[black_eagle]

The 'code' you refer to merely uploads your MAC address. Admittedly this doesn't appear to have been documented anywhere, however it is hardly 'spying' and was most likely done as a method to track the number of users. In spite of it using MAC addresses however, there is no guarantee that they are unique.

[trogggy]

Things are not always black or white. The last days I spend reading almost all posts Rob has made for the last month and I still do not believe he is an evil genius trying to declare war on the Kodi team. He is just a guy who spends a lot of his time trying to make great things for other people, just like the Kodi team. In his enthusiasm he made a lot of mistakes, because he is only doing this for fun. He is learning on the way.

That.
It looks from outside as if at the end people were going through his repo with a fine toothcomb looking for a smoking gun, and when they came across the nth one it was 'Quick, ban him before he has a chance to change it / apologise / explain how it got there / admit to being an evil genius bent on world domination.'
Maybe he was doing something nefarious and deserved a ban. As a non-expert it's hard to see what he was gaining from the piece of code - maybe someone who knows could explain? What he did deserve was a fair process, and it's obvious that didn't happen at any point.

[Bloksel]

You should have added "I ASSUME the code was added to spy on users" and that makes all the difference.

No, there is no assumption - it is what it is.

You really think Rob is creating a database in which he collects data which mac (maybe even ip) is collecting theme's for which movies/series? For what purpose?

[bilgepump]

Maybe he was doing something nefarious and deserved a ban.

Yes.

It does not matter what he was "getting" out of it. When you steal something, it does not matter what you were going to do with it. "Oh yes, I stole that item, but I had a good reason" is not a defence. It is surprising that there is any misunderstanding about this. Nobody has to prove motive, or intent, when you do something which is not permitted. Doing the act is all that needs to be known.

[Karnagious]

Posting for general background information purposes:

http://security.stackexchange.com/questi...s-publicly

I suspect any scenario in which your MAC address would be useful to an attacker (e.g., a MAC-restricted WiFi network) is a scenario in which the attacker can already view your MAC address

[Bloksel]

It does not matter what he was "getting" out of it. When you steal something, it does not matter what you were going to do with it. "Oh yes, I stole that item, but I had a good reason" is not a defence. It is surprising that there is any misunderstanding about this. Nobody has to prove motive, or intent, when you do something which is not permitted. Doing the act is all that needs to be known.

This may be case in some third world countries, but not in civilized society. And stealing is not the word I would have used, because that would mean my ip address is stolen every time I visit a website.

[trogggy]

Maybe he was doing something nefarious and deserved a ban.

Yes.

It does not matter what he was "getting" out of it. When you steal something, it does not matter what you were going to do with it. "Oh yes, I stole that item, but I had a good reason" is not a defence. It is surprising that there is any misunderstanding about this. Nobody has to prove motive, or intent, when you do something which is not permitted. Doing the act is all that needs to be known.

You have an odd point of view but you're entitled to it I suppose. It takes all sorts.
Most people would think motive was central. A mistake / oversight / careless act is not equivalent to something malicious that's done deliberately. Not for most of us.

[bilgepump]

but not in civilized society.

Australia is a "civilized society", and the law in Australia is as stated - "I had a reason!" is no defence.

I don't care whether the "attacker" can do anything with my information. You don't take it without my permission. End of story. Especially when you are doing it under cover of representations that it isn't happening.

"Yes I stole your car, but I don't have a drivers' licence so there's nothing I can use it for" is equally as silly. WHY you did it is irrelevant.

Anyway, it's clearly a waste of time discussing this further. The discussion has clarified things for me, but it raises the question as to whether there are other developers circumventing the rules because they think they have "a reason" for doing so....

[bilgepump]

A mistake / oversight / careless act is not equivalent to something malicious that's done deliberately. Not for most of us.

It is when you sit down and write code for a computer. Suggesting it somehow appeared all by itself is absolutely ridiculous.

[Bloksel]

but not in civilized society.

Australia is a "civilized society", and the law in Australia is as stated - "I had a reason!" is no defence.

I don't care whether the "attacker" can do anything with my information. You don't take it without my permission. End of story. Especially when you are doing it under cover of representations that it isn't happening.

"Yes I stole your car, but I don't have a drivers' licence so there's nothing I can use it for" is equally as silly. WHY you did it is irrelevant.

Anyway, it's clearly a waste of time discussing this further. The discussion has clarified things for me, but it raises the question as to whether there are other developers circumventing the rules because they think they have "a reason" for doing so....

I was not saying you were not civilized. I am saying you are mistaken when you feel your mac address is stolen. Your mac address is recorded in every ip package you send over the internet. In your opinion the whole world should be in jail.

[trogggy]

but not in civilized society.

Australia is a "civilized society", and the law in Australia is as stated - "I had a reason!" is no defence.

If it's a good enough reason there's absolutely a defence. Stick 'necessity' in the google box.
It's obviously irrelevant to this situation other than it might stop you posting inaccuracies here.

[trogggy]

A mistake / oversight / careless act is not equivalent to something malicious that's done deliberately. Not for most of us.

It is when you sit down and write code for a computer. Suggesting it somehow appeared all by itself is absolutely ridiculous.

Link to suggestion?

[stefansaraev]

Your mac address is recorded in every ip package you send over the internet. In your opinion the whole world should be in jail.

now. THIS is wrong. and is an invalid argument, as well.

[melhemk]

@Bloksel websites cannot log MAC they log the IP, it has to do with how TCP/IP protocol works, MAC is layer2 and will keep changing all the way, the packet arriving to the webserver has the MAC of previous hop which is most likely the router or load balancer before it. That's why he has the code to tag the file with MAC instead of just getting it from the communication path during upload.

@Karnagious, MAC disclosing or logging is not a security risk, it is a privacy risk, meaning that it cannot be used to hack but can be used to identify people by associating IP and MAC, many people were identified and arrested through their MAC addresses, the link you posted even lists one story.

Edit: To clarify even more, MAC can be very useful once you are inside a compromised network and you want a specific machine, as MAC doesn't change (unless a user spoofs a MAC) it is the best way to identify a certain machine, also can be used for packet capturing between the machine and router/gateway. So I wouldn't say it is not a security risk.

[Bloksel]

@stefansaraev and @melhemk, sorry for the wrong formulation. That was not the point I was trying to make. I was just saying, that more data you now is already being logged (not stolen). The whole Rob is a criminal discussion is absolute nonsense, without this being proven. Every time someone pinpoints to a small mistake, but the real subject is being avoided.