4 ms·

"Most apps are opt-out though, the checkboxes are already checked and a message shown." IMO, this is the key problem. I have no issue with optional telemetry,

"Most apps are opt-out though, the checkboxes are already checked and a message shown." IMO, this is the key problem. I have no issue with optional telemetry, but there should be a bright line here: all telemetry should be opt-in. If necessary, by law. It should not become standard practice for applications to send data without explicit consent.

hvidgaard 9y ago
Most applications will claim that it is explicit consent since you have to click "OK", and then try and argue that a preselected checkbox is not the same as opt-out.
johnlbevan2 9y ago
Maybe we need nullable checkboxes; so you have to explicitly make a choice either way, rather than leaving things to default. - If you have to opt in, most people won't bother as it's not of direct benefit to them (even though overall it's beneficial to the community the more people who do opt in). - If you have to opt out, people will complain even where the option's made explicitly clear (i.e. where it's not an attempt at being devious / a deliberate dark pattern). Admittedly then people complain that they have to make a choice / can't just install-and-go... :/.
- giancarlostoro 9y ago
  An off-topic mention, everytime I think of a project I'm taking over and seeing "nullable booleans" I'm left wondering why the developer before me went with that approach, there's no commentary as to why nor do I see any indication of nullable booleans being used in any special way / case. Can any dev out there give me a good use-case aside from forcing someone to check something, and should nullable booleans mostly make sense on front-end as opposed to back-end code? How does a GUI define something is nullable, if a user has not selected it but it's unselected by default.. I find it all a bit confusing...
  - throwanem 9y ago
    A checkbox is the wrong UI control for this, because its two states (checked and unchecked) do not cleanly map to the three possible values (true, false, no value). Radio buttons come closer, but most UI widget libraries provide no way to select none of a radio group once one has been selected. So you can have a radio button each for true and false, and default to no value (i.e. neither selected), but the user can't change her mind and go back to no value. Sometimes that's okay, as when no value is invalid or meaningless in the context of the form. When it's not, the best solution I have is a select box with three options; three radio buttons in a group would work too from a semantic perspective, but necessitate a probably confusing label on the no-valued one, where a blank option in a select box is much likelier to make intuitive sense to the user, especially if it's the default. For required fields, either works. With the select box, making the no-valued option default requires the user to interact with the field, and the same holds for a radio button pair that has no button selected by default. In either case, if the field's value is null rather than false, you know no selection was made and can complain accordingly.
    - wongarsu 9y ago
      >A checkbox is the wrong UI control for this, because its two states (checked and unchecked) Windows developers might disagree, since Windows 95 checkboxes have had three states (on/off/mixed, or checked/unchecked/filled out), and the third state is used in a lot of places by Windows (though usually to mean that some subitems are on and some are off).
      - throwanem 9y ago
        I've never seen one of those used to represent a null value, and I'd consequently avoid using one that way purely on the principle of least surprise.
  - DougWebb 9y ago
    Sometimes you need to know if a value has been explicitly defined or not. Also, sometimes you need to know if a value is different from what it was before. Nullable values help in both cases, because you can tell the difference between the "default" value (false for boolean, "" for strings, 0 for numbers) and "no" value (null). If you have a form being submitted, you can tell the difference between the user setting fields to their default vs the fields not being returned to you at all. Another example is an ORM system. A data entity could be initialized from an existing database record, or it could be blank. Each property of the data entity could be initialized or not, depending on the SQL query that was used to initialize it. For fields that are non-nullable in the database, you can compare two entities for the same record to determine if fields have been updated or just weren't initialized. That lets you perform database updates only when necessary, and prevents accidentally deleting information.
Sacho 9y ago
Okay, I see your point, but the counter-argument is that opt-in telemetry is practically useless. The whole point of telemetry is to passively monitor the majority of users and see how they use the software, what the pain points are, where to focus on, etc. Most of the people who would explicitly opt-in are also likely to make their feelings known through other channels, their voice is already heard on forums, help channels, issue trackers, etc. What you need to know is how the "silent majority" uses your software. Personally, I would prefer developers have this option to improve their products. I am willing to put lots of caveats there: the telemetry gathering should be clearly indicated, it should be transparent, we should have access to the data, and obviously, it should be anonymized as much as possible. I think Microsoft ticks all those boxes in their approach. I also acknowledge that they hadn't done so at the start of the issue, but the situation quickly got muddled up with the opt-in vs opt-out back-and-forth, rather than how well they had implemented their opt-out approach.
- inetknght 9y ago
  Using telemetry to see how users use software is pointless. It does nothing to actually explain why a user is doing something. So instead you have to have teams of people who try to make, at best, an educated guess about user activity and reasons behind them. If I'm clicking back and forth in a window, why should you assume it has something to do with your software? Yeah it's the most likely culprit in your opinion. But in my opinion I simply accidentally clicked somewhere, brought your window to focus, and went back to what I was doing elsewhere. Or clicked a button and clicked around to figure out how to undo it. I've seen tons of people with ADD-style clicking and typing while they're actually doing something completely irrelevant. It's literally just noise. Why do you need to try to interpret it?
  - ska 9y ago
    Using telemetry to see how users use software is pointless. The word you are looking for here is something like "limited", not "pointless". Sure, there is noise in telemetry but there is also a lot of signal. And it is the sort of signal that is difficult to acquire. I'm certainly not convinced that for consumer grade applications opt out telemetry is a good thing, for lots of reasons. But none of them are "it isn't useful".
DougWebb 9y ago
Your interactions with ycombinator.com to read this discussion and leave your comment were logged in an access.log file, which is a form of telemetry. Should that be opt-in? If so, a necessary tool for managing websites will be destroyed. If not, if an exception to your law is made, then the tools and applications you're worried about will end up with features that integrate with remote websites that are necessary for their function. Don't be so quick to call for laws.
- snakeanus 9y ago
  ycombinator.com is a site that you willingly send data to, it is not an application that you use locally. I do agree however, we do not need more laws about that, we just need the people to start using software that respects its users and can be audited by anyone - free software.
  - Klathmon 9y ago
    But that "willingly" isn't so willingly if I included a link to something on ycombinator.com on another website that has nothing to do with it.
    - snakeanus 9y ago
      Please elaborate.
      - Klathmon 9y ago
        if I link to an image, javascript file, or even an iframe to ycombinator.com, your browser will make a request to ycombinator.com most likely without you knowing. if ycombinator.com logs information on that request, is that okay? if not where does the "fault" lie? With the site that linked to a 3rd party (my website in this example)? With the site that is gathering telemetry without opt-in consent (ycombinator.com in this example)? If it's the former (my fault for including a 3rd party request), what happens when user-submitted content includes a link to a 3rd party? What about if a user-submitted content includes a link but doesn't make a request and your browser decides to prefetch the contents of that link?

