7 ms·

Basic Telemetry for Audacity

134 points by solarkraft 6y ago

johncoltrane 6y ago
Here we go…
junon 6y ago
What an incredible display of idiocy. I can't believe we're about to need an "un-Googled Audacity" fork.
torstenvl 6y ago
This is a terrible, terrible idea. Even suggesting it throws away years of trust and good will. What are they thinking?!
vimax 6y ago
That was fast. I was trying to hold out hope that muse would be ok and the aquisition wouldn't change anything, but they wouldn't even let me have that.
- ergot_vacation 6y ago
  Not even a week. The assholes couldn't wait ONE WEEK before trying to spy on all their users. Is this a record for losing the trust of an established user base? I think the worst is yet to come. I'd venture most users don't even know this happened yet.
Meph504 6y ago
The great and foolish idea that this is needed to improve software. It is so regrettable, and shows perhaps the keys were handed to the wrong people.
ashneo76 6y ago
I despise the idea that had come from I don't know where that analytics and continuous user tracking is how you improve the product
- ergot_vacation 6y ago
  Mostly I think it's a smoke screen to collect data for advertising (and hey, if an alphabet agency wants in, they can always join the party too!) There are a lot of people that seem to buy into "Telemetry is the only way to find bugs!" though.
Zardoz84 6y ago
1) Basic telemetry isn't a bad idea but... 2) Opt-in and by default disabled. Ask on first run if the user wishes to enable it, and inform about it. 3) DON'T USE GOOGLE ANALYTICS.
- zibzab 6y ago
  ... OR YANDEX
- swiley 6y ago
  >Basic telemetry isn't a bad idea but... Yes it is, the distro maintainers will strip it out which makes the data it collects garbage.
  - chayleaf 6y ago
    What you're saying is only Windows users will have telemetry... which isn't that bad, for those who want telemetry in their software
  - valdiorn 6y ago
    honest question; as someone who is currently building an audio application which has telemetry, how else would I discover bugs or problems that might be affecting my users, if I can't upload crash reports, etc. ? I mean, I'll do my best to test before releasing, but when a user contacts support, describing some weird behaviour, without telemetry I have zero information to work from, and basically have to resort to "stacktrace or GTFO"... wouldn't it be nice if that stacktrace was anonymously uploaded and I had some idea of how prevalent the issue was, and maybe there's some information in there to help me fix the problem, and make my users happy?
    - mendelmaleh 6y ago
      Why can't the user send you the crash report if he wants to?
    - kaslai 6y ago
      My personal take is that this type of telemetry is fine. I just don't want to give potentially unbounded, hard-to-audit access to my telemetry data over to the likes of Google. If your application provides a means of learning _what_ is getting sent, and you make it opt-in, and you only send it to infrastructure you completely control (within reason, I'm not going to complain if it's a VPS or something), then there shouldn't really be any controversy. I don't hate Google. I just don't want my desktop applications to even be capable of telling Google about my computer usage if I can at all help it.
open-source-ux 6y ago
We can thank developers for the widespread usage of "telemetry" in apps. (Even the word "telemetry" is designed to mask it's real meaning: tracking. Would any developer use the more honest word? Of course not.) If you want to learn how your users use your software - simply ask them. There are lots of cheap research methods from the usability field. Expect more telemetry in desktop apps, particularly with the rise of Electron. Developers don't oppose these developments, they are often the ones who initiate these tracking features in the first place. Witness the popularity of Electron-based Visual Studio Code with built-in telemetry. Most developers could not care less.
- tazjin 6y ago
  > If you want to learn how your users use your software - simply ask them And thus lose input from most of your users. This then skews your decisions towards the slim fraction of users that can be bothered to fill in surveys and such, and eventually you lose the other users. (Opt-in) telemetry is totally fine, IMO. It would be preferable that companies self-host the backend though.
  - rhn_mk1 6y ago
    While the observation seems correct, I would not be too hasty to view it as a justification of telemetry. Instead, I propose viewing it as a vicious cycle that should be fought.
