file: through Windows' own event tracing, while a trace session collects", "look_depth": "vendor_doc", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "read", "method": "docs/Privacy.md read at v1.28.0, v1.29.0 and v1.30.0", "receipts": [{"label": "the privacy file at v1.30.0, 'Windows'", "url": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L18", "kind": "primary"}, {"label": "the privacy file at v1.30.0, the API switch", "url": "https://github.com/microsoft/onnxruntime/blob/f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7/docs/Privacy.md?plain=1#L30", "kind": "primary"}, {"label": "the privacy file at v1.29.0, 'Windows'", "url": "https://github.com/microsoft/onnxruntime/blob/2e2543fbe9fae542f921d47a72d21d5a4ef0b710/docs/Privacy.md?plain=1#L18", "kind": "primary"}, {"label": "the privacy file at v1.28.0", "url": "https://github.com/microsoft/onnxruntime/blob/da9b5e364c465de65c49d91e696cd6485270757f/docs/Privacy.md?plain=1#L14", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'What changed, and when'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-changed", "kind": "pointer"}], "last_read_utc": "2026-10-10"}
{"package": "onnxruntime", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": "every handshake hung up", "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library: it opens no listening port of its own", "cloud_features": [], "read_source": null, "measured_utc": {"from": "2026-09-28T08:45:25Z", "to": "2026-09-28T08:51:43Z"}, "read_utc": null, "exercised": ["import, a one-addition model built in memory, loaded and run once on the processor, then 120 s alive"], "not_exercised": ["a second launch from the same home", "a working network", "the time past 120 s"], "leaves_on_disk": [], "version_at_witness": null, "measured_on": ["onnx-runtime-telemetry-on-linux#what-we-measured"], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [{"text": "Its privacy file says: \"Currently telemetry is only implemented for Windows builds\".", "source": "https://github.com/microsoft/onnxruntime/blob/da9b5e364c465de65c49d91e696cd6485270757f/docs/Privacy.md?plain=1#L14", "read_utc": "2026-10-10"}], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "onnx-runtime-1.28.0-pypi-linux-x86_64/none", "product": "ONNX Runtime", "slug": "onnx-runtime", "version": "1.28.0", "version_read_utc": "2026-09-28", "build": "the PyPI wheel for Linux x86-64", "os": "Debian 12 container, x86-64", "arch": "x86-64", "install_method": "pip, the official PyPI wheel (onnxruntime-1.28.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl, CPython 3.12.13)", "group": "libraries other tools install for you", "sends_by_default": "none_found", "answer_cell": "none found · measured: none in 120 s from launch in 3 runs; a second launch and a working network not exercised", "look_depth": "run", "licence": {"name": "MIT", "source": "the licence GitHub reads for microsoft/onnxruntime", "read_utc": "2026-10-10"}, "grade": "measured", "method": "the same sealed Docker probe as the 1.30.0 row (the kit published with our ONNX Runtime telemetry measurement, research hub, 2026-09-28)", "receipts": [{"label": "the kit's run summary", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/SUMMARY.md", "kind": "primary"}, {"label": "run 1, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort128-default-r1/result.json", "kind": "primary"}, {"label": "run 2, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort128-default-r2/result.json", "kind": "primary"}, {"label": "run 3, every event", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/data/probe/runs/ort128-default-r3/result.json", "kind": "primary"}, {"label": "the privacy file at v1.28.0: telemetry 'only implemented for Windows builds'", "url": "https://github.com/microsoft/onnxruntime/blob/da9b5e364c465de65c49d91e696cd6485270757f/docs/Privacy.md?plain=1#L14", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'What we measured'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#what-we-measured", "kind": "pointer"}], "last_read_utc": "2026-09-28"}
{"package": "open-webui", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default bind read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "open-webui-0.11.4-source/none", "product": "Open WebUI", "slug": "open-webui", "version": "0.11.4", "version_read_utc": "2026-10-10", "build": "the source at tag v0.11.4", "os": "not run: the dependency pin applies to every platform", "arch": "any", "install_method": "not installed: its dependency pin read at tag v0.11.4", "group": "servers and apps you run", "sends_by_default": "not_read", "answer_cell": "not read · only its ONNX Runtime version checked: it pins 1.26.0, from before ONNX Runtime's Linux telemetry; its own calls were not read", "look_depth": "dependency_only", "licence": {"name": "Open WebUI License (the name its LICENSE file states at v0.11.4)", "source": "https://github.com/open-webui/open-webui/blob/8bd8b4fac5e059578ac0c74b3c18d11139f88b7d/LICENSE#L1", "read_utc": "2026-10-10"}, "grade": "read", "method": "pyproject.toml and backend/requirements.txt read at tag v0.11.4 for the onnxruntime pin", "receipts": [{"label": "the pin in pyproject.toml", "url": "https://github.com/open-webui/open-webui/blob/8bd8b4fac5e059578ac0c74b3c18d11139f88b7d/pyproject.toml#L101", "kind": "primary"}, {"label": "the pin in backend/requirements.txt", "url": "https://github.com/open-webui/open-webui/blob/8bd8b4fac5e059578ac0c74b3c18d11139f88b7d/backend/requirements.txt#L93", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'Which tools bring it in'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#which-tools-bring-it-in", "kind": "pointer"}], "last_read_utc": "2026-10-10"}
{"package": "openvino", "condition": null, "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "an import event ('general_import')", "class": "usage"}, {"field": "more events when convert_model runs", "class": "usage"}], "when": "The code at 2026.4.0 sends an event when the package is imported, through Google Analytics (its collection host was not read); not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "third-party analytics", "hosts": [], "switch": {"name": "opt_in_out --opt_out", "value": "run once", "accepted_values": ["run once"], "values_tested": [], "kind": "a command that writes a consent file", "where_set": "once per account: it writes the consent file the library reads", "other_spellings": ["a file at intel/openvino_telemetry under your home folder holding 0"], "also_turns_off": [], "cost_of_off": null}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": ["small-open-deciders-measured#what-we-did-not-measure"], "vendor_purpose": {"quote": "To facilitate debugging and further development, OpenVINO™ collects anonymous telemetry data.", "source": "https://docs.openvino.ai/2026/about-openvino/additional-resources/telemetry.html", "where": "the OpenVINO 2026 documentation, 'OpenVINO™ Telemetry'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its telemetry page says anonymous data is collected by default, through Google Analytics, and how to opt out.", "links": ["https://docs.openvino.ai/2026/about-openvino/additional-resources/telemetry.html"], "read_utc": "2026-10-10"}, "public_discussion": [{"url": "https://research.strata2signal.com/small-open-deciders-measured/", "by": "us", "opened_utc": "2026-09-30"}], "credit": [{"text": "The default and the opt-out are documented on its telemetry page.", "source": "https://docs.openvino.ai/2026/about-openvino/additional-resources/telemetry.html", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": [], "installed_by": ["von-1.3.5-source/model-download"], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "openvino-2026.4.0-source/import-report", "product": "OpenVINO", "slug": "openvino", "version": "2026.4.0", "version_read_utc": "2026-10-10", "build": "the source at tag 2026.4.0 (with openvino-telemetry 2025.2.0, which a fresh install brought in on 2026-10-01)", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag 2026.4.0", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · read in code and in its own documents", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for openvinotoolkit/openvino", "read_utc": "2026-10-10"}, "grade": "read", "method": "openvino's package start-up and its ovc tools' telemetry start read at tag 2026.4.0. The source at the tag; we did not check that the released wheel matches it.", "receipts": [{"label": "importing openvino imports its model-conversion tools", "url": "https://github.com/openvinotoolkit/openvino/blob/99c81491cc302313c8937d3533c4fb6458b54e7a/src/bindings/python/src/openvino/__init__.py#L105-L106", "kind": "primary"}, {"label": "the tools send the import event", "url": "https://github.com/openvinotoolkit/openvino/blob/99c81491cc302313c8937d3533c4fb6458b54e7a/tools/ovc/openvino/tools/ovc/__init__.py#L16-L17", "kind": "primary"}, {"label": "the telemetry start, with no opt-in dialog", "url": "https://github.com/openvinotoolkit/openvino/blob/99c81491cc302313c8937d3533c4fb6458b54e7a/tools/ovc/openvino/tools/ovc/telemetry_utils.py#L41-L47", "kind": "primary"}, {"label": "its telemetry page", "url": "https://docs.openvino.ai/2026/about-openvino/additional-resources/telemetry.html", "kind": "primary"}, {"label": "our small open deciders measurement (research hub, 2026-09-30), 'What we did not measure'", "url": "https://research.strata2signal.com/small-open-deciders-measured/#what-we-did-not-measure", "kind": "pointer"}], "last_read_utc": "2026-10-10"}
