I use popcon data a lot for eg, tasksel, and often one is only
interested in data for unstable, or stable. But there's no good way to
separate those in the results. Instead, various workarounds have to be
used, like trying to tease out information about packages present in one
version of debian and not in the other.

So, could the release information please be included in the report?
Specifically just the name of the current release from
/etc/debian_version.

This is additional information about the system. However, there is very
little privacy invasion here, because the report already tends to
contain sufficient information to identify the version of debian used by
the system. Notably the version of popularity-contest that is installed,
and also many of the installed packages, which can be cross referenced
with the package lists to tell which suites the set could have come
from. So, an attacker who intercepts the report somehow can already work
this out heuristically, probably good enough for their nefarious
purposes.

Of course, once the release information is available in the popcon database,
the web interface can be updated to let it be used in queries. But
getting popcon collecting it is the first step.

(As a bonus it'll be easier to notice when ubuntu accidentially floods
debian's popcon with their user reports, as has happened once or twice
before.)

[Joey Hess]

According to the changelog, this was added in versoin 1.8 and replaced
by the popcon version in version 1.19 because the content was not
reliable.  If I remember correctly, several people modify the content
of that file themselves and fill it all sorts of text there.

Are you sure you want an unreliable data source?

Dear Joey,

I am a bit confused by your report. I would expect what you request to be
adequately provided by the popcon.debian.org  website and the
popularity-contest version field.  We even provide separate data for stable.

Thus maybe you are using a different interface that is lacking the information
you need ?

Unfortunately /etc/debian_version is a configuration file and we learnt that
some users modify it.  Beside this is just a round-about way to report the
version of base-files.

Now, we use the dpkg VENDOR field for that purpose.

Cheers,

Bill Allombert wrote:

But not separate data for unstable+testing.

Also, there is no way to get a graph for a package limited to reports
for stable or unstable+testing.

Also, there is no graph of the total number of reporters who are using
a given release. "Statistics per popularity-contest releases" is almost
that, but not really.

Those are the things I would find useful in the website.

Hmm, it seems to me it would be easier to throw out the odd report with
an unknown suite name than to maintain a mapping from
popularity-contest package version to suite, especially since there
are periods in time when a given popularity-contest version can be in
both testing and stable. But I suppose I don't know your business.

Indeed, but I am concerned that providing data for a small subset of
the archive is a increasing the risk a deanonymization.

Currently unstable+testing is about 15% of the archive but it is
often much less. Furthermore if we publish data for unstable+testing,
then data for old-stable and older can be computed by substraction,
which is another subset that could be used for deanonymization.

Add to that that processing an extra substet take quite a lot of time.

If by graph you means 'https://qa.debian.org/popcon.php', then it is not
maintained by us.

What is missing, specifically ?

Cheers,

Bill Allombert wrote:

I'd personally be happy to get this data for the top 50% most installed
packages or so. I guess that would avoid most of the data leaks?

Summing up the appropriate lines by eye is rather difficult..