24 ms·

Windows package manager does not permit opting out of telemetry

428 points by ccmcarey 6y ago

Wowfunhappy 6y ago
Since it’s open source, I wonder if anyone will be willing to maintain a branch that has all the telemetry removed, but is otherwise basically unchanged and so can connect to the normal repositories.
- Bedon292 6y ago
  Don't think that is even necessary, is it? The private builds of it share no telemetry. Just need someone to build it and share their build I think.
cowmix 6y ago
While I love WSL2, my biggest beef with the install process is I had to turn on almost every crap privacy-busting feature back on. I had 'decrapified' my Windows 10 install previously and the WSL2 reversed almost all that.
- m463 6y ago
  mua-ha-ha-ha-ha
  - dang 6y ago
    Please don't do this here.
- AndrewGaspar 6y ago
  That's probably a function of WSL2 currently only being available in Insider, no? If you want to use pre-release builds, I think it's fair to expect that you need to enable telemetry.
  - guug 6y ago
    > If you want to use pre-release builds, I think it's fair to expect that you need to enable telemetry. I wouldn't.
- 2OEH8eoCRo0 6y ago
  Why did you install a preview build of Windows then? Wait for release.
narag 6y ago
Is this package manager in the default installation? How do I find out if I have it?
- ccmcarey 6y ago
  It's a new package manager, currently just in preview. Discussed on HN a few days ago - https://news.ycombinator.com/item?id=23236218 https://news.ycombinator.com/item?id=23236218
Voloskaya 6y ago
That's not what I understand. > diagnostic data collection (telemetry) is not enabled for private builds > this data collection is covered by windows 10 privacy, You can find the windows 10 privacy statement and details of controlling the diagnostic and feedback settings here. So if you build from source, you can disable it, and if you don't build from source but install it from the store, then telemetry is controlled by the central privacy settings in Windows 10. Presumably this would be a problem only if you specifically don't want MS to have telemetry from winget, but you also specicifically want them to have telemetry on the rest of your OS, which would be... weird.
- ccmcarey 6y ago
  It's not quite so clear. The data collection policy linked in the comment (that can be controlled in settings) distinguishes between required and optional data collection. It's possible to disable optional data collection, but not required data collection. Here's one of the elements that is required (and so it cannot be disabled): Information about your device, its settings and capabilities, including applications and drivers installed on your device I find that quite obtrusive.
  - Voloskaya 6y ago
    The required telemetry is already gathered by windows 10 though. My point is to say that if you disable the optional telemtry in W10, then presumably winget doesn't collect anything. So while I agree with you that the required telemetry is obtrusive, it's not new and it's not related to winget.
    - ccmcarey 6y ago
      This project collects usage data and sends it to Microsoft to help improve our products and services It's this type of broad data collection disclaimer that I find lacking in modern products. Usage data? It's not clear what that is, or what exactly is being recorded, and what is sent that is required, and what is sent that is optional.
jjordan 6y ago
When it comes to things like this, it feels like old "Linux is a cancer" Microsoft is battling the new multi-platform open-source Microsoft for whether the company should be evil or not.
- seemslegit 6y ago
  There is no new Microsoft - this is the "embrace, extend, extinguish" Microsoft of always, betting that the forkable nature of open source will not matter in practice, so far correctly.
nperez 6y ago
I recently installed an Insider build of Windows so I could use WSL2 to run some docker containers in a Linux environment. The insider build requires that you enable full telemetry which includes sending your visited websites to MS. I need WSL2 so I’m just avoiding doing anything private on my personal computer for now. I understand why the data is useful to them but I don’t think they understand or care why this is an important issue to others
- Voloskaya 6y ago
  On the other hand, an insider build is a beta, the only purpose of this is specifically to be able to get telemetry to detect issues before releasing.
  - dr-detroit 6y ago
    Every complaint about microsoft on hackernews comes from some teen whose never heard of Windows Enterprise and has no idea what they're complaining about.
  - techntoke 6y ago
    How does logging websites you visit help Linux? Windows 10 2004 is already RTM. I've never understood why Microsoft hides their ISO images. It's like they want people to install a version of their OS with a bunch of manufacturer spyware or missing multiple major updates which take hours to install and leaves a bunch of files/directories behind.
    - joombaga 6y ago
      Maybe I'm missing the point, but you can download ISOs with the media creation tool.
      - vetinari 6y ago
        If you want to download ISO, you must pretend you are not Windows. Otherwise, it will redirect you to the media creation tool, that will download bunch of files that it wants to hide from you and insist on creating a media for you.
fartcannon 6y ago
According to a recent post, we spend 34 years of our lives staring at screens. If Microsoft wants 34 years of data on each of us, let's collectively bargain on a value for it.
wereHamster 6y ago
> Um no, you need to allow opting out of telemetry. Entitled people is what drives developers away from projects.
alkonaut 6y ago
