16 ms·

FWIW that isn’t a unique identifier for the author, it’s for Wacom’s GA account. I didn’t see any meaningful identifier being sent. Of course the set of most op

FWIW that isn’t a unique identifier for the author, it’s for Wacom’s GA account. I didn’t see any meaningful identifier being sent. Of course the set of most opened apps and your IP are probably enough to identify you. That said, yep, it seems lame they don’t disclose this tracking. I can understand why they’d want to know what apps their device pairs most often with, but tracking all app opens seems aggressive, but maybe it’s the only way to identify what app is open when the device is used. (I work for an analytics company)

penagwin 7y ago
Tracking the currently open application software side is perfectly within scope for a drawing tablet - they often have buttons that can be bound to keyboard shortcuts, etc. It makes sense that it should know when you're focused on Photoshop vs Google Chrome. But why are they sending this data to a server? My best guess is that this helps them focus on what software people are using. This allows them access to the popularity of graphic applications. They get to see what percentage of users use say Photoshop vs [Other program here] - so they know where to prioritize integrations and testing. But I'm not sure how much "integrations" or work with third parties Wacom does - the drawing tablets are following an api standard after all. But maybe wacom does work directly with application devs, I don't really know. I doubt they're doing this to try to track individual users - even if there are ways to do it. That said I really wish they approached this with a more friendly "Would you like to enable some basic Telemetry to improve Wacom products - Yes, No" instead of a very unfriendly user agreement where they try to force it.
- Joe-Z 7y ago
  IMO the more simple explanation is they want this data to sell to data aggregators, who can in turn enrich the profile they have on you. There's a similar thing going on with smart TVs, right?
  - hkmurakami 7y ago
    That seems pretty unlikely for a mid sized, independently operated/capitalized Japanese company tbh.
    - Joe-Z 7y ago
      Why? Because they don't have enough users for this to be worth it you mean?
    - phoe-krk 7y ago
      Unless they want easy money. Show me a modern mid-sized, independently operated/capitalized corporation that doesn't want it.
      - csallen 7y ago
        Having started numerous tech companies myself, interviewed hundreds of others who have, and started a community that instructions others on how to do so, I will say that HN's perception of how easy, profitable, and common it is to have a business model focused on selling data is overblown. I'd wager the vast majority of data collectors (e.g. Google Analytics accounts) just want it for their own internal decision-making and analysis.
        phoe-krk 7y ago
        As much as I would like to believe you, I cannot. With literally almost every company around me gathering analytics and with every average person's operating system, web browser, social media, phones, televisions, smart locks, smart fridges, graphic card drivers and graphic tablets sending this data out in bulk, you are not going to convince me that the authors of all that software are siphoning data out of us all for nothing.
        jasonlotito 7y ago
        > you are not going to convince me that the authors of all that software are siphoning data out of us all for nothing. That's not what they are saying at all, and suggesting it's for nothing proves you don't understand the value of using the data for internal decision making. Simply put: the main use of this data is for that reason: internal decision making. Answering questions like: * How are our customers using our products? * What errors are they experiencing? * What features are they using? * Where are they confused? * What features cause the most problems? * What feature should we work on next? These are all regular questions that are answered by collecting these types of metrics, including the one described in this post. Selling the data to third parties isn't easy. The data is generally gathered to inform product decisions, not to sell, so it's not in any easy format that makes it easy to sell. One has to go out of their way to sell this data, and the cost to put together this data in a way that's useful to sell would almost certainly cost more to setup and manage than they would get from such a small number of relative users. The simple fact is, everyone sends data back to their servers for collecting and parsing, including Apple, the company everyone puts on a pedestal for privacy. Simply put: show me the evidence they are selling the data to third parties for profit. Anything less is speculation.
  - penagwin 7y ago
    I know this is the popular conclusion - but from a developer perspective, data such as what software your product is used with is INCREDIBLY valuable for project planning and prioritization. People hate web tracking, but knowing what browsers or devices are visiting your website can be enormously helpful. Also I don't know all the details here - I know that Vizio TVs where collecting data and explicitly kept the IP and other personal data with it. I don't know if wacom is doing that. Now that said - I don't like that they're handing this data to Google through Google Analytics. I also think they should be far more up front about what they collect, what they use it for, etc.
    - vageli 7y ago
      > I know this is the popular conclusion - but from a developer perspective, data such as what software your product is used with is INCREDIBLY valuable for project planning and prioritization. People hate web tracking, but knowing what browsers or devices are visiting your website can be enormously helpful. What happened to actually communicating with users to learn more about how they use the product?
      - Kalium 7y ago
