Slash Privacy Watch's Journal: Slashdot Customer Profiles

What is the Slashdot Customer Profile?

Slashdot is owned by VA Linux, and VA Linux is a for-profit Corporation. This means that, like other corporations, Slashdot must maintain a customer profile for every user (yes, even you Anonymous Cowards!). These customer profiles are kept in Slashdot's master MySQL database, which is archived on a frequent basis to preserve VA Linux's valuable Intellectual Property rights to its' customer information. The Customer Profile contains many fields, such as the email address you used to register your Slashdot account. In addition, it contains these fields which are accessed in users.pl, line 1898.

They're Tracking WHAT?

You may have noticed that the Customer Profile contains a field called $iplist. You're not dreaming, this is a list of every IP address anyone has used to access Slasdot - ever. Slashdot has a perfectly legitimate reason for maintaining these detailed records on every customer. However, while every Slashdot user understands that the privacy of each Slashdot user is paramount to the current management of Slashdot, we must also understand that Slashdot is property, and that it has been bought - and sold - before. Therefore we must not consider the implication of the existence of Slashdot Customer Profiling under the existing management, but rather the implications under any future management.

Who Would Want my IP?

Let's assume, for the sake of argument only, that VA Linux decides to sell Slashdot to DoubleClick in order to boost its' short-term cash supply. Doubeclick would be looking at Slashdot mainly as an Intellectual Property asset, and its' customer database as the primary portion of that asset (because Slaschode is GPL'd). How, then, can VA Linux maximize the resale value of Slashdot's Intellectual Property assets? By tracking every possible piece of information. The list of IP addresses used by every Slashdot user, reverse-correlated by email, would provide a very lucrative marketing tool to a would-be buyer of Slashdot. Doubleclick could use this Intellectual Property to:

• Correlate web hits to member sites by IP address, sending an email to every Slashdot user who visits a target site.
• Correlate web hits by IP address and present customized content to each Slashdot user who visits a target site, for instance: "Welcome to Superdomains.com, Slashdot user Jamie!"

It is easy to see why recording the IP profiles of every Slashdot customer maximizes the value of the Slashdot Customer Database. The question is, should you be given the option to opt-out?