# Misunderstandings or Bugs
**URL:** https://forum.syncthing.net/t/misunderstandings-or-bugs/12170
**Category:** Support
**Created:** [September 15, 2018, 6:31pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170 "2018-09-15T18:31:28Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@h1z1](https://forum.syncthing.net/u/h1z1)
#### Post date: [September 15, 2018, 6:31pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/1 "2018-09-15T18:31:28Z")
Bit of a follow up to Github.
Having run Syncthing for a bit I started noticing some things I’d consider odd. Hopefully they are just misunderstandings and could possibly be resolved by having better defaults?
My end goal is a process which is seen but not heard. Is that possible? One where any config is largely static. I’m not interested in public discovery servers, usage reporting, stats reporting, etc. I’m not a fan of TLS either due to SNI leaks. Though I can’t find any conclusive document of such an environment nor how to disable those.
None the less, one of the biggest surprises was how much data is leaked. To be clear, I consider _any_ data I haven’t allowed, to be a leak. I’m well aware there are some things which are required for basic connectivity (public IP and port for example) - I’m not refering to those.
Thanks
---
### Author:  [@canton7](https://forum.syncthing.net/u/canton7)
#### Post date: [September 15, 2018, 7:10pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/2 "2018-09-15T19:10:28Z")
> [@h1z1](#):
>
> My end goal is a process which is seen but not heard. Is that possible? One where any config is largely static
That is the normal mode of operation for Syncthing.
> [@h1z1](#):
>
> I’m not interested in public discovery servers
Provided that you either 1) have a static IP on at least one device in every pairing (which Syncthing is configured to use), or 2) communicate only over a local network which allows discovery using UDP broadcast, you can disable Global Discovery.
> [@h1z1](#):
>
> usage reporting, stats reporting, etc
This defaults to off, with a single prompt to enable.
> [@h1z1](#):
>
> I’m not a fan of TLS either due to SNI leaks.
You’ll have to clarify what exactly you’re worried about. Syncthing uses “syncthing” as the server name.
> [@h1z1](#):
>
> Though I can’t find any conclusive document of such an environment nor how to disable those.
- To disable Global Discovery, go into Settings → Connections, and uncheck “Global Discovery”
- To disable Usage Reporting, go into Settings → General, and change “Anonymous Usage Reporting” to “Disabled”
- You cannot disable TLS. Syncthing is intended to be secure.
> [@h1z1](#):
>
> None the less, one of the biggest surprises was how much data is leaked. To be clear, I consider _any_ data I haven’t allowed, to be a leak
By default, Global and Local Discovery are enabled, and Usage Reporting is disabled. If discovery was not enabled by default, then Syncthing would not work out of the box for the vast majority of users, in particular those who are less technically inclined. Those who require more specialised setups can simply click on “Settings” and uncheck a couple of checkboxes.
See [Security Principles](https://docs.syncthing.net/users/security.html) in the documentation for a full discussion.
---
### Author:  [@h1z1](https://forum.syncthing.net/u/h1z1)
#### Post date: [September 15, 2018, 7:47pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/3 "2018-09-15T19:47:10Z")
Comments below,
> [@canton7](#):
>
> > [@h1z1](#):
> >
> > My end goal is a process which is seen but not heard. Is that possible? One where any config is largely static
>
> That is the normal mode of operation for Syncthing.
Think our definition of static differ. What I mean is static config, static keys, etc.
> [@](#):
>
> > [@h1z1](#):
> >
> > I’m not interested in public discovery servers
>
> Provided that you either 1) have a static IP on at least one device in every pairing (which Syncthing is configured to use), or 2) communicate only over a local network which allows discovery using UDP broadcast, you can disable Global Discovery.
Which I have 🙂 It can be disabled but not by default. The instructions on how to do that are not obvious.
> [@](#):
>
> > [@h1z1](#):
> >
> > usage reporting, stats reporting, etc
>
> This defaults to off, with a single prompt to enable.
Isn’t off with any verson I’ve used and isn’t when running an RC version. Even then it requires knowing about the existance of them.
Defaults to “Version 3”
> [@](#):
>
> > [@h1z1](#):
> >
> > I’m not a fan of TLS either due to SNI leaks.
>
> You’ll have to clarify what exactly you’re worried about. Syncthing uses “syncthing” as the server name.
Which is sufficient to know what is running. I realize TLS is used all over the place including HTTP itself. I’m also aware of the political reasons behind it.
They are broken for the same reasons.
> [@](#):
>
> > [@h1z1](#):
> >
> > Though I can’t find any conclusive document of such an environment nor how to disable those.
