Hacker News Reader

Comment by tlackemann | Hacker News Reader

I don't understand the pettiness around this issue.

Audacity needed a maintainer to help with support and development. Developer, who has a pretty active YouTube channel covering design in music software, takes interest and leads the project. Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

Can someone fill me in on what this person could have done better? Honestly, it seems like pearl-clutching from a select group of users who never gave a shit in the first place and just want to whine about something they never contributed to and get to use for free.

View on HN

I think there's a misunderstanding: Tantacrul, the developer with a pretty active Youtube channel, works for the Muse Group, which acquired Audacity. This has nothing to do with him. A company acquired Audacity, not him, and he's not in charge of the Muse Group. Your portraying of the whole thing is inaccurate.

People didn't lose their collective minds.

The Muse Group acquired Audacity, then introduced:

- a CLA (which, between other things, allows them to make closed source versions of Audacity)

- telemetry

- a very controversial privacy policy

People aren't losing their minds. And please, do not spread misinformation.

> a CLA (which, between other things, allows them to make closed source versions of Audacity)

But all previous commits they'd build on are GPL..

Controversial? This looks extremely similar to most other privacy policies. I would urge you to read the privacy policy on any other web sites that you visit, or for any other services that you use, and compare and contrast. A good starting point might be the privacy policy on your phone's app store.

We're talking about Free Software — not about websites, services, or mobile cartels.

I'm not sure what you're suggesting the difference is, or what specifically here is a "mobile cartel?" FOSS projects and other related things also have privacy policies, and in fact you probably want them to so that they're clear what they're doing with the data they've aggregated. Here's some examples:

https://docs.github.com/en/github/site-policy/github-privacy...

https://www.debian.org/legal/privacy.en.html

https://fedoraproject.org/wiki/Legal:PrivacyPolicy

https://www.fsf.org/about/free-software-foundation-privacy-p...

Those are all talking about interacting with those projects' websites and community events, not about interacting with the software those projects produce or package. It is absolutely not the norm that Free Software running on my machine reports my usage.

Do you expect to be able to receive updates and security fixes to your installed programs? Or send back a patch or bug report? If so, then it absolutely is the norm, because all that needs to be done over the internet and can generate PII. It probably shouldn't be assumed that a distribution platform can avoid having a clear and straightforward privacy policy because it calls itself a "FOSS repo" and not an "app store." Or did I miss something? Do some people only exchange security updates and crash dumps off of physical media given in person?

> Do some people only exchange security updates and crash dumps off of physical media given in person?

Sure it's not "the norm" but personally I run a Poudriere[0] server and build all my own software packages. One server syncs the FreeBSD Ports collection and downloads the needed software source distfiles, but then none of my other machines/jails are allowed to install software from anywhere outside my own network. A lot of them don't get any Internet access at all.

That still has nothing to do with in-app analytics though.

[0] https://github.com/freebsd/poudriere/wiki

I'm still not sure what you're saying, you're still downloading the source from an external website on the internet, which I would expect would have a privacy policy, and would do things like comply with the GDPR. And presumably, the ports collection is getting the original source from upstreams, which could be on github or a similar service, so you can't sidestep that if you want to maintain your own ports tree.

It absolutely does have to do with analytics: in particular, Debian has an opt-in anayltics system called "popcon" which is mentioned in the privacy policy.

"none of my other machines/jails are allowed to install software from anywhere outside my own network. A lot of them don't get any Internet access at all."

Presumably the objective is to have machines that do not connect to the network without at least a human in the loop. This used to be the default, and is still very helpful in a lot of situations. For one, it keeps the noise down when you are trying to debug network issues.

How is Microsoft Github a FOSS project?

That FSF link relates to their site.

Audacity is an offline non-networked application.

I think if you read the comments in the link, it's pretty clear: changes regarding personal information were dumped on the community along with a bunch of legalese without warning, an announcement, or context. Had the new maintainers given the community a heads up via a simple blog post explaining the reasoning behind this, we wouldn't be where we are. Hopefully they can chalk this off as a learning experience and move forward to gain trust of the community.

You missed: project purchased by ad-heavy website owner (ultimateguitar).

As for how they could make it better: make it opt-in not opt-out.

This is the kind of toxic behaviour we all tolerate from commercial software, but people get mad when it leaks into open source.

An example of the problem is that in the UK those below 13yo cannot give consent to telemetry. Audacity is used in their public schooling system. Newer versions of Audacity will not be usable by those students anymore.

Roughly.

So they just don't consent to it? The telemetry certainly isn't mandatory; it isn't even enabled by default from what I can tell.

There was no opt-out. Minors were asked not to use the app.

Here is the link towards the Privacy notice on the 2nd of July. https://archive.fo/d3LBR#selection-673.0-673.129

Asked not to is different from forbidden though, no? I’m not a legal expert but I doubt this clause is one they wanted to put in and is probably driven by some legal counsel with an eye on international law.

lawyers do what they’re told. This is the acquiring company maximizing the value of their acquisition by any means possible.

In this case, children 12 and below cannot give consent but they can use the app if parental consent is given.

