5 ms·

There are a few concerns I have as a occasional Julia user. When I update my packages is this going to be a silent change, or can we get a notification and a Y

by parsimo2010 6y ago

There are a few concerns I have as a occasional Julia user. When I update my packages is this going to be a silent change, or can we get a notification and a Y/N option to opt out when updating? How visible and easy is it to change this setting after updating if I change my mind? I don’t have a specific concern about the Julia team using my data, but I have general concerns about companies collecting telemetry. Can’t they get a rough estimate of active users by counting unique IP addresses over the past X months which doesn’t require opting people in to telemetry? Edit: I think I read the link incorrectly. This person is arguing that users should have to actively opt-in, not that they are opted in automatically. They are arguing for a change that would increase privacy, and I need to opt-out in my current installation. I didn’t know I was sending telemetry right now.

deleted 6y ago
[deleted]
dnautics 6y ago
Downthread there's an comment that addresses your point by JohnMylesWhite: > I think this is the crux of the issue: you’re already doing that across the Internet since your IP address is part of many (most?) normal HTTP requests. It’s not perfectly uniquely identifiable, but it’s not so far away from being that and it’s being submitted without even the possibility of opt-out in most cases / for most people. > So I think the core issue this thread should resolve: would it be better for Julia to just do everything via logging IP addresses? That’s what everyone else in OSS is already doing (seemingly without almost any concerns), so perhaps the problem is just that Julia is talking about how to best do things rather than just doing them? That feels quite perverse to me, but it’s my big fear after reading this thread.
nwvg_7257 6y ago
You are not sending telemetry right now. That is a feature which will be activated in the upcoming 1.5 release. It will display a notification.
- KenoFischer 6y ago
  While this is true of the feature mentioned, do note that packages are currently hosted on various third party hosting services that can and do track substantially similar information. In 1.5, we're moving to our own infrastructure for serving packages (which should give better performance and allow things like incremental updates). This thread is about what information gets sent along with those requests.
- fiddlerwoaroof 6y ago
  If you make an HTTP request, you are sending “telemetry” information in the form of endpoints, headers and IP information. The server may not track this information, but it’s exploitable
  - parsimo2010 6y ago
    My issue is that I’ve come to terms with the fact that the IP address of every connection can be tracked server side- I can use a VPN to get a little anonymity but can’t stop a server from logging connections and downloads. But telemetry adds data on top of that, and it seems like a lot of software wants to track me. I’d feel it was okay if I was required to register an account and log in before downloading/updating packages, that’s a noticeable action that lets my brain process the idea that I’m able to be tracked. But sending “anonymous” metadata with almost no action on my part rubs me the wrong way. Lots of devs try to optimize things so they are low friction for users, but I think the Julia user base is a little different than normal software and wouldn’t mind a little friction if it meant they had better control of their privacy.
    - fiddlerwoaroof 6y ago
      As far as I can tell, this isn’t adding anything to IP sharing: the package manager just attaches a persistent UUID to every request. In fact, it is more private than IPs because it can’t be tied to an ISP or geographical region.
      - 6y ago
mirekrusin 6y ago
This whole thing is making noise about nothing. Other package managers like npm already do this kind of telemetry, and without opt-out option, because they are centralised. Julia packages are not, there is no central server. They want to access primitive view of the package usage so they know where the whole ecosystem is, how to prioritise and help with getting funding – as they mention in the thread it's difficult to raise money if you can't present basic userbase numbers.

deleted 6y ago

[deleted]

dnautics 6y ago

Downthread there's an comment that addresses your point by JohnMylesWhite: > I think this is the crux of the issue: you’re already doing that across the Internet since your IP address is part of many (most?) normal HTTP requests. It’s not perfectly uniquely identifiable, but it’s not so far away from being that and it’s being submitted without even the possibility of opt-out in most cases / for most people. > So I think the core issue this thread should resolve: would it be better for Julia to just do everything via logging IP addresses? That’s what everyone else in OSS is already doing (seemingly without almost any concerns), so perhaps the problem is just that Julia is talking about how to best do things rather than just doing them? That feels quite perverse to me, but it’s my big fear after reading this thread.

nwvg_7257 6y ago

You are not sending telemetry right now. That is a feature which will be activated in the upcoming 1.5 release. It will display a notification.

KenoFischer 6y ago
While this is true of the feature mentioned, do note that packages are currently hosted on various third party hosting services that can and do track substantially similar information. In 1.5, we're moving to our own infrastructure for serving packages (which should give better performance and allow things like incremental updates). This thread is about what information gets sent along with those requests.
fiddlerwoaroof 6y ago
If you make an HTTP request, you are sending “telemetry” information in the form of endpoints, headers and IP information. The server may not track this information, but it’s exploitable
- parsimo2010 6y ago
  My issue is that I’ve come to terms with the fact that the IP address of every connection can be tracked server side- I can use a VPN to get a little anonymity but can’t stop a server from logging connections and downloads. But telemetry adds data on top of that, and it seems like a lot of software wants to track me. I’d feel it was okay if I was required to register an account and log in before downloading/updating packages, that’s a noticeable action that lets my brain process the idea that I’m able to be tracked. But sending “anonymous” metadata with almost no action on my part rubs me the wrong way. Lots of devs try to optimize things so they are low friction for users, but I think the Julia user base is a little different than normal software and wouldn’t mind a little friction if it meant they had better control of their privacy.
  - fiddlerwoaroof 6y ago
    As far as I can tell, this isn’t adding anything to IP sharing: the package manager just attaches a persistent UUID to every request. In fact, it is more private than IPs because it can’t be tied to an ISP or geographical region.
    - 6y ago

mirekrusin 6y ago

This whole thing is making noise about nothing. Other package managers like npm already do this kind of telemetry, and without opt-out option, because they are centralised. Julia packages are not, there is no central server. They want to access primitive view of the package usage so they know where the whole ecosystem is, how to prioritise and help with getting funding – as they mention in the thread it's difficult to raise money if you can't present basic userbase numbers.