3 ms·

Why telemetry at all? I don't expect a programming language to have telemetry as an default feature. I want to hammer this rule into everyone regardless of the

Why telemetry at all? I don't expect a programming language to have telemetry as an default feature. I want to hammer this rule into everyone regardless of the domain you're working in when it comes to privacy: - Explicitly ask the user. Respect their privacy. Explain why you would like to collect data, may be show past examples of what you've done with the data and don't deploy dark patterns or default behavior. It is not that hard. No backlash. No problem at all if you ask the user. Sure, that would lead to less than optimal telemetry for the collecting party but there should not be any way around this. Want more data? Incentivize users, may be give them free subscription for helping out with the beta testing. Give them a discount. Treat data just like a commodity that costs money to obtain responsibly. Right now, everyone is a data-cartel trying to hoard as much as possible. Why is this so hard to understand? This is opposite of "level-headed". I usually allow PyCharm to collect telemetry, I allow Apple to use Siri requests for improving it. It is because they do this as respectfully as possible without deceiving the user.

ssivark 6y ago
> Why telemetry at all? I don't expect a programming language to have telemetry as an default feature. That expectation is incorrect if you’ve ever used a package server or pulled packages from some website including Github (for ANY language). HTTP requests do communicate your IP address, and it is standard practice to store them and use them for analytics.
- systemvoltage 6y ago
  No problem if they do it on the server side. Don't pollute the user space with telemetry without asking. If I download julia binaries from their website, they can collect IP information if the local laws allow it. Once it is in my possession, it is reprehensible to do anything without asking me first.
  - improbable22 6y ago
    In case this isn't clear, the telemetry being discussed is only doing anything when you ask the package manager to connect to a server, to download things.
    - systemvoltage 6y ago
      It is clear. There is a UUID generated on the user-side to identify them. It’s one thing to collect statistics of downloads on the server side and another thing to profile me. It’s pretty clear to me.
      - umvi 6y ago
        How does a single random number "profile you" ...?
        gnud 6y ago
        With that identifier, an individual can be tracked across different networks. This might well make you identifiable. (Not that I think Julia does this)
wlesieutre 6y ago
> I allow Apple to use Siri requests for improving it. It is because they do this as respectfully as possible without deceiving the user. Let's not forget that despite Apple's otherwise good privacy record, Siri was saving your recordings to be listened to and reviewed by 3rd party contractors without giving you any opportunity to opt out. It was only late last year after their competitors were called out for the same issues that Apple provided an opt-out option. And given how proactive they were with privacy warnings about donating voicemail transcriptions to improve voicemail accuracy, it was pretty reasonable to think "Surely if they were saving the Siri input recordings and letting people listen to them, they would have warned me about that and asked me if it's OK." https://www.cnbc.com/2019/10/28/ios-13point2-has-new-siri-privacy-settings-including-deletion-and-opt-out.html https://www.cnbc.com/2019/10/28/ios-13point2-has-new-siri-pr... It's possible they still had better privacy protections in place for handling the recordings once they have them on their servers(compared to Amazon and others), but even the contents of voice recordings can be enough to de-anonymize them depending on what you've said.
3JPLW 6y ago
I encourage you to read https://julialang.org/legal/data https://julialang.org/legal/data This is very minimal data that gets sent along with requests that you’re already making to a (user-selectable) package server.
umvi 6y ago
Have any zealous "opt in" folks ever been in a position where they need to somehow obtain statistical information about their user base (to raise funding, to make business decisions, to know what features are most being used, etc)? Opt in is like hard mode and practically worthless, <1% of your user base will opt in.
- rightbyte 6y ago
  If you ask nicely and don't pretick the yes or no box I have a hard time believing <1% would opt-in. This is just excuses. Usage statistics could be tied to downloads or public source code analysis. No need for tracking.
  - orf 6y ago
    You can have a hard time believing it, but it’s still true. And the point still stands if it’s 5%. Most people just don’t care, and will go with the defaults.
    - rightbyte 6y ago
      My point is if there is not default no-one will go with the default. Just force an active choice e.g. the first time the package manager is invoked from CLI and assume opt-out for scripts running it to not break scripts.
- ninjin 6y ago
  Yes, as an academic and a co-creator of the de-facto annotation tool in my field [1] I certainly have (although having Google Analytics for the website is something I regret…). Now, we have the “luxury” of citation counts as a proxy for academic usage, but I know next to nothing about how our tool is/has been used in industry apart from what pops up on the mailing list. To be fair though, I suspect we could have had bigger impact and maybe keep the project more “alive” with both more efforts on our part and if we had decided to raise funds additional user metrics could have helped, but I am not shedding tears over this. [1]: http://brat.nlplab.org/ http://brat.nlplab.org/ Now, I absolutely sympathise with any developers in this situation. But I think the underlying issue is that we lack a good way to give consent and are stuck with awful solutions like opt-out and ridiculous pop-ups. Is there not good work on this out there or are we forever going to have to endure sub-optimal solutions?