zibzab 6y ago
What does EFF say about telemetry? I assume they have some recommendations for situation where you need them but want to do it the right way??
hycaria 6y ago
In April 2021, it was announced that Muse Group, (owners of MuseScore and Ultimate Guitar) would be acquiring Audacity.
captainmuon 6y ago
This seems universally hated. I am usually pretty privacy concious and do a lot of stuff that I don't want to be seen by the authorities / competitors / my family / whoever depending on context. But honestly I don't really understand the issue with telemetry. What is your concrete worry, or your threat model? A) I can imagine somebody you know works at Google, and tries to stalk you. But they'd need to know your IP address, and I assume Google has protections in place against accessing consumer data, and it would leave an audit trail. And in the end, they would only be able to see when you edit audio files and whether you use the toolbar or keyboard shortcuts. B) Or maybe they feed that data into a super scary tracking algorithm and use it to better target ads? But I don't know how that would even work, as they would have to understand what Audacity's tracking categories mean. I know it is a controversal opinion, but I think telemetry is usually a net win. Especially if you want to improve the UX of your open source app, you need actual usage data. And unfortunately, opt-in doesn't work, because you get skewed data. Why would anybody opt in? There's no benefit to me to take part, but there is benefit to all if everybody takes part.
- inshadows 6y ago
  You are giving your behavior data for free. It's a win for the receiver, because they don't usually provide the aggregated data back. Sure, you're also getting a product for "free", but this kind of transaction (data for product) is not required in free software. The philosophy is completely different. And let's face it, the data they collect have intrinsic value in aggregate. I'm not saying they're going to use it for nefarious purposes, but it'll enrich them in a way I'm not sure is completely ethical by my standards (hoarding behavior data, surveillance). Phrased in yet another way, you're giving them an edge to transform into personal data business. This may be unanticipated, but so long as the collected data will be their private property, it's real possibility.
  - throwaway3699 6y ago
    Even aggregated there is little monetary value beyond "people don't use this effect, let's try and ask why". Analytics doesn't answer many questions, that's true, but it does tell you where to look. It supplements talking to customers, not replacing.
OMGWTF 6y ago
Are we sure that window titles do not contain sensitive information? (E.g. file names, paths) https://github.com/audacity/audacity/pull/835/files#diff-4bfd3b3b53026d49a2072771cab4e8afd22b54de76baf68e3cb222adec2e191aR84 https://github.com/audacity/audacity/pull/835/files#diff-4bf...
mt42or 6y ago
Why so many hates from developers who never used or helped building Audacity ?
- tazjin 6y ago
  Because a huge part of the tech community lives in a kind of "outrage mania" at this point and is just looking for the next shitstorm to post in. This Github thread has literal calls for violence, racism and other such things in it and people keep piling on more. Tomorrow we'll have a different thread.
  - deleted 6y ago
    [deleted]
  - junon 6y ago
    I've been watching this thing from the start. I've not seen a lot of that. People are outraged at being tracked. That's perfectly acceptable outrage.
    - tazjin 6y ago
      > I've been watching this thing from the start. I've not seen a lot of that. The worst comments are gone. I reported some to Github and they removed the responsible accounts. > People are outraged at being tracked People are outraged at opt-in functionality. Whether it should exist is worth discussing (and, of course, how it should be implemented) - but lets not pretend that there is some evil move to "steal" your data going on here.
      - junon 6y ago
        You should research the history of Muse Group. This is not their first time doing this.
        tazjin 6y ago
        Doing what exactly? Adding opt-in (why do people ignore this part?) functionality for tracking how their software is used, to figure out how to prioritise? I just don't see how people read evil conspiracy stuff into that. Searching for what this company supposedly did wrong brings up a bunch of terrible articles which literally quote stuff like 4chan greentext with fictional (and implausible) scenarios for how this can be abused. Is this tracking going to be useful for their purposes? No idea. Should they self-host this instead? Maybe, if that's feasible.
