9 ms·
Ubuntu Will No Longer Track Which Packages Users Install
- swiley 6y agoGeese, I’m surprised they were doing it to begin with! This sort of thing is why I won’t touch VScode and fsharp. How do people building these things become convinced this is ok?
- Twirrim 6y agopopularity-contest comes from Debian. They introduced it quite a while ago as a way to help prioritise maintenance work etc.
- notRobot 6y agoI don't know about Ubuntu, but while installing Debian it makes it very clear what popularity-contest does and asks the user for explicit consent. The default option is "I do not wish to participate", so if someone isn't paying attention during the install process and just hits 'Enter', their privacy remains intact. This, IMO, is the perfect way to do telemetry.
- lewiscollard 6y agoOn Ubuntu you still have to explicitly enable it - and unless I missed something in my last couple of Ubuntu installs you are never prompted to enable it during installation. If you want to opt in, you have to do a dpkg-reconfigure and even then the default is still "No". This is not privacy-hostile in any meaningful way.
- Twirrim 6y agoThe default in Ubuntu is to ask you at install time if you want it installed / enabled or not, for about as long as I remember, and I've been using Ubuntu for since ~5.04ish days.
- bansheehash 6y agoTry VSCodium, which is VSCode without MS telemetry: https://github.com/VSCodium/vscodium https://github.com/VSCodium/vscodium
- vaxman 6y agoReally? I thought it was common knowledge that UK are brutal about surveillance. James Bond and Kingsman, CCTV on every corner, Canonical CEO dismissing privacy concerns in new products “because you already trust us when we sign the packages” ...
- Analemma_ 6y ago> How do people building these things become convinced this is ok? Because they have the data proving that opt-in telemetry means no telemetry. Every time this topic comes up, HN sticks its fingers in its ears and refuses to accept this, but it's the truth. 99% of users, even for a developer-focused application like VSCode, just click through and accept the defaults. So if you want telemetry that isn't useless for any practical purposes, it has to be opt-out. If you want, you can have a separate argument about whether having the telemetry is worth it, but if you've had that discussion and decided the answer is yes, then opt-out follows immediately from that.
- GekkePrutser 6y agoJust because a supplier wants to have telemetry doesn't suddenly make it ethical to do opt-out (or even forced like MS does with Windows 10!). If they care about their users and it's not possible to have worthwhile telemetry with opt-in, they simply can't have it.
- Analemma_ 6y agoThat's a strange definition of "can't". VSCode can and does, and it's the most popular editor in the world [0]. [0]: https://insights.stackoverflow.com/survey/2019#development-environments-and-tools https://insights.stackoverflow.com/survey/2019#development-e...
- deleted 6y ago[deleted]
- nitrogen 6y agoIt's the same definition that says you "can't" steal your coworkers' lunch as they are eating it.
- on9wim5R 6y agoIndeed, I wouldn't try to find a case for "good telemetry", it basically means snooping, as far as I'm concerned. And this is not even something that can't be replaced : if you want to know about your users habits, ask them. I would have no problem with seeing once in a while a broadcast message after syncing packages showing me an url of a poll. But automatic data collection is never ok.
- Jonnax 6y agoBecause they want to know what to continue developing or what to deprecate. The reasoning is simple.
- nitrogen 6y agoThe reasoning is simple. The reality is complex. Always, always think about second order effects.
- throwaway43234 6y agoWhat are the second order effects? What's this "complex reality" you're living in? VSCode gives you a log of every telemetry event it sends, none contain PII (if they do that'd be a serious issue and should be reported) and it provides a settings page to list and opt-out of every online service (including telemetry).
- nitrogen 6y agoIt's a loss of the trust of your users. It's ever harsher data protection laws. It's the vehement reaction you get when you say to someone, "your personal space is mine for the taking, and maybe I'll take a little less of it if you beg me to stop." It's the slippery slope of dark patterns to cajole and conceal and browbeat users into avoiding the opt-out. It's the camel that starts with its nose and then quickly removes you from your own tent. It's the grab first, apologize later modern world of capitalistic exploitation all in the name of gaming the quarterly numbers. It's the next paving stone on the road to your users crying out "We're mad as hell and we aren't going to take it anymore!"
- throwaway43234 6y agoLol... always amusing when someone asks HNers what changes they'd like to see and why, and they respond with crazy analogies that are totally unactionable... not the first time this has happened, won't be the last.
- rlpb 6y agoAs far as I'm aware, it's always been opt-in on Ubuntu as it is on Debian.
- Multicomp 6y ago> and fsharp Come again? Is there telemetry in the F# compiler I didn't know about? Or you mean that OOTB VSCode has telemetry, so you won't use it for your F# code, opting instead for a different text editor / IDE?
- swiley 6y agoNothing says there isn’t. I was shocked when I heard vscode had telemetry even though it was open source and now I’m not sure I want to use any other open source stuff that comes from that company. Especially a compiler.
- tych0 6y agofor deb packages I guess? https://snapcraft.io/docs/snap-store-metrics https://snapcraft.io/docs/snap-store-metrics > the store assigns an anonymous identifier, the device-serial, to every new snapd client it sees. This exchange usually happens when a new installation contacts the store, and the identifier persists for the lifespan of the machine. > Systems running snapd will periodically make a refresh request to the store, checking the for the most recent release of each installed snap. At that moment, they inform the store of their device-serial along with a list of the currently installed snaps.
- GekkePrutser 6y agoLol another reason for me to hate snaps. I didn't yet know that. PS: My other reasons: - Much more resource wasteful - Single store operated by canonical only - No simple updating a library with a vulnerability and having all apps that use that library automatically fixed. - Makes really messy virtual mountpoints everywhere.
