6 ms·

For reference, they collect[1]: The command being used (for example, "build", "restore") The ExitCode of the command For test projects, the test ru

by orf 9y ago

For reference, they collect[1]: The command being used (for example, "build", "restore") The ExitCode of the command For test projects, the test runner being used The timestamp of invocation The framework used Whether runtime IDs are present in the "runtimes" node The CLI version being used I'm actually OK with this to be honest. Here is the telemetry code itself: https://github.com/dotnet/cli/blob/5a37290f24aba5d35f3f958300aa20329e5ccaa7/src/dotnet/Telemetry.cs#L92-L104 https://github.com/dotnet/cli/blob/5a37290f24aba5d35f3f95830... They also publish all the telemetry data (Change 2016 and q3): https://dotnetcli.blob.core.windows.net/usagedata/dotnet-cli-usage-2016-q3.tsv https://dotnetcli.blob.core.windows.net/usagedata/dotnet-cli... 1. https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry

Avalaxy 9y ago
So this is yet another case of someome blowing something completely out of proportions and spending their time working on something completely useless that will never benefit them.
- princekolt 9y ago
  "Out of proportions" for now. Nothing stops them from changing this later, updating the small print saying "oh we changed that" and blaming you for not checking for changes to their EULA regularly.
  - Klathmon 9y ago
    If this is your fear how do you use any software? MS could update your OS to do anything tomorrow, Canonical could hide some literal malware in any number of packages for Ubuntu tonight, Intel could write a backdoor into your machine in it's next microcode update. And OSS doesn't fully prevent this either. GCC could add some kind of nefarious exploit in the next version of it's compiler (knowingly or otherwise). Just take a look at the underhanded c competition for just how scary easy it is to hide exploits in plain sight! I can't even fathom the amount of work it would be to personally review every line of code that goes into your machine from the microcode up to the newest NPM module (even if it were all open and it was possible to do). At some point you need to trust someone else.
    - pdkl95 9y ago
      That's why betrayals of trust - such as adding spyware that takes data without the user's informed consent ("opt-out") - are such a big problem. You're right - there isn't enough time to audit everything, so we have to rely on trust. "Relying on trust" means instead of reviewing code, you have to review trustworthiness.
merb 9y ago
do you actually inspect every github commit, that this won't change?
- shakna 9y ago
  It already has. [0] [0] https://github.com/dotnet/docs/pull/2706/files https://github.com/dotnet/docs/pull/2706/files
  - pricechild 9y ago
    One of the items added: > +- Geographical location† I feel like that's one of the pieces of information I'd expect a new opt-in or notification to appear for at the very least. Did that happen?
    - merb 9y ago
      well even if they do that now, there is no guarantee that a future release will remove notifications. just look at the automotive industry in germany. if you give them trust, they probably will do shady stuff, no matter how good their initial behavior was. never trust a company.
sundvor 9y ago
Thanks. As I was scanning through the article, this is exactly what I was looking for but couldn't quite see for all the salt.
0xcoffee 9y ago
Also, when you run `dotnet restore`, you get the following message: Welcome to .NET Core! --------------------- Learn more about .NET Core @ https://aka.ms/dotnet-docs. Use dotnet --help to see available commands or go to https://aka.ms/dotnet-cli-docs. Telemetry -------------- The .NET Core tools collect usage data in order to improve your experience. The data is anonymous and does not include command-line arguments. The data is collected by Microsoft and shared with the community. You can opt out of telemetry by setting a DOTNET_CLI_TELEMETRY_OPTOUT environment variable to 1 using your favorite shell. You can read more about .NET Core tools telemetry @ https://aka.ms/dotnet-cli-telemetry. Configuring... ------------------- A command is running to initially populate your local package cache, to improve restore speed and enable offline access. This command will take up to a minute to complete and will only happen once. Sure its enabled by default, but at least they clearly notify you about it. So its strange that the author says: 'I’ve been using the dotnet core since well before then and I never knew about this.'
- blub 9y ago
  The author must not be used to the new spyware-by-default mentality coming from Microsoft. Hard to believe, but they used to sell products a while ago and had no telemetry. If you want to see how it's done properly, look at OmniGroup: their apps have toggleable telemetry and it's off by default.
  - nitinreddy88 9y ago
    @blub can you explain me how it's exactly "spying on you"? There is difference between collecting information about how many people are using vs whether a particular person is using. Collecting diagnostic information from windows application failures/how many failures etc are there ever since Windows 95 era. Similarly, collecting information about how many people are using dotnet core build/test/publish is similar to how Google/Mozilla tracks how many users are running which version of their product and experience issues. If Microsoft/Google/Mozilla or any other company uses that information to identify a specific person is "effectively spying on you". Until that's not there, the same functionality exists in almost every product. Just click bait article.
shakna 9y ago
That's not quite correct. More is collected, but the docs are still being updated. [0] The other things being collected are: * Geographical location * Operating system and version [0] https://github.com/dotnet/docs/pull/2706/files https://github.com/dotnet/docs/pull/2706/files
bjpbakker 9y ago
> For reference, they collect That's not all that matters. IMO the real decision is: do you /trust/ MS ? Do you trust that they anonymize collected data and that they won't secretly change collected data? Do you trust future MS with that information. > I'm actually OK with this to be honest That's perfectly fine if you trust them. Many people don't. Personally I wouldn't trust any dev tool that uploads my usage.
- pjmlp 9y ago
  So I assume you don't use web apps.
  - vetinari 9y ago
    These tools are not web apps. They work entirely on a local machine. Their fundamental mode of operation is not to run on a remote machine.
- FooBarWidget 9y ago
  > do you /trust/ MS ? Why do you have to trust MS? You can read the source code to check for yourself whether sensitive information is sent. You don't have to take Microsoft's word for it.
- lightbyte 9y ago
  >That's not all that matters. IMO the real decision is: do you /trust/ MS ? Do you trust that they anonymize collected data and that they won't secretly change collected data? Do you trust future MS with that information. You don't need to trust them. The telemetry code is open source AND they release the aggregate data it collects for anyone to use/inspect.
  - msla 9y ago
    If it's completely open, how do they keep it from being spammed?
- JadeNB 9y ago
  > That's not all that matters. IMO the real decision is: do you /trust/ MS ? Do you trust that they anonymize collected data and that they won't secretly change collected data? Do you trust future MS with that information. Bear with me. This seems like the wrong question, but not for the reason you might expect. Rather, I think that it might be wrong because, even if Microsoft acts in completely good faith, it is damn near impossible to anonymise collected data properly [obligatory citation of the 'anonymised' AOL search data]. It doesn't matter whether I trust someone to do something if they (probably) can't do it.
cm2187 9y ago
Well, as long as you make sure that the project name doesn't give away anything that could compete with a Microsoft product or that would leak information about some confidential product you are working on... It's not just independent devs that are using .net. And the name of the company appears often in the assembly.
grkvlt 9y ago
And, the 'secret' environment variable to disable it is actually printed in the text of the last (installation successful) dialog of the install wizard, at least on OSX for the 2.0.0 preview...

