Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Console Do Not Track – Proposal for a standard environment variable

consoledonottrack.com

Post reply on HN
Print view View original

311–320 of 352 posts

Re: Console Do Not Track – Proposal for a standard environment variable

#311

Post by hnlmorg »

KMnO4 wrote: post #218
hnlmorg wrote: post #52

Earlier quoted context omitted.

I don't see why both solutions can't co-exist. If DO_NOT_TRACK suppresses the honest software (of which should be the majority you have installed anyway) then you have fewer applications left to manage manually / less network noise to identify and black. Saying an imperfect solution is worthless is a little like throwing the baby out with the bath water.

> If DO_NOT_TRACK suppresses the honest software Ahh, my big issue is that I don’t mind tracking in genuinely honest software. Want to know how many people are still running your app on 32-bit machines and that’s it? Be my guest! It does seem like DO_NOT_TRACK isn’t supporting honest software, though. I can’t enable it for Audacity and disable it for Homebrew, for example.

Sure you can:

    brew() {
        unset DO_NOT_TRACK
        $(which brew) $*
    }
Or if you just want it enabled for specific applications:

    alias brew="DO_NOT_TRACK=1 brew"

Re: Console Do Not Track – Proposal for a standard environment variable

#312

Post by sneak »

fouric wrote: post #307
sneak wrote: post #268

Earlier quoted context omitted.

Without obtaining advance consent? Yes, because that would be spyware.

I completely disagree with your definition of spyware. A crash report, absent any PII, is not spyware to me, and does not require my advance consent to be sent. You're entitled to your own definition, of course, but I hope that for the good of society as a whole, you and people with your tyrannical/authoritarian attitude toward issues that can (usually) be resolved civilly with never hold positions of power.

Crash reports contain memory dumps, and private information.

Additionally, they disclose client IP when submitting, which is city-level geolocation of a user of a particular piece of software.

They're fine if you get advance consent from the user before transmitting. Sending the contents of memory (especially after a crash, where it contains by definition unexpected things) is a serious security issue/data leak, if done automatically.

My position is the opposite of authoritarian: it's that these sorts of interactions should happen only with the full, informed, advance consent of both parties involved. Authoritarian is a good way to describe devs who feel completely entitled to all information about their software running on computers which they do not own or have any rights to.

Re: Console Do Not Track – Proposal for a standard environment variable

#313

Post by [deleted] »

Seirdy wrote: post #292
notatoad wrote: post #212

Earlier quoted context omitted.

>it's on the developers of the software to make these settings granular and off-by-default. why? privacy advocates in these discusssions always jump to this position and assume everybody is going to agree just because they've invoked the magic p-word. telemetry is useful, and most people don't really care enough to change the defaults one way or the other. assuming that "because privacy" is not an argument that will…

> assuming that "because privacy" is not an argument that will sway me, can you explain why i should default to the less-useful option just for the sake of appeasing the people most likely to change the defaults? No, I can't. I think that ethical principles like respect for users' privacy are more important than collecting data to fix bugs/features. Shareholders may disagree, of course; this is where developer agency…

[deleted]

Re: Console Do Not Track – Proposal for a standard environment variable

#314

Post by [deleted] »

Seirdy wrote: post #292
notatoad wrote: post #212

Earlier quoted context omitted.

>it's on the developers of the software to make these settings granular and off-by-default. why? privacy advocates in these discusssions always jump to this position and assume everybody is going to agree just because they've invoked the magic p-word. telemetry is useful, and most people don't really care enough to change the defaults one way or the other. assuming that "because privacy" is not an argument that will…

> assuming that "because privacy" is not an argument that will sway me, can you explain why i should default to the less-useful option just for the sake of appeasing the people most likely to change the defaults? No, I can't. I think that ethical principles like respect for users' privacy are more important than collecting data to fix bugs/features. Shareholders may disagree, of course; this is where developer agency…

[deleted]

Re: Console Do Not Track – Proposal for a standard environment variable

#315

Post by dredmorbius »

yoz-y wrote: post #95
TeMPOraL wrote: post #66

Sure. But I have a question: why ? Why should we opt out of the telemetry? To me, this idea seems to not just be admitting defeat, it's ensuring defeat right from the start. Telemetry should always be opt-in. Yes, that means vendors will get much less data. It's on them to deal with it. On a related note, I wonder how long it takes until one of the vendors of popular CLI tools or desktop apps get fined for GDPR viola…

I'll play the devil's advocate. Most people will shoot support e-mails at you which are more or less "app crashes". If you have not already encountered the problem you have to walk them through tedious debugging process. If you collect crash reports, you have probably already fixed the problem. For usage data, it allows developers to focus on features that matter and know which ones you can remove. For example I don'…

Telemetry alone doesn't tell you how valuable a given functionality is. A critical problem, one imposed through the tyranny of the minimum viable user,[1] is that the high value creator community of any tool or service is going to be small. Quite often 1%, if a very small fraction of that.

Your telemetry data will show you only that such features see little use. They won't tell you how much value is derived from that use, or what the effects of removing such functionality will be on the suitability and viability of your application.

Default telemetry is demonstrable harm for negative gains.

________________________________

Notes:

1. See: https://old.reddit.com/r/dredmorbius/comments/69wk8y/the_tyr...

Re: Console Do Not Track – Proposal for a standard environment variable

#316

Post by imiric »

sneak wrote: post #267
imiric wrote: post #127

Earlier quoted context omitted.

