13 ms·

.NET core spies on users by default

250 points by Ice_cream_suit 9y ago

Ice_cream_suit 9y ago
Leaks data from production servers to a Microsoft run network. What fun.... "Behavior The telemetry feature is on by default. You can opt-out of the telemetry feature by setting an environment variable DOTNET_CLI_TELEMETRY_OPTOUT (e.g. export on OS X/Linux, set on Windows) to true (e.g. “true”, 1). Doing this will stop the collection process from running."
- transverse 9y ago
  I can also opt out by not using or running Microsoft junk in the first place. Cheers.
  - philliphaydon 9y ago
    What MS junk?
    - transverse 9y ago
      dot NET core, for example. Considering it's basically spyware, it definitively qualifies as junk.
      - ChicagoDave 9y ago
        Really? Spyware? Really?
        flukus 9y ago
        From wikipedia: https://en.wikipedia.org/wiki/Spyware https://en.wikipedia.org/wiki/Spyware > Spyware is software that aims to gather information about a person or organization without their knowledge, that may send such information to another entity without the consumer's consent, or that asserts control over a device without the consumer's knowledge This fits the bill, it's gathering information without consent and sending it to another entity. Most of what I'm sure you'd consider real spyware is collecting statistical information for "legitimate" market research companies, not sniffing for credit card numbers. At least the have the decency to use dark UI patterns or long EULA's to get consent.
        ChicagoDave 9y ago
        FUD pure and simple. Please read about the actual telemetry and the warning you get on first use. I'm sensing a weird anti-Microsoft push in this thread and it's about 10+ years late. MS is about as open and friendly as it gets for being a large corporation.
        musage 9y ago
        Microsoft never really owned up to any of it. If you trust them, I cannot trust you.
        ChicagoDave 9y ago
        I'd argue their actions speak volumes. They open-sourced nearly all of their platform and made it component-based so you don't need bloat for all solutions. They've made .NET core completely cross-platform, even on MacOS. There are community versions of their development tools and even a completely free text editor that many non-MS developers love. These actions are a direct admission that their previous monopolistic practices were bad for business and that the blue ocean philosophy is beneficial to everyone.
        musage 9y ago
        > These actions are a direct admission that their previous monopolistic practices were bad for business Yes, and? When a butter thief finally stops stealing butter it's a direct admission that the butter shop security is catching them too often and beating them too hard. But there is no direct bridge from that direct admission to the direct admission of wrongdoing. You're giving them forgiveness for what they did not repent of in clear terms that make backpedaling impossible. Your call.
        philliphaydon 9y ago
        Living in the past I see. I used to hate Apple. They made crap products. First gen iPod was a junk item. Now I own an iPhone because it’s a good product. I stopped living in the past. Because hate it baggage, Life is too short to be pissed Off all the time. It just isn’t worth it.
- Rohansi 9y ago
  Is running dev tools (compilers etc) on production servers a thing? I have always built on my machine (or build server) and then deployed to production.
  - tren 9y ago
    That's the way to do it, use a build server, deploy with something like Octopus to production.
- deleted 9y ago
  [deleted]
caleblloyd 9y ago
It also tells you that telemetry is enabled and gives you instructions to disable it the first time you run the `dotnet` command. Just like any other tool that automatically checks the telemetry box for you. You just need to use an environment variable instead of a checkbox in this case because it is server software.
- oblio 9y ago
  If I'm reading the comments right, it sends some stuff during installation. So before you can do anything.
  - sitharus 9y ago
    It uses an environment variable, you can set that before running the installer.
    - flukus 9y ago
      Only if you know about it prior to installation. Opt-out is simply never acceptable and it should be considered spyware until it's fixed. I can't believe there are so many apologists for this sort of behavior. All that's missing is hiding the information in a basement, without stairs and a sign saying "beware of the tiger".
      - gatmne 9y ago
        You bring up a good point. Software shouldn't start sending information until the user is explicitly informed just as users are required to explicitly consent to an EULA. Otherwise it's the software that's using the user and not the other way around.
      - electricEmu 9y ago
        > Only if you know about it prior to installation. This is a piece of third party software. "Should be" doesn't override reading the manual and knowing what you're installing.
cafxx 9y ago
My first reaction was "if you're really worried about accidental/malicious exfiltration I'm sure you're running your servers WITHOUT unfiltered outbound access to the internet, RIGHT?"
- api 9y ago
  You're right, but at the same time you should not have to. Software should be secure by default.
  - cafxx 9y ago