{"package": "openwhispr (Electron desktop app)", "condition": "the first time the assistant or a chat message needs it, when the model is not already on disk", "call_kind": ["fetches"], "trigger": "on_request", "sends": [{"field": "a download of a small embedding model (all-MiniLM-L6-v2: its model file and tokenizer)", "class": "request"}], "when": "The code at v1.10.2 downloads the model on the assistant's first use, when it is not already on disk; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "model hub", "hosts": [{"name": "huggingface.co", "provenance": "asked"}], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": "none found", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default binds read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "Whisper GGML, Parakeet, GGUF, and embedding model downloads.", "source": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L38", "where": "docs/network-allowlist.md at v1.10.2, the Purpose cell of the huggingface.co row (quoted whole)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its network allowlist lists huggingface.co for embedding model downloads; it does not say the assistant's first use starts one.", "links": ["https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L31-L38"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "openwhispr-1.10.2-source/assistant-embedding-model", "build": "every desktop build", "os": "not run: the source applies to every desktop build", "arch": "any", "install_method": "not installed: source read at tag v1.10.2", "sends_by_default": "yes", "answer_cell": "yes · read in code: on the assistant's first use", "look_depth": "code_read_call_sites", "method": "src/helpers/localEmbeddings.js read at tag v1.10.2. The source at the tag; we did not check that the released build matches it.", "receipts": [{"label": "the two download addresses", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/src/helpers/localEmbeddings.js#L95-L99", "kind": "primary"}, {"label": "its network allowlist", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L38", "kind": "primary"}], "product": "OpenWhispr", "slug": "openwhispr", "version": "1.10.2", "version_read_utc": "2026-10-10", "group": "servers and apps you run", "licence": {"name": "MIT", "source": "the licence GitHub reads for OpenWhispr/openwhispr", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-10"}
{"package": "openwhispr (Electron desktop app)", "condition": "whenever the app shows a person with an email address (attendees, participants, mentions)", "call_kind": ["fetches"], "trigger": "on_request", "sends": [{"field": "an MD5 hash of the person's email address, in the image address", "class": "identifier"}], "when": "The code at v1.10.2 requests an avatar image each time it shows a person with an email address; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "third-party service", "hosts": [{"name": "www.gravatar.com", "provenance": "asked"}], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": "none found", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default binds read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": null, "none_found": "none found in docs/network-allowlist.md and the README at v1.10.2, read 2026-10-10", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "none_found", "text": "None found: its network allowlist and README at v1.10.2 do not list the avatar service.", "links": ["https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1", "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/README.md"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "If the request fails, the app shows the person's initial instead.", "source": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/src/components/ui/PersonAvatar.tsx#L24", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "openwhispr-1.10.2-source/avatars", "build": "every desktop build", "os": "not run: the source applies to every desktop build", "arch": "any", "install_method": "not installed: source read at tag v1.10.2", "sends_by_default": "yes", "answer_cell": "yes · read in code: for any person shown with an email address", "look_depth": "code_read_call_sites", "method": "src/components/ui/PersonAvatar.tsx read at tag v1.10.2", "receipts": [{"label": "the avatar request built from the email's hash", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/src/components/ui/PersonAvatar.tsx#L24-L50", "kind": "primary"}], "product": "OpenWhispr", "slug": "openwhispr", "version": "1.10.2", "version_read_utc": "2026-10-10", "group": "servers and apps you run", "licence": {"name": "MIT", "source": "the licence GitHub reads for OpenWhispr/openwhispr", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-10"}
{"package": "openwhispr (Electron desktop app)", "condition": null, "call_kind": ["checks"], "trigger": "background", "sends": [{"field": "a session request with no token", "class": "request"}], "when": "The code at v1.10.2 asks for the account session when the app's window loads its account state, at every launch; whether its session library asks again later was not read. Not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [{"name": "auth.openwhispr.com", "provenance": "asked"}], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": "none found", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default binds read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "Account sign-in and session refresh (Better Auth).", "source": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L16", "where": "docs/network-allowlist.md at v1.10.2, the Purpose cell of the auth.openwhispr.com row (quoted whole)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its network allowlist lists the sign-in service for account sign-in and session refresh; it does not say a guest's launch also asks.", "links": ["https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L8-L16"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "openwhispr-1.10.2-source/session-check", "build": "every desktop build", "os": "not run: the source applies to every desktop build", "arch": "any", "install_method": "not installed: source read at tag v1.10.2", "sends_by_default": "yes", "answer_cell": "yes · read in code: also for a guest who never signs in", "look_depth": "code_read_call_sites", "method": "src/lib/auth.ts and src/hooks/useAuth.ts read at tag v1.10.2 (better-auth 1.6.27's session hook makes the request)", "receipts": [{"label": "the sign-in service's address", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/src/lib/auth.ts#L13-L15", "kind": "primary"}, {"label": "the session hook", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/src/hooks/useAuth.ts#L73-L74", "kind": "primary"}, {"label": "its network allowlist", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L16", "kind": "primary"}], "product": "OpenWhispr", "slug": "openwhispr", "version": "1.10.2", "version_read_utc": "2026-10-10", "group": "servers and apps you run", "licence": {"name": "MIT", "source": "the licence GitHub reads for OpenWhispr/openwhispr", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-10"}
{"package": "openwhispr (Electron desktop app)", "condition": "only while you are signed in to an OpenWhispr account; a guest's calls stop before they are sent", "call_kind": ["cloud_you_chose"], "trigger": "you_asked", "sends": [{"field": "the transcript text", "class": "content"}, {"field": "the audio's duration, the speech-to-text provider and model, timings, and the app version", "class": "usage"}, {"field": "a session ID and a transcription ID", "class": "identifier"}, {"field": "the audio's size, format and language", "class": "usage"}, {"field": "the local date, the dictation's time and its word count, when its analytics sync is on", "class": "usage"}], "when": "The code at v1.10.2 posts a usage record after each streaming dictation while you are signed in, including when you use your own provider key; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [{"name": "api.openwhispr.com", "provenance": "asked"}], "switch": {"name": "do not sign in", "value": "stay a guest", "accepted_values": ["stay a guest"], "values_tested": [], "kind": "a choice in the app", "where_set": "in the app's onboarding: continue without an account", "other_spellings": [], "also_turns_off": [], "cost_of_off": null}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code: the request throws before sending without a sign-in; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default binds read", "cloud_features": [{"name": "OpenWhispr Cloud: transcription, sync and the agent, once you sign in", "switch": "do not sign in", "source": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L8-L17"}], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "Cloud API: transcription, sync, agent reasoning, settings, usage.", "source": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L15", "where": "docs/network-allowlist.md at v1.10.2, the Purpose cell of the api.openwhispr.com row (quoted whole)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its network allowlist lists the cloud API for usage among other things; it does not say the usage record carries the transcript text.", "links": ["https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L15"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "openwhispr-1.10.2-source/signed-in-streaming-usage", "build": "every desktop build", "os": "not run: the source applies to every desktop build", "arch": "any", "install_method": "not installed: source read at tag v1.10.2", "sends_by_default": "when_chosen", "answer_cell": "when chosen · read in code: only while signed in", "look_depth": "code_read_call_sites", "method": "src/helpers/ipcHandlers.js and src/helpers/audioManager.js read at tag v1.10.2", "receipts": [{"label": "the usage record and its fields", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/src/helpers/ipcHandlers.js#L9509-L9545", "kind": "primary"}, {"label": "sent after each streaming dictation, your own provider key included", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/src/helpers/audioManager.js#L5285-L5320", "kind": "primary"}, {"label": "its network allowlist", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L15", "kind": "primary"}], "product": "OpenWhispr", "slug": "openwhispr", "version": "1.10.2", "version_read_utc": "2026-10-10", "group": "servers and apps you run", "licence": {"name": "MIT", "source": "the licence GitHub reads for OpenWhispr/openwhispr", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-10"}