i_have_to_speak 6y ago
Here we go again. Follow Rocky Linux's path and start a community fork!
gaius_baltar 6y ago
Once the binaries come, it's a matter of finding out the GA tracking IDs and spam them with nonsense data.
- FDSGSG 6y ago
  ... but why?
  - gaius_baltar 6y ago
    Remove the incentive for the next one and protect the current victims by k-anonimizing their data.
h1x 6y ago
Initial response from the company: https://old.reddit.com/r/programming/comments/n6kxm8/psa_audacity_pr_to_add_telemetry_sharing_user/gx91j70/ https://old.reddit.com/r/programming/comments/n6kxm8/psa_aud... Basically, "everything's fine, you can trust us".
- junon 6y ago
  They've all but gone silent on the official Audacity discord too.
dharma1 6y ago
The first comment in the PR has been updated - https://github.com/audacity/audacity/pull/835 https://github.com/audacity/audacity/pull/835 "Why have telemetry at all? Essentially, it’s to help us to identify product issues early" "We will consider replacing Google and Yandex with another service if we find one that fulfills our requirements - thanks for the suggestions and keep them coming." "Just to reiterate, telemetry is completely optional and disabled by default. We will try to make it as clear as possible exactly what data is collected if the user chooses to opt-in and enable telemetry. We will consider adding the fine-grained controls that some of you have asked for."
- ergot_vacation 6y ago
  In other words "We're sorry you don't like what we're doing, but there's nothing wrong with it and we're going to keep doing it." Wow. I don't want fine-grained control, I want it out of the code.
swiley 6y ago
Just a reminder: This is coming from the same company that made a bunch of publicly available sheet music hard to access. I'm sure they'll have a number of "interesting" PRs in the future.
- Dracophoenix 6y ago
  From what I understand, that decision was made because of potential legal liability.
  - ghoward 6y ago
    They also applied it to music in the public domain or under CC0.
valdiorn 6y ago
dumb question; can someone explain to me how a private company (muse group) "acquires" an open source project with lots of contributors? Who "sells" it? Who receives payment (if anyone?) Who decides the IP is now Muse Group's property?
deeblering4 6y ago
> Why have telemetry at all? Essentially, it’s to help us to identify product issues early: > Audacity is widely used across several platforms, but we have no information on the application stability. Really? You have no information about this? Don't you think instability would be reported by some users? > It is difficult for us to estimate the size of the user base accurately. You can obtain an estimate by tracking the number of downloads along with some far less intrusive metrics like user agent, etc. > We need a way to make informed decisions about which OS versions to support. For example, can we raise the minimum version of the macOS to 10.10 to update the wxWidgets to the latest version? Generally speaking no you should not raise the minimum OS version on a ubiquitous piece of software like this. Either work with the library vendor to find a way to support old and new, or use a different library. At a minimum keep the old versions around, there are no doubt offline installations out there running on old kit. Don't force everyone to upgrade their hardware/OS (it's expensive, and with apple products also means usable hardware going to the landfill) > We have a known issue with the new file format introduced in Audacity 3.0. We found it with the great help of the community members on our forum. However, there is no way for us to estimate the impact of these issues on users. Is it just a random case? Do we need to rush the work on the recovery tool or help the users one by one? Or do we need to rethink the file format to make it safer and more easily recoverable? Again, use the estimate metrics from downloads and user agents. And in any event you should prioritize fixes by the severity of the actual bug, not by "how many people does it affect". Just focus on writing stable software.
h_anna_h 6y ago
Are these related? https://news.ycombinator.com/item?id=26995610 https://news.ycombinator.com/item?id=26995610 https://news.ycombinator.com/item?id=27004688 https://news.ycombinator.com/item?id=27004688

