GNOME Bugzilla – Bug 522008
disabling "show temperature" and "show weather" doesn't stop weather from showing up in the location list
Last modified: 2018-11-19 15:06:26 UTC
This report has been filed here: https://bugs.edge.launchpad.net/ubuntu/+source/gnome-panel/+bug/199597 "I never asked for a weather service on my desktop. I just want a clock. I've turned off 'show weather' and 'show temperature' in the preferences; but if I left-click on the time, my locations are still shown with a weather icon next to them. This means that gnome-panel is connecting to the network somewhere to pull down weather information, without my permission! If this clock applet is going to be the default, there needs to be an option to disable weather updates by the GNOME panel; for users with limited bandwidth, these unrequested weather updates are a potential DoS, not to mention being an information leak." Thanks,
I can confirm this bug. I'm able to duplicate the bug using Ubuntu 8.04.
These settings only influence showing temperature and weather _next to_ the date and time on the panel. They're not intended to enable/disable weather forecast retrieving.
I think it's a valid report, there's no way to disable the weather icons there, it makes more sense if you enable/disable the weather/temperature it also can enable/disable it from the locations dialog. Thanks.
Whether or not this particular knob is intended to affect forecast retrieval, I think it's very important that there be /some/ option that allows turning off forecast retrieval. It's not at all obvious from the UI that picking a location in the clock applet is going to result in network queries for weather information that can't be turned off within the applet.
Can confirm this bug and should add a note regarding privacy. The applet, disabled or not, periodically queries noaa.gov. It does this regardless of proxy settings and regardless of network connectivity. The reason this is a privacy issue is that this unannounced and unconfigurable network traffic can be used to ID and track a user and their window manager, operating system, etc. Temporary workaround include blackholing noaa.gov in dns, adding iptables rules, etc. Strongly recommend patching this applet to conform to network, privacy, and security best practices. If not to allow them to disable it at least to inform the end-user of the applet's traffic and its implications.
I can confirm that this invalid behavior (particularly the privacy issue) is still occurring as of 2.28.1 in Ubuntu 9.10. It's a dastardly thing to have network traffic occur without first consulting the user.
Can confirm on CentOS 6.6. It seams queries may be generated by libgweather.so (part of libgweather package). And it seams there is no easy way to remove such library without braking a few other packages. Disabling queries is also well hidden and dosn't seam to be reliable. Such default behaviour is not welcome in work/production environment. I think beacons like this should be strictly optional. A few workarounds for anyone searching for similar info: - to redirect DNS queries: echo '127.0.0.1 weather.noaa.gov' >> /etc/hosts - edit /etc/gconf/schemas/clock.schemas by changeing /schemas/apps/clock_applet/prefs/show_temperature and /schemas/apps/clock_applet/prefs/show_weather key defaults to false. May need to edit other schemas too. After that rebuild gconf database: cd /etc/gconf GCONF_CONFIG_SOURCE=`gconftool-2 --get-default-source` gconftool-2 --makefile-install-rule schemas/clock.schemas - as a user change clock preferances not to display weather and temperature Changing /schemas/apps/gweather/prefs/auto_update in /etc/gconf/schemas/gweather.schemas and rebuilding database dosn't seam to help.
How old gnome-panel is used in CentOS 6.6?
I have: $ rpm -q gnome-panel gnome-panel-2.30.2-15.el6.x86_64
It is 5 years old release... No one is working on 2.x release so it will not be fixed in 2.x.
I expected that. CentOS/RedHat 6.x are supported at least untill 2020-11-30. Engineering environments will last even longer. So this issue will remain relevant for the next five years and here is a good place to post workarounds discovered (anyone searching for it would get here sooner or later). Also it may work as a notice about privacy issues, their handling and unacceptable programming practice.
If someone is still using gnome-panel and still want to see fix for this then please re-open/re-report this bug here - https://gitlab.gnome.org/GNOME/gnome-panel/issues.