Audacity may collect “Data necessary for law enforcement, litigation” and more
Audacity now has quite a bit of networking code. Some of the more interesting parts involve something called "Sentry". Code for that went in 26 days ago.[1] I'm not sure when this runs, but there is code here [2] to read the contents of the URL<p><a href="https://sentry.io/get-cli/" rel="nofollow">https://sentry.io/get-cli/</a><p>and feed it into the bash shell. Whomever controls that URL can download anything they want.<p>This supposedly is for crash reporting.<p>Whether this is a security problem I will leave to others.<p>[1] <a href="https://github.com/audacity/audacity/blob/97914403f61cfebf6f3c87d084dc1a5e5d5eac7d/libraries/lib-sentry-reporting/SentryRequestBuilder.cpp" rel="nofollow">https://github.com/audacity/audacity/blob/97914403f61cfebf6f...</a><p>[2] <a href="https://github.com/audacity/audacity/blob/2e0e3b4162c8e4ab3dab1f0ca0494b0acf024e8e/scripts/ci/upload_debug_symbols.sh" rel="nofollow">https://github.com/audacity/audacity/blob/2e0e3b4162c8e4ab3d...</a>