Are people worried about the actual contents of these kinds of telemetry, or rather just annoyed by the fact that it's there at all? The first position seems a bit odd for something that is open source (so presumably you can verify what's being sent). I mean it might be bad to send "I installed product X" or "I used the command X" to a remote server, but on the other hand if I really feel this is a problem would I ever even be using the closed source binaries that the package manager installs, without worrying more what they might do, than what happened when the package manager ran? Some times I get the feeling that the telemetry thing just became an expression of annoyance with something else entirely, or just the current state of affairs. It's like one of those cultural wars where every battle is so symbolic that everyone forgot what the real issue was ("Why do we worry so much about who uses which bathroom again dad?").
- ccmcarey 6y ago
  > Are people worried about the actual contents of these kinds of telemetry, or rather just annoyed by the fact that it's there at all? Both, I imagine. Worried about the contents because the trend of companies pulling in as much data as they can tends to not end well for consumers, and annoyed as it's an invasion of privacy that there is tracking for the many things we do on our personal devices.
- xkapastel 6y ago
  Windows itself collects telemetry so I can see your point, but your example is bad. Single sex bathrooms are not symbolic at all and are a serious issue.
- jka 6y ago
  Without necessarily being worried or annoyed by telemetry, I could understand that people might question the need for it; is it required by other package managers? Collecting data creates a risk that the data will be intercepted or misused at a later point, and there are often legal requirements regarding data collection and processing too.
- aspenmayer 6y ago
  We have regard for bathrooms as well as telemetry for a shared reason: privacy and a sense of control and safety. We are exposed and we seek to limit our exposure.
pluc 6y ago
Makes you wonder what they've done or gonna do to the underlying GitHub infrastructure to further their marketing/whatever agenda.
anonymousab 6y ago
Telemetry seems to be a sore and curt topic with Microsoft. I've yet to see anyone make headway on even just having a discussion about it with public facing MS devs; it almost always gets a quick, rote toe-the-line response and the discussion gets terminated or blackballed or ignored thereafter. It has the airs of an internal mandate. I can't help but be deeply suspicious of this behaviour.
- nojito 6y ago
  Because the word telemetry has been bastardized by the online justice warrior community. People post on HN all the time at how software sucks and never improves....but how can a developer learn how their software is being used without being swayed by the vocal minority?
  - MaxBarraclough 6y ago
    You've given a defence of telemetry. You haven't given a defence for Microsoft's lack of openness, or for the lack of user choice.
  - dvfjsdhgfv 6y ago
    You make it a binary choice, whereas it's very simple: you can make the dafaults you like, but then you should also offer an option to opt out, clearly explaining what it does and why, and you should respect the choice of your customer throughout subsequent updates. This is what being decent means. Most people will just accept the defaults, so why piss the rest off?
  - ManlyBread 6y ago
    You can make telemetry opt-in and ask for consent at the moment of the installation. Microsoft refused to make it optional and lost the trust of millions of users worldwide, all while doing nothing to actually make Windows 10 suck less.
  - m0xte 6y ago
    No. I hope this burns to read. Software never improves because incompetence is the norm. Not because we didn't have a magical data collection unicorn available. Competent software companies ran user panels, had decent quality control, didn't steamroll their communities, didn't market loudly over user dissent and certainly didn't shut down their issue tracking to even their top tier partners. That was Microsoft 10 years ago. That is Microsoft today. But you know, Telemetry solves all these problems doesn't it? No The real answer to your question: ask and listen. People will gladly tell you. Do not just take the data otherwise you end up with a set of poorly selected metrics which do not represent user opinion and a lot of pissed off customers who don't want to or can't tell you due to legislation and data protection.
jeroenhd 6y ago
I would have expected Microsoft to stalk their users like always and go for an opt-out instead of an opt-in (which, by the way, is legally required according to the GDPR but national privacy offices seem unwilling to actually take Microsoft to court). What's sad is that Microsoft actively lied in its description and privacy statement by stating it's possible to opt out of tracking. This is not possible for Windows 10 Home and Pro users. Advertising that opting out is possible when it's not is a blatant lie.
nojito 6y ago
This whole bastardization of the word 'Telemetry' by the online community is completely abhorrent. It is impossible to get proper usage feedback from your programs without being swayed by the vocal minority community. We always find posts online on how crappy software is, but how can software improve if the majority of people actually using the software don't give feedback at all? https://xkcd.com/1172/ https://xkcd.com/1172/
- JMTQp8lwXL 6y ago
  This looks like a straw man. Automatic collection and transmission of usage data is not what is meant by "giving feedback". Giving feedback is manually opting to provide a statement about the experience of using the software. Giving feedback is uncontroversial.
  - darkwater 6y ago
    > Giving feedback is manually opting to provide a statement about the experience of using the software Which almost nobody does, unless they are either completely unsatisfied with the software or completely in love with the software (just like TripAdvisor feedback)