        That assumes a great deal about both the resources available to do it and the ability to get responses from a representative sample of customers. It's not challenging to see why someone might choose a one-time cost in software engineering over an ongoing cost in communication.
        adamc 7y ago
        It's not challenging, but it's wrong. If you want to explain it to them, making a binding promise of what it would be used for, and have it be opt-in, that would be another thing. It's not hard to see how to do it right.
        Kalium 7y ago
        Morally and ethically, you're absolutely correct in every single possible way. I was attempting to illustrate the decision-making processes that may have led to this juncture and what happened to communicating with customers. Please accept my apologies, as I have plainly failed to be clear that this was not an argument as to the moral or ethical questions concerned. Again, you're completely right. It's not at all difficult to see the morally and ethically correct way to go about this.
  - pvaldes 7y ago
    > IMO the more simple explanation is they want this data to sell to data aggregators Seems the obvious answer, yep.
  - deleted 7y ago
    [deleted]
  - Rapzid 7y ago
    It's certainly the more cynical explanation. I believe wanting it for product development is just as simple.
  - dwild 7y ago
    Can you even export this information with PII on Google Analytics or only aggregate of that information?
    - andybak 7y ago
      Only aggregate
      - dwild 7y ago
        Then if the goal was to sell, they wouldn't use Google Analytic.
  - FireBeyond 7y ago
    It would be "simpler" to say, but that doesn't invalidate the other reason. My tablet behaves differently per application. If I typically have one app open only on one screen I can limit the tablets "workspace". Context-specific buttons based on app. And if you're doing that _and have build sufficient app infrastructure around it_ as Wacom has to support fairly custom per-app behavior, the more realistic conclusion is that they're trying to get more info on that - now you can argue about opt in on the "share experience data" privacy setting - and I would agree, absolutely. But "more simple to say that they're just selling data for money" is a pretty reductionist argument that jumps solely to the most negative possible motivation. "What's the worst they could be doing with it? Selling it? That's probably what they're doing, not making their tool more useful."
  - andybak 7y ago
    > IMO the more simple explanation For me Occam's Razor points towards internal analytics.
- thewebcount 7y ago
  It doesn't really matter what their reasons are. Having the data is a liability. The author explained one scenario where these things can go wrong. Another is if they're hacked. Or if they're purchased by a larger unethical company. Or if they accidentally keep the data in an open database on an Amazon cloud service. Or a million other scenarios.
jancsika 7y ago
FWIW that isn’t a unique identifier for the author, it’s for Nike’s marketing account. I didn’t see that the Nike employee who hid in the author's closet wrote down any meaningful identifier on their form. Of course the set of the most popular gym floors where the author wore the shoes and the author's home address are probably enough to identify you. That said, yep, it seems lame they don’t disclose this tracking. I can understand why they’d want to know where their pairs of shoes most often travel, but tracking all gyms seems aggressive, but maybe it’s the only way to identify what gym floor the shoes were used in. (I work for Adidas)
paranoidrobot 7y ago
The browser is one to commonly put personal identifiers in the title bar. Pretty much every site you visit puts PII in the title, which the browser dutifully includes in it's title. GSuite leaks my email address: "Inbox - my.email@example.corp - Example Corp Mail - Mozilla Firefox" Desktop apps are pretty much no different. Outlook leaks my email address, and subject lines of emails or meeting information: "Inbox - my.email@example.corp - Outlook" "EMBARGOED Friday 7th ::: Corp Revenue for 2019, +25% over expectations! - Mesage (HTML)" "Meeting: Pre-Announcement, Dial-In +1 555 1234 ext 1234" Visual Studio leaks filenames, repository information: "page.html - corp-project-repo - Visual Studio Code" Pretty sure most office suite and Adobe apps will do something similar.
guug 7y ago
This tracking becomes a big issue when aggregated with other data. As someone who works for an analytics company, you should be well aware of this.
- codezero 7y ago
  I am aware.
nebulous1 7y ago
Isn't the cid being sent specifically to identify the user?
- codezero 7y ago
  Heya - I could swear that wasn't there when I originally wrote the comment, but obviously it is there. Thanks for pointing that out. With that said, it doesn't change the substance of my comment too much - as I pointed out one can get a pretty solid unique identifier many ways, not limited to what I said above, you could even call out the presence of a permanently identifying header that Chrome gives some users[0]. [0] https://news.ycombinator.com/item?id=22236106 https://news.ycombinator.com/item?id=22236106
tbodt 7y ago
The cid parameter (the one that's censored) is a unique identifier for the author.
- codezero 7y ago
  Heya, replied to another comment that brought up the same thing, sorry about that - here's what I wrote there: Heya - I could swear that wasn't there when I originally wrote the comment, but obviously it is there. Thanks for pointing that out. With that said, it doesn't change the substance of my comment too much - as I pointed out one can get a pretty solid unique identifier many ways, not limited to what I said above, you could even call out the presence of a permanently identifying header that Chrome gives some users[0]. [0] https://news.ycombinator.com/item?id=22236106 https://news.ycombinator.com/item?id=22236106

