7 ms·

It performs an auto-update check. You know it's just performing an auto-update check. While there's not no argument to be made here, it's not like it's secretly

by urthen 7y ago

It performs an auto-update check. You know it's just performing an auto-update check. While there's not no argument to be made here, it's not like it's secretly collecting a bunch of data and reporting it before letting you opt out. The paranoid, accusatory tone in the issue does nothing to help your argument, and I believe makes it harder for maintainers to take you seriously. Your argument is well thought out, and I don't necessarily disagree with it in principle, but you're making mountains out of molehills here. If you'd simply pointed out the issue and asked that the auto-update check be performed after the consent check - especially if it came with a PR implementing that - you'd go a lot further.

sneak 7y ago
> You know it's just performing an auto-update check Actually, I don't. I didn't agree to let it phone home. It does it before it tells me anything at all. It's also connecting to the telemetry service endpoint immediately on launch, despite not having selected a telemetry consent setting yet. How about this one? It phones home when you click "don't phone home". https://github.com/atom/atom/issues/20185 https://github.com/atom/atom/issues/20185
- urthen 7y ago
  Don't use Atom then? Seems pretty obvious if you care that much. I respect your privacy views and even share many/most of them (if not so strictly), and appreciate that you are probably just trying to bring this to people's attention. However, you are not the king of open source, and you cannot dictate how other authors must write their projects. It's an open source product written by a for-profit company. There's always going to be trade-offs.
  - sneak 7y ago
    > However, you are not the king of open source, and you cannot dictate how other authors must write their projects No, but I can convince other people who don't like their computers being used a spying tools against them to put social pressure on maintainers so that they stop doing this nonsense. Atom's telemetry used to be on by default; spying silently caused them such a shitstorm that they added a consent dialog. They're almost there! Now they just have to make it functional. https://github.com/atom/atom/pull/12281 https://github.com/atom/atom/pull/12281 There are precedents. We can push back, especially against open source projects. > There's always going to be trade-offs. I don't think that's how software works. I certainly don't take that to mean that I should just accept that it's going to spy on me. I don't want that, and I don't accept that, and I will yell, loudly, at anyone who says I should accept that without a fight.
    - sjwright 7y ago
      It’s open source. They aren’t forcing you to use their software, and they’re certainly not forcing you to use their binaries.
      - sneak 7y ago
        i use Little Snitch and DNS blackholing of tracking services, so these issues don't really affect me. today i decided i care more about strangers than i thought i did people brand new to our industry should be able to download a nice gui editor and not get their consent trampled and get spied on even after they click the "dont spy on me" button it's easy to laugh and be like "oh lol it's software from microsoft what did they expect, noobs" like someone else did in this thread but that's bullshit and you and i both know it the software simply shouldn't do that when you say "don't send my data away pls" i don't want everyone to have to say "oh use homebrew it's great but also add this weird line about analytics to your .bashrc before you install it oh wait you don't know what a bashrc is huh" when they talk to some teenager who just got a $15 rtlsdr and wants to install gnuradio on their mac that's not a good first-10-minutes-at-the-command-line experience. i don't think that's fair or good or optimal. i want the world to be different, and i want these maintainers to realize that they made a mistake, and revert it. i don't think they're bad people, i think they're just misguided, and they're optimizing for vanity metrics like user count, which will effectively go away entirely if i succeed and they only get telemetry from users who said "yes it's ok i don't mind". that's a lot fewer users, and they know it, which is why so many of them are refusing to engage with the ethical argument about silently using a user's own hardware to spy on them without their knowledge or consent. it shouldn't be a controversial position that our tools should not spy on us.
