Exclude IP

[PaulWoitaschek]

Is it possible to only exclude the ip from bug reports? I can see them on every report and I feel this is something private.

[william-ferguson-au]

Which field are you referring to?

[PaulWoitaschek]

user_ip

[william-ferguson-au]

USER_IP is not one of the default ReportFields, so you must be explicitly including it. If you don't want it sent, then don't include it. See https://github.com/ACRA/acra/wiki/AdvancedUsage#choosing-which-fields-to-be-included-in-reports

[PaulWoitaschek]

This is the way I'm using acra. I didn't include an IP knowingly.

[william-ferguson-au]

Hmm, then that's very strange.

The only place that USER_IP is included is https://github.com/ACRA/acra/blob/master/src/main/java/org/acra/collector/CrashReportDataFactory.java#L502

Can you post a crash report created from that config, showing it.

[PaulWoitaschek]

This is from my device.

[william-ferguson-au]

None of the lowercase fields in that report are ACRA fields, including user_ip.
Since requestHeaders is one of those it makes me think that they are being added by the HttpRequest itself.

[PaulWoitaschek]

I dont fully understand this. So it is acralyzer that saves these values to the log?

[william-ferguson-au]

ACRA is the client side library. It is not adding these fields. The HttpRequest that ACRA is using to send to your back end (presumably ACRAlyzer) may well be adding these fields to the report.

ACRAlyzer (which I don't know a lot about) should just be logging the incoming request and aggregating it.

[william-ferguson-au]

Try recompiling ACRA with ACRA.DEVLOGGING = true.
You should then see the log at https://github.com/ACRA/acra/blob/master/src/main/java/org/acra/util/HttpRequest.java#L154

I suspect that it is clean and that those fields are being added afterwards by the Apache HttpClient.

[PaulWoitaschek]

I didn't configure anything for acralyzer. So this is a serious privacy leaking by acralyer? So I should file a bug there?

[william-ferguson-au]

Well I don't think it's serious privacy leak. Every http call to a server
provides the IP address of the client.

But if you don't want it recorded on the server then, yes the server would
need not to record it. Or you could just not look at it.

Personally I think your fears are misplaced.

On Wed, 29 Jul 2015 3:52 am Paul Woitaschek notifications@github.com
wrote:

I didn't configure anything for acralyzer. So this is a serious privacy
leaking by acralyer? So I should file a bug there?

—
Reply to this email directly or view it on GitHub
#295 (comment).

[PaulWoitaschek]

Thanks for the reply. I wouldn't personally care too much about this, but I state for the users of my app, that all data is recorded anonymously, so I would prefer to collect as less data as I can. (especially for data I don't need).