by orf 9y ago

Avalaxy 9y ago

So this is yet another case of someome blowing something completely out of proportions and spending their time working on something completely useless that will never benefit them.

princekolt 9y ago
"Out of proportions" for now. Nothing stops them from changing this later, updating the small print saying "oh we changed that" and blaming you for not checking for changes to their EULA regularly.
- Klathmon 9y ago
  If this is your fear how do you use any software? MS could update your OS to do anything tomorrow, Canonical could hide some literal malware in any number of packages for Ubuntu tonight, Intel could write a backdoor into your machine in it's next microcode update. And OSS doesn't fully prevent this either. GCC could add some kind of nefarious exploit in the next version of it's compiler (knowingly or otherwise). Just take a look at the underhanded c competition for just how scary easy it is to hide exploits in plain sight! I can't even fathom the amount of work it would be to personally review every line of code that goes into your machine from the microcode up to the newest NPM module (even if it were all open and it was possible to do). At some point you need to trust someone else.
  - pdkl95 9y ago
    That's why betrayals of trust - such as adding spyware that takes data without the user's informed consent ("opt-out") - are such a big problem. You're right - there isn't enough time to audit everything, so we have to rely on trust. "Relying on trust" means instead of reviewing code, you have to review trustworthiness.

merb 9y ago

do you actually inspect every github commit, that this won't change?

shakna 9y ago
It already has. [0] [0] https://github.com/dotnet/docs/pull/2706/files https://github.com/dotnet/docs/pull/2706/files
- pricechild 9y ago
  One of the items added: > +- Geographical location† I feel like that's one of the pieces of information I'd expect a new opt-in or notification to appear for at the very least. Did that happen?
  - merb 9y ago
    well even if they do that now, there is no guarantee that a future release will remove notifications. just look at the automotive industry in germany. if you give them trust, they probably will do shady stuff, no matter how good their initial behavior was. never trust a company.

sundvor 9y ago

Thanks. As I was scanning through the article, this is exactly what I was looking for but couldn't quite see for all the salt.