{"package": "openwhispr (Electron desktop app)", "condition": null, "call_kind": ["checks"], "trigger": "background", "sends": [{"field": "requests for the release feed", "class": "request"}, {"field": "an install ID header (x-user-staging-id) that its updater library stores once and sends on each check", "class": "identifier"}], "when": "The code at v1.10.2 checks 3 s after launch and every 4 hours after, whether or not automatic updates are on (the setting stops only downloads); not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "code host", "hosts": [{"name": "github.com", "provenance": "asked"}], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": "none found: the update setting stops downloads, not the check", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default binds read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [{"path": ".updaterId in the app's data folder", "what": "the stored install ID", "receipt": "https://github.com/electron-userland/electron-builder/blob/bed3a9c421a8a05c49f36a2af5d7ae3598cb1b95/packages/electron-updater/src/AppUpdater.ts#L642-L665"}], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "Application auto-update (release artifacts via electron-updater, GitHub provider).", "source": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L17", "where": "docs/network-allowlist.md at v1.10.2, the Purpose cell of the github.com row (quoted whole)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its network allowlist lists github.com for application auto-update; it does not mention the install ID header or the 4-hour timing.", "links": ["https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L8-L17"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "On Linux, the deb, rpm and tar.gz builds carry no updater, so they make no update check.", "source": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/src/updater.js#L3-L5", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "openwhispr-1.10.2-updater-builds/update-check", "build": "the macOS, Windows and Linux AppImage builds (the deb, rpm and tar.gz builds have no updater)", "os": "not run: the source applies to macOS, Windows and the Linux AppImage", "arch": "any", "install_method": "not installed: source read at tag v1.10.2", "sends_by_default": "yes", "answer_cell": "yes · read in code", "look_depth": "code_read_call_sites", "method": "src/updater.js read at tag v1.10.2, and electron-updater 6.8.9 (the version its lockfile pins) for the header. The source at the tag; we did not check that the released build matches it.", "receipts": [{"label": "the check at 3 s and every 4 hours", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/src/updater.js#L330-L351", "kind": "primary"}, {"label": "the updater runs only where it can replace the app", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/src/updater.js#L3-L5", "kind": "primary"}, {"label": "electron-updater 6.8.9 sets the install ID header", "url": "https://github.com/electron-userland/electron-builder/blob/bed3a9c421a8a05c49f36a2af5d7ae3598cb1b95/packages/electron-updater/src/AppUpdater.ts#L488-L489", "kind": "primary"}, {"label": "electron-updater 6.8.9 stores the ID", "url": "https://github.com/electron-userland/electron-builder/blob/bed3a9c421a8a05c49f36a2af5d7ae3598cb1b95/packages/electron-updater/src/AppUpdater.ts#L642-L665", "kind": "primary"}, {"label": "its network allowlist", "url": "https://github.com/OpenWhispr/openwhispr/blob/1c123e8739f87c0a72d0b252bc9cff14e684b7f4/docs/network-allowlist.md?plain=1#L17", "kind": "primary"}], "product": "OpenWhispr", "slug": "openwhispr", "version": "1.10.2", "version_read_utc": "2026-10-10", "group": "servers and apps you run", "licence": {"name": "MIT", "source": "the licence GitHub reads for OpenWhispr/openwhispr", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-11"}
{"package": "pip", "condition": "when you run pip, at most once every 7 days; skipped in a Python marked externally managed (PEP 668) when no virtual environment is active, as Ubuntu 26.04's own Python is", "call_kind": ["checks"], "trigger": "on_request", "sends": [{"field": "a lookup of the newest pip on the package index", "class": "request"}], "when": "Read in code at 26.2.1: when pip runs and its last check is more than a week old, against PyPI or the index you configure; it returns before any request in an externally managed Python outside a virtual environment; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "package index", "hosts": [{"name": "pypi.org", "provenance": "asked"}], "switch": {"name": "PIP_DISABLE_PIP_VERSION_CHECK", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable (or the --disable-pip-version-check option)", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": ["--disable-pip-version-check"], "also_turns_off": ["the notice that a newer pip exists"], "cost_of_off": "you are no longer told that a newer pip exists"}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a command-line tool", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "Don't periodically check PyPI to determine whether a new version of pip is available for download. Implied with --no-index.", "source": "https://github.com/pypa/pip/blob/634a6ec1a5d9dcc2433571cdb2f4c58a4bb29caf/src/pip/_internal/cli/cmdoptions.py#L1201-L1202", "where": "the help text of --disable-pip-version-check at 26.2.1 (it states the check's purpose by negation)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "The option's help text, printed by pip --help, describes the check and how to turn it off.", "links": ["https://github.com/pypa/pip/blob/634a6ec1a5d9dcc2433571cdb2f4c58a4bb29caf/src/pip/_internal/cli/cmdoptions.py#L1195-L1203"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [{"text": "pip skips the check in an externally managed Python (PEP 668) outside a virtual environment, where the distribution updates pip.", "source": "https://github.com/pypa/pip/blob/634a6ec1a5d9dcc2433571cdb2f4c58a4bb29caf/src/pip/_internal/self_outdated_check.py#L221-L224", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "pip-26.2.1-source/self-version-check", "product": "pip", "slug": "pip", "version": "26.2.1", "version_read_utc": "2026-10-10", "build": "the source at tag 26.2.1", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag 26.2.1", "group": "Ubuntu and the network software around them", "sends_by_default": "yes", "answer_cell": "yes · read in code: at most once a week, when you run pip in a virtual environment or in a Python not marked externally managed", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for pypa/pip", "read_utc": "2026-10-10"}, "grade": "read", "method": "src/pip/_internal/self_outdated_check.py and cli/cmdoptions.py read at tag 26.2.1", "receipts": [{"label": "the weekly interval", "url": "https://github.com/pypa/pip/blob/634a6ec1a5d9dcc2433571cdb2f4c58a4bb29caf/src/pip/_internal/self_outdated_check.py#L42", "kind": "primary"}, {"label": "the check", "url": "https://github.com/pypa/pip/blob/634a6ec1a5d9dcc2433571cdb2f4c58a4bb29caf/src/pip/_internal/self_outdated_check.py#L206-L235", "kind": "primary"}, {"label": "the option's own help text", "url": "https://github.com/pypa/pip/blob/634a6ec1a5d9dcc2433571cdb2f4c58a4bb29caf/src/pip/_internal/cli/cmdoptions.py#L1195-L1203", "kind": "primary"}, {"label": "the externally-managed test: a marker file in the standard library, no virtual environment", "url": "https://github.com/pypa/pip/blob/634a6ec1a5d9dcc2433571cdb2f4c58a4bb29caf/src/pip/_internal/utils/misc.py#L629-L641", "kind": "primary"}, {"label": "Ubuntu 26.04's Python 3.14 package installs that marker", "url": "https://git.launchpad.net/ubuntu/+source/python3.14/tree/debian/rules?h=import/3.14.4-1ubuntu0.2#n1196", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "pip", "condition": "on every request to a package index, when you run pip", "call_kind": ["reports"], "trigger": "you_asked", "sends": [{"field": "the installer and Python versions and implementation, the distribution and its version, the system and its release, the processor architecture", "class": "system"}, {"field": "the OpenSSL, setuptools and rustc versions, and whether it looks like a CI run", "class": "software"}], "when": "Read in code at 26.2.1: inside the user agent of each request pip makes to PyPI or the index you configure; pip is not a background caller.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "package index", "hosts": [{"name": "pypi.org", "provenance": "asked"}], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": "none found for the user agent", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a command-line tool", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": null, "none_found": "none found in pip's user guide at 26.2.1, read 2026-10-10", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its user guide mentions the user agent only to say PIP_USER_AGENT_USER_DATA can add to it; the fields are not listed.", "links": ["https://github.com/pypa/pip/blob/634a6ec1a5d9dcc2433571cdb2f4c58a4bb29caf/docs/html/user_guide.rst?plain=1#L101-L102"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "pip-26.2.1-source/user-agent-fields", "product": "pip", "slug": "pip", "version": "26.2.1", "version_read_utc": "2026-10-10", "build": "the source at tag 26.2.1", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag 26.2.1", "group": "Ubuntu and the network software around them", "sends_by_default": "yes", "answer_cell": "yes · read in code: in the user agent of every request to a package index", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for pypa/pip", "read_utc": "2026-10-10"}, "grade": "read", "method": "src/pip/_internal/network/session.py read at tag 26.2.1", "receipts": [{"label": "the user agent's fields", "url": "https://github.com/pypa/pip/blob/634a6ec1a5d9dcc2433571cdb2f4c58a4bb29caf/src/pip/_internal/network/session.py#L84-L175", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "pollinate", "condition": "at boot until it has seeded once; not inside containers; on Ubuntu 24.04 installs whose metapackage brings it in (ubuntu-server, ubuntu-server-minimal and ubuntu-cloud-minimal), not the desktop's", "call_kind": ["reports", "fetches"], "trigger": "background", "sends": [{"field": "a user agent naming installed package versions, the distribution release, the kernel, the processor model, uptime and the virtualisation type", "class": "system"}], "when": "Per its unit: once at boot, until a seeded marker exists; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [{"name": "entropy.ubuntu.com", "provenance": "asked"}], "switch": {"name": "disable pollinate.service", "value": "disabled", "accepted_values": ["disabled"], "values_tested": [], "kind": "a systemd service", "where_set": "systemctl disable pollinate.service", "other_spellings": [], "also_turns_off": ["seeding the random number generator from the network at first boot"], "cost_of_off": "a fresh virtual machine relies on its own entropy at first boot"}, "switch_verdict": "not_tested", "switch_verdict_how": "documented behaviour of systemd; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a boot script", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "Please understand...neither Pollen nor Pollinate increase the amount of entropy available on the system!  