Moodle in English: Does Moodle call home?

Does Moodle call home?

by Soen Trueman - Saturday, November 21, 2020, 3:00 AM

Hi!

I'm looking to adopt Moodle to host our online courses for a large rollout, for potentially around 40,000 learners, and whilst I've been able to answer most of the security questions myself, I've got a simple question which I can't find a definitive answer for:

On a self-hosted platform, does Moodle call home to either moodle.org (or any other endpoints) in the factory-default configuration? If so, what information is reported?

Many thanks,

Soen

Re: Does Moodle call home?

by Ken Task - Saturday, November 21, 2020, 4:10 AM

Kinda depends upon what you mean by 'phone home'.

If using git to install and update/upgrade, yes ... goes to moodle code repo.

Option to register your moodle with moodle.net ... which shares info (not very much cept version of moodle, number of courses, etc) ... that actually could sign you up for notifications about updates to core code.

Other things ... moodle help ... option to use local (your server help) on version of moodle or go to moodle.org help.

The new H5P upon installation auto loads libraries related.

If you install/update a plugin via the GUI then yes have to go to Moodle plugins site to do that.

Maybe you'd better share what you might have observed???

If you think somethings not right what?

DNS can be hijacked and even traceroutes (routing) ... sooooo????

'SoS', Ken

Average of ratings: -

Re: Does Moodle call home?

by Marcus Green - Saturday, November 21, 2020, 4:15 AM

It calls home if you register and you can get an idea of the sort of information it returns from here.
https://stats.moodle.org
The H5P plugin may call home with information.
If your question is related to privacy, Moodle treats it very seriously. If it is related to performance then there it is not an issue.

Average of ratings: -

Re: Does Moodle call home?

by Randy Thornton - Saturday, November 21, 2020, 5:58 AM

This is an excellent question that should really have some documentation. Items I can think of are:

- Checking for available updates for core and its plugins - on by default. (Setting and Scheduled task: Check for updates ). The endpoint seems to be https://download.moodle.org/api/1.3/updates.php.

- Site registration checks once a week if you are registered or not - on by default - even if you don't register, it still checks at stats.moodle.org. (Scheduled task: Site registration)

- MathJax is on by default and connects to https://cdn.jsdelivr.net/npm/mathjax@2.7.8/MathJax.js - even if you aren't using it. (Filter setting)

- H5P library updates, as Ken and Marcus note, are on by default. (Setting and Scheduled task: Download available H5P content types from h5p.org )

Things that may phone home or used to phone home but may not anymore but I'm not sure:

- Language pack updates - I'm not sure if or how these auto-update anymore or not? If memory serves (and it may not), there was a link for this on the packs page to do the update, but then it was automated to check for any new packs or updated strings in the installed packs. Is this true and if so is it part of the schedule update checks now or on its own schedule?

- Time zone file updates - Are these updated after install? I would think so since the tz definitions are not static and do change. There is no admin setting to update them. Ken, do you know how these are updated?

Randy

Average of ratings:Useful (3)

Re: Does Moodle call home?

by Ken Task - Saturday, November 21, 2020, 7:20 AM

Would think whatever moodle does would call OS NTP or check it ... can re-call if 2 Moodles running MNet had system clocks off more than 30 minutes they wouldn't talk.

Haven't heard of any issues about NTP or php related.

'SoS', Ken

Average of ratings: -

Re: Does Moodle call home?

by Andrew Lyons - Monday, November 23, 2020, 10:34 AM

Hi Ken,

Moodle uses the standard date libraries for PHP, which make use of the standard C libraries to fetch system time.

There is no need for Moodle to perform its own NTP checks - that really is a server configuration issue and has nothing to do with Moodle.

Average of ratings: -

Re: Does Moodle call home?

by Randy Thornton - Tuesday, November 24, 2020, 1:47 AM

Andrew

That makes sense to me, since it's needed for a lot of server functions anyway.

Still wonder how the language packs work though. Since AMOS is getting a rebuild at the moment, will have to wait until that is over to do some testing.....

Average of ratings: -

Re: Does Moodle call home?

by Randy Thornton - Wednesday, December 9, 2020, 5:09 AM

I would like to add one more item to this list of defaults that "call home" and answer my own question about language packs.

Installed language packs are updated daily by a Scheduled task, "Update all installed language packs" \tool_langimport\task\update_langpacks_task, which runs daily at 04:19.

This is on by default. It goes to https://download.moodle.org/langpack/ and its subfolders for the various packs it is checking on. When this task runs, is also updates the list of Available language packs as well.

Average of ratings:Useful (1)

Re: Does Moodle call home?

by Marcus Green - Friday, December 11, 2020, 5:21 AM

It would be possible to add 'phone home' code to a plugin. I have thought of adding it to my own (with a consent option defaulted to off), to send back bits of information so I could find out how they are used. This would be noticed when the plugins were first submitted and I don't know what the default policy from the plugin checkers.

Average of ratings: -

Re: Does Moodle call home?

by Randy Thornton - Friday, December 18, 2020, 12:48 AM

I would like to add yet one more thing to the call home list: the Moodle Campaign tool which is on the Site admin > Notifications page. This calls home to get banners, at least. Details are here in the original tracker: https://tracker.moodle.org/browse/MDL-68320. This was added to Moodle 3.9.

Unlike all the other call home items I have listed before, it seems the only way to disable this is to add a CFG setting in the config.php file. How to do that is documented in the tracker above, using $CFG->showcampaigncontent = false;. I haven't personally tested this, but it is in the config-dist for 3.10 around line 1066 and all that.

Average of ratings:Useful (1)

Security and privacy

Does Moodle call home?