    - DeepYogurt 6y ago
      > Which almost nobody does, unless they are either completely unsatisfied with the software or completely in love with the software (just like TripAdvisor feedback) Good point. Better build in a surveillance engine to spy on your users. /s
      - darkwater 6y ago
        If feedback is truly anonymous AND can be opted out anyway - which I know is the OP issue - I don't have any problem with it.
    - JMTQp8lwXL 6y ago
      At least in the enterprise space, many users won't provide feedback because they feel the product teams won't do anything with the feedback, since someone above your pay grade agreed to pay for the software -- ergo, your opinion does not impact the bottom line.
wintermutestwin 6y ago
Why do we use MS's terminology for it (telemetry) when it is essentially theft of private and sensitive data? From what I have gathered, they are snarfing up my browsing data and what applications I have installed. I don't have the time or energy to jump through the hoops to figure out how to stop this blatant invasion of my privacy. On top of that, I've read that win10 shows ads in the actual OS. That is so beyond unacceptable that I am stuck on an unsupported OS (7) As a result, I now have only two windows7 boxes - one for gaming and one that I use as a front end for some specialized audio hardware. Each box is dedicated to that purpose and is relegated to a subnet. 20 years ago, 90% of my computing was on windows - now it is <10%. Soon, I'll get another mac to do all my audio work on and, eventually, I'll relegate my gaming to Linux available titles.
iphone_elegance 6y ago
Eh, looking at the code it's pretty benign
tinfoil10 6y ago
Tin foil hat here. The person posting this is the lead maintainer of Chocolatey, a long standing 3rd party Windows package manager. Although the point is reasonable (why NOT just provide an opt out, like .NET SDK?), it seems to me that there is a potential ulterior motive in dragging down winget.
- ocdtrekkie 6y ago
  Probably because the .NET SDK is a separate program, and winget is being slipped into a default component app of Windows 10. I am irritated about Windows 10's telemetry policy, but it makes sense for component applications to obey the system telemetry configuration rather than each one having their own settings.
- driverdan 6y ago
  I downvoted you because motive doesn't matter, the facts stand alone.
enitihas 6y ago
I thought everyone knew it was the pseudo official Microsoft policy to extract as much data as possible. I mean if you use windows, you must be anyways used to something like this.
thrower123 6y ago
I wouldn't mind the Windows telemetry, if it ever seemed like they were using it to actually fix things that suck. However, it's been almost ten years since the Start Menu search has worked at all, and wonky multi-monitor and settings/control panel settings dichotomies persist. Some have posited that this official package manager will be a death blow to Chocolatey, but I doubt it.
shanemhansen 6y ago
My .02 cents. To me the arguments I read here around "but product improvement is hard so that justifies collecting the data" ring hollow. When your convenience at work is balanced against someones right to privacy, there's no middle ground. Privacy wins. You need active informed consent to phone home for reasons not related to the proper functioning of the application. I wish most applications offered 3 boxes: 1) Don't send telemetry 2) Send data needed to catch bad rollouts (think SRE style status code and latency metrics). 3) Send anonymized data to help improve the product. 4) I want to be a beta tester/insider, you can capture my logs.
- kgwxd 6y ago
  0) Don't compile the code responsible for the telemetry into the binary because I don't trust the checkboxes will always be respected in code. Especially after seeing an off-by-one error in the description :)
  - fsflover 6y ago
    -1) Open source the code, so people can check that you really do what you declare.
mycall 6y ago
Could Pi-hole stop it?
- hedora 6y ago
  Microsoft adds new telemetry domains on a regular basis, so it would be a cat and mouse game. I imagine if a large percentage of machines used DNS black holes, they’d move to DoH with a pinned certificate.
deleted 6y ago
[deleted]
cessor 6y ago
I find it outrageous; "Telemetry" is built into most new Microsoft software. For example, they recently released a replacement for powershell and CMD, called "Terminal 1.0", which also comes with some aggressive telemetry built in: https://github.com/microsoft/terminal/blob/master/src/host/telemetry.cpp https://github.com/microsoft/terminal/blob/master/src/host/t... This also applies to newer releases of powershell, aka PS Core. I haven't tried either, but I guarantee you telemetry in both applications is not opt-in but opt out using some obscure method, if that is even possible. In any case, the claim that telemetry is necessary to improve anything related to customer experience is ridiculous. Not only is a general data collection unnecessary; it would be more efficient to run some experiments, and be it some opt in A/B tests. Surveillance like the above is encroaching and can easily be abused. The data collected are usually fine-grained enough to allow for some nice fingerprinting of individual users. The potential for abuse is high.
- justadudeama 6y ago
  Maybe I don't understand all the way, but I see this line of code in there: `TraceLoggingUInt32(_rguiTimesApiUsed[GetConsoleAliases], "GetConsoleAliases"),` Is that sending Microsoft all of my bash/zsh aliases? And what about `TraceLoggingUInt32(_rguiTimesApiUsed[GetConsoleTitle], "GetConsoleTitle"),` If it works how most other Terminals I have used - that is going to send the name of the program I am running or host I am connected to to Microsoft. I think that is pretty invasive if you ask me.
  - DHowett 6y ago
