9 ms·
Microsoft .Net Core telemetry is not opt-in
- manigandham 8y agoThis should link to the entire github issue, not a single person's recent comment in a 2 year old thread. Also the title should be changed to clarify "telemetry".
- fiiv 8y agoFrom their perspective, they claim that it is not personal info since it's anonymised. On that, they're right. But it still makes a shitty user experience to do something that is counter to what your users expect and want.
- setquk 8y agoMaybe, maybe not. They record 3 octets of your IP address and the experience is opt-out rather than opt-in. ECJ ruled that IP addresses are PII but did not specify if using a partial address is OK. On the basis it is the 3 most significant octets, then this could be used to identify a company or a pool of users or a unique user on an unpopulated network. Edit: also from [1]: "Hashed MAC address — Determine a cryptographically (SHA256) anonymous and unique ID for a machine. Useful to determine the aggregate number of machines that use .NET Core. This data will not be shared in the public data releases." I think a machine could be a user in this circumstance? Also a hash isn't anonymous if it's idempotent based on the IP address alone as it's merely a derived value. [1] https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve...
- deleted 8y ago[deleted]
- tscs37 8y agoAtleast per german court rulings, which at that time largely covered what is defined as PII under GDPR, say that the full IP is PII but the first three octets is not.
- annabellish 8y agoThe last three octets absolutely could be in conjunction with some other pieces of data, though.
- tscs37 8y agoOf course, yes. Once you can identify a unique person it's personal data, even if you cut of octets. If you only log the IP for example for detecting duplicate accounts, it should be good enough.
- pjc50 8y agoECJ ruling citation please? That would be extremely useful in settling this argument.
- setquk 8y agohttp://curia.europa.eu/juris/document/document.jsf?text=&docid=184668&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1406323 http://curia.europa.eu/juris/document/document.jsf?text=&doc...
- slenk 8y agoIn the US under HIPAA laws, your IP address counts as PHI, not just PII Source: I work in IS for healthcare providers
- zaroth 8y agoNo, an IP on its own is not PHI. IPs must be removed when de-identifying PHI, which is not the same at all as claiming IPs are themselves PHI. [1] - https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#protected https://www.hhs.gov/hipaa/for-professionals/privacy/special-...
- jacques_chester 8y ago> But it still makes a shitty user experience to do something that is counter to what your users expect and want. One way to improve shitty user experiences is to study them. This requires information. How do I answer questions like: what is the most frequently-used command? Which command causes the most people to give up? Which argument is being asked for, which already exists? What effect does a change in documentation have? How many projects do people work on and do we need to invest in tools for repositories with many projects? Etc etc. This is all Product Management 101: form hypothesis and test it.
- ptx 8y agoYou could answer such questions the usual established way it's normally done in other fields: sample a voluntarily participating statistically significant subset of the population.
- jacques_chester 8y agoOther fields do this when there is no better alternative. It's is orders of magnitudes more expensive and also, more to the point, quite unreliable.
- ringbugger 8y agoWould be great to give the user an option to send statistics or something like that to do just that. I really like VSC. But things like this really question all the positive experience. I doubt product management is going to help here. Will now scan network transfer VSC is causing. In many other cases I wouldn't even bother anymore.
- jacques_chester 8y ago> Would be great to give the user an option to send statistics or something like that to do just that. This is exactly what they do.
- flukus 8y agoThis has been an issue for 2 years now, so what is it they've done with this oh so valuable data? What improvements have been made as a result of the data collected? I suspect the answer is that no concrete improvements have been made and all it's accomplished is to make them look bad.
- deleted 8y ago[deleted]
- yread 8y agohttps://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve...
- setquk 8y agoAnd there's the money shot: "Hashed MAC address — Determine a cryptographically (SHA256) anonymous and unique ID for a machine. Useful to determine the aggregate number of machines that use .NET Core. This data will not be shared in the public data releases."
- JorgeGT 8y agoSomeone please correct me if I'm wrong, but (2^48 possible MAC addresses) / (60000MH/s) / (3600 s/h) = 1.3 h to calculate the SHA256 sum of every MAC address in an AWS p3.16xlarge instance (~$50) https://medium.com/@iraklis/running-hashcat-v4-0-0-in-amazons-aws-new-p3-16xlarge-instance-e8fab4541e9b https://medium.com/@iraklis/running-hashcat-v4-0-0-in-amazon...
- noir_lord 8y agoLooks about right to me. I wonder why they didn't use something like bcrypt/scrypt with lots of rounds.