    Software is buggy by default. That alone is enough to require you to not run with unfiltered access, if you really care about minimizing security risks. And if you do it (and you should) then this story doesn't affect you. I agree though that transparency about data collection is important, especially for building trust.
paxys 9y ago
It collects redacted usage data for dotnet development commands - e.g. dotnet restore for package management - not run a backdoor on your production servers like the title implies. If you scroll down the thread you'll see that it doesn't even collect arguments you pass to the commands. If you think that npm or any other tool you use doesn't do the same you are delusional.
- 4lch3m1st 9y ago
  Well, it is an opt-out feature, which is already a way to purposely collect data if you're not playing attention enough. Plus, if npm has such flaw, this is still no excuse for Core to do the same.
hoodoof 9y ago
I'm sure this recently discussed on HN.
jacobmischka 9y ago
Fear mongering, it's relatively benign telemetry. Also needs (2016).
- transverse 9y ago
  That's not for you to decide. It's meant to be the user's call.
  - svick 9y ago
    It is. You're informed about it and you can opt-out.
- dang 9y ago
  Thanks, we added the year.
  - pmontra 9y ago
    It started in 2016 but it's not over. There are comments from a few minutes ago, maybe because of this HN thread, and tales of things that went wrong recently. Example: a failed HIPAA inspection. I'd take the year away, not to make people think it's not relevant anymore.
    - dang 9y ago
      Ok, we've taken it out.
j_s 9y ago
Yes, that is correct. Not sure what triggered this renewal of the campaign on the part of the opposition. Maybe this post on today's Microsoft discussion (re: Windows Phone abandoned)? https://news.ycombinator.com/item?id=15434859 https://news.ycombinator.com/item?id=15434859 Microsoft/.Net Foundation added telemetry to the dotnet command line last year | https://news.ycombinator.com/item?id=14836737 https://news.ycombinator.com/item?id=14836737 (Jul 2017)
- cjsuk 9y ago
  I’ve been at it for a while. I’ve learned that if you want something to change you don’t let it go.
  - socrates666 9y ago
    ... that's not absolutely right. There is way more than simply "don't let go."
mappu 9y ago
Visual Studio Code also has opt-out telemetry enabled by default, with no warning (that i've seen). https://code.visualstudio.com/docs/supporting/faq#_how-to-disable-telemetry-reporting https://code.visualstudio.com/docs/supporting/faq#_how-to-di...
- jve 9y ago
  People don't read TOS, Agree the terms and then complain. If this kind of privacy is really important for people, they should at least read TOS. https://code.visualstudio.com/license https://code.visualstudio.com/license > DATA. The software may collect information about you and your use of the software, and send that to Microsoft. Microsoft may use this information to provide services and improve our products and services. There may also be some features in the software that enable you to collect data from users of your applications. If you use these features to enable data collection in your applications, you must comply with applicable law, including providing appropriate notices to users of your applications. You can learn more about data collection and use in the help documentation and the privacy statement at http://go.microsoft.com/fwlink/?LinkID=528096&clcid=0x409 http://go.microsoft.com/fwlink/?LinkID=528096&clcid=0x409. Your use of the software operates as your consent to these practices.
gatmne 9y ago
Extremely disappointing. First we had to keep a close eye on our browsers, now we have to keep track of our text editors, dev tools, operating system, and even our own hardware. if we're really lucky, some will have some obscure way of limiting it. Making you job easier and improving your product are not valid excuses for this kind of despicable behavior. When I set up my next dev machine, everything will be sandboxed or the entire machine air-gaped. Some developers and software vendors can no longer be trusted.
- transverse 9y ago
  There is an easier solution, at least a partial one. Just don't use Microsoft crap.
- svick 9y ago
  > if we're really lucky, some will have some obscure way of limiting it. In this case, it tells you how to completely turn it off the first time you use it.
chris_wot 9y ago
"FYI: Microsoft The fact that this is an opt-out vs. opt-in and the opt-out procedure is based upon an env. var. just caused dotnet to fail an externally conducted HIPAA privacy/security audit at a genome testing lab in the backyard of your main campus. Lucky for us, we were able to convert the runtime to use Mono and get a temporary pass, but this killed the future CIL-based projects with the lab's management..." Ouch!
- erk__ 9y ago
  Would you no be able to build a version with the telemetry disabled?
  - sundvor 9y ago
    Yeah, not exactly super hard to find the info: https://github.com/dotnet/cli/pull/2145 https://github.com/dotnet/cli/pull/2145 "There is a way to opt-out of the telemetry gathering process by setting an environment variable DOTNET_CLI_TELEMETRY_OPTOUT. Doing this will stop the collection process from running. "
  - manigandham 9y ago
    But why? It's a single environment variable to turn it off. That HIPPA comment raises more questions about their dev practices if they're running dev SDKs on production servers or can't set a single env variable.
- deleted 9y ago
  [deleted]
manigandham 9y ago
