Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft: Require user consent before sending any telemetry

github.com

Post reply on HN
Print view View original

91–100 of 129 posts

Re: Microsoft: Require user consent before sending any telemetry

#91

Post by lloydatkinson »

LightHugger wrote: post #88
lloydatkinson wrote: post #80

Looks like the monthly “people absolutely lose their minds over VS Code telemetry”. The same people would then be complaining if VS Code crashed constantly from bugs that they also never report in place of no telemetry.

This rediculous false dichotomy of "if not for excessive telemetry it would be crashy" is so beyond reason. If it crashes just pop up the crash reporter and prompt the user with a button to send the crash report in. Done. No ethical issues there. But no apparantly you think microsoft needs a constant faucet if your information to prevent crashes. Golly i wonder how developers managed before said faucets.

[flagged]

Re: Microsoft: Require user consent before sending any telemetry

#93

Post by jen20 »

pjmlp wrote: post #75
throwaway79897 wrote: post #74

Earlier quoted context omitted.

I don't see the connection between Amazon, Facebook, and Netflix and free software.

Apparently everyone celebrates the stuff they put out into FOSS, whereas their agenda is hardly any different from Micro$oft.

In the case of Go quite recently, there was such outrage about opt-out telemetry that the proposal was walked back, and implemented (correctly) as opt-in instead.

Re: Microsoft: Require user consent before sending any telemetry

#94

Post by jen20 »

lloydatkinson wrote: post #91
LightHugger wrote: post #88

Earlier quoted context omitted.

This rediculous false dichotomy of "if not for excessive telemetry it would be crashy" is so beyond reason. If it crashes just pop up the crash reporter and prompt the user with a button to send the crash report in. Done. No ethical issues there. But no apparantly you think microsoft needs a constant faucet if your information to prevent crashes. Golly i wonder how developers managed before said faucets.

[flagged]

> How would they know if performance took a hit or any number of other issues that don’t result in a crash?

Testing, a QA team, and an opt-in bug reporting mechanism.

Re: Microsoft: Require user consent before sending any telemetry

#95

Post by pjmlp »

jen20 wrote: post #93
pjmlp wrote: post #75

Earlier quoted context omitted.

Apparently everyone celebrates the stuff they put out into FOSS, whereas their agenda is hardly any different from Micro$oft.

In the case of Go quite recently, there was such outrage about opt-out telemetry that the proposal was walked back, and implemented (correctly) as opt-in instead.

Yeah, however there have been other cases where the outrage was ignored, like on how the modules story went.

Re: Microsoft: Require user consent before sending any telemetry

#96

Post by jen20 »

pjmlp wrote: post #95
jen20 wrote: post #93

Earlier quoted context omitted.

In the case of Go quite recently, there was such outrage about opt-out telemetry that the proposal was walked back, and implemented (correctly) as opt-in instead.

Yeah, however there have been other cases where the outrage was ignored, like on how the modules story went.

Modules isn't any worse than NuGet for privacy. Neither are good, but it's hard to say the outrage was "ignored" - people bring it up constantly.

Re: Microsoft: Require user consent before sending any telemetry

#97

Post by RecycledEle »

When the owner of a device is using it, they should have the right to inspect all data on that machine in plain language and to inspect all communications to and from that machine (again in plain language.) They should have the right to stop any communications at any level they choose using plain language menus.

Re: Microsoft: Require user consent before sending any telemetry

#98

Post by alkonaut »

guappa wrote: post #87
alkonaut wrote: post #81

Earlier quoted context omitted.

Anonymous/pseudonymous telemetry doesn't necessarily require user consent other than for being polite. If you store PII you do, but if you do that you also aren't really doing anonymous/pseudonymous telemetry to begin with.

As was said elsewhere, since telemetry itself is not a functionality, ip address is personal information and requires consent.

Read the replies elsewhere. GDPR doesn’t care about whether a http request containing an IP is necessary or not. The GDPR is not in any way regulating how or why any PII is “transmitted” out of your system.

Re: Microsoft: Require user consent before sending any telemetry

#99

Post by tpush »

RecycledEle wrote: post #97

When the owner of a device is using it, they should have the right to inspect all data on that machine in plain language and to inspect all communications to and from that machine (again in plain language.) They should have the right to stop any communications at any level they choose using plain language menus.

I'd support that law.

Re: Microsoft: Require user consent before sending any telemetry

#100

Post by alkonaut »

trashtester wrote: post #82
alkonaut wrote: post #36

Earlier quoted context omitted.

Unless there is any PII associated with the pseudonym, there is nothing specifically in GDPR that says you can’t or shouldn’t do this so long as it’s not information that can identify a physical person. Note that being able to attribute multiple pieces of data to the same anonymous person does not necessarily identify them (and it’s important to not accidentally do so): It’s important though if you e.g have multiple…

You are right in the edit. The hash needs to be using a secret salt that is unavailable to any potential attacker to not be PII. You're mixing up the termso psedonymization and anononymization, though. If something provably not PII, it is considered anonymous. Psedonymization specifically means to keep the data as PII, but where the risk of misuse is reduced by making the identification hard. In practical terms, psed…

I use pseudonymization in the sense of having persistent identifiers for users/machines/etc that cannot be reversed on the server side.

Basically: just like the usernames on hn are pseudonyms it’s important they are persistent so you can follow who wrote what despite not being able to attribute posts to physical persons. That is: hn is a pseudonymous forum rather than anonymous.

The hash(localSalt + PII) is provably not PII. But it’s still making the data possible to correlate. The telemetry event I send on Monday can be attributed to the same source as the event I send on Tuesday.

Post reply on HN