Hacker News Reader

Comment by peteretep | Hacker News Reader

> We assumed that making it opt-in would allay privacy concerns

That seems like a reasonable assumption to me?

It is a reasonable assumption. They just totally flubbed the original incident. Someone just dropped a PR saying they're merging in telemetry without any issue discussion, or forum post, or anything, and all the initial review discussion on it was able how they should vendor their dependencies - no discussion about telemetry.

Once the feature and toggle exist, reversing the default is a much lower barrier than adding the feature. Keeping it expensive helps reassure users that they'd notice the change.

Absolutely agreed. A program without telemetry being possible at all is not one that I need to worry about enabling it behind my back. Imagine if /bin/bash had optional telemetry. Suddenly I'd need a way to ensure that telemetry is never enabled. In order to make sure that no confidential data are leaked, I'd need to have that setting always be visible, perhaps by adding it to my $PS1. I'd need to make a mental habit of checking that setting before executing any command that contains confidential data. All that additional overhead as a result of telemetry being an option at all.

There are a couple different stages on the sliding scale of telemetry, which have huge effects in the amount of privacy being sacrificed on the part of the user. However, the biggest technical hurdle is in that very first step, from "No telemetry is possible" to "telemetry is possible". Every single step after that is small and incremental, easily enabled with minimal effort.

* No telemetry is possible.

* Telemetry is possible, but requires searching in a menu to enable.

* Telemetry is possible, and has a single opt-in popup, path of least resistance is to disable telemetry. (e.g. An unchecked box that enables telemetry, and a "Continue" button. The easiest path is to ignore the box and just click continue.)

* Telemetry is possible, and has a single yes/no popup, both accept/decline are equally easy to select.

* Telemetry is possible, and has a single opt-out popup, path of lease resistance is to enable telemetry. (e.g. Same as the opt-in popup, but with the box defaulting to being checked.) This is the level that starts to raise red flags for me, and to make me feel uncomfortable with it.

* Telemetry is possible, and has several nag screens. These may re-occur each time you start the software, or re-occur sporadically. These may have the euphemistic option "Not Now", a newspeak phrase that prevents me from saying "No" entirely.

* Telemetry is mandatory, but can be blocked at the router level. Any software here and above is spyware, and should be treated as such.

* Telemetry is mandatory, and software refuses to run without a server connection.

> Imagine if /bin/bash had optional telemetry.

That immediately brought PowerShell to mind -- it boggles the mind how much opt-out telemetry Microsoft has in their core offerings.

Holy wat? I had to look it up to make sure you weren't joking, but yes, PowerShell has telemetry [0]. I hadn't ever looked into it when developing on Windows because it hadn't even crossed my mind that that would be something that was done. I think I'd insert "Silently enables telemetry without telling you and with no indication that telemetry can be disabled" just below the mandatory telemetry stage, and would extend the "spyware" description to include it.

[0] https://docs.microsoft.com/en-us/powershell/module/microsoft...

Not just PowerShell by the way. Most of their CLI offerings (compilers, shells, ...) that I've used have opt-out telemetry.

> Silently enables telemetry

Iirc most of them tell you about that the first time you use them, or they did back when I still used Windows.

The default was opt-in (telemetry off).

If I where in their shoes, these would the multiple dimensions I'd think about when taking that decision:

- legal (living in Germany I am legally only allowed to share personal data from my users with entities with whom I have a data processing contract ("Datenverarbeitungsvertrag") that specifies how they treat said data)

- practical (using a provider which people trust, will make more people switch on telemetry. People who use your software usually trust you – so it makes sense to collect telemetry yourself)

- personal (I want to know what I am running where, feels better to me)

- political (no need to feed big monopolists yet another shovel of user data. After all I make open source software because I want the world to become a better place)

- ethical (is it ethical to use a provider which could do god knows what with your users data? Users trust you, which means you have to choose providers which you can trust)

- symbolical (whom does a open source project trust with their users data? What does this in itself communicate?)

That being said this is opt-in, which leaves the decision about many of these things to the users. However to me this episode revealed something about their thinking on that specific issue – or rather the lack of it. I wouldn't have raised an eyebrow if they managed to express a good reason why they want to rely specifically on those services, why they trust them with their user data etc. What raised my eyebrows is, that they didn't think about that at all, which means the privacy of their users isn't valued as high as I would have assumed prior.

Their reaction gives some hope they learn from this.

That's not primarily what it was about.

"...the convenience of using Yandex and Google is at odds with the public perception of trustworthiness..."

If it's opt-in and there are privacy concerns about where this data goes to after you opt into it, then probably fewer people will choose to opt in. The option outlined in the submission may attract more people to opt in, thus making the data more conclusive and valuable.

> We assumed that making it opt-in would allay privacy concerns but since this isn't the case, we are dropping it.

Especially after dropping Google & Yandex, I guess they could've stood up for their telemetry needs, and flat-out say that "if you have privacy concerns about our anonymous opt-in telemetry, you can just use the default settings."

Yeah, opt-in is totally fine. I'm straight up militant about opt-out spyware bullshit in apps, but opt-in should be acceptable to everyone.

Both yes and no imo. I strongly believe that they have good intentions and that the reception has been a bit in bad faith.

I think it's a reasonable assumption to make, but as a user I'd want insight and granular choices, rather than just "allow telemetry? y/N"

The PR had the opt-in choice button set as default, which is not very GDPR compatible.

It definitely is but unfortunately the original PR didn't say that it was opt-in, only that it was "optional" which usually means opt-out.

Obviously people on Reddit and HN assumed the worst and by then it was too late to get the truth out.

Bit of a shame; I feel like telemetry probably would have been quite useful to them (e.g. for optimising which things are in the toolbar). Though, on the other hand I think Audacity's usability problems are obvious enough that they easily have a decade of work before they get to the point where they run out of things to improve.

Reply on news.ycombinator.com