penagwin 7y ago

Tracking the currently open application software side is perfectly within scope for a drawing tablet - they often have buttons that can be bound to keyboard shortcuts, etc. It makes sense that it should know when you're focused on Photoshop vs Google Chrome. But why are they sending this data to a server? My best guess is that this helps them focus on what software people are using. This allows them access to the popularity of graphic applications. They get to see what percentage of users use say Photoshop vs [Other program here] - so they know where to prioritize integrations and testing. But I'm not sure how much "integrations" or work with third parties Wacom does - the drawing tablets are following an api standard after all. But maybe wacom does work directly with application devs, I don't really know. I doubt they're doing this to try to track individual users - even if there are ways to do it. That said I really wish they approached this with a more friendly "Would you like to enable some basic Telemetry to improve Wacom products - Yes, No" instead of a very unfriendly user agreement where they try to force it.

Joe-Z 7y ago
IMO the more simple explanation is they want this data to sell to data aggregators, who can in turn enrich the profile they have on you. There's a similar thing going on with smart TVs, right?
- hkmurakami 7y ago
  That seems pretty unlikely for a mid sized, independently operated/capitalized Japanese company tbh.
  - Joe-Z 7y ago
    Why? Because they don't have enough users for this to be worth it you mean?
  - phoe-krk 7y ago
    Unless they want easy money. Show me a modern mid-sized, independently operated/capitalized corporation that doesn't want it.
    - csallen 7y ago
      Having started numerous tech companies myself, interviewed hundreds of others who have, and started a community that instructions others on how to do so, I will say that HN's perception of how easy, profitable, and common it is to have a business model focused on selling data is overblown. I'd wager the vast majority of data collectors (e.g. Google Analytics accounts) just want it for their own internal decision-making and analysis.
      - phoe-krk 7y ago
        As much as I would like to believe you, I cannot. With literally almost every company around me gathering analytics and with every average person's operating system, web browser, social media, phones, televisions, smart locks, smart fridges, graphic card drivers and graphic tablets sending this data out in bulk, you are not going to convince me that the authors of all that software are siphoning data out of us all for nothing.
        jasonlotito 7y ago
        > you are not going to convince me that the authors of all that software are siphoning data out of us all for nothing. That's not what they are saying at all, and suggesting it's for nothing proves you don't understand the value of using the data for internal decision making. Simply put: the main use of this data is for that reason: internal decision making. Answering questions like: * How are our customers using our products? * What errors are they experiencing? * What features are they using? * Where are they confused? * What features cause the most problems? * What feature should we work on next? These are all regular questions that are answered by collecting these types of metrics, including the one described in this post. Selling the data to third parties isn't easy. The data is generally gathered to inform product decisions, not to sell, so it's not in any easy format that makes it easy to sell. One has to go out of their way to sell this data, and the cost to put together this data in a way that's useful to sell would almost certainly cost more to setup and manage than they would get from such a small number of relative users. The simple fact is, everyone sends data back to their servers for collecting and parsing, including Apple, the company everyone puts on a pedestal for privacy. Simply put: show me the evidence they are selling the data to third parties for profit. Anything less is speculation.
- penagwin 7y ago
  I know this is the popular conclusion - but from a developer perspective, data such as what software your product is used with is INCREDIBLY valuable for project planning and prioritization. People hate web tracking, but knowing what browsers or devices are visiting your website can be enormously helpful. Also I don't know all the details here - I know that Vizio TVs where collecting data and explicitly kept the IP and other personal data with it. I don't know if wacom is doing that. Now that said - I don't like that they're handing this data to Google through Google Analytics. I also think they should be far more up front about what they collect, what they use it for, etc.
  - vageli 7y ago
    > I know this is the popular conclusion - but from a developer perspective, data such as what software your product is used with is INCREDIBLY valuable for project planning and prioritization. People hate web tracking, but knowing what browsers or devices are visiting your website can be enormously helpful. What happened to actually communicating with users to learn more about how they use the product?
    - Kalium 7y ago
      That assumes a great deal about both the resources available to do it and the ability to get responses from a representative sample of customers. It's not challenging to see why someone might choose a one-time cost in software engineering over an ongoing cost in communication.
      - adamc 7y ago
        It's not challenging, but it's wrong. If you want to explain it to them, making a binding promise of what it would be used for, and have it be opt-in, that would be another thing. It's not hard to see how to do it right.
        Kalium 7y ago
        Morally and ethically, you're absolutely correct in every single possible way. I was attempting to illustrate the decision-making processes that may have led to this juncture and what happened to communicating with customers. Please accept my apologies, as I have plainly failed to be clear that this was not an argument as to the moral or ethical questions concerned. Again, you're completely right. It's not at all difficult to see the morally and ethically correct way to go about this.
- pvaldes 7y ago
  > IMO the more simple explanation is they want this data to sell to data aggregators Seems the obvious answer, yep.
- deleted 7y ago
  [deleted]
- Rapzid 7y ago
  It's certainly the more cynical explanation. I believe wanting it for product development is just as simple.
- dwild 7y ago
  Can you even export this information with PII on Google Analytics or only aggregate of that information?
  - andybak 7y ago
    Only aggregate
    - dwild 7y ago
      Then if the goal was to sell, they wouldn't use Google Analytic.
- FireBeyond 7y ago
  It would be "simpler" to say, but that doesn't invalidate the other reason. My tablet behaves differently per application. If I typically have one app open only on one screen I can limit the tablets "workspace". Context-specific buttons based on app. And if you're doing that _and have build sufficient app infrastructure around it_ as Wacom has to support fairly custom per-app behavior, the more realistic conclusion is that they're trying to get more info on that - now you can argue about opt in on the "share experience data" privacy setting - and I would agree, absolutely. But "more simple to say that they're just selling data for money" is a pretty reductionist argument that jumps solely to the most negative possible motivation. "What's the worst they could be doing with it? Selling it? That's probably what they're doing, not making their tool more useful."
- andybak 7y ago
  > IMO the more simple explanation For me Occam's Razor points towards internal analytics.
thewebcount 7y ago
It doesn't really matter what their reasons are. Having the data is a liability. The author explained one scenario where these things can go wrong. Another is if they're hacked. Or if they're purchased by a larger unethical company. Or if they accidentally keep the data in an open database on an Amazon cloud service. Or a million other scenarios.

