Hacker News Reader

Comment by alkonaut | Hacker News Reader

Are people worried about the actual contents of these kinds of telemetry, or rather just annoyed by the fact that it's there at all?

The first position seems a bit odd for something that is open source (so presumably you can verify what's being sent). I mean it might be bad to send "I installed product X" or "I used the command X" to a remote server, but on the other hand if I really feel this is a problem would I ever even be using the closed source binaries that the package manager installs, without worrying more what they might do, than what happened when the package manager ran?

Some times I get the feeling that the telemetry thing just became an expression of annoyance with something else entirely, or just the current state of affairs. It's like one of those cultural wars where every battle is so symbolic that everyone forgot what the real issue was ("Why do we worry so much about who uses which bathroom again dad?").

View on HN

My purchase of a piece of software does not give that software provider carte blanche access to what I do with that software. Unless I explicitly give my approval (opt in), exfiltration of information from my system is an ethical breach of my privacy if not a breach of data protection laws.

As for why this matters, you need only look at Hong Kong for that answer. And even here in the US, many large companies are kowtowing to the Chinese government and changing their products in the US to toe those lines.

I'd gladly agree to negotiate a sale of my usage data, where I can set my price and they can decide if they'd like to buy it. Or better, I'll agree to send my telemetry data if they agree to send me their source code so I can see exactly what is being sent.

I'm wholly in favor of an equitable exchange between consenting parties. Thumbs up from me.

The "equitable exchange" of telemetry is you give anonymized usage data for free, and the developers provide you with a better product based on that data. If you trust the developer, it sounds like a reasonable deal to me. No one is making you use that software.

> the developers provide you with a better product based on that data

I think that it's incorrect to believe that telemetry allows developers to build "better" software. Web pages have had intrusive telemetry for over a decade now, and they still broadly suck. We're able to navigate the world of hamburger menus, text with poor contrast, and scrolljacking because we're adaptable humans, not because these kinds of changes actually improve the websites.

The problem is that telemetry can only tell you the "what" and "how", but not the "why".

> If you trust the developer

It's not just the developers who gain access to that data. It's everybody at the company. It's 3rd parties who contract with that company. It's everybody who hacks into the data set at the company. And it's every governmental agency from (almost) any country with an overly broad warrant who has access to that data.

See my upstream comments about China and Hong Kong

> No one is making you use that software.

Just as nobody is making an effort to make it simple (or even possible) to make an informed choice about whether I should use that software. Homebrew is a great example. I know that it's sending telemetry to Google only because someone raised a ruckus and used social pressure to make the homebrew devs add in a reasonable amount of consent into the install and update process.

Thankfully, laws are catching up with technology, and I should soon be able to rely upon simply saying "data collection not directly tied to software functionality legally requires my explicit consent, and that consent is not required to run the software".

I don't think you understand how telemetry works because you're comparing it to scrolljacking and such. The telemetry they're talking about is for error reporting. It answers questions like

1. Did this error condition that should not happen happen?

2. How many users did it happen for? (Who is not available for legal reasons)

If you search for tracelogging in the code you'll find they're associated with debugging and errors.

https://github.com/microsoft/winget-cli/blob/e997f3e394e66f2...

I don't know if you understand how difficult it is to debug programs that fail on someone else's machine. Well that's what telemetry is for.

This is a link to github, it's already open source. So, I think your wish is granted?

That's the case for this particular program, however this thread of conversation is aimed at software telemetry in general.

> My purchase of a piece of software does not give that software provider carte blanche access to what I do with that software.

Says who?

Me. Ethics. Data and privacy protection laws.

I'd even go so far as to say "Common Sense".

Says the people who elect the people who make laws. Confer GDPR.

I bet you also want the software to work and not have bugs. Telemetry gives devs information to prioritize and debug information fix the bugs.

You can...

1. Make telemetry opt-in and ask the user to share data. This is what Apple does

2. Collect telemetry and give the user an option to share that data after a crash or bug. Many companies do this.

3. Make telemetry opt-out but be forthright with what information is sent and why.

4. Don't allow opting out of telemetry but be open and upfront with what is being collected and why.

5. Hide the fact that telemetry is being sent, hide what is being sent, and don't allow the user to opt out.

> Make telemetry opt-in and ask the user to share data. This is what Apple does

You should check - apple software still contacts the mothership constantly.

By that reasoning Enterprise edition of Windows is worse because users actually can turn the spying off

>>I bet you also want the software to work and not have bugs. Telemetry gives devs information to prioritize and debug information fix the bugs.

You're just illustrating a single possible use among the universe of actual real world uses of telemetry, such as gathering your personal info to build up your profile to use against you as the company sees fit.

As others have stated throughout this discussion, it's standard practice for over a decade to use systems that don't collect telemetry to keep systems updated and safe. It boggles the mind how some people try to claim that the only way to remain safe with Microsoft products is to be perpetually spied upon.

And yet, if anything, I see an inverse correlation between software quality and invasive telemetry.

Maybe there's a correlation between invasive telemetry and not caring about your users.

> Are people worried about the actual contents of these kinds of telemetry, or rather just annoyed by the fact that it's there at all?

Both, I imagine. Worried about the contents because the trend of companies pulling in as much data as they can tends to not end well for consumers, and annoyed as it's an invasion of privacy that there is tracking for the many things we do on our personal devices.

We have regard for bathrooms as well as telemetry for a shared reason: privacy and a sense of control and safety. We are exposed and we seek to limit our exposure.

Without necessarily being worried or annoyed by telemetry, I could understand that people might question the need for it; is it required by other package managers?

Collecting data creates a risk that the data will be intercepted or misused at a later point, and there are often legal requirements regarding data collection and processing too.

It exposes a lot of indirect info about what you may be doing, writing, etc. I know in a high security environment that is a no no.

Its also the principle.

Lastly its trust. I tolerate some telemetry from Apple and sometimes opt into it with things like Debian. I don't trust Microsoft not to be customer hostile.

Windows itself collects telemetry so I can see your point, but your example is bad. Single sex bathrooms are not symbolic at all and are a serious issue.

My stance is simple, I want to turn off all telemetry, period. It's my computer, I should be able to do whatever I want on it. Anything less is unacceptable.

I understand why telemetry is valuable to developers and I can accept when it's active by default. But I _insist_ on being able to turn it off.

Hopefully Shutup10 will be updated to disable this telemetry too.

Barring that, use something like Wireshark to see exactly where this stuff is being sent and block it at the firewall/router level.

But people also worry about what those closed source binaries do, in the last few months there was plenty of discussion about the Zoom installer doing shady things.

Symbols matter. When someone tells you they don't respect your privacy, it's appropriate to believe them.

The bathroom comment is off topic flamebait.

You are correct. It's annoyance with data harvesting and idealism around "I have the right to remain uncounted". I support much of that in theory, but not to the absolute extreme that is popular in some communities.

Unfortunately, it's often also combined with "I have the right to have my opinion counted", which leads to some very ironic moments where people opt out of telemetry and then complain that their uncountable needs aren't counted.

Reply on news.ycombinator.com