The thing is opt-in telemetry doesn't work. Few people will actively choose to enable it, even if they read the documentation and are aware of it. I think we should distinguish benign uses of telemetry from tracking that collects invasive details about the environment the app is running in. A popular CLI open source project I use has telemetry enabled by default. The authors are upfront about the data it collects and…

"Behaving ethically wouldn't work for us, so we decided to behave unethically" is not a legitimate viewpoint.

Who is the ethics arbiter in that quote?

"Submitting anonymous usage data in order to build a better product" sure sounds legitimate to me.

Re: Console Do Not Track – Proposal for a standard environment variable

#317

Post by oytis »

notatoad wrote: post #212
Seirdy wrote: post #200

Earlier quoted context omitted.

Lots of people in the Free Software community think that programs should exist only to help the user, and should just do exactly what the user tells them to do and nothing else. I am one of those people. Showing ads, making network requests that aren't necessary to carry out the expected functionality, etc. all fall under violations of that principle. Some violations are worse than others, but I treat them the same w…

>it's on the developers of the software to make these settings granular and off-by-default. why? privacy advocates in these discusssions always jump to this position and assume everybody is going to agree just because they've invoked the magic p-word. telemetry is useful, and most people don't really care enough to change the defaults one way or the other. assuming that "because privacy" is not an argument that will…

It's not even about privacy, it's the basic ethical principle that you should ask for consent before doing something to me. It is a command line tool that I run on my machine, why should it be allowed to what I didn't ask it to in the first place?

Developers might think telemetry a good thing - then decent ones would care to convince the user that it's a good thing too. Some users will agree, some will not, but asking is just a basic act of respect and decency.

Re: Console Do Not Track – Proposal for a standard environment variable

#318

Post by fouric »

sneak wrote: post #312
fouric wrote: post #307

Earlier quoted context omitted.

I completely disagree with your definition of spyware. A crash report, absent any PII, is not spyware to me, and does not require my advance consent to be sent. You're entitled to your own definition, of course, but I hope that for the good of society as a whole, you and people with your tyrannical/authoritarian attitude toward issues that can (usually) be resolved civilly with never hold positions of power.

Crash reports contain memory dumps, and private information. Additionally, they disclose client IP when submitting, which is city-level geolocation of a user of a particular piece of software. They're fine if you get advance consent from the user before transmitting. Sending the contents of memory (especially after a crash, where it contains by definition unexpected things) is a serious security issue/data leak, if d…

> Crash reports contain memory dumps, and private information.

No, they don't. You're ascribing characteristics to them that they do not have. Maybe your crash reports have memory dumps and private information in them, but that means that they're poorly-engineered - there's nothing about a crash report that requires it to have that information in it. This should be clear to you, because you're a programmer.

> Additionally, they disclose client IP when submitting, which is city-level geolocation of a user of a particular piece of software.

Most people, including me, do not care about city-level geolocation information - and for those that do, Tor or a pastebin service are options. Again, you're ascribing certain characteristics to crash reports that they do not have, and you should know better, because you're a programmer, and being a privacy...enthusiast, you're certainly familiar with Tor.

> They're fine if you get advance consent from the user before transmitting.

...which leads to far less crash report data, insecure systems due to disabled auto-update, and selection bias in your telemetry data.

> Sending the contents of memory (especially after a crash, where it contains by definition unexpected things) is a serious security issue/data leak, if done automatically.

More assumptions that are false. Who said that a crash report has to contain a memory dump? A stack trace, complete with annotations that allow private data to be redacted, is both a useful crash report and will not leak any personal information.

> My position is the opposite of authoritarian

I was referring to an earlier comment you made:

> That is another website on my to-do list: one that names and shames spyware developers who create these commits.

This is authoritarian. Or tyrannical, if you like. The syntax doesn't matter - what matters is that you're attempting to use your power as an individual to try to impose your own beliefs on the majority. Beliefs which, by the way, are not held by the majority.

> Authoritarian is a good way to describe devs who feel completely entitled to all information about their software running on computers which they do not own or have any rights to.

This is blatantly false. You're perfectly free to not run any of this software - there's no "authoritarian" going on. You are free to rewrite whatever software you want, or, because most of the interesting stuff is open-source, fork it and remove the telemetry bits. Let me state it again: developers building some functionality into a tool is not authoritarian, as long as the user isn't compelled to use the software in the first place (which is true the overwhelming majority of the time).

You, meanwhile, are trying to force other people to change the software that they have been writing, according to your own whims. That's authoritarian.

Re: Console Do Not Track – Proposal for a standard environment variable

#319

Post by yunohn »

naikrovek wrote: post #272
yunohn wrote: post #84

Earlier quoted context omitted.

> "please donate, I'm not rich enough yet" Who do you feel entitled enough to judge someone’s humble request for a donation, despite them developing the free software that you use often enough to be annoyed by it?

if they wanted to be paid, would they not release as a product, instead of releasing as open source? "hey I'm gonna give away my time and effort for free" is not how you get money. it's how you get geek cred or build up a resume or whatever. all fine, of course. do what you want. if you want to charge for your code, charge for it and stop asking for donations every time I clone or build your stuff. have a donation bu…

This is a very steamed and unfair rant; it really seems like you don’t understand how little FOSS work makes, and how little money is ever donated to most or any projects.

I don’t know who hurt you in FOSS, but you sound really mean.

Post reply on HN