Lots of FUD as usual with these topics. The .NET Core CLI/SDK dev tool to build and package code is the only thing sending telemetry. It's not the main `dotnet` command itself nor anything in the runtime. The data is also available for anyone to analyze: https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry It's definitely nothing out of the ordinary and is common practice among many tools and apps you already use. Your smartphone sends back way more data if you're that concerned. There's also a warning the first time you use it, and if you're using something like this then it's a reasonable expectation that as a software developer you understand the message and how to disable it if you want to. EDIT: the insights based on this telemetry are also interesting to look at and add further clarity: https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve...
- bhrgunatha 9y ago
  > Lots of FUD as usual with these topics. > It's definitely nothing out of the ordinary and is common practice among many tools and apps you already use. Also as usual it's opt-out and NOT opt-in. People get riled because (usually) a) built in telemetry is almost always an unexpected and unannounced change - only to be discovered later. b) opt-in is the only approach that leaves your trust in tact - everyone uses opt-out because they know the majority of users people will not choose to opt in given a choice.
  - manigandham 9y ago
    I don't see how it's unexpected when you get a message telling you when you first run it - and the only thing to do with this tool is to run commands explicitly. Most apps are opt-out though, the checkboxes are already checked and a message shown. I agree that it would be easier to just enter an option on the command line instead of typing the environment variable option.
    - flukus 9y ago
      > I don't see how it's unexpected when you get a message telling you when you first run it - and the only thing to do with this tool is to run commands explicitly. What about when it's run through VS or some other tool that hides much of the text? How does it know that I've read this information when it could be buried in several thousand lines of output from itself and other tools like make or msbuild? Being explicit about opt-out is even less acceptable for command line tools than it is GUI based ones.
quickben 9y ago
To all the posters saying it's harmless. What's your stance on your source code being uploaded on crashes while you develop your app with new IP in it?
- throwaway-1102 9y ago
  All of this can be "shut off" through options during install and first usage.
  - quickben 9y ago
    I accept that point. I also raise a counter point of Microsoft overwriting privacy customization such as that, on subsequent updates, regularly.
- Gaelan 9y ago
  Do you have any evidence that this occurs? It doesn't seem to appear in MS's documentation.
  - jabot 9y ago
    If you have a debug build the source is included automatically (as debug information). MS reserves the right to look at memory dumps and crashed binaries "to improve the customer experience" or something... Take these two things together, and... you lose your source code :-(
    - Gaelan 9y ago
      (Assuming this is true) That’s Win10, not .NET. That would happen regardless of the telemetry discussed here.
    - Quarrelsome 9y ago
      if you genuinely fear this then go build tons of drivel and make it crash giving them too much to look at. The idea that MS are busy analysing arbitrary crashing code really suggests they have more time on their hands than sense. Getting people to read code is expensive as fuck.
Gaelan 9y ago
Is there any reason this matters? Besides the automatic reaction of "data = evil" that I'm seeing, I see no reason why it even remotely matters that this data gets out.* I see no practical way MS could benefit from this other than by improving the open source project. Maybe if they reallly wanted to they could link your IP to a Facebook/Google account so you could get ads for developer tools? Is there actually a good reason to turn this off? * I'm assuming MS is being honest about what they're collecting in their documentation. If someone has evidence that their sources/binaries say something different, feel free to bring it up.
- jabot 9y ago
  > I see no practical way MS could benefit from this other than by improving the open source project. Then why don't they make it opt in? > Is there actually a good reason to turn this off? Security. In the sense of "enable only needed features, to reduce attack surface". Of course it would be even better to not have it turned on by default in the first place. Microsoft comes from a place of being automatically distrusted by a lot of people, and for good reason. It may seem unfair to you, but they have to conduct better than this to make up for this disadvantage.
  - Gaelan 9y ago
    > Then why don't they make it opt in? Perhaps because they think it is a reasonable default that few people will want to change (vocal minorities and all that)? Curious if anybody who does opt-in telemetrics has stats on first-time downloads vs telemetry enables. > Security. In the sense of "enable only needed features, to reduce attack surface". I’d assume that the attack surface here is pretty small (HTTPS request via the standard mechanism, ignore the response). If .NET HTTPS APIs are broken, we’ve got bigger problems. At the end of the day, everything is a cost/benefit, and it seems like this is something pretty hard to get wrong + pretty large tangible benefit for the project.
    - saiya-jin 9y ago
