Comment by userbinator | Hacker News Reader

Comment by userbinator | Hacker News Reader

Parent Full thread

There's already a comment here, and I've also personally experienced just from talking with others offline, that a lot of people don't even know VSCode had telemetry, despite it mentioned several times in the product itself and its documentation. They (and remember, these people are supposedly developers) either ignored it, or just didn't read the docs.

I guess a big WARNING banner might scare users away, but it's still a bit disturbing to see such a lax attitude towards tools which developers use to work with a software company's most valuable assets. A lot of people, developers included, don't really read EULAs, and it's the same reason (traditional) spyware could thrive: no doubt they all specify in their license agreements the fact that they all collect information, but approximately no one reads those.

Put it another way, would you want your compiler or other parts of your toolchain sending information about all the source files it processed? I wouldn't consider myself particularly paranoid when it comes to security, maybe even looser than the average on HN, and even then I wouldn't use such tools. I wonder how many companies have already banned their use...

It may be disturbing, but it is entirely understandable that no one reads the EULA. If I read all the terms and policies for every piece of software and site I use, I would be doing that full time.

Companies have basically DoS attacked the public by attaching pages of legalese to anything and everything.

>Companies have basically DoS attacked the public by attaching pages of legalese to anything and everything.

It's DDoS. You could read one EULA, but there are way too many, it's a distributed attack.

A DDoS is by definition also a DoS, so the OP's statement stands just fine on its own.

Telemetry is all about how it’s presented to the user. It should simply be presented at install/first start and users should be shown the checkbox (it shouldn’t be hidden away in settings) and asked nicely to leave it on in order to improve the product. Checked by default is a hot topic but I think it is OK so long as it’s presented clearly to the user.

I mean obviously I wouldn’t like any of the information I handle to be sent somewhere, but I also don’t mind statistics about that info (number of files, file sizes, feature use count) to be sent to Microsoft. If I found out that file contents was transmitted then obviously I’d be outraged - but I’m rational and assume Microsoft is too.

>I mean obviously I wouldn’t like any of the information I handle to be sent somewhere, but I also don’t mind statistics about that info (number of files, file sizes, feature use count) to be sent to Microsoft. If I found out that file contents was transmitted then obviously I’d be outraged - but I’m rational and assume Microsoft is too.

Exactly, telemetry on a broad level is important to find out if your software has problems. The problem is what kind of telemetry you have.

Precisely! Albeit I am a bit surprised our infosec team seemingly haven't cracked down or made a stance just yet on Kite and other telemetry software for developers. That day will come soon I am sure :)

Kite runs locally, why would infosec crack down on it?

maybe this is old information but I thought it sent information back to Kite? This article is old but for what it's worth: https://qz.com/1043614/this-startup-learned-the-hard-way-tha...

Most people don't even know Chrome is reading their entire hard drive, thanks to software_reporter_tool.exe .

I didn't know until I saw it myself. Maybe I forgot some announcement, but I don't need Chrome to role play as an antivirus.

Can you please explain in details?

Sure. I think all the info you need is in this screenshot [0].

According to "Matt" [1], It scans the folders related to Chrome. Please do not worry as your data wouldn't be effected by the clean up tool. .. I think reality speaks for itself. My Steam Library just isn't related to Chrome.

[0] https://imgur.com/QtcSXY9

[1] https://support.google.com/chrome/forum/AAAAP1KN0B0T8qnffV5g...

> They (and remember, these people are supposedly developers) either ignored it, or just didn't read the docs.

Or they forgot and their stance on it changed. I vaguely remembered (or thought I did) having seen it. Just checked my settings and it's disabled. I've gotten way more privacy minded in the last 24 months, so I figured I might have said "yeah, you can collect data" back when I first installed it, but now I'd prefer they didn't.

A middle way would be to periodically remind people, "hey, you've consented to sending anonymous usage data to us so we can make better decisions. I just wanted to confirm that you're still cool with this" once a year or something, because at least for me, "does this app collect telemetry data?" is not something I constantly have in my working memory.

> A middle way would be to periodically remind people ...

Almost nobody will do this because, if they do, they know people will turn it off. It's the same reason commonly given for making tracking (or "telemetry", as they call it) opt-out and on by default, instead of requiring users to opt-in -- "if we have it off by default and ask users to enable it, pretty much nobody will".

They may very well be correct but, to me, that doesn't make it okay.

Yeah, I believe you're right. It might be a matter of framing. If you show me the value of collecting telemetry data, what good decisions you've made because of it, how you got rid of that annoying thing plenty of users complained about because you saw that it affected a large group of users and wasn't just a loud dozen etc, you might sell it to me.

Most data collection for "analytics" is just about you as the product owner optimizing the product for whatever goal you want to, engagement, sales, ad clicks, retention or what have you. I as a user that provides the data gain nothing from that and, being the target of those manipulations, I might actually lose (by spending more time on your site than I wanted to etc), but if you can show that I give data = I get better product, I don't think I'd be that hard to convince.

I don't know if VS Code does something in that regard (if they do, they don't communicate it effectively enough to reach me), but I do like their approach in general - I once read through an issue where they discussed changing some component for a more advanced one and pretty much everybody agreed that the newer one was better, but they still had a few words on "how can we measure that? how can we make sure that it's not just us devs that work on this thing all day and it won't be the same for the people using it in their daily life on all kinds of experience levels". I liked that a lot (so much so that I still remember it months after reading), but apparently not quite enough to enable telemetry data ;)

I have it enabled on my personal computer, but disabled on my work computer. I like them improving their product, so I want to support that, but at work it's a bit different.

Off topic but from a podcast I was listening to recently: your most valuable asset is your team, not your code. This is evidenced by exits - without the team the codebase ain’t worth much.

My old CTO used to say “I don’t care if they have the source code, let them try and actually run the damn thing”

For stealing/running the service, sure. But they find an exploit

Reply on news.ycombinator.com