        BubRoss 7y ago
        > i use Little Snitch and DNS blackholing of tracking services Why do you need that when you can just not use things that spy on you (by your own logic)
        saagarjha 7y ago
  - marcinzm 7y ago
    >However, you are not the king of open source, and you cannot dictate how other authors must write their projects. And you're not the king of what people are allowed to voice their views and opinions on in public forums. Authors can do whatever they want and users can say whatever they want as a result. Doing something does not mean you are free of the consequences, including people voicing their opinions, of those actions.
  - CKN23-ARIN 7y ago
    > However, you are not the king of open source I am, however, the king of my own computer, and this software does not respect my sovereignty.
    - urthen 7y ago
      Like I said - if it matters to you, don't use it. I've never had a problem with people that have extremely strict views of privacy. In fact I usually think they're right. But it's incredibly impractical, and most people don't currently care, which is the real problem. Treating relatively trivial things like this as if it were some conspiracy on behalf of the surveillance state doesn't do anything to get people to listen. Get people to start dropping Facebook and Google, then we can start tackling the smaller offenses like this. Until then, treating this like you're going up against the NSA is a vanity exercise.
      - catalogia 7y ago
        > "Like I said - if it matters to you, don't use it." Or he can do one better: Not use it and publicly criticize it.
        sjwright 7y ago
        That’s not “better”, in fact it’s not really in the spirit of open source, where criticism comes in the form of patches and forks. “Doing one better” would be patching and compiling from source yourself. Better still would be maintaining an up-to-date fork for the benefit of other like-minded people.
        sneak 7y ago
        Ok, I'll bite. Open source is a hacker thing. Hackers like open source because it avoids useless duplication of effort, which is toilsome and wasteful. Hackers don't like toil and unnecessary waste. Forks are nothing but otherwise-unnecessary waste. They become necessary through asshattery like spying on users, but they are a last resort, because everything else about a fork is antithetical to most hackers: it's boring, wasteful, duplicated work, induced solely by an unreasonable upstream. We try a lot of things before we fork, including naming and shaming.
  - squeaky-clean 7y ago
    Please don't make the "Don't use atom then" argument in response to someone sharing unexpected info about Atom. No one is saying that they are being forced to use Atom. They are sharing info others may not know about Atom. You're saying "Don't use Atom", but what you're implying is "Don't talk about Atom"
  - taneq 7y ago
    How are you meant to know about this a priori unless you've read an article about it on an obscure tech website?
    - edoceo 7y ago
      Use strace on every process? Inspect all code that ever runs on your boxen? Those work but, I still prefer the canary-article. Much easier.
      - taneq 7y ago
        What'd be really nice is transparent, built-in sandboxing of every non-system application by the OS. The desktop security model of "protect your files from other users but not from applications you run" is horribly outdated.
        rossmohax 7y ago
        flatpack on Linux has all ingredients to enforce such sandboxing
        matheusmoreira 7y ago
        On top of all that, we also need deep packet inspection and filtering. All the data flowing into and out of the sandbox must be inspected while in the clear by filtering software under our control. If the packet is known to contain nothing but a unique identifier for tracking, it gets blocked. If it also contains useful data, the identifier is either deleted or anonymized before the packet goes through. ISPs, companies and governments can do it for surveillance, censorship and security reasons. We should be able to do it too in order to empower ourselves.