hvidgaard 9y ago

Most applications will claim that it is explicit consent since you have to click "OK", and then try and argue that a preselected checkbox is not the same as opt-out.

johnlbevan2 9y ago

Maybe we need nullable checkboxes; so you have to explicitly make a choice either way, rather than leaving things to default. - If you have to opt in, most people won't bother as it's not of direct benefit to them (even though overall it's beneficial to the community the more people who do opt in). - If you have to opt out, people will complain even where the option's made explicitly clear (i.e. where it's not an attempt at being devious / a deliberate dark pattern). Admittedly then people complain that they have to make a choice / can't just install-and-go... :/.

giancarlostoro 9y ago
An off-topic mention, everytime I think of a project I'm taking over and seeing "nullable booleans" I'm left wondering why the developer before me went with that approach, there's no commentary as to why nor do I see any indication of nullable booleans being used in any special way / case. Can any dev out there give me a good use-case aside from forcing someone to check something, and should nullable booleans mostly make sense on front-end as opposed to back-end code? How does a GUI define something is nullable, if a user has not selected it but it's unselected by default.. I find it all a bit confusing...
- throwanem 9y ago
  A checkbox is the wrong UI control for this, because its two states (checked and unchecked) do not cleanly map to the three possible values (true, false, no value). Radio buttons come closer, but most UI widget libraries provide no way to select none of a radio group once one has been selected. So you can have a radio button each for true and false, and default to no value (i.e. neither selected), but the user can't change her mind and go back to no value. Sometimes that's okay, as when no value is invalid or meaningless in the context of the form. When it's not, the best solution I have is a select box with three options; three radio buttons in a group would work too from a semantic perspective, but necessitate a probably confusing label on the no-valued one, where a blank option in a select box is much likelier to make intuitive sense to the user, especially if it's the default. For required fields, either works. With the select box, making the no-valued option default requires the user to interact with the field, and the same holds for a radio button pair that has no button selected by default. In either case, if the field's value is null rather than false, you know no selection was made and can complain accordingly.
  - wongarsu 9y ago
    >A checkbox is the wrong UI control for this, because its two states (checked and unchecked) Windows developers might disagree, since Windows 95 checkboxes have had three states (on/off/mixed, or checked/unchecked/filled out), and the third state is used in a lot of places by Windows (though usually to mean that some subitems are on and some are off).
    - throwanem 9y ago
      I've never seen one of those used to represent a null value, and I'd consequently avoid using one that way purely on the principle of least surprise.
- DougWebb 9y ago
  Sometimes you need to know if a value has been explicitly defined or not. Also, sometimes you need to know if a value is different from what it was before. Nullable values help in both cases, because you can tell the difference between the "default" value (false for boolean, "" for strings, 0 for numbers) and "no" value (null). If you have a form being submitted, you can tell the difference between the user setting fields to their default vs the fields not being returned to you at all. Another example is an ORM system. A data entity could be initialized from an existing database record, or it could be blank. Each property of the data entity could be initialized or not, depending on the SQL query that was used to initialize it. For fields that are non-nullable in the database, you can compare two entities for the same record to determine if fields have been updated or just weren't initialized. That lets you perform database updates only when necessary, and prevents accidentally deleting information.

