Zeroday 01100100011010010

I ran into an awkward situation the other day while debugging an issue with my PDA synch software. I’m in a unique situation where I have an older Windows Mobile based PDA but I’m using a Powerbook for my main computing needs. The two don’t play so nicely together however certain software vendors like MarkSpace pick up the slack with middleware. “The Missing Sync” allows me to bridge this gap and synch the MS hardware with OS X software. I ran into an issue when I inadvertently upgraded to a non-free version (They moved on to 3.0 but I’m content with 2.5 I paid for last year) and while it was giving me errors I decided to try to open an automated tech support ticket. The dialog box that came up notified me that system information was being sent and there was a button to review what would be transmitted. Training with the Stopbadware group made me curious and I pressed the button.

What I saw was unsettling and I’m still trying to determine who is “at fault”. Amid the lines of system diagnostic info was my IM conversations for the last few days. Nothing incredibley personal but nothing that I really wanted the Tech Support Rep at Markspace to read. Definitely nothing that would help them solve any of my PDA synch issues. I realized that the tech support application simply pulled the entire console.log file from my computer which Growl (an increasingly popular notfication app) had been logging my IM conversations to. By default Growl will log every IM, sign on, etc that is shown to console.log.

Note that in this picture I have changed the default away from console.log.

I’m really not sure who should change here. Should Growl stop logging to console.log by default? Should MarkSpace stop pulling the entire console.log file? Who else is doing this as part of their tech support procedures? At the very least users of Growl should change this setting until the dust settles. I’m still in communication with MarkSpace and can say that they are responsive and now very aware of this issue.