Rather, Pollinate adequately and securely seeds (and periodically re-seeds) the PRNG in cloud virtual machines through communications with a Pollen server.", "source": "https://git.launchpad.net/ubuntu/+source/pollinate/plain/README?h=import/4.33-3.1ubuntu1", "where": "its README at 4.33-3.1ubuntu1, 'ABSTRACT'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its README explains what it is for; the fields in its user agent are in the script, not the README.", "links": ["https://git.launchpad.net/ubuntu/+source/pollinate/plain/README?h=import/4.33-3.1ubuntu1"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "Ubuntu 26.04's server and minimal cloud metapackages stopped bringing in pollinate at ubuntu-meta 1.570.2 (2026-07-03).", "source": "https://git.launchpad.net/ubuntu/+source/ubuntu-meta/tree/debian/changelog?h=import/1.570.4#n21", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "pollinate-4.33-3.1ubuntu1-ubuntu-24.04/entropy-seed", "product": "pollinate", "slug": "pollinate", "version": "4.33-3.1ubuntu1", "version_read_utc": "2026-10-10", "build": "the Ubuntu 24.04 package", "os": "not run: the Ubuntu 24.04 source package", "arch": "any", "install_method": "not installed: the Ubuntu 24.04 source package read at 4.33-3.1ubuntu1", "group": "Ubuntu and the network software around them", "sends_by_default": "yes", "answer_cell": "yes · read in code: at first boot, until seeded, where installed (Ubuntu 24.04's server and minimal cloud metapackages)", "look_depth": "code_read_call_sites", "licence": {"name": "GPL-3.0 (its README)", "source": "https://git.launchpad.net/ubuntu/+source/pollinate/plain/README?h=import/4.33-3.1ubuntu1", "read_utc": "2026-10-10"}, "grade": "read", "method": "the script, its default server and its unit read in the source package at 4.33-3.1ubuntu1", "receipts": [{"label": "the user agent and the request", "url": "https://git.launchpad.net/ubuntu/+source/pollinate/plain/pollinate?h=import/4.33-3.1ubuntu1", "kind": "primary"}, {"label": "the default server", "url": "https://git.launchpad.net/ubuntu/+source/pollinate/plain/debian/pollinate.default?h=import/4.33-3.1ubuntu1", "kind": "primary"}, {"label": "the first-boot unit", "url": "https://git.launchpad.net/ubuntu/+source/pollinate/plain/debian/pollinate.service?h=import/4.33-3.1ubuntu1", "kind": "primary"}, {"label": "Ubuntu 24.04's server metapackage depends on pollinate", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-meta/tree/server-amd64?h=import/1.539.2#n21", "kind": "primary"}, {"label": "and so does its minimal server metapackage", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-meta/tree/server-minimal-amd64?h=import/1.539.2#n15", "kind": "primary"}, {"label": "and its minimal cloud metapackage", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-meta/tree/cloud-minimal-amd64?h=import/1.539.2#n17", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "pyannote.audio", "condition": "when a pipeline or model is loaded and run", "call_kind": ["reports"], "trigger": "on_request", "sends": [{"field": "where the pipeline came from (an official pyannote name, 'huggingface', or 'local') and its Python class", "class": "usage"}, {"field": "each file's duration and the speaker-count settings", "class": "usage"}], "when": "Per its README and its shipped config at 4.0.7: when a pipeline is loaded and for each file it processes; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor telemetry collector", "hosts": [{"name": "otel.pyannote.ai", "provenance": "asked"}], "switch": {"name": "PYANNOTE_METRICS_ENABLED", "value": "0", "accepted_values": ["0"], "values_tested": [], "kind": "environment variable", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": ["set_telemetry_metrics in Python, for the session or across sessions"], "also_turns_off": [], "cost_of_off": null}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a library", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "With the optional telemetry feature in `pyannote.audio`, you can choose to send anonymous usage metrics to help the `pyannote` team improve the library.", "source": "https://github.com/pyannote/pyannote-audio/blob/b749285c5cdd4636b2edc7f766f1352c8dde9369/README.md?plain=1#L112-L150", "where": "its README at tag 4.0.7, the Telemetry section's opening sentence (line 114); the shipped config (src/pyannote/audio/telemetry/config.yaml, line 1) sets metrics_enabled: true", "read_utc": "2026-10-11"}, "vendor_documents_it": {"value": "yes", "text": "Its README lists what is tracked, the switch, and that the default comes from the shipped telemetry config.", "links": ["https://github.com/pyannote/pyannote-audio/blob/b749285c5cdd4636b2edc7f766f1352c8dde9369/README.md?plain=1#L112-L150"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [{"text": "The README lists exactly what is tracked and three ways to set the switch.", "source": "https://github.com/pyannote/pyannote-audio/blob/b749285c5cdd4636b2edc7f766f1352c8dde9369/README.md?plain=1#L112-L150", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "pyannote-audio-4.0.7-source/pipeline-metrics", "product": "pyannote.audio", "slug": "pyannote-audio", "version": "4.0.7", "version_read_utc": "2026-10-10", "build": "the source at tag 4.0.7", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag 4.0.7", "group": "libraries other tools install for you", "sends_by_default": "yes", "answer_cell": "yes · read in its shipped config and its own documents", "look_depth": "vendor_doc", "licence": {"name": "MIT", "source": "the licence GitHub reads for pyannote/pyannote-audio", "read_utc": "2026-10-10"}, "grade": "read", "method": "the telemetry config shipped in the package and the README's Telemetry section read at tag 4.0.7; the sending code was not enumerated", "receipts": [{"label": "the shipped config: metrics on, and the endpoint", "url": "https://github.com/pyannote/pyannote-audio/blob/b749285c5cdd4636b2edc7f766f1352c8dde9369/src/pyannote/audio/telemetry/config.yaml#L1-L2", "kind": "primary"}, {"label": "the README's Telemetry section", "url": "https://github.com/pyannote/pyannote-audio/blob/b749285c5cdd4636b2edc7f766f1352c8dde9369/README.md?plain=1#L112-L150", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "qdrant (the vector database server)", "condition": null, "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "anonymized system information, configuration, and timings and counters of parts of the code", "class": "usage"}, {"field": "a random ID for the instance", "class": "identifier"}], "when": "The code at v1.19.1 reports at start and then every hour; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor telemetry collector", "hosts": [{"name": "telemetry.qdrant.io", "provenance": "asked"}], "switch": {"name": "QDRANT__TELEMETRY_DISABLED", "value": "true", "accepted_values": ["true"], "values_tested": [], "kind": "environment variable", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": ["telemetry_disabled: true in its config file", "the --disable-telemetry command-line option"], "also_turns_off": [], "cost_of_off": "none known: its documents say turning it off does not affect monitoring your own database"}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "all_interfaces", "listens_source": "its shipped config/config.yaml at v1.19.1 sets the host to every interface", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "In order to identify bottlenecks and improve Qdrant, we need to collect information about how it is used.", "source": "https://qdrant.tech/documentation/ops-configuration/usage-statistics/", "where": "Qdrant's documentation, 'Usage statistics'", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its usage-statistics page says what is collected, how it is anonymized, and three ways to turn it off.", "links": ["https://qdrant.tech/documentation/ops-configuration/usage-statistics/"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [{"text": "Statistics are anonymized and tied to a random instance ID, and its documents say Qdrant Cloud turns them off by default.", "source": "https://qdrant.tech/documentation/ops-configuration/usage-statistics/", "read_utc": "2026-10-10"}], "does_not_send": [{"text": "Its documents say it never collects your IP address, collection data, collection names or URLs.", "source": "https://qdrant.tech/documentation/ops-configuration/usage-statistics/", "read_utc": "2026-10-10"}], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "qdrant-1.19.1-source/usage-statistics", "product": "Qdrant", "slug": "qdrant", "version": "1.19.1", "version_read_utc": "2026-10-10", "build": "the source at tag v1.19.1", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag v1.19.1", "group": "servers and apps you run", "sends_by_default": "yes", "answer_cell": "yes · read in code and in its own documents", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for qdrant/qdrant", "read_utc": "2026-10-10"}, "grade": "read", "method": "src/common/telemetry_reporting.rs, src/settings.rs and config/config.yaml read at tag v1.19.1. The source at the tag; we did not check that the released build matches it.", "receipts": [{"label": "the address and the hourly loop", "url": "https://github.com/qdrant/qdrant/blob/6ab21cac18ebb6f4ae29102c7f8f5cc11affd5de/src/common/telemetry_reporting.rs#L19-L41", "kind": "primary"}, {"label": "the reporting loop", "url": "https://github.com/qdrant/qdrant/blob/6ab21cac18ebb6f4ae29102c7f8f5cc11affd5de/src/common/telemetry_reporting.rs#L75-L86", "kind": "primary"}, {"label": "the switch, off by default", "url": "https://github.com/qdrant/qdrant/blob/6ab21cac18ebb6f4ae29102c7f8f5cc11affd5de/src/settings.rs#L255-L256", "kind": "primary"}, {"label": "environment variables with the QDRANT__ prefix", "url": "https://github.com/qdrant/qdrant/blob/6ab21cac18ebb6f4ae29102c7f8f5cc11affd5de/src/settings.rs#L328-L329", "kind": "primary"}, {"label": "the default bind", "url": "https://github.com/qdrant/qdrant/blob/6ab21cac18ebb6f4ae29102c7f8f5cc11affd5de/config/config.yaml#L331", "kind": "primary"}, {"label": "its usage-statistics page", "url": "https://qdrant.tech/documentation/ops-configuration/usage-statistics/", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "sglang", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default bind read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-01", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "It pins FlashInfer 0.6.18, whose kernel download at the next release, 0.6.18.post1, is its own row.", "source": "https://github.com/sgl-project/sglang/blob/94602c9c2b7cbdb8efd5c52802dac6a1c180089e/python/pyproject.toml#L42", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "sglang-0.5.20-source/none", "product": "SGLang", "slug": "sglang", "version": "0.5.20", "version_read_utc": "2026-10-01", "build": "the source at tag v0.5.20", "os": "not run: the source applies to Linux", "arch": "any SGLang supports", "install_method": "not installed: a code search at tag v0.5.20", "group": "servers and apps you run", "sends_by_default": "not_read", "answer_cell": "not read · a keyword search found nothing", "look_depth": "code_read_keyword", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for sgl-project/sglang", "read_utc": "2026-10-10"}, "grade": "read", "method": "a name search of python/sglang for telemetry, usage_stats, posthog, DO_NOT_TRACK and sentry_sdk (the 'telemetry' hits are OpenTelemetry tracing, off unless configured); not an audit of its network calls", "receipts": [{"label": "the source at tag v0.5.20", "url": "https://github.com/sgl-project/sglang/tree/94602c9c2b7cbdb8efd5c52802dac6a1c180089e", "kind": "primary"}], "last_read_utc": "2026-10-01"}
