😨 Is Ubuntu Linux spying on you?

🚩 I’m sure you all saw the shocking video, showing that Windows 11 is essentially spyware. Even a clean Windows 11 transmits data to stuff like “scorecardresearch.com” and “privacyportal.onetrust.com”.

(Note: In the domains above “research” is euphemism for “ad profiling”, while “privacy” for “tracking”.)

🤔 So is my favorite desktop – Ubuntu Linux – any better?

• I wrote a small systemd unit (see below) to run tcpdump on “any” network interface and record DNS requests. It starts even before the network is up.
• I disabled auto-start for NextCloud, Dropbox and Slack to reduce noise.
• I rebooted my laptop and fired up a terminal.

See the result in the screenshot below.

⚠️ Be mindful: This is not a clean Ubuntu. This is my work laptop that I use on a daily basis.

✨ Fortunately, the results feel encouraging. It seems to me like Ubuntu features no creepy stuff. No “research”, no “privacy”.

Most DNS requests are due to:

• My obsession with clock synchronization.
• Various APT repos for Google Chrome, Microsoft Azure CLI, Microsoft VSCode and Docker.

🥼 Wanna check what DNS requests your laptop performs? Use the script below:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# systemd unit to record DNS and DHCP requests
#
# Setup:
#   sudo systemctl edit tcpdump --full --force
#   # copy-paste the code below
#   sudo systemctl enable tcpdump
#   sudo systemctl status tcpdump  # should show "loaded" and "active"
#
# Usage:
#   # reboot your workstation
#   tcpdump -r /tmp/tcpdump.pcap 2> /dev/null | grep -Po '(?<=A[?] )[^ ]*' | sort -u
#
[Unit]
Description="Record DNS and DHCP traffic"
Before=network-pre.target
Wants=network-pre.target

[Service]
ExecStart=/usr/bin/tcpdump -n -i any -C 10000 -G 86400 -w /tmp/tcpdump.pcap -z gzip -s 0 port 53 or port 67 or port 68

[Install]
WantedBy=multi-user.target