Debian 9 opted out of data collection, doing it anyway?

Question

I've noticed when I log in to my Debian 9 account, it informs me that there are updates. I update and upgrade in terminal and it informs me that 0 bytes have been downloaded but requests to upload around 100Mb. The path is /var/cache/apt/archives/ so I checked out /archives/ and it's basically a collection of all the programs I've chosen to download since I installed, along with some files I can't open even as root.

During my install I specifically opted out of giving info to Linux about my settings and programs I install. Is there another reason why Debian is uploading from my hard drive? Will I be less secure if I just choose 'n' every time this kind of 'update' happens?

Answer 1

You've misread or mistranslated several things. Debian is not doing any data collection and it is downloading, not uploading.

Upgrades do not upload anything. The only data that's sent from your computer is the requests to download the updated list of package versions and the package files for the packages that you install or update. The mirror from which you're downloading the packages can log your requests; the Debian project itself does not collect logs from mirrors.

When you use a command line tool to upgrade, you get a confirmation prompt like this:

Need to get 42 MB of archives. After unpacking 250 kB will be freed.
Do you want to continue? [Y/n/?] 

The wording depends on which tool you use, some package managers might not ask at all. The first number here is the amount of data that will be downloaded. The second number refers to disk space. If all the packages for the upgrade or installation have already been downloaded, you'll be told that 0 bytes need to be downloaded. There's nothing here about uploading. The tools don't even have any uploading code or any messages about uploading.

The directory /var/cache/apt/archives contains package files that have been downloaded to your computer. These files are never uploaded anywhere. (What would be the point anyway?) Debian does not upload anything from your hard drive.

There are no files on your computer that you cannot open as root. (It's possible to configure a system to have files that can't be opened as root, but that requires an advanced setup with a security framework such as SELinux. There's nothing like that on a default Debian installation.) If there's a file you can't open, it's because you don't know how to do it, not because of a security restriction. There are a few special files that can't be read at all, but not due to a security restriction: they're special files that don't store data, but only exist as a gateway to a system functionality such as an output-only peripheral. Those files live under /dev, /proc and /sys, not /var.

You should always keep your system up to date. If you choose n when asked to confirm a security update, your system will be a lot less secure. Not doing timely security updates is by far the biggest security risk for a user with ordinary needs.