11 ms·
in Microsoft/microsoft-ui-xaml - Data/Telemetry This project collects usage data and sends it to Microsoft to help improve our products and services. Read Micr
by protomyth 8y ago
in Microsoft/microsoft-ui-xaml - Data/Telemetry
This project collects usage data and sends it to Microsoft to help improve our products and services. Read Microsoft's privacy statement to learn more.
For more information on telemetry implementation see the developer guide.
https://privacy.microsoft.com/en-US/privacystatement https://privacy.microsoft.com/en-US/privacystatement
https://github.com/Microsoft/microsoft-ui-xaml/blob/master/docs/developer_guide.md#Telemetry https://github.com/Microsoft/microsoft-ui-xaml/blob/master/d...
Looks really easy to disable, but probably something some folks need to be aware of. Love the license and effort Microsoft put into this.
- kgwxd 8y agoIt would be nice if we could all agree on a global environment variable to opt-out of all telemetry so we wouldn't have to keep track of the thousands of places to turn it off.
- ahoka 8y agoHow about opt-in? Privacy should be the default.
- naikrovek 8y agoWould someone please explain to me how usage telemetry is a privacy invasion? I can't draw a line between those two things.
- kgwxd 8y agoI've yet to see anyone try to explain how it's not an invasion of privacy without actually making an argument for how it is an invasion of privacy.
- danmg 8y agoHow is telemetry not a privacy violation? It's sending back arbitrary data to someone else without explicit authorization. This data can contain anything including information about the running environment, the contents of files on the computer, other running programs. It doesn't matter that it's Microsoft instead of an Estonian teenager doing it. You own your computer. You explicitly decide what data comes from it. NO EXCEPTIONS.
- jhall1468 8y ago> It's sending back arbitrary data to someone else without explicit authorization. You are giving very explicit authorization by agreeing to the EULA. > You own your computer. You explicitly decide what data comes from it. NO EXCEPTIONS. That's still true. And by installing a product and agreeing to a EULA which includes a section on telemetry you are doing just that. Thus, your options are "don't install the software" or "opt-out".
- danmg 8y agoClick through EULAs are not legal documents. This has been established. It's also unlawful under the GDPR.
- blackoil 8y agoDoes telemetry contains any data that comes under GDPR?
- naikrovek 8y agoThey very much are legal documents, and they are binding.
- danmg 8y agoNope. Specht v. Netscape Communications Corp. dealt exactly with this sort of click through 'telemetry'. Doesn't matter if it's in a shrinkwrap license.
- ineedasername 8y agoEh, not quite so clear-cut. There were some big caveats in that decision "clicking on a download button does not show assent to license terms if those terms were not conspicuous and if it was not explicit to the consumer that clicking meant agreeing to the license" [0] It doesn't appear to say clickwraps are non-binding, only that it has to be "conspicuous" and basically that a user knew they were agreeing to something. Unfortunately that too is open to interpretation. As with most things of this nature, if someone wants to sue, they can sue, and it's a resource fight in the courts. [0] https://en.wikipedia.org/wiki/Specht_v._Netscape_Communications_Corp https://en.wikipedia.org/wiki/Specht_v._Netscape_Communicati....
- laythea 8y agoMaybe this will help. True story. I just moved into my rented house and discovered the CCTV outside my front door, in public view, but also on my property, is actually monitored by the landlord, not me. - you = me - software = house - telemetry = CCTV
- IMTDb 8y agoAlso a true story I just entered a new mall and discovered that they monitors how many people come in and out (and at what time) in order to ensure they have enough cashier. - you = me - software = mall - monitoring basic metrics in order to improve the service = counting people in/out This is completely OK, and somehow everybody likes that they increase the number of cashier during busy time. Just like the mall, you do not own the software, you juste have the right to enter/use it.
- laythea 8y agoIt's not sending back "the software". It is sending back data about you. And who knows what. Indeed, human greed is faster moving than regulation, so its no wonder we are in the transition phase. And if you tell me all this identifiable data about me is safe, this is simply not true. Safe from motivated 3rd parties, then this is also not true. Unfortunately, we do not live in this ideal world where data is used for only good. We live in a world where people get away with undetected overreach all the time.
- svick 8y ago> It is sending back data about you. And who knows what. This is specifically about telemetry in an open source code. If you want to know what data it sends, you can look for yourself.
- naikrovek 8y ago> my rented house > my property Those two things don't jive. It's your property OR you rent it. Not both.