    I dunno. The name "_rguiTimesApiUsed" (and that it's a "uint32") suggests that it's a count of times an API was used, not the raw data that went through that API. EDIT: I put together a list of what happens in this file in a sibling comment.
- DHowett 6y ago
  I'm just gonna recycle the bits I've posted here before about this exact file :) [1] https://news.ycombinator.com/item?id=22331345 https://news.ycombinator.com/item?id=22331345 [2] https://news.ycombinator.com/item?id=19322398 https://news.ycombinator.com/item?id=19322398, https://news.ycombinator.com/item?id=19324538 https://news.ycombinator.com/item?id=19324538 The file you've identified produces a local, opt-in event stream that does not leave your machine unless you literally e-mail it to me. It's just got that unfortunate word in the filename that means we're bad guys. EDIT, upon closer inspection: when this is built as part of the Windows product (which consumes source from this repository) those values may end up in an event stream. In the interest of full disclosure, those events are: 1. Part of the console host (conhost.exe) and covered by the Windows global data collection settings 2. Pertaining to (incomplete, but it's too early in the morning for me to do a full review of this code): 2.a. The number of times each low-level console API was used 2.b. How the legacy Find dialog is being used (long strings, short strings, search direction, number of times) 2.c. Specific settings like font size, how many colors are configured, how big the window and buffer are
towndrunk 6y ago
So what exactly is it sending back to MS?
brenden2 6y ago
I don't use Windows, and the only Microsoft product I have installed is VS Code (with telemetry explicitly disabled), but in spite of that about 10% of all the blocked DNS requests according to my pi-hole are to Microsoft's telemetry servers at watson.telemetry.microsoft.com.
slim 6y ago
On the topic of Microsoft is not less evil than before : today I needed to use Teams, I was pleasantly surprised by the fact it supported a web client. I tried to use it and got caught in a tunnel of dark ux. You go to the website, click to sign in, get asked for your email and password, then verify your email, then you discover that you actually signed up for something else and now you can signup for teams. You follow the wizard again, then you are told to use Skype because you are not a company. You restart and make sure to check the box saying you are a company, then put your company info, it works! You try to start a call, and you get told it does not work in firefox...
- jdsully 6y ago
  Yea a lot of microsoft stuff doesn’t work in Firefox. They are the worst of all the big companies at supporting it.
  - techsupporter 6y ago
    Which is hilarious since if you spoof your Firefox UA string to be Chrome or Edgeium, all Teams features work properly in the browser.
    - ccmcarey 6y ago
      Yep. Google also offers a lot of "rich cards" in their search (interactive things mostly) that are only available on Chrome .. unless you change the user agent of another browser to Chrome, in which case it also works perfectly.
      - saagarjha 6y ago
        Google actually seems to show those to me occasionally in Safari.
      - lou1306 6y ago
        IANAL but would not that be grounds for abuse of dominant position? Using their dominance in web search to undercut competing browser vendors?
TeddyDD 6y ago
Well, you are using Windows (basically a spyware), why do you pretend that you care about privacy?
jannes 6y ago
Here is Microsoft's privacy dashboard: https://account.microsoft.com/privacy/ https://account.microsoft.com/privacy/ It lets you delete at least some of the data. Although I don't know if it includes the data from the package manager. Here you can contact their Data Protection Officer if you would like to ask: https://www.microsoft.com/en-GB/concern/privacy https://www.microsoft.com/en-GB/concern/privacy
Animats 6y ago
Opt out of Windows. My last Windows 7 machine broke down, and the few Windows programs I needed to run are now running under Wine on Linux. I've never used Windows 10 except in a store demo. Decided I didn't want it.
nromiun 6y ago
Anybody else really turned off by the unnecessary amount of internet access in these new CLI tools? It's not just telemetry. Some tools will just access the internet even when they don't need to (my favourite is checking for a new version with every command). I like the CLI because it is so minimal and transparent (compared to GUI). But that seems to be changing these days.
anonymousiam 6y ago
Good example of a use case for Pi-Hole.
HeadsUpHigh 6y ago
Sounds like someone forgot to turn the pretend button on.
arh68 6y ago
Half-serious startup idea: Telemetry Escrow, where I send data to Escrow, can inspect what it is, then Microsoft pays per datum. Escrow holds all historicals / some samples, depending on tier. Does the data have value?, after all? How much..
CawCawCaw 6y ago
Ha... here's an experiment you can try on Windows, assuming you haven't previously taken steps to debloat the system. 1. Run procmon.exe /noconnect from Sysinternals 2. Filter -> Drop Filtered Events 3. Ctrl-L, Add Filter -> 'Path' Contains 'Telemetry' then 'Include' and Add 4. Press OK and then Ctrl-E (Start Capture) 5. Leave it running for a few minutes
underko 6y ago
The assumption that windows package manager does not permit opting out of telemetry seems to be wrong. The whole issue is not stating how to opt out and someone assumed that it means it is not possible. However, based on the updated readme https://github.com/microsoft/winget-cli#datatelemetry https://github.com/microsoft/winget-cli#datatelemetry there was a way to opt-out from the beggining, just not documented. Yes, it should have been clarified from the start, but I think it's positive the option was always there and they managed to clarify how to opt-out in mere 7 hours.

