8 ms·
How about opt-in? Privacy should be the default.
by ahoka 8y ago
How about opt-in? Privacy should be the default.
- naikrovek 8y agoWould someone please explain to me how usage telemetry is a privacy invasion? I can't draw a line between those two things.
- kgwxd 8y agoI've yet to see anyone try to explain how it's not an invasion of privacy without actually making an argument for how it is an invasion of privacy.
- danmg 8y agoHow is telemetry not a privacy violation? It's sending back arbitrary data to someone else without explicit authorization. This data can contain anything including information about the running environment, the contents of files on the computer, other running programs. It doesn't matter that it's Microsoft instead of an Estonian teenager doing it. You own your computer. You explicitly decide what data comes from it. NO EXCEPTIONS.
- jhall1468 8y ago> It's sending back arbitrary data to someone else without explicit authorization. You are giving very explicit authorization by agreeing to the EULA. > You own your computer. You explicitly decide what data comes from it. NO EXCEPTIONS. That's still true. And by installing a product and agreeing to a EULA which includes a section on telemetry you are doing just that. Thus, your options are "don't install the software" or "opt-out".
- danmg 8y agoClick through EULAs are not legal documents. This has been established. It's also unlawful under the GDPR.
- blackoil 8y agoDoes telemetry contains any data that comes under GDPR?
- naikrovek 8y agoThey very much are legal documents, and they are binding.
- danmg 8y agoNope. Specht v. Netscape Communications Corp. dealt exactly with this sort of click through 'telemetry'. Doesn't matter if it's in a shrinkwrap license.
- ineedasername 8y agoEh, not quite so clear-cut. There were some big caveats in that decision "clicking on a download button does not show assent to license terms if those terms were not conspicuous and if it was not explicit to the consumer that clicking meant agreeing to the license" [0] It doesn't appear to say clickwraps are non-binding, only that it has to be "conspicuous" and basically that a user knew they were agreeing to something. Unfortunately that too is open to interpretation. As with most things of this nature, if someone wants to sue, they can sue, and it's a resource fight in the courts. [0] https://en.wikipedia.org/wiki/Specht_v._Netscape_Communications_Corp https://en.wikipedia.org/wiki/Specht_v._Netscape_Communicati....
- naikrovek 8y agoYep. I've got an attorney standing right next to me saying they are.
- justinclift 8y ago> You are giving very explicit authorization by agreeing to the EULA. Bullcrap. Many people's Win7 installs were upgraded to Win10 without their consent. To claim otherwise is blatantly dishonest.
- laythea 8y agoMaybe this will help. True story. I just moved into my rented house and discovered the CCTV outside my front door, in public view, but also on my property, is actually monitored by the landlord, not me. - you = me - software = house - telemetry = CCTV
- IMTDb 8y agoAlso a true story I just entered a new mall and discovered that they monitors how many people come in and out (and at what time) in order to ensure they have enough cashier. - you = me - software = mall - monitoring basic metrics in order to improve the service = counting people in/out This is completely OK, and somehow everybody likes that they increase the number of cashier during busy time. Just like the mall, you do not own the software, you juste have the right to enter/use it.
- laythea 8y agoIt's not sending back "the software". It is sending back data about you. And who knows what. Indeed, human greed is faster moving than regulation, so its no wonder we are in the transition phase. And if you tell me all this identifiable data about me is safe, this is simply not true. Safe from motivated 3rd parties, then this is also not true. Unfortunately, we do not live in this ideal world where data is used for only good. We live in a world where people get away with undetected overreach all the time.
- svick 8y ago> It is sending back data about you. And who knows what. This is specifically about telemetry in an open source code. If you want to know what data it sends, you can look for yourself.
- naikrovek 8y ago> my rented house > my property Those two things don't jive. It's your property OR you rent it. Not both.
