5 ms·

.NET Core does not "violate" GDPR any more than Google Analytics does, or any other system that receives data. It's up to the data controller to ensure that no

.NET Core does not "violate" GDPR any more than Google Analytics does, or any other system that receives data. It's up to the data controller to ensure that no personal data is sent, which is done by setting the environment variable DOTNET_CLI_TELEMETRY_OPTOUT. There are fair arguments against the nature of opt-in telemetry, but saying "they violate GDPR" is just hyperbole, imo.

0x0 8y ago
Is opt-out a valid strategy for GDPR compliance? I got the impression that these things had to be opt-in?
- oblio 8y ago
  They have to be opt-in. The only way you can work around it is if you can guarantee that the data you collect does not uniquely identify someone.
  - opless 8y ago
    And of course, all metadata is personally identifying.
    - oblio 8y ago
      Let's say your browser knows just my screen resolution. Just based on that, you can't identify me. Not all metadata is personally identifying. A very careful bundle of metadata might be.
      - tveita 8y ago
        Any large enough bundle of carelessly collected metadata will be enough to identify a person.
  - josteink 8y ago
    Repeat after me: If you don't collect user-data, but just aggregated and anonymized usage-data, the GDPR does not comply. No need to panic. I know the all the spin-doctors Silicon Valley and the privacy-hostile tech companies can afford is trying to make it seem like GDPR makes everything into a giant mess where you need a team of lawyers to just write basic web-server logs. But just because the spin-doctors are trying to spin things that way, doesn't mean it's true. This is ofcourse big scale privacy-violators trying to give the general population the impression that the GDPR is "ridiculous", something to disregard, and in the process, trying to sabotage a law which will make it unlawful for them to keep tracking, mining and selling the shit out of your personal information. They are trying to make you turn your back on someone who is actually fighting for your privacy. That's just scummy as heck. GDPR is about common sense and basic decency. It works out just fine for everyone not into scummy user-hostile shit. You just need to be up front about what user-data you collect and how you intend to use it. No user-data? Move along. No GDPR.
    - 0x0 8y ago
      But it's not aggregated, and the combination of geolocation + os kernel build number + runtime id + osversion + sdkversion could very well be unique. Just take a look at some choice lines from one of the .tsv files at https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve... : Timestamp Occurences Command Geography OSFamily RuntimeID OSVersion SDKVersion 5/8/2017 12:00:00 AM 3 fable Madagascar Windows win10-x64 10.0.14393 1.0.3 6/8/2017 12:00:00 AM 1 fable Germany Windows win7-x86 6.1.7601 1.0.1 4/11/2017 12:00:00 AM 3 user-secrets Vietnam Windows win10-x64 10.0.14393 1.0.0 5/1/2017 12:00:00 AM 1 user-secrets Thailand Windows win10-x64 10.0.14393 1.0.0-preview2-003131 4/3/2017 12:00:00 AM 1 restore3 Peru Linux debian.8-x64 8 1.0.1 Especially with commands being logged, one slip-up (paste, tabcomplete etc) could end up in public .tsv files for anyone to see.
      - josteink 8y ago
        > Especially with commands being logged, one slip-up (paste, tabcomplete etc) could end up in public .tsv files for anyone to see. That argument can be extended to anything and as such cannot be deemed valid. I could accidentally post AWS secrets as my user-agent in my browser. Does that mean everyone on the internet should be held accountable to GDPR because I might visit them and my user-agent end up in their server-logs? Ofcourse not. Microsoft is clearly showing a reasonable effort w.r.t. limiting what gets logged and how. That should be more than enough to appease any GDPR-concerns. They can't be held accountable for all possible errors or error-modes in the known universe. If anyone here is claiming they should, what they then also claim is that any software handling user-data must be 100% bug-free to be GDPR-compliant. And that's obviously a ludicrous position. Stop the nonsense.
deleted 8y ago
[deleted]
SmellyGeekBoy 8y ago
It violates GDPR because it defaults to enabled. GDPR states that data collection should be opt-in.
- philliphaydon 8y ago
  The data is neither personal or sensitive. So which data collection needs to be opt-in?
  - opless 8y ago
    Of course all metadata is subjectively speaking personally identifiable information. But which data are you claiming isn't?
    - philliphaydon 8y ago
      All the data they collect. Atleast based on the GDPR training thing I had to do yesterday for work.