428 points by ccmcarey 6y ago

Since it’s open source, I wonder if anyone will be willing to maintain a branch that has all the telemetry removed, but is otherwise basically unchanged and so can connect to the normal repositories.

Bedon292 6y ago
Don't think that is even necessary, is it? The private builds of it share no telemetry. Just need someone to build it and share their build I think.

cowmix 6y ago

While I love WSL2, my biggest beef with the install process is I had to turn on almost every crap privacy-busting feature back on. I had 'decrapified' my Windows 10 install previously and the WSL2 reversed almost all that.

m463 6y ago
mua-ha-ha-ha-ha
- dang 6y ago
  Please don't do this here.
AndrewGaspar 6y ago
That's probably a function of WSL2 currently only being available in Insider, no? If you want to use pre-release builds, I think it's fair to expect that you need to enable telemetry.
- guug 6y ago
  > If you want to use pre-release builds, I think it's fair to expect that you need to enable telemetry. I wouldn't.
2OEH8eoCRo0 6y ago
Why did you install a preview build of Windows then? Wait for release.

narag 6y ago

Is this package manager in the default installation? How do I find out if I have it?

ccmcarey 6y ago
It's a new package manager, currently just in preview. Discussed on HN a few days ago - https://news.ycombinator.com/item?id=23236218 https://news.ycombinator.com/item?id=23236218

Voloskaya 6y ago

That's not what I understand. > diagnostic data collection (telemetry) is not enabled for private builds > this data collection is covered by windows 10 privacy, You can find the windows 10 privacy statement and details of controlling the diagnostic and feedback settings here. So if you build from source, you can disable it, and if you don't build from source but install it from the store, then telemetry is controlled by the central privacy settings in Windows 10. Presumably this would be a problem only if you specifically don't want MS to have telemetry from winget, but you also specicifically want them to have telemetry on the rest of your OS, which would be... weird.

ccmcarey 6y ago
It's not quite so clear. The data collection policy linked in the comment (that can be controlled in settings) distinguishes between required and optional data collection. It's possible to disable optional data collection, but not required data collection. Here's one of the elements that is required (and so it cannot be disabled): Information about your device, its settings and capabilities, including applications and drivers installed on your device I find that quite obtrusive.
- Voloskaya 6y ago
  The required telemetry is already gathered by windows 10 though. My point is to say that if you disable the optional telemtry in W10, then presumably winget doesn't collect anything. So while I agree with you that the required telemetry is obtrusive, it's not new and it's not related to winget.
  - ccmcarey 6y ago
    This project collects usage data and sends it to Microsoft to help improve our products and services It's this type of broad data collection disclaimer that I find lacking in modern products. Usage data? It's not clear what that is, or what exactly is being recorded, and what is sent that is required, and what is sent that is optional.

jjordan 6y ago

When it comes to things like this, it feels like old "Linux is a cancer" Microsoft is battling the new multi-platform open-source Microsoft for whether the company should be evil or not.

seemslegit 6y ago
There is no new Microsoft - this is the "embrace, extend, extinguish" Microsoft of always, betting that the forkable nature of open source will not matter in practice, so far correctly.

nperez 6y ago

I recently installed an Insider build of Windows so I could use WSL2 to run some docker containers in a Linux environment. The insider build requires that you enable full telemetry which includes sending your visited websites to MS. I need WSL2 so I’m just avoiding doing anything private on my personal computer for now. I understand why the data is useful to them but I don’t think they understand or care why this is an important issue to others

Voloskaya 6y ago
On the other hand, an insider build is a beta, the only purpose of this is specifically to be able to get telemetry to detect issues before releasing.
- dr-detroit 6y ago
  Every complaint about microsoft on hackernews comes from some teen whose never heard of Windows Enterprise and has no idea what they're complaining about.
- techntoke 6y ago
  How does logging websites you visit help Linux? Windows 10 2004 is already RTM. I've never understood why Microsoft hides their ISO images. It's like they want people to install a version of their OS with a bunch of manufacturer spyware or missing multiple major updates which take hours to install and leaves a bunch of files/directories behind.
  - joombaga 6y ago
    Maybe I'm missing the point, but you can download ISOs with the media creation tool.
    - vetinari 6y ago
      If you want to download ISO, you must pretend you are not Windows. Otherwise, it will redirect you to the media creation tool, that will download bunch of files that it wants to hide from you and insist on creating a media for you.

fartcannon 6y ago

According to a recent post, we spend 34 years of our lives staring at screens. If Microsoft wants 34 years of data on each of us, let's collectively bargain on a value for it.

wereHamster 6y ago

> Um no, you need to allow opting out of telemetry. Entitled people is what drives developers away from projects.