jancsika 7y ago

FWIW that isn’t a unique identifier for the author, it’s for Nike’s marketing account. I didn’t see that the Nike employee who hid in the author's closet wrote down any meaningful identifier on their form. Of course the set of the most popular gym floors where the author wore the shoes and the author's home address are probably enough to identify you. That said, yep, it seems lame they don’t disclose this tracking. I can understand why they’d want to know where their pairs of shoes most often travel, but tracking all gyms seems aggressive, but maybe it’s the only way to identify what gym floor the shoes were used in. (I work for Adidas)

paranoidrobot 7y ago

The browser is one to commonly put personal identifiers in the title bar. Pretty much every site you visit puts PII in the title, which the browser dutifully includes in it's title. GSuite leaks my email address: "Inbox - my.email@example.corp - Example Corp Mail - Mozilla Firefox" Desktop apps are pretty much no different. Outlook leaks my email address, and subject lines of emails or meeting information: "Inbox - my.email@example.corp - Outlook" "EMBARGOED Friday 7th ::: Corp Revenue for 2019, +25% over expectations! - Mesage (HTML)" "Meeting: Pre-Announcement, Dial-In +1 555 1234 ext 1234" Visual Studio leaks filenames, repository information: "page.html - corp-project-repo - Visual Studio Code" Pretty sure most office suite and Adobe apps will do something similar.

guug 7y ago

This tracking becomes a big issue when aggregated with other data. As someone who works for an analytics company, you should be well aware of this.

codezero 7y ago
I am aware.

nebulous1 7y ago

Isn't the cid being sent specifically to identify the user?

codezero 7y ago
Heya - I could swear that wasn't there when I originally wrote the comment, but obviously it is there. Thanks for pointing that out. With that said, it doesn't change the substance of my comment too much - as I pointed out one can get a pretty solid unique identifier many ways, not limited to what I said above, you could even call out the presence of a permanently identifying header that Chrome gives some users[0]. [0] https://news.ycombinator.com/item?id=22236106 https://news.ycombinator.com/item?id=22236106

tbodt 7y ago

The cid parameter (the one that's censored) is a unique identifier for the author.

codezero 7y ago
Heya, replied to another comment that brought up the same thing, sorry about that - here's what I wrote there: Heya - I could swear that wasn't there when I originally wrote the comment, but obviously it is there. Thanks for pointing that out. With that said, it doesn't change the substance of my comment too much - as I pointed out one can get a pretty solid unique identifier many ways, not limited to what I said above, you could even call out the presence of a permanently identifying header that Chrome gives some users[0]. [0] https://news.ycombinator.com/item?id=22236106 https://news.ycombinator.com/item?id=22236106