{"package": "sherpa-onnx", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default bind read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "sherpa-onnx-1.13.8-source/none", "product": "sherpa-onnx", "slug": "sherpa-onnx", "version": "1.13.8", "version_read_utc": "2026-10-10", "build": "the Linux x86-64 build files at tag v1.13.8", "os": "not run: the build files for Linux x86-64", "arch": "x86-64", "install_method": "not installed: its build files read at tag v1.13.8", "group": "libraries other tools install for you", "sends_by_default": "not_read", "answer_cell": "not read · only its ONNX Runtime version checked: its Linux x86-64 build bundles 1.28.2 (a third-party rebuild), from before ONNX Runtime's Linux telemetry; its own calls were not read", "look_depth": "dependency_only", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for k2-fsa/sherpa-onnx", "read_utc": "2026-10-10"}, "grade": "read", "method": "cmake/onnxruntime-linux-x86_64.cmake read at tag v1.13.8", "receipts": [{"label": "the bundled ONNX Runtime archive named in the build files", "url": "https://github.com/k2-fsa/sherpa-onnx/blob/11afbd009a7f8c08f4bcf2fc1b265d0df4670fbf/cmake/onnxruntime-linux-x86_64.cmake#L17", "kind": "primary"}, {"label": "ONNX Runtime 1.28.2's privacy file: telemetry only in Windows builds", "url": "https://github.com/microsoft/onnxruntime/blob/33ca9628233dc8f002435e868d4c2e9f82766ca1/docs/Privacy.md?plain=1#L14", "kind": "primary"}, {"label": "our ONNX Runtime telemetry measurement (research hub, 2026-09-28), 'Which tools bring it in'", "url": "https://research.strata2signal.com/onnx-runtime-telemetry-on-linux/#which-tools-bring-it-in", "kind": "pointer"}], "last_read_utc": "2026-10-10"}
{"package": "snapd", "condition": null, "call_kind": ["checks"], "trigger": "background", "sends": [{"field": "store refresh checks for installed snaps", "class": "request"}], "when": "Per its documents: the system refreshes four times a day by default. Not wire-checked at this version.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "update service", "hosts": [{"name": "api.snapcraft.io", "provenance": "asked"}], "switch": {"name": "refresh.hold, or mask snapd's units", "value": "a hold date, or masked", "accepted_values": ["a hold date, or masked"], "values_tested": [], "kind": "a snap system option, or systemd units", "where_set": "snap set system refresh.hold=<date>, or systemctl mask on snapd's units (no snap works while they are masked)", "other_spellings": [], "also_turns_off": ["security and feature updates for your snaps"], "cost_of_off": "your snaps stop receiving updates, security fixes included"}, "switch_verdict": "not_tested", "switch_verdict_how": "documented; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a system daemon: not a server you reach", "cloud_features": [], "read_source": "vendor_doc", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "Snaps update automatically, and by default, the snapd daemon checks for updates 4 times a day.", "source": "https://snapcraft.io/docs/how-to-guides/manage-snaps/manage-updates/", "where": "Snap documentation, 'Manage updates', its opening sentence", "read_utc": "2026-10-11"}, "vendor_documents_it": {"value": "yes", "text": "Its 'Manage updates' page documents the refresh schedule and how to hold it.", "links": ["https://snapcraft.io/docs/how-to-guides/manage-snaps/manage-updates/"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "snapd-2.76.3-ubuntu-26.04/store-refresh", "product": "snapd", "slug": "snapd", "version": "2.76.3+ubuntu26.04", "version_read_utc": "2026-10-10", "build": "the Ubuntu 26.04 package", "os": "Ubuntu 26.04 desktop, x86-64 (a machine of ours, not a stock install)", "arch": "x86-64", "install_method": "the distro's package snapd 2.76.3+ubuntu26.04", "group": "Ubuntu and the network software around them", "sends_by_default": "yes", "answer_cell": "yes · read in its own documents", "look_depth": "vendor_doc", "licence": {"name": "GPL-3.0", "source": "the licence GitHub reads for canonical/snapd", "read_utc": "2026-10-10"}, "grade": "read", "method": "its 'Manage updates' page read 2026-10-10; the package version read on a machine of ours", "receipts": [{"label": "its 'Manage updates' page", "url": "https://snapcraft.io/docs/how-to-guides/manage-snaps/manage-updates/", "kind": "primary"}, {"label": "the store's address in snapd's source (upstream tag 2.76.3)", "url": "https://github.com/canonical/snapd/blob/58163ecc3eae8d0581d893934115eb354d85f85e/store/store.go#L226-L234", "kind": "primary"}, {"label": "the default refresh schedule, four times a day", "url": "https://github.com/canonical/snapd/blob/58163ecc3eae8d0581d893934115eb354d85f85e/overlord/snapstate/autorefresh.go#L50", "kind": "primary"}, {"label": "the package", "url": "https://launchpad.net/ubuntu/+source/snapd/2.76.3+ubuntu26.04", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "Strata (an inference engine and its server)", "condition": null, "call_kind": [], "trigger": null, "sends": [], "when": null, "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": null, "hosts": [], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": null, "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "loopback", "listens_source": "its server's default host is the loopback address (serve/server.py at 8fc40dde)", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": null, "vendor_documents_it": null, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "When started bound to an address beyond loopback, the server looks up its own host name to print the addresses other devices can use; that lookup goes to your resolver, not to a vendor.", "source": "https://github.com/Niko1221/Strata/blob/8fc40dde5e8897a097ec0ea6ea27f9313d171268/serve/server.py#L1744-L1747", "read_utc": "2026-10-10"}, {"text": "Its setup script downloads the files it needs when you run it.", "source": "https://github.com/Niko1221/Strata/blob/8fc40dde5e8897a097ec0ea6ea27f9313d171268/setup.py#L522-L537", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "strata-8fc40dde-source/none", "product": "Strata", "slug": "strata", "version": "8fc40dde", "version_read_utc": "2026-10-10", "build": "the source at commit 8fc40dde (its setup names engine v0.1.25; the tag v0.1.25 now names a rewritten commit)", "os": "not run: the source applies to every platform it builds", "arch": "any", "install_method": "not installed: source read at commit 8fc40dde", "group": "research engines and model repositories we read", "sends_by_default": "none_found", "answer_cell": "none found · code read at 8fc40dde: no call on its own; it fetches only what a request or your configuration names", "look_depth": "code_read_call_sites", "licence": {"name": "MIT", "source": "the licence GitHub reads for Niko1221/Strata", "read_utc": "2026-10-10"}, "grade": "read", "method": "every network client call enumerated at 8fc40dde (Python requests, httpx, urllib, aiohttp, socket, grpc, websockets, huggingface_hub downloads; JS fetch, XMLHttpRequest, net, https, dgram, WebSocket, axios); each hit read: the setup script's downloads, image URLs named in a request, MCP servers you configure, and the bundled chat client talking to the local server. The repository's history was later rewritten: the tag v0.1.25 now names commit d4e04766.", "receipts": [{"label": "the server's default host", "url": "https://github.com/Niko1221/Strata/blob/8fc40dde5e8897a097ec0ea6ea27f9313d171268/serve/server.py#L1536", "kind": "primary"}, {"label": "an image URL named in a request is fetched", "url": "https://github.com/Niko1221/Strata/blob/8fc40dde5e8897a097ec0ea6ea27f9313d171268/serve/server.py#L397-L403", "kind": "primary"}, {"label": "the own-name lookup, only when bound beyond loopback", "url": "https://github.com/Niko1221/Strata/blob/8fc40dde5e8897a097ec0ea6ea27f9313d171268/serve/server.py#L1517-L1533", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "ubuntu-insights", "condition": "when consent is off, the report it sends says only that you opted out", "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "a report holding only an opt-out flag (\"OptOut\": true), when consent is off", "class": "consent state"}], "when": "A weekly user timer runs the upload. Seen on a machine of ours: the program's own record of four uploads, dated 2026-07-06 (twice), 2026-08-06 and 2026-09-08, read 2026-09-28; and the upload address in the binary.", "when_observed_s": null, "when_anchor": null, "when_condition": "on a working network", "when_state": null, "host_class": "OS telemetry", "hosts": [{"name": "metrics.ubuntu.com", "provenance": "asked"}], "switch": {"name": "mask its two user timers", "value": "masked", "accepted_values": ["masked"], "values_tested": [], "kind": "systemd user timers (ubuntu-insights-collect.timer, ubuntu-insights-upload.timer)", "where_set": "for each account: systemctl --user mask on both timers", "other_spellings": [], "also_turns_off": [], "cost_of_off": null}, "switch_verdict": "not_tested", "switch_verdict_how": "set, read back; not wire-checked", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a reporting tool", "cloud_features": [], "read_source": "vendor_doc", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [{"path": ".cache/ubuntu-insights/<source>/uploaded/", "what": "a copy of each report it sent", "receipt": "witness/ubuntu-insights-0.9.3ubuntu-uploads.txt"}], "version_at_witness": "0.9.3ubuntu was installed when the records were read on 2026-09-28; the version at each upload date is not recorded here", "measured_on": [], "vendor_purpose": {"quote": "If