egdod 7y ago
It’s reporting your IP address. That’s not nothing.
- na85 7y ago
  What's the alternative? I'm not sure how a client can query a server for updates without exposing its IP address beyond obfuscation like TOR or perhaps a VPN.
  - hashkb 7y ago
    It can just obtain the user's consent; and, if denied, the alternative is to not phone home at all.
    - na85 7y ago
      I suppose, but that smacks of toejam-eating extremism in my opinion. I recall reading a study that showed the #1 most common habit among compute security professionals was having automatic updates enabled. The idea that you're willing to risk running an outdated version in today's extremely adversarial computing environment just to avoid "leaking" your IP address just doesn't make any sense to me. I thought we stopped considering IP addresses as confidential information years ago?
    - mirimir 7y ago
      That's pretty much the norm in Linux. One typically gets packages from the distro's repository. And traffic with modern repositories uses HTTPS. So third parties don't see what packages are being used. And unless one configures a developer repository, there's never any traffic to the developer. Also, IP addresses are considered PII under GDPR. Edit: Still, if one cares that much about ones IP address, it's prudent to use a VPN service or Tor.
      - colejohnson66 7y ago
        > Also, IP addresses are considered PII under GDPR. Not true. They’re only PII if they can be used to connect something to a person. It’s a minor distinction, but it is one nonetheless.
hashkb 7y ago
The maintainers who reply dodge the issue in a way that must be frustrating to the reporter; and makes it seems like they'd probably not accept a PR that modified this behavior. Calling privacy advocates "paranoid" in today's climate is a bit suspect. There's a definite issue here that the Atom team should address - a reasonable user would expect that, after opting out, the app would never phone home, and it does. Blaming tone is too easy - at this point the Atom team is representing Microsoft, so I'd say the burden is on them to soak up a little snark; especially coming from a user who maybe expects them to behave a bit more like the GitHub of old. Even if they were a small open-source team I would still expect them to directly confront the issue instead of beating around the bush. It's about privacy, and splitting hairs to deny the reporter's reality is a bad look.
- urthen 7y ago
  The application clearly states that it sends an opt-out notification anonymously after opt-out. I think they're doing better than most in terms of transparency. Is there room for improvement? Sure. But I don't think attacking people who are already doing pretty well compared to the field is the best use of anyone's time. This is just picking on an open-source team which already has shown themselves to take user feedback about privacy seriously. If you are so suspect of third parties that any device or application sending any network traffic without previous authorization is of serious concern to you, there's a lot more important and impactful products to voice concern about. Like pretty much any other part of Microsoft.
- lukasb 7y ago
  The "never phone home" UI should make it clear that it will still phone home to check for updates. But I'm sympathetic to Github here. Having users on unpatched software is a bigger risk to them than not having 100% perfect insulation from sending their IP address to Microsoft.
  - vunie 7y ago
    >Having users on unpatched software is a bigger risk to them than not having 100% perfect insulation from sending their IP address to Microsoft. That's not a decision for Github to make. Let the user decide. Perhaps by even presenting them with a dialog on first run that informs them then asks them ti decide.
TAForObvReasons 7y ago
The more interesting question, which you completely sidestep by trying to categorize the leaked info, is whether software should perform an auto-update check before giving you an option to opt out. I don't think the author would have been concerned if they were asked whether the software should check for updates.
- bromuro 7y ago
  MacOS apps are used to prompt a dialog - atom should too.