>
> - To disable Global Discovery, go into Settings → Connections, and uncheck “Global Discovery”
> - To disable Usage Reporting, go into Settings → General, and change “Anonymous Usage Reporting” to “Disabled”
> - You cannot disable TLS. Syncthing is intended to be secure.
Which requires running the syncthing service for GUI access (or API if you know).
See above, TLS is not really secure.
> [@](#):
>
> > [@h1z1](#):
> >
> > None the less, one of the biggest surprises was how much data is leaked. To be clear, I consider _any_ data I haven’t allowed, to be a leak
>
> By default, Global and Local Discovery is enabled, and Usage Reporting is disabled. If discovery was not enable by default, then Syncthing would not work out of the box for the vast majority of users, in particular those who are less technically inclined. Those who require more specialised setups can simply click on “Settings” and untick a couple of checkboxes.
Usage reporting is enabled. Disabling such things after doesn’t negate the data that was already sent. Can this be disabled by default / on first run?
> [@](#):
>
> See [Security Principles](https://docs.syncthing.net/users/security.html) in the documentation for a full discussion.
Indeed, I have. Pretty frightening. I fully understand different people have different risks. It doesn’t say anything about how to actually disable nor secure syncthing though.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [September 15, 2018, 8:05pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/4 "2018-09-15T20:05:33Z")
> [@h1z1](#):
>
> Usage reporting is enabled. Disabling such things after doesn’t negate the data that was already sent. Can this be disabled by default / on first run?
Usage reporting is disabled by default on everything which isn’t a release candidate / beta build.
> [@](#):
>
> [your other points]
You should realize that Syncthing is, primarily, optimized to _work_, out of the box, for mostly normal people. Granted, we currently only work well for the slightly geeky, but that’s not the end goal. If you are paranoid (and I use the term in the most affectionate way) you _will_ need to adjust the defaults, and possibly test them in a walled off sandbox before deploying. You are not the primary target audience and you never will be.
---
### Author:  [@h1z1](https://forum.syncthing.net/u/h1z1)
#### Post date: [September 15, 2018, 8:19pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/5 "2018-09-15T20:19:48Z")
> [@calmh](#):
>
> > [@h1z1](#):
> >
> > Usage reporting is enabled. Disabling such things after doesn’t negate the data that was already sent. Can this be disabled by default / on first run?
>
> Usage reporting is disabled by default on everything which isn’t a release candidate / beta build.
To be clear we’re talking about the same “usage report”, I just started a clean install yet see this:
INFO: Usage report: Post [https://data.syncthing.net/newdata:](https://data.syncthing.net/newdata:) dial tcp 165.227.145.99:443: connect: connection refused
? (connect was refused becuase it’s blocked locally)
> [@](#):
>
> > [@](#):
> >
> > [your other points]
>
> You should realize that Syncthing is, primarily, optimized to _work_, out of the box, for mostly normal people. Granted, we currently only work well for the slightly geeky, but that’s not the end goal. If you are paranoid (and I use the term in the most affectionate way) you _will_ need to adjust the defaults, and possibly test them in a walled off sandbox before deploying.
I’m trying to get to that point yes. What I’ve found so far though doesn’t match.
> [@](#):
>
> You are not the primary target audience and you never will be.
That is something quite alarming tbh. You’re basically saying it works because no one audits it? Just to be clear, my intention was not to shame anyone, it’s nothing personal. It was not meant as a security audit.
My usecase is certainly not unique. Syncthing is frequently cited as an alternative to other technologies but I’ve never really found a review behond simple install instructions.
EDITS: Formatting
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [September 15, 2018, 8:24pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/6 "2018-09-15T20:24:29Z")
Doesn’t match what? “Works because no one audits it”? So far I haven’t seen a single legitimate technical complaint from you. You make vague assertions about choosing TLS for political reasons and it being broken, which is patently false on both accounts. You are wrong about usage reporting. You are randomly “frightened” by stuff but don’t say what. All in all, I feel this is slightly insulting and not constructive.
A clean install of a release version does _not_ do usage reporting by default. I don’t know what you’re running if it does.
---
### Author:  [@h1z1](https://forum.syncthing.net/u/h1z1)
#### Post date: [September 15, 2018, 8:36pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/7 "2018-09-15T20:36:03Z")
> [@calmh](#):
>
> Doesn’t match what? “Works because no one audits it”?
Doesn’t match what is documented. In your own documentation
> [@](#):
>
> So far I haven’t seen a single legitimate technical complaint from you. You make vague assertions about choosing TLS for political reasons and it being broken, which is patently false on both accounts.
You’re confusing things. The TLS issue with SNI is fairly well documented, even in your own documentation.