Having children in that age range use the app would require Audacity to seek parental consent by "[making] reasonable efforts (taking into account the available technology and risks inherent in the processing) to verify that the person providing consent holds parental responsibility for the child."1

While they wrote to minors "please do not use the App", they also wrote "The App we provide is not intended for individuals below the age of 13."2 Not being a lawyer, I cannot talk about the implications of these passages.

src1: https://ico.org.uk/for-organisations/guide-to-data-protectio... src2: link in my parent comment

The specific situation being pointed out here is that the software is/was used in public schools. It doesn't really fit in the category of "if nobody knows, nobody cares, and nobody wants to know" that you'll find on your on personal device.

The school installing software that has terms not allowing those under 13 to use it, because those kids don't have the legal right to consent to the software collecting information from them, has a very real chance of becoming an issue - both for the school and whoever made the decision.

It sounds like any Internet use by children in schools would be a legal issue, then. If IP addresses are considered personally identifiable information subject to consent policies, then ordinary web logging is data collection that a child can not consent to.

A more direct example would be in Chrome/Firefox/etc automatically checking for updates, which is the equivalent of what Audacity describes in the linked post.

> It sounds like any Internet use by children in schools would be a legal issue, then. If IP addresses are considered personally identifiable information subject to consent policies, then ordinary web logging is data collection that a child can not consent to.

It's not going to happen for all kinds of reasons, but there's a lot that could be said in favour of prohibiting _unsupervised_ Internet access to children 12 and under.

> Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

I have never once used software I thought was actually good that was designed based on feedback from telemetry.

How would you know though? Telemetry is so common in desktop and web apps alike that you're probably surrounded by it.

It's only common in certain bubbles. Someone who primarily uses FOSS could easily say this. Someone who prefers software created in the era before online telemetry was widespread could also say this.

Seems to have only picked up in the last decade or so. Before that it wasn't really practical, and everything seemed to work fine without it.

When I was a kid, computers weren't connected to the internet. The first time I had a connection it was at 33.6 kbit/s (at 25 cents per minute).

Can you imagine if I had had all these 'modern' programs on my computer that would suddenly try to talk over that tiny straw of a connection? It'd be unusable!

There are still a lot of reasons why you would like to maybe hope that a computer doesn't try to randomly talk to everyone and everything on the intertubes on a whim.

For instance: said computer might be acting as a firewall, or it's being used for SCADA, needs to comply with corporate or government security policy, or is otherwise supposed to be something-gapped.

I guess for regular consumer technology that hope has long fled. You'd think that floss software could automatically be trusted to be quiet-by-default, but I guess that time is now past as well.

Possibly software that is quiet-by-default needs to start explicitly noting that it is so; so that if you have a particular task that really needs a quiet-by-default machine, you can draw from that subset.

You are right that audacity probably doesn't need to be in the quiet-by-default category. But ...eh... somehow this feels like a retreat.

> Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

Their ability to make decisions doesn't matter. It is does not justify putting spyware into previously trusted software.

Also, nobody believes that excuse for a second. They couldn't care less about "improving" anything but their bottom line. They are merely capitalizing on the trustworthiness of an open source project in an attempt to extract maximum value out of its users.

If they wanted to improve the software, they would have hired somebody with good taste to work on it. People with good taste do not tolerate abusive spyware.

> Can someone fill me in on what this person could have done better?

They could have not collected any "metrics" in the first place. That way, this ridiculous privacy policy would never have been necessary.

How about just asking people for their opinion instead of trying to somehow conclude on usage patterns and stuff from telemetry data, which is not opt-in, but opt-out, which is quite sneaky in itself?

"Just ask those people!" Is what I think every single time, when this kind of issue pops up. Ask the people what they find annoying about the product, ask them what they like. There are many questions you can ask and which yield a much more direct result than telemetry data, without upsetting a community and without coming across as sneaky and disrespectful of user privacy.

Exactly! And if you really need any sort of "telemetry" to get the data that you need, then do what so many other FOSS software I've seen with any sort of "phone home features" does, and simply ask the user during the first run if it's okay to send <such and such data> for development purposes. (Also, a toggle in the preferences is always nice, too, so that I can enable such a feature on days I'm feeling particularly helpful, and still easily disable it on days I'm feeling like there's no need for my software to be sending data anywhere outside my network.)

It's not uncommon for me to approve such features when I'm dealing with software I trust, and when I'm thoroughly informed of exactly what data they're collecting and why. If I see a list of reasonable data points and it's not too intrusive or overreaching (and if I can examine the data before it's sent) then I'm quite often okay with it (again, with software I already trust for other reasons).

One thing would be not violating the Open Source Definition by forbidding use by under 13s.

https://www.independent.co.uk/life-style/gadgets-and-tech/au...

> Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

I don't understand the reaction either. It's hard to talk about this stuff here because of the anti-analytics groupthink. Everyone seems to jump to the worst possible conclusion whenever it's brought up.

I can't help but wonder if the people screeching about it have ever actually put analytics in their own products. Understanding how your software is used in the real world by real users is absolutely invaluable!

The reason people jump to the worst possible conclusion is the same reason that people often do: because abuse is rampant. And sometimes that's why we can't have nice things, because too many people have misbehaved while using them.

Assuming integrity, I think the people complaining about it would indeed do unto others as they would have others do unto themselves. That is to say: not include telemetry.

Reply on news.ycombinator.com