Sacho 9y ago

Okay, I see your point, but the counter-argument is that opt-in telemetry is practically useless. The whole point of telemetry is to passively monitor the majority of users and see how they use the software, what the pain points are, where to focus on, etc. Most of the people who would explicitly opt-in are also likely to make their feelings known through other channels, their voice is already heard on forums, help channels, issue trackers, etc. What you need to know is how the "silent majority" uses your software. Personally, I would prefer developers have this option to improve their products. I am willing to put lots of caveats there: the telemetry gathering should be clearly indicated, it should be transparent, we should have access to the data, and obviously, it should be anonymized as much as possible. I think Microsoft ticks all those boxes in their approach. I also acknowledge that they hadn't done so at the start of the issue, but the situation quickly got muddled up with the opt-in vs opt-out back-and-forth, rather than how well they had implemented their opt-out approach.

inetknght 9y ago
Using telemetry to see how users use software is pointless. It does nothing to actually explain why a user is doing something. So instead you have to have teams of people who try to make, at best, an educated guess about user activity and reasons behind them. If I'm clicking back and forth in a window, why should you assume it has something to do with your software? Yeah it's the most likely culprit in your opinion. But in my opinion I simply accidentally clicked somewhere, brought your window to focus, and went back to what I was doing elsewhere. Or clicked a button and clicked around to figure out how to undo it. I've seen tons of people with ADD-style clicking and typing while they're actually doing something completely irrelevant. It's literally just noise. Why do you need to try to interpret it?
- ska 9y ago
  Using telemetry to see how users use software is pointless. The word you are looking for here is something like "limited", not "pointless". Sure, there is noise in telemetry but there is also a lot of signal. And it is the sort of signal that is difficult to acquire. I'm certainly not convinced that for consumer grade applications opt out telemetry is a good thing, for lots of reasons. But none of them are "it isn't useful".

DougWebb 9y ago

Your interactions with ycombinator.com to read this discussion and leave your comment were logged in an access.log file, which is a form of telemetry. Should that be opt-in? If so, a necessary tool for managing websites will be destroyed. If not, if an exception to your law is made, then the tools and applications you're worried about will end up with features that integrate with remote websites that are necessary for their function. Don't be so quick to call for laws.

snakeanus 9y ago
ycombinator.com is a site that you willingly send data to, it is not an application that you use locally. I do agree however, we do not need more laws about that, we just need the people to start using software that respects its users and can be audited by anyone - free software.
- Klathmon 9y ago
  But that "willingly" isn't so willingly if I included a link to something on ycombinator.com on another website that has nothing to do with it.
  - snakeanus 9y ago
    Please elaborate.
    - Klathmon 9y ago
      if I link to an image, javascript file, or even an iframe to ycombinator.com, your browser will make a request to ycombinator.com most likely without you knowing. if ycombinator.com logs information on that request, is that okay? if not where does the "fault" lie? With the site that linked to a 3rd party (my website in this example)? With the site that is gathering telemetry without opt-in consent (ycombinator.com in this example)? If it's the former (my fault for including a 3rd party request), what happens when user-submitted content includes a link to a 3rd party? What about if a user-submitted content includes a link but doesn't make a request and your browser decides to prefetch the contents of that link?