[https://docs.syncthing.net/users/security.html:](https://docs.syncthing.net/users/security.html:)
### Sync Connections (BEP)([Security Principles — Syncthing documentation](https://docs.syncthing.net/users/security.html#sync-connections-bep))
Sync connections are attempted to all configured devices, when the address is possible to resolve. The sync connection is based on TLS 1.2. The TLS certificates are sent in clear text (as in HTTPS etc), meaning that the certificate Common Name (by default `syncthing` ) is visible.
> [@](#):
>
> You are wrong about usage reporting.
Nothing wrong with that, thus why I’m asking what reports you’re refering to and what I see. As I said, the line above is literally from the syncthing client after a clean install.
> [@](#):
>
> You are randomly “frightened” by stuff but don’t say what. All in all, I feel this is slightly insulting and not constructive.
I have, quite clearly said what is frightening. Sorry you feel that is not construcive? I asked you in PM how you wanted to proceed.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [September 15, 2018, 8:49pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/8 "2018-09-15T20:49:09Z")
> [@h1z1](#):
>
> Doesn’t match what is documented. In your own documentation
What doesn’t?
> [@h1z1](#):
>
> The TLS issue with SNI is fairly well documented, even in your own documentation.
Indeed. If that’s what you think is broken, and for a political reason, then clearly we’ll agree to disagree. Back to you not being the target audience, if the fact that an eavesdropper on the network can tell you are using Syncthing is a blocker for you.
> [@h1z1](#):
>
> As I said, the line above is literally from the syncthing client after a clean install.
My Syncthing doesn’t do that, and neither does other people’s Syncthings. So I think you’ve made a mistake, either in enabling it and then forgetting, or in running something that _is not a release build_. If it’s a candidate build it will say that usage reporting is enabled, both on the console and in the settings GUI.
> [@h1z1](#):
>
> Sorry you feel that is not construcive? I asked you in PM how you wanted to proceed.
I said go wild and talk on the forum. We’re doing that. I can still feel insulted when you are essentially saying our work is crap - work that we do without getting paid, for fun (supposedly), for your benefit, by the way.
---
### Author:  [@h1z1](https://forum.syncthing.net/u/h1z1)
#### Post date: [September 15, 2018, 9:07pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/9 "2018-09-15T21:07:59Z")
> [@calmh](#):
>
> > [@h1z1](#):
> >
> > Doesn’t match what is documented. In your own documentation
>
> What doesn’t?
Where to start? STNOUPGRADE for one. Disabling relay stats on the relay server. At this point I don’t think it matters based on your replies.
> [@](#):
>
> > [@h1z1](#):
> >
> > The TLS issue with SNI is fairly well documented, even in your own documentation.
>
> Indeed. If that’s what you think is broken, and for a political reason, then clearly we’ll agree to disagree. Back to you not being the target audience, if the fact that an eavesdropper on the network can tell you are using Syncthing is a blocker for you.
That will definetly be a quote to remember. Glad you clarified your position.
> [@](#):
>
> > [@h1z1](#):
> >
> > As I said, the line above is literally from the syncthing client after a clean install.
>
> My Syncthing doesn’t do that, and neither does other people’s Syncthings. So I think you’ve made a mistake, either in enabling it and then forgetting, or in running something that _is not a release build_.
As I’ve said before, WHERE IS IT DOCUMENTED? Certinaly isn’t on Github’s release notes. Isn’t part of the client install.
I’ve been told this isn’t even enabled by default at _all_ until I pointed out that yes, it actually is.
> [@](#):
>
> If it’s a candidate build it will say that usage reporting is enabled, both on the console and in the settings GUI.
I see that no where in the GUI. The “anonymous usage reporting” under Settings-\>General, simply says “Version 3”. As I said above.
Reporting something like that on the console is almost as bad as saying it’s in the manpage.
> [@](#):
>
> > [@h1z1](#):
> >
> > Sorry you feel that is not construcive? I asked you in PM how you wanted to proceed.
>
> I said go wild and talk on the forum. We’re doing that. I can still feel insulted when you are essentially saying our work is crap - work that we do without getting paid, for fun (supposedly), for your benefit, by the way.
At no point did I say that. None.
---
### Author:  [@AudriusButkevicius](https://forum.syncthing.net/u/AudriusButkevicius)
#### Post date: [September 15, 2018, 10:13pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/10 "2018-09-15T22:13:14Z")
I am pretty sure you are running a non-release build, hence why usage reporting is force enabled.
STNOUPGRADE is there for legacy reasons, nowadays upgrades are configurable from the UI via a proper config flag.