- viraptor 8y agoYou may be right. But it may not be a straight sha256. It could be a multi-round hash based on sha2. In the same way shadow hashes are default called sha512, but in reality it's a 5000 round version, so your price could be $250000 instead. (Or less/more)
- SwingingShips 8y agoOh this will get exciting
- dnomad 8y agoIt boggles the mind that a bunch of very smart people at Microsoft thought this was a good idea. Say what you will about Oracle but Java has never been malware that continuously spies on users. Unfortunately the GDPR explicitly allows this kind of IoT-style ubiquitous anonymized monitoring: as long as the information cannot be tied back to an individual person (meaning no IP addresses but GUIDs are fine) and the business can claim a legitimate business interest they're likely to get away with it. This sort of ubiquitous monitoring is only going to get more popular. In Hong Kong we're seeing new Condo apartments that have full-fledged "internal sensor grids" a la Star Trek (as it was described to me). In theory though the data collection firm (which is not the same firm that owns the building) has no way of correlating it back to a specific person/apartment number.
- manigandham 8y agoLike all things, there must be a sense of context and proportionality. This issue is specifically about the .NET Core SDK command line tools. Getting data about which commands are used most, if they're successful or throwing errors, possible typos, unclear command flags, etc, are useful when shipping software frameworks used by 10s of millions to build products that run the entire Fortune 500 and thousands of other businesses. This is not ubiquitous spyware, and is about as generic as it gets while still remaining useful. Every software company (many of which are featured here on HN) does the same analytical tracking to figure out how their products are being used and it results in better features. What exactly is the danger here, especially with the lack of personal info and an opt-out method? They even make the data public along with insights into how it helped: https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve...
- 0x0 8y agoCollecting command line arguments is a HUGE invasion of privacy. Imagine I ran a command "make.exe my-secret-project-name" or "make.exe process_gdrp_removal_request SOME_SSN". And as the linked page admits, they really do collect all command line arguments, not just a white list of valid commands. Perhaps someone accidentally pastes an AWS API Secret into the wrong terminal window and it ended up as "dotnet.exe MY_AWS_SECRET". ("You will notice misspellings, like “bulid”. That’s what the user typed. It’s information").
- oaiey 8y agoCan I suggest to change the title. It is misleading at the current state. PS: this should be opt-in due to community request and not by some philosophy or law
- nhebb 8y agoI have been contacted twice in the past year by Microsoft rep's who both told me that one of my products is among the top installed add-ins for Excel (they didn't say top "X", just "top" - but I'll take it). I assume they collect this data via telemetry. What bothered me is that when I asked questions back, I would get no reply. If they are going to collect this data, the least they could do is help developers out with some aggregate data. I've been selling this product for 10+ years, and to this day, I still vacillate on which version of the .NET framework to target.
- SmellyGeekBoy 8y agoI've always gladly submitted bug reports and begrudgingly accepted some telemetry in the belief that it helps the developers fix bugs and build a better product. But apparently this data isn't even passed back to developers?
- MatthewWilkes 8y agoThis has been covered here many times, but consent is not the only basis for lawful processing under GDPR.
- akerro 8y agoDoes that mean that every .Net application has a built-in botnet unless disabled by developers? Can I disable is a as user?
- oaiey 8y agoAny published app may not invoke telemetry according to their documentation. Only the CLI tools related to build or developer inner loop activities. PS: according to documentation of the feature
- Zekio 8y agoit can be disabled with an environment variable Edit: manigandham answer is more correct
- manigandham 8y agoThis has nothing to do with your application or code. This is the .NET Core command line tools that send generic telemetry on which commands are used most, timings, and SDK versions. It shows a message when you first use the tools and can be disabled, check the docs: https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry
- yummybear 8y ago.NET Core does not "violate" GDPR any more than Google Analytics does, or any other system that receives data. It's up to the data controller to ensure that no personal data is sent, which is done by setting the environment variable DOTNET_CLI_TELEMETRY_OPTOUT. There are fair arguments against the nature of opt-in telemetry, but saying "they violate GDPR" is just hyperbole, imo.
- 0x0 8y agoIs opt-out a valid strategy for GDPR compliance? I got the impression that these things had to be opt-in?
- oblio 8y agoThey have to be opt-in. The only way you can work around it is if you can guarantee that the data you collect does not uniquely identify someone.
- opless 8y agoAnd of course, all metadata is personally identifying.
- oblio 8y agoLet's say your browser knows just my screen resolution. Just based on that, you can't identify me. Not all metadata is personally identifying. A very careful bundle of metadata might be.
- tveita 8y agoAny large enough bundle of carelessly collected metadata will be enough to identify a person.