0x0 8y ago

Is opt-out a valid strategy for GDPR compliance? I got the impression that these things had to be opt-in?

oblio 8y ago
They have to be opt-in. The only way you can work around it is if you can guarantee that the data you collect does not uniquely identify someone.
- opless 8y ago
  And of course, all metadata is personally identifying.
  - oblio 8y ago
    Let's say your browser knows just my screen resolution. Just based on that, you can't identify me. Not all metadata is personally identifying. A very careful bundle of metadata might be.
    - tveita 8y ago
      Any large enough bundle of carelessly collected metadata will be enough to identify a person.
- josteink 8y ago
  Repeat after me: If you don't collect user-data, but just aggregated and anonymized usage-data, the GDPR does not comply. No need to panic. I know the all the spin-doctors Silicon Valley and the privacy-hostile tech companies can afford is trying to make it seem like GDPR makes everything into a giant mess where you need a team of lawyers to just write basic web-server logs. But just because the spin-doctors are trying to spin things that way, doesn't mean it's true. This is ofcourse big scale privacy-violators trying to give the general population the impression that the GDPR is "ridiculous", something to disregard, and in the process, trying to sabotage a law which will make it unlawful for them to keep tracking, mining and selling the shit out of your personal information. They are trying to make you turn your back on someone who is actually fighting for your privacy. That's just scummy as heck. GDPR is about common sense and basic decency. It works out just fine for everyone not into scummy user-hostile shit. You just need to be up front about what user-data you collect and how you intend to use it. No user-data? Move along. No GDPR.
  - 0x0 8y ago
    But it's not aggregated, and the combination of geolocation + os kernel build number + runtime id + osversion + sdkversion could very well be unique. Just take a look at some choice lines from one of the .tsv files at https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve... : Timestamp Occurences Command Geography OSFamily RuntimeID OSVersion SDKVersion 5/8/2017 12:00:00 AM 3 fable Madagascar Windows win10-x64 10.0.14393 1.0.3 6/8/2017 12:00:00 AM 1 fable Germany Windows win7-x86 6.1.7601 1.0.1 4/11/2017 12:00:00 AM 3 user-secrets Vietnam Windows win10-x64 10.0.14393 1.0.0 5/1/2017 12:00:00 AM 1 user-secrets Thailand Windows win10-x64 10.0.14393 1.0.0-preview2-003131 4/3/2017 12:00:00 AM 1 restore3 Peru Linux debian.8-x64 8 1.0.1 Especially with commands being logged, one slip-up (paste, tabcomplete etc) could end up in public .tsv files for anyone to see.
    - josteink 8y ago
      > Especially with commands being logged, one slip-up (paste, tabcomplete etc) could end up in public .tsv files for anyone to see. That argument can be extended to anything and as such cannot be deemed valid. I could accidentally post AWS secrets as my user-agent in my browser. Does that mean everyone on the internet should be held accountable to GDPR because I might visit them and my user-agent end up in their server-logs? Ofcourse not. Microsoft is clearly showing a reasonable effort w.r.t. limiting what gets logged and how. That should be more than enough to appease any GDPR-concerns. They can't be held accountable for all possible errors or error-modes in the known universe. If anyone here is claiming they should, what they then also claim is that any software handling user-data must be 100% bug-free to be GDPR-compliant. And that's obviously a ludicrous position. Stop the nonsense.

deleted 8y ago

[deleted]

SmellyGeekBoy 8y ago

It violates GDPR because it defaults to enabled. GDPR states that data collection should be opt-in.

philliphaydon 8y ago
The data is neither personal or sensitive. So which data collection needs to be opt-in?
- opless 8y ago
  Of course all metadata is subjectively speaking personally identifiable information. But which data are you claiming isn't?
  - philliphaydon 8y ago
    All the data they collect. Atleast based on the GDPR training thing I had to do yesterday for work.