by urthen 7y ago

sneak 7y ago

> You know it's just performing an auto-update check Actually, I don't. I didn't agree to let it phone home. It does it before it tells me anything at all. It's also connecting to the telemetry service endpoint immediately on launch, despite not having selected a telemetry consent setting yet. How about this one? It phones home when you click "don't phone home". https://github.com/atom/atom/issues/20185 https://github.com/atom/atom/issues/20185

urthen 7y ago
Don't use Atom then? Seems pretty obvious if you care that much. I respect your privacy views and even share many/most of them (if not so strictly), and appreciate that you are probably just trying to bring this to people's attention. However, you are not the king of open source, and you cannot dictate how other authors must write their projects. It's an open source product written by a for-profit company. There's always going to be trade-offs.
- sneak 7y ago
  > However, you are not the king of open source, and you cannot dictate how other authors must write their projects No, but I can convince other people who don't like their computers being used a spying tools against them to put social pressure on maintainers so that they stop doing this nonsense. Atom's telemetry used to be on by default; spying silently caused them such a shitstorm that they added a consent dialog. They're almost there! Now they just have to make it functional. https://github.com/atom/atom/pull/12281 https://github.com/atom/atom/pull/12281 There are precedents. We can push back, especially against open source projects. > There's always going to be trade-offs. I don't think that's how software works. I certainly don't take that to mean that I should just accept that it's going to spy on me. I don't want that, and I don't accept that, and I will yell, loudly, at anyone who says I should accept that without a fight.
  - sjwright 7y ago
    It’s open source. They aren’t forcing you to use their software, and they’re certainly not forcing you to use their binaries.
    - sneak 7y ago
      i use Little Snitch and DNS blackholing of tracking services, so these issues don't really affect me. today i decided i care more about strangers than i thought i did people brand new to our industry should be able to download a nice gui editor and not get their consent trampled and get spied on even after they click the "dont spy on me" button it's easy to laugh and be like "oh lol it's software from microsoft what did they expect, noobs" like someone else did in this thread but that's bullshit and you and i both know it the software simply shouldn't do that when you say "don't send my data away pls" i don't want everyone to have to say "oh use homebrew it's great but also add this weird line about analytics to your .bashrc before you install it oh wait you don't know what a bashrc is huh" when they talk to some teenager who just got a $15 rtlsdr and wants to install gnuradio on their mac that's not a good first-10-minutes-at-the-command-line experience. i don't think that's fair or good or optimal. i want the world to be different, and i want these maintainers to realize that they made a mistake, and revert it. i don't think they're bad people, i think they're just misguided, and they're optimizing for vanity metrics like user count, which will effectively go away entirely if i succeed and they only get telemetry from users who said "yes it's ok i don't mind". that's a lot fewer users, and they know it, which is why so many of them are refusing to engage with the ethical argument about silently using a user's own hardware to spy on them without their knowledge or consent. it shouldn't be a controversial position that our tools should not spy on us.
      - BubRoss 7y ago
        > i use Little Snitch and DNS blackholing of tracking services Why do you need that when you can just not use things that spy on you (by your own logic)
        saagarjha 7y ago
- marcinzm 7y ago
  >However, you are not the king of open source, and you cannot dictate how other authors must write their projects. And you're not the king of what people are allowed to voice their views and opinions on in public forums. Authors can do whatever they want and users can say whatever they want as a result. Doing something does not mean you are free of the consequences, including people voicing their opinions, of those actions.
- CKN23-ARIN 7y ago
  > However, you are not the king of open source I am, however, the king of my own computer, and this software does not respect my sovereignty.
  - urthen 7y ago
    Like I said - if it matters to you, don't use it. I've never had a problem with people that have extremely strict views of privacy. In fact I usually think they're right. But it's incredibly impractical, and most people don't currently care, which is the real problem. Treating relatively trivial things like this as if it were some conspiracy on behalf of the surveillance state doesn't do anything to get people to listen. Get people to start dropping Facebook and Google, then we can start tackling the smaller offenses like this. Until then, treating this like you're going up against the NSA is a vanity exercise.
    - catalogia 7y ago
      > "Like I said - if it matters to you, don't use it." Or he can do one better: Not use it and publicly criticize it.
      - sjwright 7y ago
        That’s not “better”, in fact it’s not really in the spirit of open source, where criticism comes in the form of patches and forks. “Doing one better” would be patching and compiling from source yourself. Better still would be maintaining an up-to-date fork for the benefit of other like-minded people.
        sneak 7y ago
        Ok, I'll bite. Open source is a hacker thing. Hackers like open source because it avoids useless duplication of effort, which is toilsome and wasteful. Hackers don't like toil and unnecessary waste. Forks are nothing but otherwise-unnecessary waste. They become necessary through asshattery like spying on users, but they are a last resort, because everything else about a fork is antithetical to most hackers: it's boring, wasteful, duplicated work, induced solely by an unreasonable upstream. We try a lot of things before we fork, including naming and shaming.
- squeaky-clean 7y ago
  Please don't make the "Don't use atom then" argument in response to someone sharing unexpected info about Atom. No one is saying that they are being forced to use Atom. They are sharing info others may not know about Atom. You're saying "Don't use Atom", but what you're implying is "Don't talk about Atom"
- taneq 7y ago
  How are you meant to know about this a priori unless you've read an article about it on an obscure tech website?
  - edoceo 7y ago
    Use strace on every process? Inspect all code that ever runs on your boxen? Those work but, I still prefer the canary-article. Much easier.
    - taneq 7y ago
      What'd be really nice is transparent, built-in sandboxing of every non-system application by the OS. The desktop security model of "protect your files from other users but not from applications you run" is horribly outdated.
      - rossmohax 7y ago
        flatpack on Linux has all ingredients to enforce such sandboxing
      - matheusmoreira 7y ago
        On top of all that, we also need deep packet inspection and filtering. All the data flowing into and out of the sandbox must be inspected while in the clear by filtering software under our control. If the packet is known to contain nothing but a unique identifier for tracking, it gets blocked. If it also contains useful data, the identifier is either deleted or anonymized before the packet goes through. ISPs, companies and governments can do it for surveillance, censorship and security reasons. We should be able to do it too in order to empower ourselves.

