Audacity: Clarification of Privacy Policy

That thread is certainly not a good example of communication, but I cannot find any place where a representative from the Muse group says that they own the copyright to all sheet music on their site. They say (and that's to the best of my knowledge mostly correct at least here in Germany) that the arrangement for music is legally protected and even if someone else typed down the sheet, the rights to this sheet are still protected. And they point to the music industry enforcing restrictions (having worked with the music industry, I find that one entirely credible)

> Going as far as to state that they will "cooperate with github.com and Chinese government to physically find you and stop the illegal use of licensed content."

Wow, that's low. It's one thing to send dumb threats, it's another to threaten someone with involvement of a government that frequently disappears people. This is how you turn your products into the PR equivalent of radioactive waste.

The tone of the post from the Musescore developer at [0] is so bizarre I wonder if the people who manage the company's policies and communications even know about it.

In that case, at least there is some separation between the site musescore.com and the musescore open source app.

when this happens the product dies. in my mind it’s as if audacity never existed. hopefully a project emerges from a forked code base that’s useable going forward.

I dont understand all the ruckus around this. Just fork the repo and remove the spying code (I dont want an audio editor to share my CPU and IP with anyone).

It has been done for larger codebases like OpenOffice and MySql.

Telemetry and error reporting are opt-in. Error reporting uses industry-standard Sentry (also an OSS), which is not a nefarious data seller. Auto-update checked are opt-count and send a very basic user-agent with less data than an average web browser HTTP request. There is no spying here.

I think if you read the comments in the link, it's pretty clear: changes regarding personal information were dumped on the community along with a bunch of legalese without warning, an announcement, or context. Had the new maintainers given the community a heads up via a simple blog post explaining the reasoning behind this, we wouldn't be where we are. Hopefully they can chalk this off as a learning experience and move forward to gain trust of the community.

You missed: project purchased by ad-heavy website owner (ultimateguitar).

As for how they could make it better: make it opt-in not opt-out.

This is the kind of toxic behaviour we all tolerate from commercial software, but people get mad when it leaks into open source.

An example of the problem is that in the UK those below 13yo cannot give consent to telemetry. Audacity is used in their public schooling system. Newer versions of Audacity will not be usable by those students anymore.

Roughly.

I think there's a misunderstanding: Tantacrul, the developer with a pretty active Youtube channel, works for the Muse Group, which acquired Audacity. This has nothing to do with him. A company acquired Audacity, not him, and he's not in charge of the Muse Group. Your portraying of the whole thing is inaccurate.

People didn't lose their collective minds.

The Muse Group acquired Audacity, then introduced:

- a CLA (which, between other things, allows them to make closed source versions of Audacity)

- telemetry

- a very controversial privacy policy

People aren't losing their minds. And please, do not spread misinformation.

> Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

I have never once used software I thought was actually good that was designed based on feedback from telemetry.

> Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

Their ability to make decisions doesn't matter. It is does not justify putting spyware into previously trusted software.

Also, nobody believes that excuse for a second. They couldn't care less about "improving" anything but their bottom line. They are merely capitalizing on the trustworthiness of an open source project in an attempt to extract maximum value out of its users.

If they wanted to improve the software, they would have hired somebody with good taste to work on it. People with good taste do not tolerate abusive spyware.

> Can someone fill me in on what this person could have done better?

They could have not collected any "metrics" in the first place. That way, this ridiculous privacy policy would never have been necessary.

One thing would be not violating the Open Source Definition by forbidding use by under 13s.

> Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

I don't understand the reaction either. It's hard to talk about this stuff here because of the anti-analytics groupthink. Everyone seems to jump to the worst possible conclusion whenever it's brought up.

I can't help but wonder if the people screeching about it have ever actually put analytics in their own products. Understanding how your software is used in the real world by real users is absolutely invaluable!

How about just asking people for their opinion instead of trying to somehow conclude on usage patterns and stuff from telemetry data, which is not opt-in, but opt-out, which is quite sneaky in itself?

"Just ask those people!" Is what I think every single time, when this kind of issue pops up. Ask the people what they find annoying about the product, ask them what they like. There are many questions you can ask and which yield a much more direct result than telemetry data, without upsetting a community and without coming across as sneaky and disrespectful of user privacy.

This isn't telemetry though.

I would assume it's from webserver logs. I could of course be wrong.

Logs, maybe abuse protection? For better or worse, the musescore-downloader affair has probably made them a bit pensive and defensive around potential abuse from clients.

They may also simply think that it's just plainly required if they're going to run an online service that the app connects to by default.

That's all speculation though, hopefully they'll answer that question on the GitHub discussion.

How could it be nonconsensual? The policy is provided when installing the software. This may certainly be a bad decision for the Audacity team, but nobody is being forced to use their product.

It certainly looks that way. Though in fairness, gaslighting implies the intent to deceive. I fear that these folk could actually be more of the kind that simply doesn't see anything wrong with their way of "making" money.

While technically legal (although the last about that might not have been said either), I think they are going to find out how their grubby ideas of right-and-wrong might not align at all with a substantial part of the user base of the product they now own.

I believe that they are already doing actual practical harm in some places, which might end up costing them dearly if it would trigger some kind of organized revolt. With their behavior so far, that can/will only end in escalation. I very much doubt that the plans of this new owner will become the financial success they may have imagined.

Sadly, Audacity as a product will no doubt suffer as a consequence. Still makes me wonder if there hasn't been some kind of financial support/injection by a commercial vendor involved, somehow. Of course it doesn't have to, but the idea just does not want to leave me alone.

I'd totally get a paid product like Ableton or Pro Tools if they didn't send data about me.

It really depends on what you need.

There are lots of non-FOSS but effectively-free alternatives. Ocenaudio is way better than Audacity in gobs of ways, except it's not multi-track. Reaper is pretty great but if you're hoping for commercial use with $20K+ gross/year, you need to pay $200+ USD.

In FOSS land, Zrhythm, Qtractor, LMMS...but these are DAWs so again it depends on what you were using Audacity for. You could even learn sox and maybe benefit from some command line use, like writing scripts for things you need to do all the time.

My advice: List the specific tasks you need to do, and aim to find 2-3 apps that will fill the gap. Then any extras on top of that will be gravy.

Edit: Oh and you can also use FOSS like Blender and render edited sound to mp3, or KDEnlive, or other software that's video or animation related. So if you already know those tools, or like how they work (in some ways they are pretty slick!) then they may fit better than other audio-only software.

Yep. In particular, any version of audacity from a Linux distro's package manager is likely already built with telemetry off.

depends on someone actually paying the developers because I don't think development is community driven but done by Muse.

People need to keep in mind that open source software doesn't automatically develop itself just because you can fork the code. Audacity is a pretty big, complicated piece of software.

I’m not sure the developer who manages to remove telemetry is also ready to start maintaining fast Fourier transforms…

ardour may have worded that better than the audacity folks, but make no mistake, as per it's privacy policy ardour will phone home (to check for new versions), store information about bugs and comply with requests from law enforcement.

    If you download and use a ready-to-run version of Ardour from ardour.org, the program will attempt to contact ardour.org at startup to determine if you should be notified about a new release of the software. If the computer where you use Ardour is connected to the internet, this process will store the computer's internet address and an identifier for its operating system.
    
    If you report a bug to our bug tracker, we will store whatever information you provide as part of the bug report.
    
    When Do We Privately Share Personal Data?
    
    Never, unless required to by law.

I get the feeling that the community has had enough of the corporate shenanigans, that a proper fork is about to go alive any day now.