Hacker News Reader

Comment by dantondwa | Hacker News Reader

I think there's a misunderstanding: Tantacrul, the developer with a pretty active Youtube channel, works for the Muse Group, which acquired Audacity. This has nothing to do with him. A company acquired Audacity, not him, and he's not in charge of the Muse Group. Your portraying of the whole thing is inaccurate.

People didn't lose their collective minds.

The Muse Group acquired Audacity, then introduced:

- a CLA (which, between other things, allows them to make closed source versions of Audacity)

- telemetry

- a very controversial privacy policy

People aren't losing their minds. And please, do not spread misinformation.

View on HN

Controversial? This looks extremely similar to most other privacy policies. I would urge you to read the privacy policy on any other web sites that you visit, or for any other services that you use, and compare and contrast. A good starting point might be the privacy policy on your phone's app store.

We're talking about Free Software — not about websites, services, or mobile cartels.

I'm not sure what you're suggesting the difference is, or what specifically here is a "mobile cartel?" FOSS projects and other related things also have privacy policies, and in fact you probably want them to so that they're clear what they're doing with the data they've aggregated. Here's some examples:

https://docs.github.com/en/github/site-policy/github-privacy...

https://www.debian.org/legal/privacy.en.html

https://fedoraproject.org/wiki/Legal:PrivacyPolicy

https://www.fsf.org/about/free-software-foundation-privacy-p...

Those are all talking about interacting with those projects' websites and community events, not about interacting with the software those projects produce or package. It is absolutely not the norm that Free Software running on my machine reports my usage.

Do you expect to be able to receive updates and security fixes to your installed programs? Or send back a patch or bug report? If so, then it absolutely is the norm, because all that needs to be done over the internet and can generate PII. It probably shouldn't be assumed that a distribution platform can avoid having a clear and straightforward privacy policy because it calls itself a "FOSS repo" and not an "app store." Or did I miss something? Do some people only exchange security updates and crash dumps off of physical media given in person?

> Do some people only exchange security updates and crash dumps off of physical media given in person?

Sure it's not "the norm" but personally I run a Poudriere[0] server and build all my own software packages. One server syncs the FreeBSD Ports collection and downloads the needed software source distfiles, but then none of my other machines/jails are allowed to install software from anywhere outside my own network. A lot of them don't get any Internet access at all.

That still has nothing to do with in-app analytics though.

[0] https://github.com/freebsd/poudriere/wiki

I'm still not sure what you're saying, you're still downloading the source from an external website on the internet, which I would expect would have a privacy policy, and would do things like comply with the GDPR. And presumably, the ports collection is getting the original source from upstreams, which could be on github or a similar service, so you can't sidestep that if you want to maintain your own ports tree.

It absolutely does have to do with analytics: in particular, Debian has an opt-in anayltics system called "popcon" which is mentioned in the privacy policy.

"none of my other machines/jails are allowed to install software from anywhere outside my own network. A lot of them don't get any Internet access at all."

Presumably the objective is to have machines that do not connect to the network without at least a human in the loop. This used to be the default, and is still very helpful in a lot of situations. For one, it keeps the noise down when you are trying to debug network issues.

How is Microsoft Github a FOSS project?

That FSF link relates to their site.

Audacity is an offline non-networked application.

> a CLA (which, between other things, allows them to make closed source versions of Audacity)

But all previous commits they'd build on are GPL..

Reply on news.ycombinator.com