consent is not given for a source, an opt-out notification will be sent regardless of the locally cached insights report's contents.", "source": "https://git.launchpad.net/ubuntu/+source/ubuntu-insights/plain/README.md?h=import/0.9.3ubuntu", "where": "its README at 0.9.3ubuntu", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its README says an opt-out notification is sent when consent is not given, and that uploaded reports are kept in an 'uploaded' folder.", "links": ["https://git.launchpad.net/ubuntu/+source/ubuntu-insights/plain/README.md?h=import/0.9.3ubuntu"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [{"text": "Its README documents the opt-out notification, and a copy of every report it sent stays on your disk to read.", "source": "https://git.launchpad.net/ubuntu/+source/ubuntu-insights/plain/README.md?h=import/0.9.3ubuntu", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "ubuntu-insights-0.9.3ubuntu-ubuntu-26.04/opt-out-report", "product": "Ubuntu Insights", "slug": "ubuntu-insights", "version": "0.9.3ubuntu", "version_read_utc": "2026-09-28", "build": "the Ubuntu 26.04 package", "os": "Ubuntu 26.04 desktop, x86-64 (a machine of ours, not a stock install)", "arch": "x86-64", "install_method": "the distro's package ubuntu-insights 0.9.3ubuntu", "group": "Ubuntu and the network software around them", "sends_by_default": "yes", "answer_cell": "yes · seen on a machine of ours, and read in its own documents: a report saying you opted out, even with consent off", "look_depth": "vendor_doc", "licence": {"name": "GPL-3.0", "source": "the licence GitHub reads for ubuntu/ubuntu-insights", "read_utc": "2026-10-10"}, "grade": "witnessed", "method": "the program's own upload records on a machine of ours, read 2026-09-28; its README at the package version read 2026-10-10", "receipts": [{"label": "witness extract: the upload records (written at build by script from the private read)", "url": "witness/ubuntu-insights-0.9.3ubuntu-uploads.txt", "kind": "primary"}, {"label": "its README at the package version: the opt-out notification", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-insights/plain/README.md?h=import/0.9.3ubuntu", "kind": "primary"}, {"label": "the package", "url": "https://launchpad.net/ubuntu/+source/ubuntu-insights/0.9.3ubuntu", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "ubuntu-pro-client (source package ubuntu-advantage-tools)", "condition": "when apt updates its package lists, at most once a day", "call_kind": ["checks"], "trigger": "background", "sends": [{"field": "a download of the news file", "class": "request"}], "when": "Per its unit file and code: in the background during an apt update, limited to at most one network request per 24 hours. Not wire-checked.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor API", "hosts": [{"name": "motd.ubuntu.com", "provenance": "asked"}], "switch": {"name": "pro config set apt_news=false", "value": "false", "accepted_values": ["false"], "values_tested": [], "kind": "a Pro client setting", "where_set": "run once as root: pro config set apt_news=false", "other_spellings": [], "also_turns_off": ["the news shown after apt upgrade"], "cost_of_off": "you no longer see the short news items shown with apt upgrades"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code and documented in the unit; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a system service: not a server you reach", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "This service runs in the background during an `apt update` to download the latest news and set it to appear in the output of the next `apt upgrade`.", "source": "https://git.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/plain/systemd/apt-news.service?h=import/37.2ubuntu0.1", "where": "the comment at the head of apt-news.service at 37.2ubuntu0.1", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "The unit's own comment says where the news comes from, when it is fetched, the daily limit and the switch.", "links": ["https://git.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/plain/systemd/apt-news.service?h=import/37.2ubuntu0.1"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "ubuntu-pro-client-37.2ubuntu0.1-ubuntu-26.04/apt-news", "product": "Ubuntu Pro client (APT news)", "slug": "ubuntu-pro-client", "version": "37.2ubuntu0.1", "version_read_utc": "2026-10-10", "build": "the Ubuntu 26.04 package", "os": "Ubuntu 26.04 desktop, x86-64 (a machine of ours, not a stock install)", "arch": "x86-64", "install_method": "the distro's package ubuntu-pro-client 37.2ubuntu0.1", "group": "Ubuntu and the network software around them", "sends_by_default": "yes", "answer_cell": "yes · read in code and in its own unit file", "look_depth": "code_read_call_sites", "licence": {"name": "GPL-3.0", "source": "the licence GitHub reads for canonical/ubuntu-pro-client", "read_utc": "2026-10-10"}, "grade": "read", "method": "the source package at 37.2ubuntu0.1: the apt hook, the news service, its gate on the setting and the default address", "receipts": [{"label": "the apt hook that starts the news service", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/plain/apt-hook/20apt-esm-hook.conf?h=import/37.2ubuntu0.1", "kind": "primary"}, {"label": "the service's own description", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/plain/systemd/apt-news.service?h=import/37.2ubuntu0.1", "kind": "primary"}, {"label": "the gate on the setting and the 24-hour limit", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/plain/lib/apt_news.py?h=import/37.2ubuntu0.1", "kind": "primary"}, {"label": "the default address", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/plain/uaclient/defaults.py?h=import/37.2ubuntu0.1", "kind": "primary"}, {"label": "the setting's default (on)", "url": "https://git.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/plain/uaclient/config.py?h=import/37.2ubuntu0.1", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "uv", "condition": "on every request to a package index, when you run uv", "call_kind": ["reports"], "trigger": "you_asked", "sends": [{"field": "the installer's name (uv) and version, and, where uv sets it, the subcommand you ran", "class": "software"}, {"field": "the Python version and implementation", "class": "software"}, {"field": "the distribution: on Linux its name, version and codename, with the C library and its version where the platform names one; on macOS its version", "class": "system"}, {"field": "the system's name and release, and the processor architecture", "class": "system"}, {"field": "whether it looks like a CI run (one of four CI environment variables is set)", "class": "system"}], "when": "Read in code at 0.11.27: inside the user agent of each request uv makes to PyPI or the index you configure; uv is not a background caller.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "package index", "hosts": [{"name": "pypi.org", "provenance": "asked"}], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": "none found for the user agent", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "n/a", "listens_source": "a command-line tool", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "This metadata is added to the user agent to enrich PyPI statistics.", "source": "https://github.com/astral-sh/uv/blob/19fc8b03bb984848d62a24267abc6c406289e2c0/crates/uv-client/src/linehaul.rs#L63", "where": "the code comment on uv's LineHaul type in crates/uv-client/src/linehaul.rs at tag 0.11.27 (quoted whole)", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "none_found", "text": "None found: uv's documentation at tag 0.11.27 (its 80 pages and its README, searched for 'linehaul', 'user agent' and 'user-agent' on 2026-10-10) does not describe these fields; a code comment in linehaul.rs states their purpose.", "links": ["https://github.com/astral-sh/uv/tree/19fc8b03bb984848d62a24267abc6c406289e2c0/docs"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "uv-0.11.27-source/user-agent-fields", "product": "uv", "slug": "uv", "version": "0.11.27", "version_read_utc": "2026-10-10", "build": "the source at tag 0.11.27", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag 0.11.27", "group": "Ubuntu and the network software around them", "sends_by_default": "yes", "answer_cell": "yes · read in code: in the user agent of every request to a package index", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for astral-sh/uv", "read_utc": "2026-10-10"}, "grade": "read", "method": "crates/uv-client/src/linehaul.rs and crates/uv-client/src/base_client.rs read at tag 0.11.27", "receipts": [{"label": "the user agent's fields as uv fills them (the OpenSSL, setuptools and rustc fields are left empty)", "url": "https://github.com/astral-sh/uv/blob/19fc8b03bb984848d62a24267abc6c406289e2c0/crates/uv-client/src/linehaul.rs#L60-L152", "kind": "primary"}, {"label": "the fields added to the user agent of uv's HTTP client", "url": "https://github.com/astral-sh/uv/blob/19fc8b03bb984848d62a24267abc6c406289e2c0/crates/uv-client/src/base_client.rs#L473-L480", "kind": "primary"}], "last_read_utc": "2026-10-10"}