You are misunderstanding the target audience. The target audience is people who install it and it works out of the box, with relaying, discovery and all. There is less people that do not want these than people who would not be able to find settings to enable them, or even dismiss syncthing not working and go bitching on the forums or issue tracker.
If you think things working out of the box is the wrong stance, then I am sorry, you are using the wrong software.
As you said, you find it wrong that any data you did not allow to be leaked being leaked, but this means syncthing would not work out of the box, and we have less technical people complaining on the forums. We don’t want that.
---
### Author:  [@canton7](https://forum.syncthing.net/u/canton7)
#### Post date: [September 15, 2018, 10:20pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/11 "2018-09-15T22:20:30Z")
(As an aside, the number of support threads on the forum went down drastically after relaying was introduced and enabled by default. I can only imagine the support burden – and the number of frustrated users who give up before posting on the forum – if we disabled global discovery by default).
---
### Author:  [@h1z1](https://forum.syncthing.net/u/h1z1)
#### Post date: [September 15, 2018, 10:32pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/12 "2018-09-15T22:32:06Z")
> [@AudriusButkevicius](#):
>
> I am pretty sure you are running a non-release build, hence why usage reporting is force enabled.
Not sure what you mean by that. It was downloaded from Github under releases.
> [@](#):
>
> STNOUPGRADE is there for legacy reasons, nowadays upgrades are configurable from the UI via a proper config flag.
Can you clarify what that means? The help says nothing about it being legacy. Not disagreeing that it may not be used now but it adds to confusion.
> [@](#):
>
> You are misunderstanding the target audience. The target audience is people who install it and it works out of the box, with relaying, discovery and all. There is less people that do not want these than people who would not be able to find settings to enable them, or even dismiss syncthing not working and go bitching on the forums or issue tracker.
>
> If you think things working out of the box is the wrong stance, then I am sorry, you are using the wrong software.
> [@canton7](#):
>
> (As an aside, the number of support threads on the forum went down drastically after relaying was introduced and enabled by default. I can only imagine the support burden – and the number of frustrated users who give up before posting on the forum – if we disabled global discovery by default).
Where are you guys reading this from? I never said that, I actually have two relays running.
> [@](#):
>
> As you said, you find it wrong that any data you did not allow to be leaked being leaked, but this means syncthing would not work out of the box, and we have less technical people complaining on the forums. We don’t want that.
I also said there is some data I realize to be required. Is it really this wrong to ask questions ??
---
### Author:  [@AudriusButkevicius](https://forum.syncthing.net/u/AudriusButkevicius)
#### Post date: [September 15, 2018, 10:44pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/13 "2018-09-15T22:44:21Z")
> [@h1z1](#):
>
> Not sure what you mean by that. It was downloaded from Github under releases.
Sure, but github also has pre-releases published. If the version that gets printed on startup has rc suffix, you are running a pre-release.
> [@h1z1](#):
>
> Can you clarify what that means? The help says nothing about it being legacy. Not disagreeing that it may not be used now but it adds to confusion
This was an old way of disabling upgrades. We added a config setting which people use now, but it seemed wrong breaking everyones setups by removing the env var, so it’s still there, but we don’t advertise it as people should be using the config setting
> [@h1z1](#):
>
> I also said there is some data I realize to be required. Is it really this wrong to ask questions ??
Well, so far I understood that you are not happy that syncthing connects to relays and discovery servers by defaults. If that is not it, you should really quantify what you are talking about. So far we have 3 people replying to this thread, we none of us still understand what issue you are talking about.
Perhaps you should make a list of bullet points of what syncthing should or should not do, in terms of functionaly (“should not connect to relays” and not expressions like “be privacy respecting” as it does not explain what action within syncthing causes to be in this state).
---
### Author:  [@h1z1](https://forum.syncthing.net/u/h1z1)
#### Post date: [September 15, 2018, 11:00pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/14 "2018-09-15T23:00:43Z")
> [@AudriusButkevicius](#):
>
> > [@h1z1](#):
> >
> > Not sure what you mean by that. It was downloaded from Github under releases.
>
> Sure, but github also has pre-releases published. If the version that gets printed on startup has rc suffix, you are running a pre-release.
Glad that is clarified… I think. I mean Github publishes whatever it’s told to. Initially I thought you meant I was running a git version or something.
> [@](#):
>
> > [@h1z1](#):
> >
> > Can you clarify what that means? The help says nothing about it being legacy. Not disagreeing that it may not be used now but it adds to confusion
>
> This was an old way of disabling upgrades. We added a config setting which people use now, but it seemed wrong breaking everyones setups by removing the env var, so it’s still there, but we don’t advertise it as people should be using the config setting
Where is it advertised not to though?? That is from the -help output on syncthing itself… As are quite a few other options.