- josteink 8y agoRepeat after me: If you don't collect user-data, but just aggregated and anonymized usage-data, the GDPR does not comply. No need to panic. I know the all the spin-doctors Silicon Valley and the privacy-hostile tech companies can afford is trying to make it seem like GDPR makes everything into a giant mess where you need a team of lawyers to just write basic web-server logs. But just because the spin-doctors are trying to spin things that way, doesn't mean it's true. This is ofcourse big scale privacy-violators trying to give the general population the impression that the GDPR is "ridiculous", something to disregard, and in the process, trying to sabotage a law which will make it unlawful for them to keep tracking, mining and selling the shit out of your personal information. They are trying to make you turn your back on someone who is actually fighting for your privacy. That's just scummy as heck. GDPR is about common sense and basic decency. It works out just fine for everyone not into scummy user-hostile shit. You just need to be up front about what user-data you collect and how you intend to use it. No user-data? Move along. No GDPR.
- rehemiau 8y agoI believe it's the same with VSCode. All "telemetry.enableCrashReporter", "telemetry.enableTelemetry" and "workbench.settings.enableNaturalLanguageSearch" from user settings default to true.
- partycoder 8y agoWhat do you need to stop trusting Microsoft? They haven't changed a lot. They're still patent trolls, and if they still exist is mostly because they're still living off the momentum of their 90s monopoly. This is the type of BS that comes out of the great minds at Microsoft: https://www.cbsnews.com/news/hiybbprqag-how-google-tripped-up-microsoft/ https://www.cbsnews.com/news/hiybbprqag-how-google-tripped-u... <- a great example of how your analytics data might be used.
- jasonkostempski 8y agoI read 'not' as 'now'. For a second there I thought the world was a slightly better place today :/ I'm all for continuing the fight, but I'm suprised this very old news is on the front page again.
- alkonaut 8y agoTelemetry can be opt-OUT just as long as it displays very clearly to the user what is going on. I'd prefer opt-IN but I fully understand if microsoft don't. Having something be opt-OUT and not displayed to the user (meaning they are in no position to opt out because they aren't aware they even need to) is of course entirely unacceptable no matter which way you turn it. It can't be in fine print it needs to be in big bold letters on first run, install, etc.
- polskibus 8y agoPlease change the title to include "telemetry".
- moron4hire 8y agoThis title reads like .NET Core is forcefully replacing all other .NET frameworks on your system.
- setquk 8y agoIt is. Future versions of powershell will ship with .Net core only.
- moron4hire 8y agoPowerShell is an extremely small part of the .NET ecosystem. It's more like a REPL for a programming language than a shell. And regardless, that a future version of a piece of software would be implemented in the latest version of the framework is not at all the same thing as what I'm talking about.
- jenscow 8y agoWhy can't they just make it opt-in? When one of my kids ask for something and I say no, they might ask again. But the more they continue to ask, the more determined I am to say no. The difference between me and Microsoft (in this context), is I'm trying to bring up respectful children. This is just what Microsoft are doing - judging by the +1's, there's a huge majority of users who just don't want this. Instead of giving their customers what they're asking for, they just dig their heels in further. This is one of the main reasons I started the transition away from Windows since the 8 preview. They said that making it opt-in would mean less data. Well, doesn't that tell them something? I'm sure the .NET team would have got the same answers if this where opt-in - and let's face it, the discoveries aren't exactly ground breaking. If you ask me, I probably would have opted in. I'm sure other people would do the same (if they could). But it's not, so I jumped through the hoops to disable it (added it to /etc/environment). You don't ask, you don't get. And another thing, why not disable it using the registry when running on Windows? Personal experience tells me that only a minority of Windows devs even know what an environment variable is, let alone know how to set to globally and persistent. It's arguable whether or not this is personally identifiable. Even if it's not, it still leaves a bad taste as it's still classed as "spying" - they're sneaking the data out by making people take effort to disable it; it's beyond a simple Y/N, people have to actually learn how to do something. And it's also giving people the impression that their own apps will be contaminated. It's a command-line tool I'm running on my local computer for professional use, not a click-bait website or social media platform.
- simooooo 8y ago"Personal experience tells me that only a minority of Windows devs even know what an environment variable is" This kind of garbage ruins your argument.
- znpy 8y agoImho people can spend all the time they want discussing this. The only way to sort this out is someone suing Microsoft and then let a judge declare whether telemetry not being opt-in is a GDPR violation or not.
- he0001 8y agoI bet we’ll see research articles about how people use companies public data to pinpoint individuals in different ways. I’d think we all are going to be surprised what you can find from that data.
- CodesInChaos 8y agoNote that recovering the plain MAC address from SHA256(MAC) costs a single GPU day on a 1080.
- rkeene2 8y agoJoy [1] also does this, with no obvious warning, and no way to opt out. I reported it and the contributors said they had no problem with it, and if I didn't like it I could build from source, because correcting my activities would be useful to them. [1] https://github.com/matthewmueller/joy/issues/79 https://github.com/matthewmueller/joy/issues/79