- evross 8y agoThe privacy issue can happen in two ways that I can think of: 1. Unclear boundaries of data. How many points of data are being collected and sent 'home'? CPU performance? OK. Device name, pc username, usage duration, times the program is opened and closed. System account email address, IP address, hostnames contacted (i.e. websites visited), WiFi-based location, webcam stream for inference of end-user mood, microphone for emotion analytics? These are all examples of telemetry that could be argued are 'needed' for purely for product improvement. 2. Even if only a couple of data points are collected, it is very possible to identify the real name of the end user through analytics of the data. This inferred information is very valuable, and definitely is then a privacy issue. I hope the vast majority of developers and company execs don't intend to 'do evil' with this information, but unfortunately we have seen examples of this from public companies, despite auditing etc.
- eecc 8y agoOk. Totalitarian regime - there’s more than a few already - fake the telemetry domain name certificates and snoop on all your activities. Coupled to other humint they can easily trace a profile of all your whereabouts, habits, projects and relations both online and IRL. Then one day you disappear.
- naikrovek 8y agoThat's a hell of a leap. One day you're contributing to open source and the next day you're dead because of telemetry? Give me a fucking break. Oh, I forgot, OSS contributors are vital state resources targeted by foreign governments and drug gangs alike, and both of them have access to how you use open source Winforms. I get it, now. (Sarcasm complete. My points here are that you aren't a target of any totalitarian regime, and that totalitarian regimes don't need telemetry to make you disappear.)
- eecc 8y agoHmm, you may have heard that the USA used mobile network telemetry data to drop missiles on top of people's heads.
- naikrovek 8y agoSorry, I forgot I was on the internet. I should have said "usage telemetry." I forgot that being on the internet means that people can't really follow unless everything is spelled out precisely. It doesn't matter that the whole conversation was about usage telemetry, it needs to be specified. Are you switching the conversation topic from open source software telemetry to mobile phone tracking? That's a whole other thing, and doesn't contribute to the in-progress discussion on open source software telemetry, nor does it prove me (or anyone else) wrong.
- eecc 8y agoI’m sorry but how do the two differ? Specifically regarding the potential of privacy intrusion, identity fingerprinting and localization?
- kgwxd 8y agoAgreed, but that's asking way too much apparently. With a global opt-out, it should be easy enough to shame the software not honoring it and they get to keep taking advantage of the people that just don't care without pissing off the ones that do.
- derefr 8y agoIf it was opt-in, all the people who didn’t care either way wouldn’t bother to opt in, because—even if you have ideals suggesting it’d be better if they knew who used what features—satisfying that ideal isn’t worth the effort of finding and checking a box. (See also: the organ donor registry.) Making something like this opt-in is equivalent to not having it at all. Not just because of how little pick-up there would be on the telemetry, but also because the type of people who would opt in are a skewed sample not representative of the larger user-base they wish to learn about. It’s like the bias introduced by doing an opinion poll by asking people to do a one-hour opinion poll over the phone: you filter out the average person who doesn’t have time to do a one-hour poll, and get responses only from people with too much time on their hands (= unemployed; teenagers pretending to be adults; old people who just want attention; etc.)
- laythea 8y ago"Making something like this opt-in is equivalent to not having it at all" People who say opt in, would generally opt out. People who say opt out, would generally opt in. This applies to anything. In this case, given its about collecting my data and processing me, I say Opt In. Not having it at all is a good thing.
- derefr 8y agoMy point was that the only useful options are “an opt-out telemetry system” and “no telemetry system.” An opt-in telemetry system is wasted effort from the point of view of gathering results with statistical power. And no, the people who want opt-out would not generally opt in in an opt-in system. That'd be their preference, yes, but you’re underestimating people’s laziness in practice. There are things I’d grant telemetry access to, but I don’t know how and don’t have time in the day to learn how, especially since it grants very little advantage to me personally.
- ohithereyou 8y agoMaybe if we got something in exchange for the actual value of our data (say, Microsoft paid us per machine, per user, per hour used) then it would be worth it to opt-in.
- dddddaviddddd 8y agoI imagine this would look a lot like the IPv4 security flag or the do not track header in practice. https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt
- whatshisface 8y agoMicrosoft sends enough telemetry that they alone could make the DO_NOT_TRACK registry key completely worth it.
