I think this may be useful to earmark under a globally usable option, where
  supported.  Any objections to the name "no-home-callback"?  I'm trying to
  avoid the term "spyware" if possible, as that normally refers to things that
  are quite a bit more malicious.

  no-home-callback        Disable automatic phone-home callbacks such as version checks.

I thing that the appropriate course is to log all such callbacks in
pkg-vulnerabilities, perhaps as 'home-callback' if it sends no
application data (and spyware if it does) and disable such callbacks
as bug fixes.  There could perhaps be an option to enable them.  By
default people should not be subjected to such behavior.



-- 
        Greg Troxel <gdt@ir.bbn.com>