      Where in the cave do your work in? Every single employer of mine in last 12 years (insurance, telco, army, car industry, finance etc) this would be a complete showstopper for any utilization, not even for tiny little dev server. Losing vast amounts of potential wealthy customers for gaining some already highly controversial and at the end mostly useless data gathering is plain stupid. No nicer way around it. And vocal minorities are devs here who often decide which stack to use on new projects. Don't underestimate power of internet in this, not in 2017.
cjsuk 9y ago
Summary of the key problems: 1. Microsoft won’t engage with customers on removal of this even if it causes problems. 2. The feature fires off before it informs you. 3. We don’t trust Microsoft after they turned their platform into a data gathering and leak risk. 4. This spans more than just windows as a platform so the assumption that opt out is OK is leaking onto privacy respecting platforms. 5. This is resurrected because it’s still being fought. 6. No one else does this. This is new and we don’t want the assumption that it’s ok to go forward any more than it has. 7. Steamrolling opinion is not how you treat customers. That’s how you lose them. Microsoft are doing a big platform push for tooling I.e SQL server, powershell, VScode etc and we’re making it known that when in Rome, do as Romans do. A lot of younger users will be used to telemetry as a feature and are not sensitive to it. This does however pretty much kill the product for healthcare, finance and defence sectors. In my case this signifies the end of a 15 year investment of my life in a platform.
- MarkSweep 9y ago
  How does this “kill the product for healthcare, finance and defence sectors”? This is part of the SDK tooling, it should not installed or run in the deployment evnvironment. (If teletmetry is bad, running “dotnet restore” to download code from the internet is worse). If having telemetry in the development environment is bad too, then so was the “Visual Studio Customer Experience Program”. While that was opt-in, I would think that if telemetry was so dangerous that precautions would be taken to prevent it from being turned on. Precautions that would be at least as difficult as setting an environmental variable.
  - flukus 9y ago
    > How does this “kill the product for healthcare, finance and defence sectors”? This is part of the SDK tooling, it should not installed or run in the deployment evnvironment. This will also be installed in places like the build server that may have extra permissions into the production environment. Often the firewall between production and development won't be as great as you think and all software has to be compliant because the developers will be dealing with real private data. > If teletmetry is bad, running “dotnet restore” to download code from the internet is worse "dotnet restore" could be hitting a local repository only, which is much more common in these environments. > If having telemetry in the development environment is bad too, then so was the “Visual Studio Customer Experience Program”. Typically it would be disabled, but things slip through the cracks, no matter how many precautions there are, which is why off by default is important. Aside from that, it kills trust. The developers don't even understand that this is a privacy violation and refuse to fix it, so when the next thing on the slippery slope comes along I don't expect them to appreciate the ramifications of it. Will compiler error codes be considered telemetry? How about exceptions? How about code metrics? I can't trust the dotnetcore developers to respect privacy.
bitmapbrother 9y ago
From the people that brought you Gmail man these hypocrites never cease to amaze. The telemetry they're sending back from their OS wasn't enough so now they're sending telemetry from their language tools - unless, of course, the user proactively turns it off which they probably never do because their not directly told about the data collection.
wjd2030 9y ago
This title is very misleading... The code is open source. And it is NOT spying on the user. I understand an opt-in model is typically preferred. This title is about as click-bait-esque as it gets though.
youdontknowtho 9y ago
I know that this subject is super important to some people on this site, but it literally tells you when you execute the command how to turn it off. Also, the thread seems to have people from MS (the core team) actively soliciting feedback and wanting to work with users. They published a blog post before they started collecting telemetry, so it wasn't unannounced. There are lots of ways that this could be worse. Maybe we shouldn't slap their hand when they are doing a pretty good job? I can see how this is still completely unacceptable if you are a privacy maximalist, but most people aren't.
- socrates666 9y ago
  There is no real evidence that something substantive is coming out of this feature. It definitely seems to be doing more harm than good.
  - youdontknowtho 9y ago
    What do you base that on?
throw2016 9y ago
Maybe we should change the name of the industry from software to spyware.
mmgutz 9y ago
It's mind-boggling that people here are equating smartphones, browsers to development utilities. This is not something I would expect in Go, node, ruby ... but it's OK because it's .NET build utilities? How is that FUD?
yahna 9y ago
.NET core collects telemetry. This isn't really any different than loads of other applications, but it's microsoft instead of google so booo hiss evil evil evil.

