When you install a compiler who's respecting your privacy, and without opt in it starts sending telemetry, you can't expect that to go well.
Now naming people like this isn't going to help either I think.
What is the privacy bait and switch? The whole idea behind "anonymous usage statistics" is that it's statistical and anonymous, so that it by definition has no privacy consequences.
If that doesn't hold up (e.g. it leaks a username, a path, anything) then there should be outrage. But this discussion isn't about that. Or about the fact that it could be worse, or have a bug.
The interesting question is: is it acceptable to have telemetry that is anonymous and statistical? And if not - why? The argument "it doesn't respect my privacy" can't apply then.
It can be called anonymous when it goes through TOR to be sent, etc… which is not even considered afaik.
If you rely on the receiving party to not store your IP and other sent details, then it’s not anonymous. Sadly, some companies get evil, get compromised or get internal threats…
And yeah, opt-in is minimum or the software is called a spyware. And yes, with this definition recent Windows is a spyware.
If you want an argument about privacy, watch the insightful talk by Halvar Flake on security vs. death squads… chilling but sadly true.
The simplest argument for this is: if you don't trust the provider then why on earth would you trust that the "no" actually means no!? The compromised or evil organization would send your data anyway. And if they are really evil they wouldn't do it as part of the telemetry they'd just exfiltrate it in whatever way necessary. That's why I think the telemetry thing is a much smaller issue than it seems when it comes to privacy. It's already blind faith.
Are the currently deployed and used versions of the go compiler going to suddenly start sending telemetry? Or is it just a future version that someone would have to deliberately upgrade to?
Personally, when a new version of golang comes out, I like to read the release notes and then adjust my build environments with the necessary environment changes for the new features.
regardless i think we should hold open source projects to higher standards, such that telemetry isn’t introduced by default.