Telemetry settings in Kibana | Hacker News Reader

Telemetry settings in Kibana

elastic.co

37 pointsaendruk40 comments

Not sure if i'm missing something, however both Grafana and InfluxDB also default to sending data back:

https://grafana.com/docs/grafana/latest/setup-grafana/config... https://docs.influxdata.com/influxdb/v1.8/administration/con...

So... by default, i assume whatever i'm using is spying on me, until proven otherwise - and yes, that's kinda depressing...

(and one more reason to use something like Pi-Hole to have at least some attempt to throw a wrench into that practice)

I guess the point is opt-in by definition implies a default to false. This is opt-out. Even worse is the existence of allowChangingOptInStatus which completely contradicts the meanings of both opt-in and opt-out.

> allowChangingOptInStatus which completely contradicts the meanings of both opt-in and opt-out

I could imagine a sysadmin wanting to prevent users from enabling telemetry from the web interface by setting allowChangingOptInStatus to false and telemetry.optIn to false. That's not bad, especially since allowChangingOptInStatus is true by default.

(IIUC)

I work at Grafana Labs, and this isn't an official statement by any means, just my personal perspective, but we pretty much need some type of tracking to hold us accountable and get a general idea of how widely Grafana is deployed.

You can actually see exactly what is tracked here https://github.com/grafana/grafana/blob/main/pkg/infra/usage... and beyond basic statistics we collect an anonymous ID which is a random UUID which we have no way to correlate back to the running instance (and which can easily be reset).

Might be an unpopular opinion around here, but I think that a random software vendor collecting anonymous basic usage statistics (user XXXXXXXXXXXX runs version a.b.c, with plugins z,w.e.y enabled) is not spying on you, and is totally justified. You and others like you are trivialising the much closer to spying on you done by data hoarders like Facebook, Google, TikTok, and the actual spying done by NSA, CIA, MI6, etc. etc. by lumping everything together. Usage statistics are super important, especially for freemium (open source with optional Enterprise) software. It's not like they have any other way of knowing which feature is actually used, needs improvement, can be safely deprecated, etc.

Would I prefer for it to be opt-in? Yes. Do I understand why they would default to collection considering close to nobody would go out of their way to enable it? Yes.

I think what you missed is this situation being described as “opt in”, a new low.

This is the kind of stuff that makes me want to use Debian packages built by Debian, and not the official binaries / Docker images.

I know Debian usually sets sane defaults. For instance, a Chromium or a Firefox packaged by Debian is less likely to phone home without asking / telling you on first use.

I vaguely recall gnome phoning home, not sure if this happens on debian.

Source please. "Vaguely recall" is not anything you should write on the internet.

I block traffic on new installs and track down all connection attempts.

I had to do: gsettings set org.gnome.software download-updates false

unfortunately I only have evidence ubuntu needed this turned on, not sure about arch and debian.

https://help.gnome.org/users/gnome-packagekit/stable/auto-up...

This post had its title changed from "telemetry.optIn defaults to true" (which is the headline) to "Telemetry settings in Kibana" which is somewhat useless as a headline. What's the big deal?

"Telemetry settings in Kibana" indicates that it is about telemetry settings in Kibana. Which is what the article is.

"telemetry.optIn defaults to true" indicates that some setting, somewhere out in the world, defaults telemetry to true. It's a clickbait title.

Poster should have titled it "Kibana Telemetry Is Opt-out" if they wanted it to be a proper title.

OP's problem is not about telemetry. Their problem was exactly what the title meant, "Opt-in" means user should make it true if they need, instead they have an opt-out with a name opt-in.

Imagine buying wipes labelled wipes, but they were actually dry tissues.

Precisely, thank you.

It’s not about Kibana, or telemetry, or telemetry being opt-out. It’s about exactly what I copied from the page for lack of a deep link: the opt-out setting is deceitfully named opt-in.

It's more than just that it's opt-out - It's that the setting is even named 'opt in', while not being opt in at all.

Enabling by default this setting is quite annoying from the point of view of the user... But, from the point of view of the software developer, the choice is not so easy: You decide to either be totally blind on the usage of your software or you jump into the exact situation they are in in this comment thread: piss of people.

At least they choose to let us opt out easily, no?

> At least they choose to let us opt out easily, no?

Everybody does. Even MS and Google tools. I would say it's the bare minimum.

IIRC you can't opt out completely from sending telemetry in Windows. Your choices are "basic" and "full", or something similar.

Ah, right, hadn't thought of Windows, I was thinking about dotnet and other MS (open source) cli stuff I read about.

Opt out via environment variables (like dotnet requires) is hardly "easy" and it's quite fragile.

I think it's more about the naming. OptIn doesn't really suggest that it would be true by default. It being named telemetry.optOut and being set to false by default would make more sense.

Or, how about: telemetry.enabled?

Exactly. As in many cases in life, "Criticism is easy, and art is difficult." :)

What about if you would just... ask? I usually allow sending telemetry back if I'm asked nicely and the reason is explained well.

Cough, is this even legal under GDPR?

There is no personal information, only an anonymous identifier and usage information of a specific tool only, so GDPR doesn't come into play.

Shouldn't it be telemetry.optOut if the default is to send telemetry? Seems misleading.

Perhaps, that's the intention. In that case, telemetry.notOptOut would have been a better choice.

Yep, or telemetry.enabled

If you are not going to use the meaning of "opt-in" or "opt-out", you might as well keep things simple.

Or go the usual Microsoft route:

1. First have an telemetry.opt-out setting with the default value of "false".

2. Wait a few versions and then switch to telemetry.enabled with a default value of "true". And then just ignore the old setting, don't migrate it.

"To prevent users from changing it, set telemetry.allowChangingOptInStatus to false."

This is would be entertaining if it weren't simultaneously depressing.

(this comment was meaningful with the initial HN title, saying that telemetry.optIn was true by default)

Thanks.

Looks like the title on HN was changed to something which misses the entire point of the post.

What's the problem? There's a large popup with the info after a fresh deploy. They need usage data to shape the product.

Unless you investigate this, and keep investigating it continuously, you can't know what information they are exfiltrating from your system intentionally or unintentionally. "Shaping the product" should not require this kind of behavior.

Are there any good alternatives to Kibana?

The last time I was looking into ELK stack for centralised logs, I was trying to see if there was a better way to do it, but though many alternatives existed for ElasticSearch and Logstash parts of it, the UI - Kibana stood out as a blocker with no alternatives. Does anyone know of one?

Grafana is a fork of Kibana is the open source viable alternative to Kibana.

I've been working on one: log-store.com It has a DB built-in that is schema-less, but it's really the frontend I've been trying to focus on, as I think the interface to Kibana is poor.

The submitted title was “telemetry.optIn defaults to true”, which is verbatim text from the page.

The changed title has mislead readers into missing the point; top comments are now a generic discussion of telemetry itself and don’t even acknowledge the discrepancy between the setting name and behavior.

Reply on news.ycombinator.com