Leaks data from production servers to a Microsoft run network. What fun.... "Behavior The telemetry feature is on by default. You can opt-out of the telemetry feature by setting an environment variable DOTNET_CLI_TELEMETRY_OPTOUT (e.g. export on OS X/Linux, set on Windows) to true (e.g. “true”, 1). Doing this will stop the collection process from running."

transverse 9y ago
I can also opt out by not using or running Microsoft junk in the first place. Cheers.
- philliphaydon 9y ago
  What MS junk?
  - transverse 9y ago
    dot NET core, for example. Considering it's basically spyware, it definitively qualifies as junk.
    - ChicagoDave 9y ago
      Really? Spyware? Really?
      - flukus 9y ago
        From wikipedia: https://en.wikipedia.org/wiki/Spyware https://en.wikipedia.org/wiki/Spyware > Spyware is software that aims to gather information about a person or organization without their knowledge, that may send such information to another entity without the consumer's consent, or that asserts control over a device without the consumer's knowledge This fits the bill, it's gathering information without consent and sending it to another entity. Most of what I'm sure you'd consider real spyware is collecting statistical information for "legitimate" market research companies, not sniffing for credit card numbers. At least the have the decency to use dark UI patterns or long EULA's to get consent.
        ChicagoDave 9y ago
        FUD pure and simple. Please read about the actual telemetry and the warning you get on first use. I'm sensing a weird anti-Microsoft push in this thread and it's about 10+ years late. MS is about as open and friendly as it gets for being a large corporation.
        musage 9y ago
        Microsoft never really owned up to any of it. If you trust them, I cannot trust you.
        ChicagoDave 9y ago
        I'd argue their actions speak volumes. They open-sourced nearly all of their platform and made it component-based so you don't need bloat for all solutions. They've made .NET core completely cross-platform, even on MacOS. There are community versions of their development tools and even a completely free text editor that many non-MS developers love. These actions are a direct admission that their previous monopolistic practices were bad for business and that the blue ocean philosophy is beneficial to everyone.
        musage 9y ago
        > These actions are a direct admission that their previous monopolistic practices were bad for business Yes, and? When a butter thief finally stops stealing butter it's a direct admission that the butter shop security is catching them too often and beating them too hard. But there is no direct bridge from that direct admission to the direct admission of wrongdoing. You're giving them forgiveness for what they did not repent of in clear terms that make backpedaling impossible. Your call.
        philliphaydon 9y ago
        Living in the past I see. I used to hate Apple. They made crap products. First gen iPod was a junk item. Now I own an iPhone because it’s a good product. I stopped living in the past. Because hate it baggage, Life is too short to be pissed Off all the time. It just isn’t worth it.
Rohansi 9y ago
Is running dev tools (compilers etc) on production servers a thing? I have always built on my machine (or build server) and then deployed to production.
- tren 9y ago
  That's the way to do it, use a build server, deploy with something like Octopus to production.
deleted 9y ago
[deleted]

caleblloyd 9y ago

It also tells you that telemetry is enabled and gives you instructions to disable it the first time you run the `dotnet` command. Just like any other tool that automatically checks the telemetry box for you. You just need to use an environment variable instead of a checkbox in this case because it is server software.

oblio 9y ago
If I'm reading the comments right, it sends some stuff during installation. So before you can do anything.
- sitharus 9y ago
  It uses an environment variable, you can set that before running the installer.
  - flukus 9y ago
    Only if you know about it prior to installation. Opt-out is simply never acceptable and it should be considered spyware until it's fixed. I can't believe there are so many apologists for this sort of behavior. All that's missing is hiding the information in a basement, without stairs and a sign saying "beware of the tiger".
    - gatmne 9y ago
      You bring up a good point. Software shouldn't start sending information until the user is explicitly informed just as users are required to explicitly consent to an EULA. Otherwise it's the software that's using the user and not the other way around.
    - electricEmu 9y ago
      > Only if you know about it prior to installation. This is a piece of third party software. "Should be" doesn't override reading the manual and knowing what you're installing.

cafxx 9y ago

My first reaction was "if you're really worried about accidental/malicious exfiltration I'm sure you're running your servers WITHOUT unfiltered outbound access to the internet, RIGHT?"

api 9y ago
You're right, but at the same time you should not have to. Software should be secure by default.
- cafxx 9y ago
  Software is buggy by default. That alone is enough to require you to not run with unfiltered access, if you really care about minimizing security risks. And if you do it (and you should) then this story doesn't affect you. I agree though that transparency about data collection is important, especially for building trust.

paxys 9y ago

It collects redacted usage data for dotnet development commands - e.g. dotnet restore for package management - not run a backdoor on your production servers like the title implies. If you scroll down the thread you'll see that it doesn't even collect arguments you pass to the commands. If you think that npm or any other tool you use doesn't do the same you are delusional.