0xcoffee 9y ago

Also, when you run `dotnet restore`, you get the following message: Welcome to .NET Core! --------------------- Learn more about .NET Core @ https://aka.ms/dotnet-docs. Use dotnet --help to see available commands or go to https://aka.ms/dotnet-cli-docs. Telemetry -------------- The .NET Core tools collect usage data in order to improve your experience. The data is anonymous and does not include command-line arguments. The data is collected by Microsoft and shared with the community. You can opt out of telemetry by setting a DOTNET_CLI_TELEMETRY_OPTOUT environment variable to 1 using your favorite shell. You can read more about .NET Core tools telemetry @ https://aka.ms/dotnet-cli-telemetry. Configuring... ------------------- A command is running to initially populate your local package cache, to improve restore speed and enable offline access. This command will take up to a minute to complete and will only happen once. Sure its enabled by default, but at least they clearly notify you about it. So its strange that the author says: 'I’ve been using the dotnet core since well before then and I never knew about this.'

blub 9y ago
The author must not be used to the new spyware-by-default mentality coming from Microsoft. Hard to believe, but they used to sell products a while ago and had no telemetry. If you want to see how it's done properly, look at OmniGroup: their apps have toggleable telemetry and it's off by default.
- nitinreddy88 9y ago
  @blub can you explain me how it's exactly "spying on you"? There is difference between collecting information about how many people are using vs whether a particular person is using. Collecting diagnostic information from windows application failures/how many failures etc are there ever since Windows 95 era. Similarly, collecting information about how many people are using dotnet core build/test/publish is similar to how Google/Mozilla tracks how many users are running which version of their product and experience issues. If Microsoft/Google/Mozilla or any other company uses that information to identify a specific person is "effectively spying on you". Until that's not there, the same functionality exists in almost every product. Just click bait article.

shakna 9y ago

That's not quite correct. More is collected, but the docs are still being updated. [0] The other things being collected are: * Geographical location * Operating system and version [0] https://github.com/dotnet/docs/pull/2706/files https://github.com/dotnet/docs/pull/2706/files

bjpbakker 9y ago

> For reference, they collect That's not all that matters. IMO the real decision is: do you /trust/ MS ? Do you trust that they anonymize collected data and that they won't secretly change collected data? Do you trust future MS with that information. > I'm actually OK with this to be honest That's perfectly fine if you trust them. Many people don't. Personally I wouldn't trust any dev tool that uploads my usage.

pjmlp 9y ago
So I assume you don't use web apps.
- vetinari 9y ago
  These tools are not web apps. They work entirely on a local machine. Their fundamental mode of operation is not to run on a remote machine.
FooBarWidget 9y ago
> do you /trust/ MS ? Why do you have to trust MS? You can read the source code to check for yourself whether sensitive information is sent. You don't have to take Microsoft's word for it.
lightbyte 9y ago
>That's not all that matters. IMO the real decision is: do you /trust/ MS ? Do you trust that they anonymize collected data and that they won't secretly change collected data? Do you trust future MS with that information. You don't need to trust them. The telemetry code is open source AND they release the aggregate data it collects for anyone to use/inspect.
- msla 9y ago
  If it's completely open, how do they keep it from being spammed?
JadeNB 9y ago
> That's not all that matters. IMO the real decision is: do you /trust/ MS ? Do you trust that they anonymize collected data and that they won't secretly change collected data? Do you trust future MS with that information. Bear with me. This seems like the wrong question, but not for the reason you might expect. Rather, I think that it might be wrong because, even if Microsoft acts in completely good faith, it is damn near impossible to anonymise collected data properly [obligatory citation of the 'anonymised' AOL search data]. It doesn't matter whether I trust someone to do something if they (probably) can't do it.

cm2187 9y ago

Well, as long as you make sure that the project name doesn't give away anything that could compete with a Microsoft product or that would leak information about some confidential product you are working on... It's not just independent devs that are using .net. And the name of the company appears often in the assembly.

grkvlt 9y ago

And, the 'secret' environment variable to disable it is actually printed in the text of the last (installation successful) dialog of the install wizard, at least on OSX for the 2.0.0 preview...