5 ms·

Pkg.jl telemetry should be opt-in

sc11 6y ago
For context, this is the official page explaining what data is collected: https://julialang.org/legal/data/ https://julialang.org/legal/data/ (the link is a bit hard to find between all the other links in the Discourse thread)
- open-source-ux 6y ago
  The data collection page is well-written and clearly explained. However, I still dislike like the idea of enabling 'anonymous telemetry' by default. The problem of growing a programming language is one shared by many programing languages. Languages like Nim or Crystal have arguably even smaller programming communities than Julia. These other languages have not decided to pursue the option of telemetry to track usage (at least, not yet). There are other ways of measuring the adoption or popularity of a language: libraries, courses, books, tutorials - they are not neccesarily accurate, but they give some insight. Anyway, if this telemetry feature goes ahead, I think the clearest way to do it is as follows: - When installing a package, the user is informed that anonymous data will be sent to Julia's servers. Make it clear this data transmission is optional. - There is a link to the data collection/privacy page - There should be a clear link for users to see all the data from their computer that will be transmitted before it is sent. - Users can accept or decline the transmission of data. - Users can choose to bypass telemetry consent for future packages - Somewhere in the process above, there should be clear instructions (or a link) telling users how they can switch on and off telemetry at anytime. This sounds like a lot. But at least by being clear and upfront, users can make an informed decision. I realise it might seem churlish to complain about data collection when developers use tools and services that track their usage on a daily basis e.g. Visual Code by Microsoft or Google's vast (non-anonymous) services. But why stoop to their level?
deleted 6y ago
[deleted]
boromi 6y ago
Opting out should be straight forward.
- ihumanable 6y ago
  It is pretty simple to do and well documented. There's also a fair bit of control for the user to either completely opt-out, just opt-out of sending some data. https://julialang.org/legal/data/#opting_out https://julialang.org/legal/data/#opting_out Has all the details.
  - boromi 6y ago
    I think it should be simpler than that, personally. Like the first message after or before installing Julia. As it stands, I wouldn't have any idea upon first usage that that's how I'm supposed to turn it off.
    - ninjin 6y ago
      It looks like `mkdir -p ~/.julia/servers && echo 'telemetry = false' > ~/.julia/servers/telemetry.toml` will do it unless you have messed with `JULIA_HOME`. Still, the documentation [1] makes it clear that there is no way that I would call “easy”. [1]: https://julialang.org/legal/data/#opting_out https://julialang.org/legal/data/#opting_out As someone that has been a Julia user for more than half a decade and a part of the community I feel very uneasy about now having to opt out of this feature each time I install anything above v1.4. Not to mention that I feel that I morally would have to notify other users when I recommend Julia to them. Performing privacy workarounds for FOSS is a rarity and I would be sad if we shift towards it becoming the norm, despite seeing that it can have upsides to the community itself.
      - chrispeel 6y ago
        > As someone that has been a Julia user for more than half a decade and a part of the community I feel very uneasy about now having to opt out of this feature each time I install anything above v1.4. I'd certainly appreciate it if you repeated this in the discourse thread
musicale 6y ago
If you're doing something that could be considered a violation of user privacy, like phoning home to a telemetry service, it should not be opt-out. Probably it shouldn't exist at all. Not everything has to have "telemetry" baked into it.
- raxxorrax 6y ago
  The matter of course to include telemetry eludes me. I think this criticism is correct and should even be expanded. I never looked into Julia, only R a bit and they have mutual interfaces. These discussion don't sell me the language at all.
gpm 6y ago
Am I mistaken in thinking that this is a blatant violation of the gdpr and that distributing Julia to anyone in the EU is now illegal?
- sc11 6y ago
  julialang.org also lacks a privacy policy and loads trackers like Google Analytics without user consent. The core devs don't seem to care about the GDPR.
  - s286 6y ago
    That's really not a fair characterization of the situation.
- ninjin 6y ago
  Not according to Karpinski [1], that is a core developer. [1]: https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/28 https://discourse.julialang.org/t/pkg-jl-telemetry-should-be...
  - gpm 6y ago
    Interesting... I'm sure that lawyer knows more about this than I do so I wonder what part of it I misunderstoood...