alkonaut 6y ago

Are people worried about the actual contents of these kinds of telemetry, or rather just annoyed by the fact that it's there at all? The first position seems a bit odd for something that is open source (so presumably you can verify what's being sent). I mean it might be bad to send "I installed product X" or "I used the command X" to a remote server, but on the other hand if I really feel this is a problem would I ever even be using the closed source binaries that the package manager installs, without worrying more what they might do, than what happened when the package manager ran? Some times I get the feeling that the telemetry thing just became an expression of annoyance with something else entirely, or just the current state of affairs. It's like one of those cultural wars where every battle is so symbolic that everyone forgot what the real issue was ("Why do we worry so much about who uses which bathroom again dad?").

ccmcarey 6y ago
> Are people worried about the actual contents of these kinds of telemetry, or rather just annoyed by the fact that it's there at all? Both, I imagine. Worried about the contents because the trend of companies pulling in as much data as they can tends to not end well for consumers, and annoyed as it's an invasion of privacy that there is tracking for the many things we do on our personal devices.
xkapastel 6y ago
Windows itself collects telemetry so I can see your point, but your example is bad. Single sex bathrooms are not symbolic at all and are a serious issue.
jka 6y ago
Without necessarily being worried or annoyed by telemetry, I could understand that people might question the need for it; is it required by other package managers? Collecting data creates a risk that the data will be intercepted or misused at a later point, and there are often legal requirements regarding data collection and processing too.
aspenmayer 6y ago
We have regard for bathrooms as well as telemetry for a shared reason: privacy and a sense of control and safety. We are exposed and we seek to limit our exposure.

pluc 6y ago

Makes you wonder what they've done or gonna do to the underlying GitHub infrastructure to further their marketing/whatever agenda.

anonymousab 6y ago

Telemetry seems to be a sore and curt topic with Microsoft. I've yet to see anyone make headway on even just having a discussion about it with public facing MS devs; it almost always gets a quick, rote toe-the-line response and the discussion gets terminated or blackballed or ignored thereafter. It has the airs of an internal mandate. I can't help but be deeply suspicious of this behaviour.

nojito 6y ago
Because the word telemetry has been bastardized by the online justice warrior community. People post on HN all the time at how software sucks and never improves....but how can a developer learn how their software is being used without being swayed by the vocal minority?
- MaxBarraclough 6y ago
  You've given a defence of telemetry. You haven't given a defence for Microsoft's lack of openness, or for the lack of user choice.
- dvfjsdhgfv 6y ago
  You make it a binary choice, whereas it's very simple: you can make the dafaults you like, but then you should also offer an option to opt out, clearly explaining what it does and why, and you should respect the choice of your customer throughout subsequent updates. This is what being decent means. Most people will just accept the defaults, so why piss the rest off?
- ManlyBread 6y ago
  You can make telemetry opt-in and ask for consent at the moment of the installation. Microsoft refused to make it optional and lost the trust of millions of users worldwide, all while doing nothing to actually make Windows 10 suck less.
- m0xte 6y ago
  No. I hope this burns to read. Software never improves because incompetence is the norm. Not because we didn't have a magical data collection unicorn available. Competent software companies ran user panels, had decent quality control, didn't steamroll their communities, didn't market loudly over user dissent and certainly didn't shut down their issue tracking to even their top tier partners. That was Microsoft 10 years ago. That is Microsoft today. But you know, Telemetry solves all these problems doesn't it? No The real answer to your question: ask and listen. People will gladly tell you. Do not just take the data otherwise you end up with a set of poorly selected metrics which do not represent user opinion and a lot of pissed off customers who don't want to or can't tell you due to legislation and data protection.

jeroenhd 6y ago

I would have expected Microsoft to stalk their users like always and go for an opt-out instead of an opt-in (which, by the way, is legally required according to the GDPR but national privacy offices seem unwilling to actually take Microsoft to court). What's sad is that Microsoft actively lied in its description and privacy statement by stating it's possible to opt out of tracking. This is not possible for Windows 10 Home and Pro users. Advertising that opting out is possible when it's not is a blatant lie.

nojito 6y ago

This whole bastardization of the word 'Telemetry' by the online community is completely abhorrent. It is impossible to get proper usage feedback from your programs without being swayed by the vocal minority community. We always find posts online on how crappy software is, but how can software improve if the majority of people actually using the software don't give feedback at all? https://xkcd.com/1172/ https://xkcd.com/1172/

JMTQp8lwXL 6y ago
This looks like a straw man. Automatic collection and transmission of usage data is not what is meant by "giving feedback". Giving feedback is manually opting to provide a statement about the experience of using the software. Giving feedback is uncontroversial.
- darkwater 6y ago
  > Giving feedback is manually opting to provide a statement about the experience of using the software Which almost nobody does, unless they are either completely unsatisfied with the software or completely in love with the software (just like TripAdvisor feedback)
  - DeepYogurt 6y ago
    > Which almost nobody does, unless they are either completely unsatisfied with the software or completely in love with the software (just like TripAdvisor feedback) Good point. Better build in a surveillance engine to spy on your users. /s
    - darkwater 6y ago
      If feedback is truly anonymous AND can be opted out anyway - which I know is the OP issue - I don't have any problem with it.
  - JMTQp8lwXL 6y ago
    At least in the enterprise space, many users won't provide feedback because they feel the product teams won't do anything with the feedback, since someone above your pay grade agreed to pay for the software -- ergo, your opinion does not impact the bottom line.