egdod 7y ago

It’s reporting your IP address. That’s not nothing.

na85 7y ago
What's the alternative? I'm not sure how a client can query a server for updates without exposing its IP address beyond obfuscation like TOR or perhaps a VPN.
- hashkb 7y ago
  It can just obtain the user's consent; and, if denied, the alternative is to not phone home at all.
  - na85 7y ago
    I suppose, but that smacks of toejam-eating extremism in my opinion. I recall reading a study that showed the #1 most common habit among compute security professionals was having automatic updates enabled. The idea that you're willing to risk running an outdated version in today's extremely adversarial computing environment just to avoid "leaking" your IP address just doesn't make any sense to me. I thought we stopped considering IP addresses as confidential information years ago?
  - mirimir 7y ago
    That's pretty much the norm in Linux. One typically gets packages from the distro's repository. And traffic with modern repositories uses HTTPS. So third parties don't see what packages are being used. And unless one configures a developer repository, there's never any traffic to the developer. Also, IP addresses are considered PII under GDPR. Edit: Still, if one cares that much about ones IP address, it's prudent to use a VPN service or Tor.
    - colejohnson66 7y ago
      > Also, IP addresses are considered PII under GDPR. Not true. They’re only PII if they can be used to connect something to a person. It’s a minor distinction, but it is one nonetheless.

hashkb 7y ago

The maintainers who reply dodge the issue in a way that must be frustrating to the reporter; and makes it seems like they'd probably not accept a PR that modified this behavior. Calling privacy advocates "paranoid" in today's climate is a bit suspect. There's a definite issue here that the Atom team should address - a reasonable user would expect that, after opting out, the app would never phone home, and it does. Blaming tone is too easy - at this point the Atom team is representing Microsoft, so I'd say the burden is on them to soak up a little snark; especially coming from a user who maybe expects them to behave a bit more like the GitHub of old. Even if they were a small open-source team I would still expect them to directly confront the issue instead of beating around the bush. It's about privacy, and splitting hairs to deny the reporter's reality is a bad look.

urthen 7y ago
The application clearly states that it sends an opt-out notification anonymously after opt-out. I think they're doing better than most in terms of transparency. Is there room for improvement? Sure. But I don't think attacking people who are already doing pretty well compared to the field is the best use of anyone's time. This is just picking on an open-source team which already has shown themselves to take user feedback about privacy seriously. If you are so suspect of third parties that any device or application sending any network traffic without previous authorization is of serious concern to you, there's a lot more important and impactful products to voice concern about. Like pretty much any other part of Microsoft.
lukasb 7y ago
The "never phone home" UI should make it clear that it will still phone home to check for updates. But I'm sympathetic to Github here. Having users on unpatched software is a bigger risk to them than not having 100% perfect insulation from sending their IP address to Microsoft.
- vunie 7y ago
  >Having users on unpatched software is a bigger risk to them than not having 100% perfect insulation from sending their IP address to Microsoft. That's not a decision for Github to make. Let the user decide. Perhaps by even presenting them with a dialog on first run that informs them then asks them ti decide.

TAForObvReasons 7y ago

The more interesting question, which you completely sidestep by trying to categorize the leaked info, is whether software should perform an auto-update check before giving you an option to opt out. I don't think the author would have been concerned if they were asked whether the software should check for updates.

bromuro 7y ago
MacOS apps are used to prompt a dialog - atom should too.