Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transparent telemetry for open-source projects

research.swtch.com

Post reply on HN
Print view View original

41–50 of 314 posts

Re: Transparent telemetry for open-source projects

#41

Post by JohnFen »

Spivak wrote: post #36
groestl wrote: post #19

Earlier quoted context omitted.

> If people don't like it they can turn it off If I, perchance, encounter software I use phoning home without my explicit permission it's done on my systems. Period.

Well according to our telemetry 0% of users turn it off so it seems pretty popular. But more realistically what you gain in privacy you give up in having your voice heard by the devs. The decisions about the future of the product/project will be driven by the data, specifically the data from the kind of people who leave telemetry on.

If 0% of your users disable it, that kind of screams there's something wrong with your opt-out mechanism. Is it broken? Hidden? Difficult to do?

I mean, with any group of people, there will always be a percentage that will disable it. If the telemetry is popular, that percentage might be very small, but it would be non-zero.

Re: Transparent telemetry for open-source projects

#42

Post by JohnFen »

mananaysiempre wrote: post #14
userbinator wrote: post #3

Nope, nope, and more nope. You're not moving the Overton Window any more on me. In fact it seems there's a clear correlation between the quality of software and how much spyware there is embedded in it. It's often merely another way to justify unpopular changes with "but the data says so". IMHO if you want to collect any information, it should never be anything but opt-in, a conscious decision.

> IMHO if you want to collect any information, it should never be anything but opt-in, a conscious decision. Serious (general) question: How do you do that given a non-technical user population? Debian’s opt-in popcon kind of manages to get a little bit of data from a fairly technical one, but nowhere near enough to estimate a low usage frequency, and it’s the only opt-in program I’m aware of that gets anything usabl…

What I hear you saying here is that people don't do what you want if you give them the choice, so you lean towards not giving them the choice rather than respecting their wishes.

Is my interpretation correct?

Re: Transparent telemetry for open-source projects

#43

Post by Arnavion »

I haven't worked with golang in some time. How do golang devs generally obtain the compiler?

If you're getting it from distro repos, it should be straightforward to convince the distro package maintainer to disable the telemetry / patch it out.

Or is it a nvm/pyenv/rustup situation where you prefer to use bespoke toolchain managers to download upstream's compilers?

Re: Transparent telemetry for open-source projects

#44

Post by rom-antics »

mananaysiempre wrote: post #14
userbinator wrote: post #3

Nope, nope, and more nope. You're not moving the Overton Window any more on me. In fact it seems there's a clear correlation between the quality of software and how much spyware there is embedded in it. It's often merely another way to justify unpopular changes with "but the data says so". IMHO if you want to collect any information, it should never be anything but opt-in, a conscious decision.

> IMHO if you want to collect any information, it should never be anything but opt-in, a conscious decision. Serious (general) question: How do you do that given a non-technical user population? Debian’s opt-in popcon kind of manages to get a little bit of data from a fairly technical one, but nowhere near enough to estimate a low usage frequency, and it’s the only opt-in program I’m aware of that gets anything usabl…

Ask for consent during setup or on first run. Syncthing does this and they get plenty of usable data. It's even public: https://data.syncthing.net/

Re: Transparent telemetry for open-source projects

#46

Post by rsc »

JohnFen wrote: post #38
rsc wrote: post #27

Earlier quoted context omitted.

I am concerned about run-time telemetry in libraries as well. It might make sense for language ecosystems to offer more data about library usage gathered at build time eventually, as a different system than the one I'm posting about today. I think when you get to that level of detail you probably need to start thinking hard about differential privacy and probably cryptographic solutions like ESA or Prio. I don't thin…

Telemetry embedded in libraries is simply abusive, in my opinion. At the very least, the decision about whether or not to include telemetry should be made by the application developers, not the toolmakers.

Right. My hope would be that language tooling offering library developers visibility into compile-time information about library usage would reduce their desire to insert run-time collection instead.

Re: Transparent telemetry for open-source projects

#48

Post by vineyardmike »

slimsag wrote: post #23

I've been a pretty strong advocate of the idea that analytics should always be minimal, 100% anonymous, aggregated, and open to the public - otherwise it’s spying. This is how we do analytics on our websites today[0][1], and how we plan to do it in games we release in the future. Maybe one day I will start a dedicated FOSS service that people can use for exactly this with some trusted reputation/transparency/auditabi…

> the authors want to know 'is this popular? can we deprecate XYZ method?'

This is something that was common for internal libraries at some of the places I've worked. I'm honestly a little surprised it isn't a thing we see externally. I for sure do not want to see it, but I'm surprised we don't. Its probably enough to look at the public usage on GitHub, and make inferences and post notice on future-major-versions of libraries. Github honestly should make a tool to do this, they'd have a huge opportunity to inspect the data.

Re: Transparent telemetry for open-source projects

#49

Post by jwilk »

JohnFen wrote: post #41
Spivak wrote: post #36

Earlier quoted context omitted.

Well according to our telemetry 0% of users turn it off so it seems pretty popular. But more realistically what you gain in privacy you give up in having your voice heard by the devs. The decisions about the future of the product/project will be driven by the data, specifically the data from the kind of people who leave telemetry on.

If 0% of your users disable it, that kind of screams there's something wrong with your opt-out mechanism. Is it broken? Hidden? Difficult to do? I mean, with any group of people, there will always be a percentage that will disable it. If the telemetry is popular, that percentage might be very small, but it would be non-zero.

I think you missed the joke.

Re: Transparent telemetry for open-source projects

#50

Post by groestl »

Spivak wrote: post #36
groestl wrote: post #19

Earlier quoted context omitted.

> If people don't like it they can turn it off If I, perchance, encounter software I use phoning home without my explicit permission it's done on my systems. Period.

Well according to our telemetry 0% of users turn it off so it seems pretty popular. But more realistically what you gain in privacy you give up in having your voice heard by the devs. The decisions about the future of the product/project will be driven by the data, specifically the data from the kind of people who leave telemetry on.

See, I _am_ a dev. I run telemetry on my infrastructure, I analyse it and fix what's broken, and if necessary, try and get upstream fixed. Also, I'm not opposed to telemetry in general, but if a switch like this is turned on by default, trust is broken for good.

Software which does any type of computing without it's user's informed consent is classifiable as malware, mind you.

Post reply on HN