wintermutestwin 6y ago

Why do we use MS's terminology for it (telemetry) when it is essentially theft of private and sensitive data? From what I have gathered, they are snarfing up my browsing data and what applications I have installed. I don't have the time or energy to jump through the hoops to figure out how to stop this blatant invasion of my privacy. On top of that, I've read that win10 shows ads in the actual OS. That is so beyond unacceptable that I am stuck on an unsupported OS (7) As a result, I now have only two windows7 boxes - one for gaming and one that I use as a front end for some specialized audio hardware. Each box is dedicated to that purpose and is relegated to a subnet. 20 years ago, 90% of my computing was on windows - now it is <10%. Soon, I'll get another mac to do all my audio work on and, eventually, I'll relegate my gaming to Linux available titles.

iphone_elegance 6y ago

Eh, looking at the code it's pretty benign

tinfoil10 6y ago

Tin foil hat here. The person posting this is the lead maintainer of Chocolatey, a long standing 3rd party Windows package manager. Although the point is reasonable (why NOT just provide an opt out, like .NET SDK?), it seems to me that there is a potential ulterior motive in dragging down winget.

ocdtrekkie 6y ago
Probably because the .NET SDK is a separate program, and winget is being slipped into a default component app of Windows 10. I am irritated about Windows 10's telemetry policy, but it makes sense for component applications to obey the system telemetry configuration rather than each one having their own settings.
driverdan 6y ago
I downvoted you because motive doesn't matter, the facts stand alone.

enitihas 6y ago

I thought everyone knew it was the pseudo official Microsoft policy to extract as much data as possible. I mean if you use windows, you must be anyways used to something like this.

thrower123 6y ago

I wouldn't mind the Windows telemetry, if it ever seemed like they were using it to actually fix things that suck. However, it's been almost ten years since the Start Menu search has worked at all, and wonky multi-monitor and settings/control panel settings dichotomies persist. Some have posited that this official package manager will be a death blow to Chocolatey, but I doubt it.

shanemhansen 6y ago

My .02 cents. To me the arguments I read here around "but product improvement is hard so that justifies collecting the data" ring hollow. When your convenience at work is balanced against someones right to privacy, there's no middle ground. Privacy wins. You need active informed consent to phone home for reasons not related to the proper functioning of the application. I wish most applications offered 3 boxes: 1) Don't send telemetry 2) Send data needed to catch bad rollouts (think SRE style status code and latency metrics). 3) Send anonymized data to help improve the product. 4) I want to be a beta tester/insider, you can capture my logs.

kgwxd 6y ago
0) Don't compile the code responsible for the telemetry into the binary because I don't trust the checkboxes will always be respected in code. Especially after seeing an off-by-one error in the description :)
- fsflover 6y ago
  -1) Open source the code, so people can check that you really do what you declare.

mycall 6y ago

Could Pi-hole stop it?

hedora 6y ago
Microsoft adds new telemetry domains on a regular basis, so it would be a cat and mouse game. I imagine if a large percentage of machines used DNS black holes, they’d move to DoH with a pinned certificate.

deleted 6y ago

[deleted]

cessor 6y ago

I find it outrageous; "Telemetry" is built into most new Microsoft software. For example, they recently released a replacement for powershell and CMD, called "Terminal 1.0", which also comes with some aggressive telemetry built in: https://github.com/microsoft/terminal/blob/master/src/host/telemetry.cpp https://github.com/microsoft/terminal/blob/master/src/host/t... This also applies to newer releases of powershell, aka PS Core. I haven't tried either, but I guarantee you telemetry in both applications is not opt-in but opt out using some obscure method, if that is even possible. In any case, the claim that telemetry is necessary to improve anything related to customer experience is ridiculous. Not only is a general data collection unnecessary; it would be more efficient to run some experiments, and be it some opt in A/B tests. Surveillance like the above is encroaching and can easily be abused. The data collected are usually fine-grained enough to allow for some nice fingerprinting of individual users. The potential for abuse is high.