4lch3m1st 9y ago
Well, it is an opt-out feature, which is already a way to purposely collect data if you're not playing attention enough. Plus, if npm has such flaw, this is still no excuse for Core to do the same.

hoodoof 9y ago

I'm sure this recently discussed on HN.

jacobmischka 9y ago

Fear mongering, it's relatively benign telemetry. Also needs (2016).

transverse 9y ago
That's not for you to decide. It's meant to be the user's call.
- svick 9y ago
  It is. You're informed about it and you can opt-out.
dang 9y ago
Thanks, we added the year.
- pmontra 9y ago
  It started in 2016 but it's not over. There are comments from a few minutes ago, maybe because of this HN thread, and tales of things that went wrong recently. Example: a failed HIPAA inspection. I'd take the year away, not to make people think it's not relevant anymore.
  - dang 9y ago
    Ok, we've taken it out.

j_s 9y ago

Yes, that is correct. Not sure what triggered this renewal of the campaign on the part of the opposition. Maybe this post on today's Microsoft discussion (re: Windows Phone abandoned)? https://news.ycombinator.com/item?id=15434859 https://news.ycombinator.com/item?id=15434859 Microsoft/.Net Foundation added telemetry to the dotnet command line last year | https://news.ycombinator.com/item?id=14836737 https://news.ycombinator.com/item?id=14836737 (Jul 2017)

cjsuk 9y ago
I’ve been at it for a while. I’ve learned that if you want something to change you don’t let it go.
- socrates666 9y ago
  ... that's not absolutely right. There is way more than simply "don't let go."

mappu 9y ago

Visual Studio Code also has opt-out telemetry enabled by default, with no warning (that i've seen). https://code.visualstudio.com/docs/supporting/faq#_how-to-disable-telemetry-reporting https://code.visualstudio.com/docs/supporting/faq#_how-to-di...

jve 9y ago
People don't read TOS, Agree the terms and then complain. If this kind of privacy is really important for people, they should at least read TOS. https://code.visualstudio.com/license https://code.visualstudio.com/license > DATA. The software may collect information about you and your use of the software, and send that to Microsoft. Microsoft may use this information to provide services and improve our products and services. There may also be some features in the software that enable you to collect data from users of your applications. If you use these features to enable data collection in your applications, you must comply with applicable law, including providing appropriate notices to users of your applications. You can learn more about data collection and use in the help documentation and the privacy statement at http://go.microsoft.com/fwlink/?LinkID=528096&clcid=0x409 http://go.microsoft.com/fwlink/?LinkID=528096&clcid=0x409. Your use of the software operates as your consent to these practices.

gatmne 9y ago

Extremely disappointing. First we had to keep a close eye on our browsers, now we have to keep track of our text editors, dev tools, operating system, and even our own hardware. if we're really lucky, some will have some obscure way of limiting it. Making you job easier and improving your product are not valid excuses for this kind of despicable behavior. When I set up my next dev machine, everything will be sandboxed or the entire machine air-gaped. Some developers and software vendors can no longer be trusted.

transverse 9y ago
There is an easier solution, at least a partial one. Just don't use Microsoft crap.
svick 9y ago
> if we're really lucky, some will have some obscure way of limiting it. In this case, it tells you how to completely turn it off the first time you use it.

chris_wot 9y ago

"FYI: Microsoft The fact that this is an opt-out vs. opt-in and the opt-out procedure is based upon an env. var. just caused dotnet to fail an externally conducted HIPAA privacy/security audit at a genome testing lab in the backyard of your main campus. Lucky for us, we were able to convert the runtime to use Mono and get a temporary pass, but this killed the future CIL-based projects with the lab's management..." Ouch!