134 points by solarkraft 6y ago

johncoltrane 6y ago

Here we go…

junon 6y ago

What an incredible display of idiocy. I can't believe we're about to need an "un-Googled Audacity" fork.

torstenvl 6y ago

This is a terrible, terrible idea. Even suggesting it throws away years of trust and good will. What are they thinking?!

vimax 6y ago

That was fast. I was trying to hold out hope that muse would be ok and the aquisition wouldn't change anything, but they wouldn't even let me have that.

ergot_vacation 6y ago
Not even a week. The assholes couldn't wait ONE WEEK before trying to spy on all their users. Is this a record for losing the trust of an established user base? I think the worst is yet to come. I'd venture most users don't even know this happened yet.

Meph504 6y ago

The great and foolish idea that this is needed to improve software. It is so regrettable, and shows perhaps the keys were handed to the wrong people.

ashneo76 6y ago

I despise the idea that had come from I don't know where that analytics and continuous user tracking is how you improve the product

ergot_vacation 6y ago
Mostly I think it's a smoke screen to collect data for advertising (and hey, if an alphabet agency wants in, they can always join the party too!) There are a lot of people that seem to buy into "Telemetry is the only way to find bugs!" though.

Zardoz84 6y ago

1) Basic telemetry isn't a bad idea but... 2) Opt-in and by default disabled. Ask on first run if the user wishes to enable it, and inform about it. 3) DON'T USE GOOGLE ANALYTICS.

zibzab 6y ago
... OR YANDEX
swiley 6y ago
>Basic telemetry isn't a bad idea but... Yes it is, the distro maintainers will strip it out which makes the data it collects garbage.
- chayleaf 6y ago
  What you're saying is only Windows users will have telemetry... which isn't that bad, for those who want telemetry in their software
- valdiorn 6y ago
  honest question; as someone who is currently building an audio application which has telemetry, how else would I discover bugs or problems that might be affecting my users, if I can't upload crash reports, etc. ? I mean, I'll do my best to test before releasing, but when a user contacts support, describing some weird behaviour, without telemetry I have zero information to work from, and basically have to resort to "stacktrace or GTFO"... wouldn't it be nice if that stacktrace was anonymously uploaded and I had some idea of how prevalent the issue was, and maybe there's some information in there to help me fix the problem, and make my users happy?
  - mendelmaleh 6y ago
    Why can't the user send you the crash report if he wants to?
  - kaslai 6y ago
    My personal take is that this type of telemetry is fine. I just don't want to give potentially unbounded, hard-to-audit access to my telemetry data over to the likes of Google. If your application provides a means of learning _what_ is getting sent, and you make it opt-in, and you only send it to infrastructure you completely control (within reason, I'm not going to complain if it's a VPS or something), then there shouldn't really be any controversy. I don't hate Google. I just don't want my desktop applications to even be capable of telling Google about my computer usage if I can at all help it.

open-source-ux 6y ago

We can thank developers for the widespread usage of "telemetry" in apps. (Even the word "telemetry" is designed to mask it's real meaning: tracking. Would any developer use the more honest word? Of course not.) If you want to learn how your users use your software - simply ask them. There are lots of cheap research methods from the usability field. Expect more telemetry in desktop apps, particularly with the rise of Electron. Developers don't oppose these developments, they are often the ones who initiate these tracking features in the first place. Witness the popularity of Electron-based Visual Studio Code with built-in telemetry. Most developers could not care less.

tazjin 6y ago
> If you want to learn how your users use your software - simply ask them And thus lose input from most of your users. This then skews your decisions towards the slim fraction of users that can be bothered to fill in surveys and such, and eventually you lose the other users. (Opt-in) telemetry is totally fine, IMO. It would be preferable that companies self-host the backend though.
- rhn_mk1 6y ago
  While the observation seems correct, I would not be too hasty to view it as a justification of telemetry. Instead, I propose viewing it as a vicious cycle that should be fought.

zibzab 6y ago

What does EFF say about telemetry? I assume they have some recommendations for situation where you need them but want to do it the right way??

hycaria 6y ago

In April 2021, it was announced that Muse Group, (owners of MuseScore and Ultimate Guitar) would be acquiring Audacity.

captainmuon 6y ago

This seems universally hated. I am usually pretty privacy concious and do a lot of stuff that I don't want to be seen by the authorities / competitors / my family / whoever depending on context. But honestly I don't really understand the issue with telemetry. What is your concrete worry, or your threat model? A) I can imagine somebody you know works at Google, and tries to stalk you. But they'd need to know your IP address, and I assume Google has protections in place against accessing consumer data, and it would leave an audit trail. And in the end, they would only be able to see when you edit audio files and whether you use the toolbar or keyboard shortcuts. B) Or maybe they feed that data into a super scary tracking algorithm and use it to better target ads? But I don't know how that would even work, as they would have to understand what Audacity's tracking categories mean. I know it is a controversal opinion, but I think telemetry is usually a net win. Especially if you want to improve the UX of your open source app, you need actual usage data. And unfortunately, opt-in doesn't work, because you get skewed data. Why would anybody opt in? There's no benefit to me to take part, but there is benefit to all if everybody takes part.

inshadows 6y ago
You are giving your behavior data for free. It's a win for the receiver, because they don't usually provide the aggregated data back. Sure, you're also getting a product for "free", but this kind of transaction (data for product) is not required in free software. The philosophy is completely different. And let's face it, the data they collect have intrinsic value in aggregate. I'm not saying they're going to use it for nefarious purposes, but it'll enrich them in a way I'm not sure is completely ethical by my standards (hoarding behavior data, surveillance). Phrased in yet another way, you're giving them an edge to transform into personal data business. This may be unanticipated, but so long as the collected data will be their private property, it's real possibility.
- throwaway3699 6y ago
  Even aggregated there is little monetary value beyond "people don't use this effect, let's try and ask why". Analytics doesn't answer many questions, that's true, but it does tell you where to look. It supplements talking to customers, not replacing.

