Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft/.Net Foundation added telemetry to the dotnet command line last year

opinionatedgeek.com

Post reply on HN
Print view View original

51–60 of 101 posts

Re: Microsoft/.Net Foundation added telemetry to the dotnet command line last year

#51

Post by Sir_Cmpwn »

Though this data is more or less benine, the point remains. I don't think it's appropriate for a tool like this to phone home, and if it did, it should at least be opt-in, not opt-out (especially considering the opt-out mechanism is something as clumsy as setting an environment variable rather than a config somewhere).

This tool compiles code. Why does it need to make a network call at all? That's going to slow down your builds for the sake of phoning home to Microsoft, a company we don't exactly trust for being good stewards of our information.

Re: Microsoft/.Net Foundation added telemetry to the dotnet command line last year

#52

Post by cjsuk »

moron4hire wrote: post #36
blub wrote: post #19

Earlier quoted context omitted.

The author must not be used to the new spyware-by-default mentality coming from Microsoft. Hard to believe, but they used to sell products a while ago and had no telemetry. If you want to see how it's done properly, look at OmniGroup: their apps have toggleable telemetry and it's off by default.

What use is off-by-default? Who turns telemetry on?

This says that telemetry is the wrong solution then.

Re: Microsoft/.Net Foundation added telemetry to the dotnet command line last year

#53

Post by lightbyte »

0x0 wrote: post #45
shakna wrote: post #16

Earlier quoted context omitted.

The data is also public, at: -q .tsv" rel="nofollow">https://dotnetcli.blob.core.windows.net/usagedata/dotnet-cli... So, the latest would be: https://dotnetcli.blob.core.windows.net/usagedata/dotnet-cli...

I think it's noteworthy that they even include command line arguments that are mistyped, for example "bulid". What happens if you accidentally paste an AWS secret key or similar in the middle of a command line argument? Will that too appear in public csv files a year later?

They don't include command line arguments (yet). They include the command verb (dotnet [build/restore/etc]) that was ran.

Re: Microsoft/.Net Foundation added telemetry to the dotnet command line last year

#54

Post by cjsuk »

0x0 wrote: post #45
shakna wrote: post #16

Earlier quoted context omitted.

The data is also public, at: -q .tsv" rel="nofollow">https://dotnetcli.blob.core.windows.net/usagedata/dotnet-cli... So, the latest would be: https://dotnetcli.blob.core.windows.net/usagedata/dotnet-cli...

I think it's noteworthy that they even include command line arguments that are mistyped, for example "bulid". What happens if you accidentally paste an AWS secret key or similar in the middle of a command line argument? Will that too appear in public csv files a year later?

This is one of my objections. There are also no test cases for this piece of code either.

Re: Microsoft/.Net Foundation added telemetry to the dotnet command line last year

#55

Post by Guvante »

cjsuk wrote: post #52
moron4hire wrote: post #36

Earlier quoted context omitted.

What use is off-by-default? Who turns telemetry on?

This says that telemetry is the wrong solution then.

Why? Defaults are important and the vast majority don't care (assuming correctly selected telemetry data) and the majority can't be bothered to change the default in either case.

Again I am making a huge assumption about correctly selected telemetry data here but opt in mechanisms won't get even 10% of the data they currently do.

Re: Microsoft/.Net Foundation added telemetry to the dotnet command line last year

#56

Post by blub »

nitinreddy88 wrote: post #27
blub wrote: post #19

Earlier quoted context omitted.

The author must not be used to the new spyware-by-default mentality coming from Microsoft. Hard to believe, but they used to sell products a while ago and had no telemetry. If you want to see how it's done properly, look at OmniGroup: their apps have toggleable telemetry and it's off by default.

@blub can you explain me how it's exactly "spying on you"? There is difference between collecting information about how many people are using vs whether a particular person is using. Collecting diagnostic information from windows application failures/how many failures etc are there ever since Windows 95 era. Similarly, collecting information about how many people are using dotnet core build/test/publish is similar to…

Spyware is software collecting information about someone without their consent.

Doesn't have to be malicious, doesn't have to be what's legally defined as personal information. The fact that many companies are doing it doesn't make it less inappropriate.

Reputable companies will clearly inform users and ask for their confirmation. Then they respect their choice.

Disreputable companies such as MS or Google take without asking, use dark patterns to trick users, default to always on, reset privacy settings, etc.

Re: Microsoft/.Net Foundation added telemetry to the dotnet command line last year

#57

Post by cjsuk »

Guvante wrote: post #55
cjsuk wrote: post #52

Earlier quoted context omitted.

This says that telemetry is the wrong solution then.

Why? Defaults are important and the vast majority don't care (assuming correctly selected telemetry data) and the majority can't be bothered to change the default in either case. Again I am making a huge assumption about correctly selected telemetry data here but opt in mechanisms won't get even 10% of the data they currently do.

Defaults should respect the user first. Consent has to be given, not taken as a default.

Sure ask up front explicitly but don't in passing invoke the first capture before consent has been taken. That's a shitty tactic.

Re: Microsoft/.Net Foundation added telemetry to the dotnet command line last year

#59

Post by j_s »

vetinari wrote: post #41
nitinreddy88 wrote: post #27

Earlier quoted context omitted.

@blub can you explain me how it's exactly "spying on you"? There is difference between collecting information about how many people are using vs whether a particular person is using. Collecting diagnostic information from windows application failures/how many failures etc are there ever since Windows 95 era. Similarly, collecting information about how many people are using dotnet core build/test/publish is similar to…

Mozilla asks you, whether you want to send the telemetry. If you say no, it won't send anything. No, the settings do not mysteriously reset themselves.

Firefox tracks users with Google Analytics in the add-on settings | https://news.ycombinator.com/item?id=14753546

  "Someone submitted a PR to Mozilla to fix this, and the Mozilla devs closed it"
Impossible to opt-out until about 2 weeks ago.

Re: Microsoft/.Net Foundation added telemetry to the dotnet command line last year

#60

Post by 0x0 »

lightbyte wrote: post #53
0x0 wrote: post #45

Earlier quoted context omitted.

I think it's noteworthy that they even include command line arguments that are mistyped, for example "bulid". What happens if you accidentally paste an AWS secret key or similar in the middle of a command line argument? Will that too appear in public csv files a year later?

They don't include command line arguments (yet). They include the command verb (dotnet [build/restore/etc]) that was ran.

Well, it looks like they are including "command verbs" even if they are mistyped, for example "bulid".

What happens if you accidentally paste an AWS secret key or similar in the middle of a command verb? Will that too appear in public csv files a year later?

Post reply on HN