5 ms·

Project creator here (but obviously not the OP). Yes, we do collect minimal anonymised statistics in the sole goal of improving awless. All the statistics code

by hbbio 10y ago

Project creator here (but obviously not the OP). Yes, we do collect minimal anonymised statistics in the sole goal of improving awless. All the statistics code is here: https://github.com/wallix/awless/blob/master/stats/stats.go https://github.com/wallix/awless/blob/master/stats/stats.go As the project is Apache licensed, you're free to modify it if you don't want this. Also, if you're conscious about privacy you should use application firewalls on your client side like Little Snitch etc. since many software that you install on your machine also do this.

scaryclam 10y ago
I like the look of this, so on the software side it's a thumbs up. However, the fact that the code is active at all will rule it out for some companies (firewall or not). Perhaps make it something users can turn off in a config file? Not everyone can code in go, especially if their job is as a sysadmin, which isn't unlikely given that this is an infrastructure tool, so it might not be as simple as forking and editing the code for them.
- mbreese 10y ago
  Or make it turn-off-able (?) with an environmental variable. There are a couple of ways to make the tool default to report and allowable in non-reportable environments. The key thing is to make what is happening transparent.
  - frugalmail 10y ago
    Must be an explicit "turn-on" option.
deleted 10y ago
[deleted]
ezekg 10y ago
What does the data payload look like? I'd like to see the actual data you're sending, even if it's just a mock. From digging around in the code, it looks like you're sending infra data, including instance IDs. How do I know you aren't sending my AWS access tokens[0]? [0]: https://github.com/wallix/awless/blob/e2bf4f2cad37b011c5b3b6f4850c52e57d5d77c9/stats/stats.go?ts=2#L159-L184 https://github.com/wallix/awless/blob/e2bf4f2cad37b011c5b3b6...
the_duke 10y ago
You should at least provide a prompt on first start that asks if participating in analytics collection is acceptable.
gigatexal 10y ago
A toggle at least would be nice to turn all data collection off.
frugalmail 10y ago
I appreciate that your folks released this OSS tool. However: Where I work, as long as the data collection code is in there, whether I can modify it or not, they won't allow it on our computers. I know this is not uncommon. Dismissing this concern by saying "other software does this" while awless falls into a different category (small CLI tool) is also problematic.
- fxaguessy 10y ago
  Thanks for the feedback. Until we provide a way to allow/disable data collection, we have disabled completely the data sending (see https://github.com/wallix/awless/commit/f6389e75787390bd779773a5e253bdb7a5947ddc https://github.com/wallix/awless/commit/f6389e75787390bd7797...).
godgod 10y ago
How bout you NOT collect this information. It's just creepy that this is turned on by default.

by hbbio 10y ago

scaryclam 10y ago

I like the look of this, so on the software side it's a thumbs up. However, the fact that the code is active at all will rule it out for some companies (firewall or not). Perhaps make it something users can turn off in a config file? Not everyone can code in go, especially if their job is as a sysadmin, which isn't unlikely given that this is an infrastructure tool, so it might not be as simple as forking and editing the code for them.

mbreese 10y ago
Or make it turn-off-able (?) with an environmental variable. There are a couple of ways to make the tool default to report and allowable in non-reportable environments. The key thing is to make what is happening transparent.
- frugalmail 10y ago
  Must be an explicit "turn-on" option.

deleted 10y ago

[deleted]

ezekg 10y ago

What does the data payload look like? I'd like to see the actual data you're sending, even if it's just a mock. From digging around in the code, it looks like you're sending infra data, including instance IDs. How do I know you aren't sending my AWS access tokens[0]? [0]: https://github.com/wallix/awless/blob/e2bf4f2cad37b011c5b3b6f4850c52e57d5d77c9/stats/stats.go?ts=2#L159-L184 https://github.com/wallix/awless/blob/e2bf4f2cad37b011c5b3b6...

the_duke 10y ago

You should at least provide a prompt on first start that asks if participating in analytics collection is acceptable.

gigatexal 10y ago

A toggle at least would be nice to turn all data collection off.

frugalmail 10y ago

I appreciate that your folks released this OSS tool. However: Where I work, as long as the data collection code is in there, whether I can modify it or not, they won't allow it on our computers. I know this is not uncommon. Dismissing this concern by saying "other software does this" while awless falls into a different category (small CLI tool) is also problematic.

fxaguessy 10y ago
Thanks for the feedback. Until we provide a way to allow/disable data collection, we have disabled completely the data sending (see https://github.com/wallix/awless/commit/f6389e75787390bd779773a5e253bdb7a5947ddc https://github.com/wallix/awless/commit/f6389e75787390bd7797...).

godgod 10y ago

How bout you NOT collect this information. It's just creepy that this is turned on by default.