- craftinator 6y agoHave you tried opening the calculator in Ubuntu? On my laptop it takes a full 3 seconds for the GUI to come up, assuming I have nothing else running. 3 full wall clock seconds. It's actually faster to pull out my phone and open the calculator on it than my laptop. Which is what I do now, every time. So, if you want people to look for alternatives to your application, only provide it as a Snap.
- treesknees 6y agoYou can take your hands off the keyboard and mouse, dig your phone out of your pocket, unlock it, open the app drawer, scroll and find calculator, tap it and open it, under 3 seconds? I doubt that.
- vulcan01 6y agoMost people have their phones on the table. And on iOS (not sure about Android) you can swipe from the top-right corner to get to the calculator.
- nsl73 6y agoWow! When did they start doing this? I’m glad they stopped! I’m really grateful to Ubuntu for helping me get deeper into Linux in 2007, but I would never recommend them to anyone today.
- deleted 6y ago[deleted]
- SiempreViernes 6y agoWell, the user has to turn it on by themselves just like you have to install buildtools on your own.
- flattone 6y agoWhy would you not point a linux noob to ubuntu?
- TheAdamAndChe 6y agoYears ago(I started around 2008 or 2009 I think), Ubuntu was different because it Just Worked. It came with lots of drivers, easy defaults, and guis for everything. You could easily dual-boot it with Windows(there was a windows executable that would get it done without burning a CD or dealing with an iso), and could be installed on just about any computer at the time. Nowadays, lots of distros are just as easy(Debian, fedora, Linux mint), come with all drivers, work on basically all systems, and don't spy on you. Ubuntu isn't as easy to dual-boot windows now too. There's basically no advantage to Ubuntu now except community.
- mrmuagi 6y ago> There's basically no advantage to Ubuntu now except community. Ding Ding Ding. This is why I still recommend Ubuntu, there's a community and a wealth of knowledge out there for working with Ubuntu. Though if you are more experienced and deal with nuanced issues you will find often the community is outdated and this is a double edged sword -- a lot of material out there is for older Ubuntu distros and is no longer relevant.
- notRobot 6y agoAlso posted this as a child comment elsewhere in the thread, but: --- I don't know about Ubuntu, but while installing Debian the installer makes it very clear what popularity-contest does and asks the user for explicit consent. It also makes it very clear that this setting can be changed later at any time. The default option is "I do not wish to participate", so if someone isn't paying attention during the install process and just hits 'Enter', their privacy remains intact. This, IMO, is the perfect way to do telemetry.
- saagarjha 6y agoIf you ask politely, I will often say yes to opting in! People don’t seem to understand this and think that somehow I’ll feel exactly the same if it’s opt-out because “it’s the same data…”
- notRobot 6y agoSame here! I usually opt in to popularity-contest on all Debian installs of mine that are on PCs, though I leave it turned off on servers.
- lucb1e 6y agoI have it turned off on a laptop I use for red teaming because you don't want to be accidentally noisy on the network, but other than that it's turned on.
- dsr_ 6y agoI really wish popcon asked two questions right up front: 1. Is this machine primarily used as a laptop, desktop or server? 2. Is this machine owned by a business or by a person? All sorts of popcon results are taken as being authoritative, when (I think) the overwhelming majority of responders are personal owners with laptops or desktops.
- rovr138 6y agoSimilar. But I also set it off on vm's if I'm testing something. It'll quickly and destroyed, so I just keep thinking I'll pollute their stats.
- caiobegotti 6y agoPopcon (the software that collects such metric) has existed at least for 20 years, via Debian, just for the record for people freaking out for how long this has been a thing without them reading the installation dialogs.
- boring_twenties 6y agopopcon is off by default. You have to explicitly enable it.
- londons_explore 6y agoSimple server logs for package downloads will give a very good idea which users have which packages installed. Ubuntu doesn't even run all the mirrors, so hasn't even got control of if people are collecting this data.
- space_ghost 6y agoThis has been in Debian since forever, and the installer asks if you want it. I've always opted to not install it since it's my opinion that my package choices are weird and shouldn't -at all- influence the distro defaults.
- AdmiralAsshat 6y agoWhy couldn't they just track at the server end which packages were being downloaded if they wanted to know which ones are popular? This seems like something trivial to solve without impacting user privacy if they're downloading all the packages from you or your mirrors. Unless the point was to see what PPAs people are using?
- mikepurvis 6y agoQuite apart from the difficulty of collecting logs from the hundreds of official and unofficial mirrors, it also doesn't account for the various layers of caching.
- deleted 6y ago[deleted]
- rlpb 6y agoFrom the article: "Is “Ubuntu removes thing which doesn’t work and no-one uses” front page news?" In other words, the headline is false because "Will No Longer" implies the opposite, which even the author acknowledges is not true.
- Shared404 6y agoBecause omgubuntu is almost entirely clickbait. That I fell for. Again.
- falcolas 6y agoHomebrew - please take note of this and follow this precedent. Yes, you are (now) opt-in; so was Ubuntu's.
- rrauenza 6y agoI had a momentary panic the title meant at the system level - a system admin's nightmare!
- 2bitencryption 6y agohow do we know? the snap server is proprietary and closed-source, right?
- kevin_b_er 6y agoThis is the apt system that's losing the statistics system. Ubuntu is likely collecting data from the closed source proprietary snap system that they push users toward.
- deleted 6y ago[deleted]
- jamieweb 6y agoJust to confirm, this only seems to relate to popcon/popularity-contest, and not the other data collection features. The other two main ones are Apport for crash reporting, and ubuntu-report, which sends system info if opted-in at install.
- mrtweetyhack 6y agoWhat I read: Ubuntu pushes out broken software