- evross 8y agoThe privacy issue can happen in two ways that I can think of: 1. Unclear boundaries of data. How many points of data are being collected and sent 'home'? CPU performance? OK. Device name, pc username, usage duration, times the program is opened and closed. System account email address, IP address, hostnames contacted (i.e. websites visited), WiFi-based location, webcam stream for inference of end-user mood, microphone for emotion analytics? These are all examples of telemetry that could be argued are 'needed' for purely for product improvement. 2. Even if only a couple of data points are collected, it is very possible to identify the real name of the end user through analytics of the data. This inferred information is very valuable, and definitely is then a privacy issue. I hope the vast majority of developers and company execs don't intend to 'do evil' with this information, but unfortunately we have seen examples of this from public companies, despite auditing etc.
- eecc 8y agoOk. Totalitarian regime - there’s more than a few already - fake the telemetry domain name certificates and snoop on all your activities. Coupled to other humint they can easily trace a profile of all your whereabouts, habits, projects and relations both online and IRL. Then one day you disappear.
- naikrovek 8y agoThat's a hell of a leap. One day you're contributing to open source and the next day you're dead because of telemetry? Give me a fucking break. Oh, I forgot, OSS contributors are vital state resources targeted by foreign governments and drug gangs alike, and both of them have access to how you use open source Winforms. I get it, now. (Sarcasm complete. My points here are that you aren't a target of any totalitarian regime, and that totalitarian regimes don't need telemetry to make you disappear.)
- eecc 8y agoHmm, you may have heard that the USA used mobile network telemetry data to drop missiles on top of people's heads.
- naikrovek 8y agoSorry, I forgot I was on the internet. I should have said "usage telemetry." I forgot that being on the internet means that people can't really follow unless everything is spelled out precisely. It doesn't matter that the whole conversation was about usage telemetry, it needs to be specified. Are you switching the conversation topic from open source software telemetry to mobile phone tracking? That's a whole other thing, and doesn't contribute to the in-progress discussion on open source software telemetry, nor does it prove me (or anyone else) wrong.
- eecc 8y agoI’m sorry but how do the two differ? Specifically regarding the potential of privacy intrusion, identity fingerprinting and localization?
- kgwxd 8y agoAgreed, but that's asking way too much apparently. With a global opt-out, it should be easy enough to shame the software not honoring it and they get to keep taking advantage of the people that just don't care without pissing off the ones that do.
- derefr 8y agoIf it was opt-in, all the people who didn’t care either way wouldn’t bother to opt in, because—even if you have ideals suggesting it’d be better if they knew who used what features—satisfying that ideal isn’t worth the effort of finding and checking a box. (See also: the organ donor registry.) Making something like this opt-in is equivalent to not having it at all. Not just because of how little pick-up there would be on the telemetry, but also because the type of people who would opt in are a skewed sample not representative of the larger user-base they wish to learn about. It’s like the bias introduced by doing an opinion poll by asking people to do a one-hour opinion poll over the phone: you filter out the average person who doesn’t have time to do a one-hour poll, and get responses only from people with too much time on their hands (= unemployed; teenagers pretending to be adults; old people who just want attention; etc.)
- laythea 8y ago"Making something like this opt-in is equivalent to not having it at all" People who say opt in, would generally opt out. People who say opt out, would generally opt in. This applies to anything. In this case, given its about collecting my data and processing me, I say Opt In. Not having it at all is a good thing.
- derefr 8y agoMy point was that the only useful options are “an opt-out telemetry system” and “no telemetry system.” An opt-in telemetry system is wasted effort from the point of view of gathering results with statistical power. And no, the people who want opt-out would not generally opt in in an opt-in system. That'd be their preference, yes, but you’re underestimating people’s laziness in practice. There are things I’d grant telemetry access to, but I don’t know how and don’t have time in the day to learn how, especially since it grants very little advantage to me personally.
- ohithereyou 8y agoMaybe if we got something in exchange for the actual value of our data (say, Microsoft paid us per machine, per user, per hour used) then it would be worth it to opt-in.