ssivark 6y ago

> Why telemetry at all? I don't expect a programming language to have telemetry as an default feature. That expectation is incorrect if you’ve ever used a package server or pulled packages from some website including Github (for ANY language). HTTP requests do communicate your IP address, and it is standard practice to store them and use them for analytics.

systemvoltage 6y ago
No problem if they do it on the server side. Don't pollute the user space with telemetry without asking. If I download julia binaries from their website, they can collect IP information if the local laws allow it. Once it is in my possession, it is reprehensible to do anything without asking me first.
- improbable22 6y ago
  In case this isn't clear, the telemetry being discussed is only doing anything when you ask the package manager to connect to a server, to download things.
  - systemvoltage 6y ago
    It is clear. There is a UUID generated on the user-side to identify them. It’s one thing to collect statistics of downloads on the server side and another thing to profile me. It’s pretty clear to me.
    - umvi 6y ago
      How does a single random number "profile you" ...?
      - gnud 6y ago
        With that identifier, an individual can be tracked across different networks. This might well make you identifiable. (Not that I think Julia does this)

wlesieutre 6y ago

> I allow Apple to use Siri requests for improving it. It is because they do this as respectfully as possible without deceiving the user. Let's not forget that despite Apple's otherwise good privacy record, Siri was saving your recordings to be listened to and reviewed by 3rd party contractors without giving you any opportunity to opt out. It was only late last year after their competitors were called out for the same issues that Apple provided an opt-out option. And given how proactive they were with privacy warnings about donating voicemail transcriptions to improve voicemail accuracy, it was pretty reasonable to think "Surely if they were saving the Siri input recordings and letting people listen to them, they would have warned me about that and asked me if it's OK." https://www.cnbc.com/2019/10/28/ios-13point2-has-new-siri-privacy-settings-including-deletion-and-opt-out.html https://www.cnbc.com/2019/10/28/ios-13point2-has-new-siri-pr... It's possible they still had better privacy protections in place for handling the recordings once they have them on their servers(compared to Amazon and others), but even the contents of voice recordings can be enough to de-anonymize them depending on what you've said.

3JPLW 6y ago

I encourage you to read https://julialang.org/legal/data https://julialang.org/legal/data This is very minimal data that gets sent along with requests that you’re already making to a (user-selectable) package server.

umvi 6y ago

Have any zealous "opt in" folks ever been in a position where they need to somehow obtain statistical information about their user base (to raise funding, to make business decisions, to know what features are most being used, etc)? Opt in is like hard mode and practically worthless, <1% of your user base will opt in.

rightbyte 6y ago
If you ask nicely and don't pretick the yes or no box I have a hard time believing <1% would opt-in. This is just excuses. Usage statistics could be tied to downloads or public source code analysis. No need for tracking.
- orf 6y ago
  You can have a hard time believing it, but it’s still true. And the point still stands if it’s 5%. Most people just don’t care, and will go with the defaults.
  - rightbyte 6y ago
    My point is if there is not default no-one will go with the default. Just force an active choice e.g. the first time the package manager is invoked from CLI and assume opt-out for scripts running it to not break scripts.
ninjin 6y ago
Yes, as an academic and a co-creator of the de-facto annotation tool in my field [1] I certainly have (although having Google Analytics for the website is something I regret…). Now, we have the “luxury” of citation counts as a proxy for academic usage, but I know next to nothing about how our tool is/has been used in industry apart from what pops up on the mailing list. To be fair though, I suspect we could have had bigger impact and maybe keep the project more “alive” with both more efforts on our part and if we had decided to raise funds additional user metrics could have helped, but I am not shedding tears over this. [1]: http://brat.nlplab.org/ http://brat.nlplab.org/ Now, I absolutely sympathise with any developers in this situation. But I think the underlying issue is that we lack a good way to give consent and are stuck with awful solutions like opt-out and ridiculous pop-ups. Is there not good work on this out there or are we forever going to have to endure sub-optimal solutions?