justadudeama 6y ago
Maybe I don't understand all the way, but I see this line of code in there: `TraceLoggingUInt32(_rguiTimesApiUsed[GetConsoleAliases], "GetConsoleAliases"),` Is that sending Microsoft all of my bash/zsh aliases? And what about `TraceLoggingUInt32(_rguiTimesApiUsed[GetConsoleTitle], "GetConsoleTitle"),` If it works how most other Terminals I have used - that is going to send the name of the program I am running or host I am connected to to Microsoft. I think that is pretty invasive if you ask me.
- DHowett 6y ago
  I dunno. The name "_rguiTimesApiUsed" (and that it's a "uint32") suggests that it's a count of times an API was used, not the raw data that went through that API. EDIT: I put together a list of what happens in this file in a sibling comment.
DHowett 6y ago
I'm just gonna recycle the bits I've posted here before about this exact file :) [1] https://news.ycombinator.com/item?id=22331345 https://news.ycombinator.com/item?id=22331345 [2] https://news.ycombinator.com/item?id=19322398 https://news.ycombinator.com/item?id=19322398, https://news.ycombinator.com/item?id=19324538 https://news.ycombinator.com/item?id=19324538 The file you've identified produces a local, opt-in event stream that does not leave your machine unless you literally e-mail it to me. It's just got that unfortunate word in the filename that means we're bad guys. EDIT, upon closer inspection: when this is built as part of the Windows product (which consumes source from this repository) those values may end up in an event stream. In the interest of full disclosure, those events are: 1. Part of the console host (conhost.exe) and covered by the Windows global data collection settings 2. Pertaining to (incomplete, but it's too early in the morning for me to do a full review of this code): 2.a. The number of times each low-level console API was used 2.b. How the legacy Find dialog is being used (long strings, short strings, search direction, number of times) 2.c. Specific settings like font size, how many colors are configured, how big the window and buffer are

towndrunk 6y ago

So what exactly is it sending back to MS?

brenden2 6y ago

I don't use Windows, and the only Microsoft product I have installed is VS Code (with telemetry explicitly disabled), but in spite of that about 10% of all the blocked DNS requests according to my pi-hole are to Microsoft's telemetry servers at watson.telemetry.microsoft.com.

slim 6y ago

On the topic of Microsoft is not less evil than before : today I needed to use Teams, I was pleasantly surprised by the fact it supported a web client. I tried to use it and got caught in a tunnel of dark ux. You go to the website, click to sign in, get asked for your email and password, then verify your email, then you discover that you actually signed up for something else and now you can signup for teams. You follow the wizard again, then you are told to use Skype because you are not a company. You restart and make sure to check the box saying you are a company, then put your company info, it works! You try to start a call, and you get told it does not work in firefox...

jdsully 6y ago
Yea a lot of microsoft stuff doesn’t work in Firefox. They are the worst of all the big companies at supporting it.
- techsupporter 6y ago
  Which is hilarious since if you spoof your Firefox UA string to be Chrome or Edgeium, all Teams features work properly in the browser.
  - ccmcarey 6y ago
    Yep. Google also offers a lot of "rich cards" in their search (interactive things mostly) that are only available on Chrome .. unless you change the user agent of another browser to Chrome, in which case it also works perfectly.
    - saagarjha 6y ago
      Google actually seems to show those to me occasionally in Safari.
    - lou1306 6y ago
      IANAL but would not that be grounds for abuse of dominant position? Using their dominance in web search to undercut competing browser vendors?

TeddyDD 6y ago

Well, you are using Windows (basically a spyware), why do you pretend that you care about privacy?

jannes 6y ago

Here is Microsoft's privacy dashboard: https://account.microsoft.com/privacy/ https://account.microsoft.com/privacy/ It lets you delete at least some of the data. Although I don't know if it includes the data from the package manager. Here you can contact their Data Protection Officer if you would like to ask: https://www.microsoft.com/en-GB/concern/privacy https://www.microsoft.com/en-GB/concern/privacy

Animats 6y ago

Opt out of Windows. My last Windows 7 machine broke down, and the few Windows programs I needed to run are now running under Wine on Linux. I've never used Windows 10 except in a store demo. Decided I didn't want it.

nromiun 6y ago

Anybody else really turned off by the unnecessary amount of internet access in these new CLI tools? It's not just telemetry. Some tools will just access the internet even when they don't need to (my favourite is checking for a new version with every command). I like the CLI because it is so minimal and transparent (compared to GUI). But that seems to be changing these days.

anonymousiam 6y ago

Good example of a use case for Pi-Hole.

HeadsUpHigh 6y ago

Sounds like someone forgot to turn the pretend button on.

arh68 6y ago

Half-serious startup idea: Telemetry Escrow, where I send data to Escrow, can inspect what it is, then Microsoft pays per datum. Escrow holds all historicals / some samples, depending on tier. Does the data have value?, after all? How much..

CawCawCaw 6y ago

Ha... here's an experiment you can try on Windows, assuming you haven't previously taken steps to debloat the system. 1. Run procmon.exe /noconnect from Sysinternals 2. Filter -> Drop Filtered Events 3. Ctrl-L, Add Filter -> 'Path' Contains 'Telemetry' then 'Include' and Add 4. Press OK and then Ctrl-E (Start Capture) 5. Leave it running for a few minutes

underko 6y ago

The assumption that windows package manager does not permit opting out of telemetry seems to be wrong. The whole issue is not stating how to opt out and someone assumed that it means it is not possible. However, based on the updated readme https://github.com/microsoft/winget-cli#datatelemetry https://github.com/microsoft/winget-cli#datatelemetry there was a way to opt-out from the beggining, just not documented. Yes, it should have been clarified from the start, but I think it's positive the option was always there and they managed to clarify how to opt-out in mere 7 hours.