{"package": "vllm", "condition": null, "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "a random ID, new for each process", "class": "identifier"}, {"field": "the cloud provider if detected, processor, memory, operating system and kernel, graphics cards, CUDA version", "class": "hardware and system"}, {"field": "the vLLM version and the model's architecture as a class name (not the model's name)", "class": "software"}, {"field": "twenty-six settings of the run (the data type, cache and memory settings, quantization, feature flags such as LoRA and prefix caching, the parallel sizes, the batching limits, the attention and compile choices, speculative decoding and the expert counts) and five vLLM environment variables", "class": "configuration"}], "when": "The code at v0.30.0 sends the report once at start, then every 10 minutes the same ID and the time; we did not run this version.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "vendor telemetry collector", "hosts": [{"name": "stats.vllm.ai", "provenance": "asked"}], "switch": {"name": "VLLM_NO_USAGE_STATS", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable of the server process", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": ["DO_NOT_TRACK=1", "VLLM_DO_NOT_TRACK=1", "an empty file named do_not_track in .config/vllm under the home folder"], "also_turns_off": [], "cost_of_off": "none known: its documents name no other effect"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code and documented; we have not published a test of it", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": "all_interfaces", "listens_source": "it listens on every IPv4 address by default (cli_args.py at v0.30.0: host unset); --host localhost keeps it on the computer; our page 'Ollama or vLLM: which to run, and how' (research hub, 2026-10-08), 'Who can reach it'", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [{"path": ".config/vllm/usage_stats.json", "what": "a copy of what it sent while the report was on", "receipt": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/vllm/usage/usage_lib.py#L273-L278"}], "version_at_witness": null, "measured_on": ["a-short-history-of-vllm#who-can-talk-to-it", "ollama-or-vllm-which-to-run#what-each-calls-home"], "vendor_purpose": {"quote": "vLLM collects anonymous usage data by default to help the engineering team better understand which hardware and model configurations are widely used.", "source": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/docs/usage/usage_stats.md?plain=1#L3", "where": "docs/usage/usage_stats.md at v0.30.0", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "yes", "text": "Its usage-stats page says the report is on by default, links the code that builds it, and names the switches.", "links": ["https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/docs/usage/usage_stats.md?plain=1#L3"], "read_utc": "2026-10-10"}, "public_discussion": [{"url": "https://research.strata2signal.com/a-short-history-of-vllm/", "by": "us", "opened_utc": "2026-10-02"}, {"url": "https://research.strata2signal.com/ollama-or-vllm-which-to-run/", "by": "us", "opened_utc": "2026-10-08"}], "credit": [{"text": "The report uses a random ID that is new for each process, and the page that documents it names three ways to turn it off.", "source": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/docs/usage/usage_stats.md?plain=1#L3", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": ["flashinfer-0.6.18.post1-source/kernel-download"], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "Started from a Hugging Face model ID, vLLM also reaches Hugging Face for the weights; that download is a separate call you ask for.", "source": "https://research.strata2signal.com/a-short-history-of-vllm/#who-can-talk-to-it", "read_utc": "2026-10-02"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "vllm-0.30.0-source/usage-report", "product": "vLLM", "slug": "vllm", "version": "0.30.0", "version_read_utc": "2026-10-10", "build": "the source at tag v0.30.0", "os": "not run: the source applies to Linux, the platform vLLM supports", "arch": "any vLLM supports", "install_method": "not installed: source read at tag v0.30.0", "group": "servers and apps you run", "sends_by_default": "yes", "answer_cell": "yes · read in code and in its own documents", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for vllm-project/vllm", "read_utc": "2026-10-10"}, "grade": "read", "method": "vllm/usage/usage_lib.py, vllm/envs.py and docs/usage/usage_stats.md read at tag v0.30.0. The source at the tag; we did not check that the released wheel matches it.", "receipts": [{"label": "the default server address", "url": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/vllm/envs.py#L812-L814", "kind": "primary"}, {"label": "the switches and the do_not_track file", "url": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/vllm/usage/usage_lib.py#L55-L67", "kind": "primary"}, {"label": "the 10-minute heartbeat", "url": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/vllm/usage/usage_lib.py#L248-L257", "kind": "primary"}, {"label": "each report also written to usage_stats.json", "url": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/vllm/usage/usage_lib.py#L273-L278", "kind": "primary"}, {"label": "its usage-stats page", "url": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/docs/usage/usage_stats.md?plain=1#L3", "kind": "primary"}, {"label": "a random ID, new for each process", "url": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/vllm/usage/usage_lib.py#L127", "kind": "primary"}, {"label": "the five environment variables it collects", "url": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/vllm/usage/usage_lib.py#L36-L42", "kind": "primary"}, {"label": "the twenty-six settings passed with the report", "url": "https://github.com/vllm-project/vllm/blob/ced6857afa0ea7b2e3f0846a62e1394e90f15607/vllm/v1/utils.py#L730-L772", "kind": "primary"}, {"label": "vLLM history, 'Who can talk to it'", "url": "https://research.strata2signal.com/a-short-history-of-vllm/#who-can-talk-to-it", "kind": "pointer"}], "last_read_utc": "2026-10-11"}
{"package": "VoiceStudio (Electron desktop app with a Python backend)", "condition": null, "call_kind": ["checks"], "trigger": "background", "sends": [{"field": "requests for its release files", "class": "request"}], "when": "The code at v0.5.6 checks 10 s after launch and every 6 hours after, in packaged builds; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "code host", "hosts": [{"name": "github.com", "provenance": "asked"}], "switch": null, "switch_verdict": "n/a", "switch_verdict_how": "none found", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default bind read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": null, "none_found": "none found in the README at v0.5.6, read 2026-10-10", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "none_found", "text": "None found in the README at v0.5.6, read 2026-10-10.", "links": ["https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/README.md"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": ["onnx-runtime-1.29.0-pypi-linux-x86_64/telemetry"], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "voicestudio-0.5.6-packaged/update-check", "build": "the packaged desktop builds", "os": "not run: the source applies to the packaged desktop builds", "arch": "any", "install_method": "not installed: source read at tag v0.5.6", "sends_by_default": "yes", "answer_cell": "yes · read in code", "look_depth": "code_read_call_sites", "method": "electron/src/main/index.ts and electron/src/main/updater.ts read at tag v0.5.6. The source at the tag; we did not check that the released build matches it.", "receipts": [{"label": "the check at 10 s and every 6 hours", "url": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/electron/src/main/index.ts#L284-L291", "kind": "primary"}, {"label": "the release feed addresses", "url": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/electron/src/main/updater.ts#L13-L16", "kind": "primary"}, {"label": "its lockfile pins ONNX Runtime 1.29.0, which this app brings in", "url": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/uv.lock#L3967-L3970", "kind": "primary"}, {"label": "the check: the feed, then electron-updater (the releases API is not called)", "url": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/electron/src/main/updater.ts#L271-L281", "kind": "primary"}], "product": "VoiceStudio", "slug": "voicestudio", "version": "0.5.6", "version_read_utc": "2026-10-10", "group": "servers and apps you run", "licence": {"name": "AGPL-3.0", "source": "the licence GitHub reads for debpalash/VoiceStudio", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-10"}
{"package": "VoiceStudio (Electron desktop app with a Python backend)", "condition": "while a Hugging Face token is on the machine, from the app's settings, HF_TOKEN, or the Hugging Face CLI's token file", "call_kind": ["checks"], "trigger": "background", "sends": [{"field": "your Hugging Face token, to Hugging Face's own account endpoint", "class": "credential"}], "when": "The code at v0.5.6 checks each token it finds against Hugging Face and caches the answer for 300 s; how often the app asks again was not re-read here. Not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "model hub", "hosts": [{"name": "huggingface.co", "provenance": "asked"}], "switch": {"name": "HF_HUB_OFFLINE", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable", "where_set": "in the backend's environment, or in its env file", "other_spellings": ["remove the token"], "also_turns_off": ["every Hugging Face download"], "cost_of_off": "no model downloads until you unset it"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default bind read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "For each candidate, the resolver calls `huggingface_hub.whoami(token=...)` to verify the token is live; any HTTP error (401, 403, network) skips to the next source.", "source": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/services/token_resolver.py#L9-L11", "where": "the module's own description in backend/services/token_resolver.py at v0.5.6", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "The module's own description explains the check; the README at v0.5.6 does not mention it.", "links": ["https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/services/token_resolver.py#L1-L16"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "voicestudio-0.5.6-source/hf-token-check", "build": "the Python backend", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag v0.5.6", "sends_by_default": "yes", "answer_cell": "yes · read in code: while a Hugging Face token is on the machine", "look_depth": "code_read_call_sites", "method": "backend/services/token_resolver.py read at tag v0.5.6", "receipts": [{"label": "the check and its 300-second cache", "url": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/services/token_resolver.py#L1-L34", "kind": "primary"}], "product": "VoiceStudio", "slug": "voicestudio", "version": "0.5.6", "version_read_utc": "2026-10-10", "group": "servers and apps you run", "licence": {"name": "AGPL-3.0", "source": "the licence GitHub reads for debpalash/VoiceStudio", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-10"}