sc11 6y ago

For context, this is the official page explaining what data is collected: https://julialang.org/legal/data/ https://julialang.org/legal/data/ (the link is a bit hard to find between all the other links in the Discourse thread)

open-source-ux 6y ago
The data collection page is well-written and clearly explained. However, I still dislike like the idea of enabling 'anonymous telemetry' by default. The problem of growing a programming language is one shared by many programing languages. Languages like Nim or Crystal have arguably even smaller programming communities than Julia. These other languages have not decided to pursue the option of telemetry to track usage (at least, not yet). There are other ways of measuring the adoption or popularity of a language: libraries, courses, books, tutorials - they are not neccesarily accurate, but they give some insight. Anyway, if this telemetry feature goes ahead, I think the clearest way to do it is as follows: - When installing a package, the user is informed that anonymous data will be sent to Julia's servers. Make it clear this data transmission is optional. - There is a link to the data collection/privacy page - There should be a clear link for users to see all the data from their computer that will be transmitted before it is sent. - Users can accept or decline the transmission of data. - Users can choose to bypass telemetry consent for future packages - Somewhere in the process above, there should be clear instructions (or a link) telling users how they can switch on and off telemetry at anytime. This sounds like a lot. But at least by being clear and upfront, users can make an informed decision. I realise it might seem churlish to complain about data collection when developers use tools and services that track their usage on a daily basis e.g. Visual Code by Microsoft or Google's vast (non-anonymous) services. But why stoop to their level?

deleted 6y ago

[deleted]

boromi 6y ago

Opting out should be straight forward.

ihumanable 6y ago
It is pretty simple to do and well documented. There's also a fair bit of control for the user to either completely opt-out, just opt-out of sending some data. https://julialang.org/legal/data/#opting_out https://julialang.org/legal/data/#opting_out Has all the details.
- boromi 6y ago
  I think it should be simpler than that, personally. Like the first message after or before installing Julia. As it stands, I wouldn't have any idea upon first usage that that's how I'm supposed to turn it off.
  - ninjin 6y ago
    It looks like `mkdir -p ~/.julia/servers && echo 'telemetry = false' > ~/.julia/servers/telemetry.toml` will do it unless you have messed with `JULIA_HOME`. Still, the documentation [1] makes it clear that there is no way that I would call “easy”. [1]: https://julialang.org/legal/data/#opting_out https://julialang.org/legal/data/#opting_out As someone that has been a Julia user for more than half a decade and a part of the community I feel very uneasy about now having to opt out of this feature each time I install anything above v1.4. Not to mention that I feel that I morally would have to notify other users when I recommend Julia to them. Performing privacy workarounds for FOSS is a rarity and I would be sad if we shift towards it becoming the norm, despite seeing that it can have upsides to the community itself.
    - chrispeel 6y ago
      > As someone that has been a Julia user for more than half a decade and a part of the community I feel very uneasy about now having to opt out of this feature each time I install anything above v1.4. I'd certainly appreciate it if you repeated this in the discourse thread

musicale 6y ago

If you're doing something that could be considered a violation of user privacy, like phoning home to a telemetry service, it should not be opt-out. Probably it shouldn't exist at all. Not everything has to have "telemetry" baked into it.

raxxorrax 6y ago
The matter of course to include telemetry eludes me. I think this criticism is correct and should even be expanded. I never looked into Julia, only R a bit and they have mutual interfaces. These discussion don't sell me the language at all.

gpm 6y ago

Am I mistaken in thinking that this is a blatant violation of the gdpr and that distributing Julia to anyone in the EU is now illegal?

sc11 6y ago
julialang.org also lacks a privacy policy and loads trackers like Google Analytics without user consent. The core devs don't seem to care about the GDPR.
- s286 6y ago
  That's really not a fair characterization of the situation.
ninjin 6y ago
Not according to Karpinski [1], that is a core developer. [1]: https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/28 https://discourse.julialang.org/t/pkg-jl-telemetry-should-be...
- gpm 6y ago
  Interesting... I'm sure that lawyer knows more about this than I do so I wonder what part of it I misunderstoood...