erk__ 9y ago
Would you no be able to build a version with the telemetry disabled?
- sundvor 9y ago
  Yeah, not exactly super hard to find the info: https://github.com/dotnet/cli/pull/2145 https://github.com/dotnet/cli/pull/2145 "There is a way to opt-out of the telemetry gathering process by setting an environment variable DOTNET_CLI_TELEMETRY_OPTOUT. Doing this will stop the collection process from running. "
- manigandham 9y ago
  But why? It's a single environment variable to turn it off. That HIPPA comment raises more questions about their dev practices if they're running dev SDKs on production servers or can't set a single env variable.
deleted 9y ago
[deleted]

manigandham 9y ago

Lots of FUD as usual with these topics. The .NET Core CLI/SDK dev tool to build and package code is the only thing sending telemetry. It's not the main `dotnet` command itself nor anything in the runtime. The data is also available for anyone to analyze: https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry It's definitely nothing out of the ordinary and is common practice among many tools and apps you already use. Your smartphone sends back way more data if you're that concerned. There's also a warning the first time you use it, and if you're using something like this then it's a reasonable expectation that as a software developer you understand the message and how to disable it if you want to. EDIT: the insights based on this telemetry are also interesting to look at and add further clarity: https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve...

bhrgunatha 9y ago
> Lots of FUD as usual with these topics. > It's definitely nothing out of the ordinary and is common practice among many tools and apps you already use. Also as usual it's opt-out and NOT opt-in. People get riled because (usually) a) built in telemetry is almost always an unexpected and unannounced change - only to be discovered later. b) opt-in is the only approach that leaves your trust in tact - everyone uses opt-out because they know the majority of users people will not choose to opt in given a choice.
- manigandham 9y ago
  I don't see how it's unexpected when you get a message telling you when you first run it - and the only thing to do with this tool is to run commands explicitly. Most apps are opt-out though, the checkboxes are already checked and a message shown. I agree that it would be easier to just enter an option on the command line instead of typing the environment variable option.
  - flukus 9y ago
    > I don't see how it's unexpected when you get a message telling you when you first run it - and the only thing to do with this tool is to run commands explicitly. What about when it's run through VS or some other tool that hides much of the text? How does it know that I've read this information when it could be buried in several thousand lines of output from itself and other tools like make or msbuild? Being explicit about opt-out is even less acceptable for command line tools than it is GUI based ones.

quickben 9y ago

To all the posters saying it's harmless. What's your stance on your source code being uploaded on crashes while you develop your app with new IP in it?

throwaway-1102 9y ago
All of this can be "shut off" through options during install and first usage.
- quickben 9y ago
  I accept that point. I also raise a counter point of Microsoft overwriting privacy customization such as that, on subsequent updates, regularly.
Gaelan 9y ago
Do you have any evidence that this occurs? It doesn't seem to appear in MS's documentation.
- jabot 9y ago
  If you have a debug build the source is included automatically (as debug information). MS reserves the right to look at memory dumps and crashed binaries "to improve the customer experience" or something... Take these two things together, and... you lose your source code :-(
  - Gaelan 9y ago
    (Assuming this is true) That’s Win10, not .NET. That would happen regardless of the telemetry discussed here.
  - Quarrelsome 9y ago
    if you genuinely fear this then go build tons of drivel and make it crash giving them too much to look at. The idea that MS are busy analysing arbitrary crashing code really suggests they have more time on their hands than sense. Getting people to read code is expensive as fuck.

Gaelan 9y ago

Is there any reason this matters? Besides the automatic reaction of "data = evil" that I'm seeing, I see no reason why it even remotely matters that this data gets out.* I see no practical way MS could benefit from this other than by improving the open source project. Maybe if they reallly wanted to they could link your IP to a Facebook/Google account so you could get ads for developer tools? Is there actually a good reason to turn this off? * I'm assuming MS is being honest about what they're collecting in their documentation. If someone has evidence that their sources/binaries say something different, feel free to bring it up.

jabot 9y ago
> I see no practical way MS could benefit from this other than by improving the open source project. Then why don't they make it opt in? > Is there actually a good reason to turn this off? Security. In the sense of "enable only needed features, to reduce attack surface". Of course it would be even better to not have it turned on by default in the first place. Microsoft comes from a place of being automatically distrusted by a lot of people, and for good reason. It may seem unfair to you, but they have to conduct better than this to make up for this disadvantage.
- Gaelan 9y ago
  > Then why don't they make it opt in? Perhaps because they think it is a reasonable default that few people will want to change (vocal minorities and all that)? Curious if anybody who does opt-in telemetrics has stats on first-time downloads vs telemetry enables. > Security. In the sense of "enable only needed features, to reduce attack surface". I’d assume that the attack surface here is pretty small (HTTPS request via the standard mechanism, ignore the response). If .NET HTTPS APIs are broken, we’ve got bigger problems. At the end of the day, everything is a cost/benefit, and it seems like this is something pretty hard to get wrong + pretty large tangible benefit for the project.
  - saiya-jin 9y ago
    Where in the cave do your work in? Every single employer of mine in last 12 years (insurance, telco, army, car industry, finance etc) this would be a complete showstopper for any utilization, not even for tiny little dev server. Losing vast amounts of potential wealthy customers for gaining some already highly controversial and at the end mostly useless data gathering is plain stupid. No nicer way around it. And vocal minorities are devs here who often decide which stack to use on new projects. Don't underestimate power of internet in this, not in 2017.