{"package": "VoiceStudio (Electron desktop app with a Python backend)", "condition": "in its automatic endpoint mode, the default when you have not chosen a Hugging Face endpoint", "call_kind": ["checks"], "trigger": "background", "sends": [{"field": "connectivity probes to the official Hugging Face address and to a community mirror", "class": "request"}, {"field": "256 KiB ranged downloads to measure speed, when the mirror looks much faster", "class": "request"}], "when": "The code at v0.5.6 races the two at first run, after a download failure, and when its last decision is older than 7 days; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "model hub", "hosts": [{"name": "huggingface.co", "provenance": "asked"}, {"name": "hf-mirror.com", "provenance": "asked"}], "switch": {"name": "OMNIVOICE_HF_ENDPOINT_MODE", "value": "manual", "accepted_values": ["manual", "off", "0", "false", "no"], "values_tested": [], "kind": "environment variable", "where_set": "in the backend's environment, or in its env file (.config/omnivoice/env under your home folder)", "other_spellings": ["choosing an endpoint in Settings, Network"], "also_turns_off": ["the automatic choice between the two download hosts"], "cost_of_off": "per its own description, downloads no longer move to the reachable host when one is blocked"}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default bind read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": "This service makes that class of failure self-healing: it *races* the official endpoint against the community mirror with real connectivity probes and remembers the winner, so model downloads work out of the box wherever at least one endpoint is reachable.", "source": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/services/endpoint_race.py#L4-L8", "where": "the module's own description in backend/services/endpoint_race.py at v0.5.6", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "The module's own description explains the race and the switch; the README at v0.5.6 does not mention it.", "links": ["https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/services/endpoint_race.py#L1-L25", "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/README.md"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [], "first_published_utc": null, "superseded_by": null, "history": [], "id": "voicestudio-0.5.6-source/model-host-race", "build": "the Python backend", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag v0.5.6", "sends_by_default": "yes", "answer_cell": "yes · read in code", "look_depth": "code_read_call_sites", "method": "backend/services/endpoint_race.py read at tag v0.5.6", "receipts": [{"label": "the two addresses, the switch and the 7-day re-race", "url": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/services/endpoint_race.py#L56-L74", "kind": "primary"}, {"label": "the ranged download", "url": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/services/endpoint_race.py#L162-L176", "kind": "primary"}, {"label": "the module's own description", "url": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/services/endpoint_race.py#L1-L8", "kind": "primary"}], "product": "VoiceStudio", "slug": "voicestudio", "version": "0.5.6", "version_read_utc": "2026-10-10", "group": "servers and apps you run", "licence": {"name": "AGPL-3.0", "source": "the licence GitHub reads for debpalash/VoiceStudio", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-10"}
{"package": "VoiceStudio (Electron desktop app with a Python backend)", "condition": "only after you say yes in its consent prompt; the backend's default is off", "call_kind": ["reports"], "trigger": "background", "sends": [{"field": "a random install ID", "class": "identifier"}, {"field": "lifecycle, error and speech-generated events, with app version, platform and install channel", "class": "usage"}], "when": "Once opted in: events as they happen, to PostHog at a host set when the app is built; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "third-party analytics", "hosts": [], "switch": {"name": "Settings, Privacy: analytics off", "value": "off", "accepted_values": ["off"], "values_tested": [], "kind": "a setting in the app", "where_set": "in the app's Settings, Privacy", "other_spellings": ["OMNIVOICE_ANALYTICS_DISABLED=1, which covers the backend only"], "also_turns_off": [], "cost_of_off": null}, "switch_verdict": "not_tested", "switch_verdict_how": "found in code; not tested by us", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered: no vendor document of its default bind read", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": null, "none_found": "none found in the README at v0.5.6 and the analytics module's own description, read 2026-10-10", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "The README says usage analytics requires consent; it does not list the fields.", "links": ["https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/README.md?plain=1#L34"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [{"text": "Analytics are off until you say yes: the backend's preference defaults to false, and the README says usage analytics requires consent.", "source": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/core/analytics.py#L1-L20", "read_utc": "2026-10-10"}], "does_not_send": [], "brings_in": [], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "Once you have opted in, the desktop app's events follow the Settings switch, not the backend's environment switch.", "source": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/core/analytics.py#L96-L107", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "voicestudio-0.5.6-source/product-analytics", "build": "the backend and the desktop app", "os": "not run: the source applies to every platform", "arch": "any", "install_method": "not installed: source read at tag v0.5.6", "sends_by_default": "opt_in", "answer_cell": "only if you opt in · read in code", "look_depth": "code_read_call_sites", "method": "backend/core/analytics.py read at tag v0.5.6", "receipts": [{"label": "off unless you say yes, and the backend's kill switch", "url": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/core/analytics.py#L1-L20", "kind": "primary"}, {"label": "the stored preference, false by default", "url": "https://github.com/debpalash/VoiceStudio/blob/3915a62cb482bb43117aaebab57d22745bd1cc21/backend/core/analytics.py#L96-L119", "kind": "primary"}], "product": "VoiceStudio", "slug": "voicestudio", "version": "0.5.6", "version_read_utc": "2026-10-10", "group": "servers and apps you run", "licence": {"name": "AGPL-3.0", "source": "the licence GitHub reads for debpalash/VoiceStudio", "read_utc": "2026-10-10"}, "grade": "read", "last_read_utc": "2026-10-10"}
{"package": "von-sdk", "condition": "when its weights are not already in a local folder", "call_kind": ["fetches"], "trigger": "on_request", "sends": [{"field": "downloads of its scoring head and calibration file from its own Hugging Face repository", "class": "request"}], "when": "The code at v1.3.5 downloads the files when it loads and finds no local copy; not run.", "when_observed_s": null, "when_anchor": null, "when_condition": null, "when_state": null, "host_class": "model hub", "hosts": [{"name": "huggingface.co", "provenance": "named"}], "switch": {"name": "HF_HUB_OFFLINE", "value": "1", "accepted_values": ["1"], "values_tested": [], "kind": "environment variable", "where_set": "in the environment of the program, before it starts (see Turn them off)", "other_spellings": ["give it a local folder with the files"], "also_turns_off": ["every Hugging Face download"], "cost_of_off": "it stops with an error if the files are not on disk"}, "switch_verdict": "not_tested", "switch_verdict_how": "a huggingface_hub switch; not tested by us with Von", "switch_verdict_version": null, "switch_verdict_window": null, "switch_verdict_n": null, "steps_not_met": [], "listens_default": null, "listens_source": "not covered here", "cloud_features": [], "read_source": "code", "measured_utc": null, "read_utc": "2026-10-10", "exercised": [], "not_exercised": [], "leaves_on_disk": [], "version_at_witness": null, "measured_on": [], "vendor_purpose": {"quote": null, "none_found": "none found in its README at v1.3.5, read 2026-10-10: its settings table names the default repository but gives no purpose for the download", "read_utc": "2026-10-10"}, "vendor_documents_it": {"value": "partly", "text": "Its README's settings table says VON_MODEL_ID defaults to the Hugging Face repository wfzyx/von and may name a local checkpoint folder instead; it does not say that a missing local file starts a download.", "links": ["https://github.com/wfzyx/von/blob/c8cf93aea1beb707149c1d07e77e430b0ba550a7/README.md?plain=1#L135"], "read_utc": "2026-10-10"}, "public_discussion": [], "credit": [], "does_not_send": [], "brings_in": ["openvino-2026.4.0-source/import-report"], "installed_by": [], "installed_by_packages": [], "also_know": [{"text": "Its [intel] extra brings in OpenVINO, whose import report is its own row.", "source": "row:openvino-2026.4.0-source/import-report", "read_utc": "2026-10-10"}], "first_published_utc": null, "superseded_by": null, "history": [], "id": "von-1.3.5-source/model-download", "product": "Von", "slug": "von", "version": "1.3.5", "version_read_utc": "2026-10-10", "build": "the source at tag v1.3.5. The source at the tag; we did not check that the released wheel (von_sdk-1.3.5-py3-none-any.whl, sha256 5ba50a50cdfc3b2f11babc85f6af6a16a6a43dfec918f7e92b6647890ce1797d, as PyPI publishes it) matches it.", "os": "not run: the source is Python", "arch": "any", "install_method": "not installed: source read at tag v1.3.5", "group": "research engines and model repositories we read", "sends_by_default": "yes", "answer_cell": "yes · read in code: it downloads its own weights from Hugging Face when they are not on disk", "look_depth": "code_read_call_sites", "licence": {"name": "Apache-2.0", "source": "the licence GitHub reads for wfzyx/von", "read_utc": "2026-10-10"}, "grade": "read", "method": "every network call enumerated at v1.3.5 (Python requests, httpx, urllib, aiohttp, socket, grpc, websockets, huggingface_hub downloads; JS fetch, XMLHttpRequest, net, https, dgram, WebSocket, axios): these downloads, and its client library talking to the server address you give it; no import-time report", "receipts": [{"label": "the download when no local file exists", "url": "https://github.com/wfzyx/von/blob/c8cf93aea1beb707149c1d07e77e430b0ba550a7/src/von/backends/option_marker_backend.py#L537-L553", "kind": "primary"}, {"label": "its own repository name", "url": "https://github.com/wfzyx/von/blob/c8cf93aea1beb707149c1d07e77e430b0ba550a7/src/von/backends/option_marker_backend.py#L68", "kind": "primary"}, {"label": "the wheel's sha256, as PyPI publishes it", "url": "https://pypi.org/project/von-sdk/1.3.5/#files", "kind": "primary"}, {"label": "our small open deciders measurement (research hub, 2026-09-30), 'What we did not measure'", "url": "https://research.strata2signal.com/small-open-deciders-measured/#what-we-did-not-measure", "kind": "pointer"}], "last_read_utc": "2026-10-10"}