Bumping this conversation up given the latest news:  Lean Library was
purchased by SAGE.  https://www.leanlibrary.com/news/item250

Tim

On Wed, Sep 5, 2018 at 12:32 PM Tammy Wolf <[log in to unmask]> wrote:

> I just met with Johan Tilstra, CEO of Lean Library this morning. According
> to Johan, the fact that browser activity was being sent to Lean Library was
> an architectural oversight. He has committed to a change the way they
> collect data, specifically storing browsing activity locally, rather than
> sending it to Lean Library. They current have a new architecture in Beta
> and should have something to show next week.
>
> I feel encouraged that the company really does seem committed to
> transparency and user privacy. We will see how things go testing-wise when
> the new plugin is released.
>
> Thanks so much for this great and lively discussion.
>
>
> Tammy Allgood Wolf
> Director of Discovery Services
> ASU Library
> Arizona State University
> 480-965-1797
>
>
>
>
> -----Original Message-----
> From: Code for Libraries <[log in to unmask]> On Behalf Of Eric
> Hellman
> Sent: Friday, August 31, 2018 10:15 AM
> To: [log in to unmask]
> Subject: Re: [CODE4LIB] Lean Library Security Concerns
>
> Wow. Lean Library seems to be sloppily implemented, has a privacy policy
> that says that big dutch companies that acquire them receive ALL the user
> data, and the word "collect" doesn't mean what they think it means. The
> icing on the cake is that their T&C forbid us from reverse engineering
> their code to see what it really does.
>
> From their "privacy policy":
> We may disclose the information we obtain:
> If Lean Library is involved in a merger, acquisition or sale of all or a
> portion of its Please note that you will be notified by either email or a
> prominent notice on our website of any changes in ownership or uses of this
> information.
> from their T&C
> No Reverse Engineering and the like.User nor Licensee may, or may cause or
> permit any of its employees or any third party to, modify, adapt,
> translate, reverse engineer, decompile, disassemble, translate or create
> derivative works based on the Service without the prior written consent of
> Licensor, which Licensor may withhold in its sole discretion.
>
> Any librarian that pays to hand users over to LL as it presents itself
> today needs to reflect on their life choices.
>
> Having said that, (and having been involved in browser extension projects)
> I think LL would be super valuable if done right, with all the i's dotted
> and t's crossed.
>
> That would mean building independent code review and privacy and data
> audits of ops into LL's contracts. Remember that giving a company
> phone-back access to a browser extension gives that company (and anyone
> with the power or craft to compel that company) to see everything a user
> does online, credit card numbers, browsing behavior, passwords, EVERYTHING!
> Libraries need to examine their potential legal liability for their
> patron's catastrophic security loss if they recommend installation of this
> product (as presented today.)
>
> If anyone needs technical backup on this, please don't hesitate to contact
> me.
>
> Eric Hellman
> President, Free Ebook Foundation
> Founder, Unglue.it https://unglue.it/
> https://go-to-hellman.blogspot.com/
> twitter: @gluejar
>
> > On Aug 21, 2018, at 6:04 PM, Tammy Wolf <[log in to unmask]> wrote:
> >
> > I just wondered if anyone else on this list reviewed Lean Library<mailto:
> https://www.leanlibrary.com/> and had any security and/or privacy
> concerns.
> >
> > Here is what our Director of Security had to say,
> >
> > "I can confirm that browsing activity is sent to lean library. Attached
> is an example screenshot showing the POST when visiting a URL on
> reddit.com. And if you visit
> https://app.leanlibrary.com/?r=api/api/institutes it's trivial to see
> info about all subscribers of lean library.
> >
> > Also, there are Repeated Pings to capture user IP Address. This was also
> verified during the session capture. This occurs via
> https://app.leanlibrary.com/?r=api/api/getIp."
> >
> > Our Security Director goes on to say the following:
> >
> > "Of course this is also a question of consent. Any users of the plugin
> should first have to consent to the privacy policy:
> https://www.leanlibrary.com/privacy-policy/item181 - which would be in
> conflict with deploying this automatically to lab computers. I have some
> issues with the privacy policy itself as well. It states:
> >
> > What information does Lean Library and The Extension NOT obtain?
> > Your security and privacy is our biggest priority. We are only
> interested in information or data that can help us deliver the best
> experience possible in saving you time while and optimizing your academic
> research. Therefore, The Extension does not store any information for other
> browsing activity such as activity on non-database webpage urls.
> > Maybe they aren't technically "storing" the fact that I visited a URL on
> reddit.com, but that visit still went to their server and was captured /
> analyzed *somehow*. It would be more accurate for them to say that they
> analyze all sites you visit to determine whether they are academic in
> nature, or something. But that would be a red flag."
> >
> > Thoughts?
> >
> > Tammy Allgood Wolf
> > Director of Discovery Services
> > ASU Library
> > Arizona State University
> > 480-965-1797
> > <leanlibrary-postrequest.jpg>
>


-- 
Tim McGeary
[log in to unmask]
GTalk/Yahoo/Skype/Twitter: timmcgeary
484-294-7660 (Google Voice)