cjsuk 9y ago

Summary of the key problems: 1. Microsoft won’t engage with customers on removal of this even if it causes problems. 2. The feature fires off before it informs you. 3. We don’t trust Microsoft after they turned their platform into a data gathering and leak risk. 4. This spans more than just windows as a platform so the assumption that opt out is OK is leaking onto privacy respecting platforms. 5. This is resurrected because it’s still being fought. 6. No one else does this. This is new and we don’t want the assumption that it’s ok to go forward any more than it has. 7. Steamrolling opinion is not how you treat customers. That’s how you lose them. Microsoft are doing a big platform push for tooling I.e SQL server, powershell, VScode etc and we’re making it known that when in Rome, do as Romans do. A lot of younger users will be used to telemetry as a feature and are not sensitive to it. This does however pretty much kill the product for healthcare, finance and defence sectors. In my case this signifies the end of a 15 year investment of my life in a platform.

MarkSweep 9y ago
How does this “kill the product for healthcare, finance and defence sectors”? This is part of the SDK tooling, it should not installed or run in the deployment evnvironment. (If teletmetry is bad, running “dotnet restore” to download code from the internet is worse). If having telemetry in the development environment is bad too, then so was the “Visual Studio Customer Experience Program”. While that was opt-in, I would think that if telemetry was so dangerous that precautions would be taken to prevent it from being turned on. Precautions that would be at least as difficult as setting an environmental variable.
- flukus 9y ago
  > How does this “kill the product for healthcare, finance and defence sectors”? This is part of the SDK tooling, it should not installed or run in the deployment evnvironment. This will also be installed in places like the build server that may have extra permissions into the production environment. Often the firewall between production and development won't be as great as you think and all software has to be compliant because the developers will be dealing with real private data. > If teletmetry is bad, running “dotnet restore” to download code from the internet is worse "dotnet restore" could be hitting a local repository only, which is much more common in these environments. > If having telemetry in the development environment is bad too, then so was the “Visual Studio Customer Experience Program”. Typically it would be disabled, but things slip through the cracks, no matter how many precautions there are, which is why off by default is important. Aside from that, it kills trust. The developers don't even understand that this is a privacy violation and refuse to fix it, so when the next thing on the slippery slope comes along I don't expect them to appreciate the ramifications of it. Will compiler error codes be considered telemetry? How about exceptions? How about code metrics? I can't trust the dotnetcore developers to respect privacy.

bitmapbrother 9y ago

From the people that brought you Gmail man these hypocrites never cease to amaze. The telemetry they're sending back from their OS wasn't enough so now they're sending telemetry from their language tools - unless, of course, the user proactively turns it off which they probably never do because their not directly told about the data collection.

wjd2030 9y ago

This title is very misleading... The code is open source. And it is NOT spying on the user. I understand an opt-in model is typically preferred. This title is about as click-bait-esque as it gets though.

youdontknowtho 9y ago

I know that this subject is super important to some people on this site, but it literally tells you when you execute the command how to turn it off. Also, the thread seems to have people from MS (the core team) actively soliciting feedback and wanting to work with users. They published a blog post before they started collecting telemetry, so it wasn't unannounced. There are lots of ways that this could be worse. Maybe we shouldn't slap their hand when they are doing a pretty good job? I can see how this is still completely unacceptable if you are a privacy maximalist, but most people aren't.

socrates666 9y ago
There is no real evidence that something substantive is coming out of this feature. It definitely seems to be doing more harm than good.
- youdontknowtho 9y ago
  What do you base that on?

throw2016 9y ago

Maybe we should change the name of the industry from software to spyware.

mmgutz 9y ago

It's mind-boggling that people here are equating smartphones, browsers to development utilities. This is not something I would expect in Go, node, ruby ... but it's OK because it's .NET build utilities? How is that FUD?

yahna 9y ago

.NET core collects telemetry. This isn't really any different than loads of other applications, but it's microsoft instead of google so booo hiss evil evil evil.