> [@](#):
>
> > [@h1z1](#):
> >
> > I also said there is some data I realize to be required. Is it really this wrong to ask questions ??
>
> Well, so far I understood that you are not happy that syncthing connects to relays and discovery servers by defaults.
I never said that though… what on earth?
> [@](#):
>
> If that is not it, you should really quantify what you are talking about. So far we have 3 people replying to this thread, we none of us still understand what issue you are talking about.
It’s hard to quantify that when you’re deflecting the answers I’ve given as non-answers. At no point have any of you said you don’t udnerstand what I’m saying.
> [@](#):
>
> Perhaps you should make a list of bullet points of what syncthing should or should not do, in terms of functionaly (“should not connect to relays” and not expressions like “be privacy respecting” as it does not explain what action within syncthing causes to be in this state).
You’re taking things out of context here. Way out of context. Why not start with of what I’ve said above, do you _not_ understand? Or at least tell me what “respecting privact”, means to you and or Syncthing??
I came here at the request of calmh not to get shit on.
---
### Author:  [@canton7](https://forum.syncthing.net/u/canton7)
#### Post date: [September 15, 2018, 11:04pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/15 "2018-09-15T23:04:34Z")
@AudriusButkevicius made a very sensible suggestion, to help try and get this topic back on track. I strongly suggest following it, please.
---
### Author:  [@h1z1](https://forum.syncthing.net/u/h1z1)
#### Post date: [September 15, 2018, 11:05pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/16 "2018-09-15T23:05:49Z")
I suspect you’re going to ban me anyway regarless. What an odd thread.
---
### Author:  [@canton7](https://forum.syncthing.net/u/canton7)
#### Post date: [September 15, 2018, 11:07pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/17 "2018-09-15T23:07:59Z")
The only thing that’s potentially bannable here is rudeness, and I doubt anyone wants to go down that path.
> [@AudriusButkevicius](#):
>
> Perhaps you should make a list of bullet points of what syncthing should or should not do, in terms of functionaly (“should not connect to relays” and not expressions like “be privacy respecting” as it does not explain what action within syncthing causes to be in this state).
If you want to continue the discussion, please do this. It will help a lot.
---
### Author:  [@h1z1](https://forum.syncthing.net/u/h1z1)
#### Post date: [September 15, 2018, 11:12pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/18 "2018-09-15T23:12:01Z")
> [@canton7](#):
>
> If you want to continue the discussion, please do this. It will help a lot.
Sure… very top of this thread:
> My end goal is a process which is seen but not heard. Is that possible? One where any config is largely static. I’m not interested in public discovery servers, usage reporting, stats reporting, etc. I’m not a fan of TLS either due to SNI leaks. Though I can’t find any conclusive document of such an environment nor how to disable those.
---
### Author:  [@AudriusButkevicius](https://forum.syncthing.net/u/AudriusButkevicius)
#### Post date: [September 15, 2018, 11:13pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/19 "2018-09-15T23:13:29Z")
Sorry, but I still don’t understand what we are discussing here.
Your claim was that there were some privacy issues, I am asking what particular actions you think leads to us having issues.
So far I saw:
1. Usage reporting, which you claim is on by default. I’ve explained under what circumstances it’s on by default.
2. SNI issue. Yeah, it does leak things, but it’s better to leak things that not to encrypt, or roll out our own crypto transport. You can use a self-generated cert with a custom SNI if you wan’t, you’ll just have to do additional configuration on other peers to accept that certificate.
What else needs to be discussed?
I don’t want to talk about who said what etc, I am here to answer your questions and finish the discussion.
---
### Author:  [@canton7](https://forum.syncthing.net/u/canton7)
#### Post date: [September 15, 2018, 11:19pm UTC](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170/20 "2018-09-15T23:19:25Z")
That is the only thing you are concerned about? OK, let’s tackle it.
1. How is the config not static? I set Synching up and leave it: I don’t touch the config.
2. I think we’ve agreed that global discovery should be enabled by default? I’ve told you where you can easily turn it off. I think that aspect is resolved?
3. Usage reporting. I think we’re almost at the bottom of this one: are you or are you not running an RC release?
4. You’re not a fan of TLS. Fine. I think the point about Synching not keeping its presence a secret has already been addressed, but if you have a credible technical proposal for an alternative to TLS, please tell us.
I think that’s everything?
[Next page](https://forum.syncthing.net/t/misunderstandings-or-bugs/12170.md?page=2)