- kgwxd 8y agoI assume that's a joke :) I agree that Do Not Track and anything that looks like that RFC are useless, but they assume bad actors and includes software that doesn't run on the users machine. What I'm talking about assumes good actors and code running only on the users machine. MS and others already have ways to disable the telemetry, usually, so they want to play nice. With open source software, it's easy enough to check the code is looking at the environment variable and doing the right thing with it. Closed software still shouldn't be trusted, nothing will fix that.
- andrewflnr 8y agoCheck the date on the RFC.
- kgwxd 8y agoHA! And yet 'Do Not Track' was proposed in 2009 and actually put into practice. Guess they didn't get the joke either :) What I'm proposing isn't either of those things though. It doesn't rely on just promises of other people. I can see the code I'm compiling and running on my machine and, as long as I don't let anyone else modify it arbitrarily, I can be sure it's doing what the code said. Yes, mistakes happen and sneaky code happens but, for a vendor that actually wants to play nice, too many mistakes or even a single attempt at sneaky code will ruin their reputation. And, again, I know this won't fix closed source code or malware.
- wang_li 8y agoIf we make the developer, the developer's manager, and the entire org chart from there up to the CEO personally and criminally liable for any leaks and improper use of data, there would be zero need to opt out as they could not then externalize the costs of their shitty practices.
- xyzzy_plugh 8y agoI'm fine with simply C-levels being held responsible, which is how this traditionally worked anyways.
- 21 8y agoWe would also stop having any new software. Do you really want all software to cost $1 million per line like NASA software? Do you want the high school kid in his bedroom to go to prison because he wrote a "site" and his friends data got leaked?
- alexanderdmitri 8y agoI think there's middle ground here.
- jhall1468 8y agoYes, criminalize software bugs. Brilliant idea.
- wang_li 8y agoOnly in the context of data gathering. There is plenty of buggy software that doesn't result in my social security number, credit report, passwords, and chat history spread across the internet. It's no different than requiring, e.g., farmers to limit how and when they apply fertilizer and pesticides so as to limit runoff and down stream pollution.
- jhall1468 8y agoNo it is different, because this a conversation about telemetry which is exactly none of your social, credit report or passwords. Suggesting that developers should be criminally liable for your usage statics getting released is borderline insane.
- setquk 8y agoThey'd fuck it up if it existed. They shipped Debian packages that the environment variable didn't work on. Opt out telemetry is NOT an option. Opt in is. I've been fighting this position since they added it to .Net Core and will continue to do so.
- kgwxd 8y agoIt's already fucked. This could be checked much easier than looking for new flags every release and figuring out those do what they should. If they fuck it up too much, we'll know they're either malicious or incompetent, both are very good reasons to stop using their code.
- setquk 8y agoThey are both malicious and incompetent for sure. Firstly because collecting data is more important than customer preference and secondly because when the customer did make a preference or state a preference they screwed up and told the customer to fuck off respectively. Now after 16 years of using .Net and building a lot of massive products this is the status quo of how I have been treated all along and it hasn’t changed one little bit other than the marketing so it’s time to get off the ride. At this point I firmly believe that the “open source” drive here is part of a new market domination strategy rather than something for altruistic good. Fair enough but I don’t have any love left to give now. If you ship some stuff on every platform it looks like you are an attractive option and once you’ve bought in you can’t get off the crack smoking schizophrenic rollercoaster. I want off.
- anticensor 8y agoIn other words, how we find out color of your computer.
- Kiro 8y agoAm I the only one who always accepts these kind of "help improve the product" things? I want to help improve the product.
- etatoby 8y agoI also usually accept those requests. I don't see what all the fuss is about.
- cptskippy 8y agoSo you're why all my products suck! I do the same.
- reitanqild 8y agoNo, that's because companies prioritize short term at every turn ;-)
- floatboth 8y agoSame. I run Firefox Nightly with everything under "Nightly Data Collection and Use" checked.
- calcifer 8y agoSame. I have all telemetry and Shield studies enabled in Firefox.
- burk96 8y agoI have some telemetry enabled on Firefox as well, but that is mainly because I trust Mozilla to be more ethical than most other companies. (For the record I'm not saying they're perfect and that everyone should trust them!)
- airstrike 8y agoI generally figure there are enough people like you that they don't need my data as well, so I opt out, if nothing else to spare my computer a bit of resources
- herpderperator 8y agoLooks like enabling telemetry was one of the first things they did: https://github.com/dotnet/winforms/pull/6 https://github.com/dotnet/winforms/pull/6