OMGWTF 6y ago

Are we sure that window titles do not contain sensitive information? (E.g. file names, paths) https://github.com/audacity/audacity/pull/835/files#diff-4bfd3b3b53026d49a2072771cab4e8afd22b54de76baf68e3cb222adec2e191aR84 https://github.com/audacity/audacity/pull/835/files#diff-4bf...

mt42or 6y ago

Why so many hates from developers who never used or helped building Audacity ?

tazjin 6y ago
Because a huge part of the tech community lives in a kind of "outrage mania" at this point and is just looking for the next shitstorm to post in. This Github thread has literal calls for violence, racism and other such things in it and people keep piling on more. Tomorrow we'll have a different thread.
- deleted 6y ago
  [deleted]
- junon 6y ago
  I've been watching this thing from the start. I've not seen a lot of that. People are outraged at being tracked. That's perfectly acceptable outrage.
  - tazjin 6y ago
    > I've been watching this thing from the start. I've not seen a lot of that. The worst comments are gone. I reported some to Github and they removed the responsible accounts. > People are outraged at being tracked People are outraged at opt-in functionality. Whether it should exist is worth discussing (and, of course, how it should be implemented) - but lets not pretend that there is some evil move to "steal" your data going on here.
    - junon 6y ago
      You should research the history of Muse Group. This is not their first time doing this.
      - tazjin 6y ago
        Doing what exactly? Adding opt-in (why do people ignore this part?) functionality for tracking how their software is used, to figure out how to prioritise? I just don't see how people read evil conspiracy stuff into that. Searching for what this company supposedly did wrong brings up a bunch of terrible articles which literally quote stuff like 4chan greentext with fictional (and implausible) scenarios for how this can be abused. Is this tracking going to be useful for their purposes? No idea. Should they self-host this instead? Maybe, if that's feasible.

i_have_to_speak 6y ago

Here we go again. Follow Rocky Linux's path and start a community fork!

gaius_baltar 6y ago

Once the binaries come, it's a matter of finding out the GA tracking IDs and spam them with nonsense data.

FDSGSG 6y ago
... but why?
- gaius_baltar 6y ago
  Remove the incentive for the next one and protect the current victims by k-anonimizing their data.

h1x 6y ago

Initial response from the company: https://old.reddit.com/r/programming/comments/n6kxm8/psa_audacity_pr_to_add_telemetry_sharing_user/gx91j70/ https://old.reddit.com/r/programming/comments/n6kxm8/psa_aud... Basically, "everything's fine, you can trust us".

junon 6y ago
They've all but gone silent on the official Audacity discord too.

dharma1 6y ago

The first comment in the PR has been updated - https://github.com/audacity/audacity/pull/835 https://github.com/audacity/audacity/pull/835 "Why have telemetry at all? Essentially, it’s to help us to identify product issues early" "We will consider replacing Google and Yandex with another service if we find one that fulfills our requirements - thanks for the suggestions and keep them coming." "Just to reiterate, telemetry is completely optional and disabled by default. We will try to make it as clear as possible exactly what data is collected if the user chooses to opt-in and enable telemetry. We will consider adding the fine-grained controls that some of you have asked for."

ergot_vacation 6y ago
In other words "We're sorry you don't like what we're doing, but there's nothing wrong with it and we're going to keep doing it." Wow. I don't want fine-grained control, I want it out of the code.

swiley 6y ago

Just a reminder: This is coming from the same company that made a bunch of publicly available sheet music hard to access. I'm sure they'll have a number of "interesting" PRs in the future.

Dracophoenix 6y ago
From what I understand, that decision was made because of potential legal liability.
- ghoward 6y ago
  They also applied it to music in the public domain or under CC0.

valdiorn 6y ago

dumb question; can someone explain to me how a private company (muse group) "acquires" an open source project with lots of contributors? Who "sells" it? Who receives payment (if anyone?) Who decides the IP is now Muse Group's property?

deeblering4 6y ago

> Why have telemetry at all? Essentially, it’s to help us to identify product issues early: > Audacity is widely used across several platforms, but we have no information on the application stability. Really? You have no information about this? Don't you think instability would be reported by some users? > It is difficult for us to estimate the size of the user base accurately. You can obtain an estimate by tracking the number of downloads along with some far less intrusive metrics like user agent, etc. > We need a way to make informed decisions about which OS versions to support. For example, can we raise the minimum version of the macOS to 10.10 to update the wxWidgets to the latest version? Generally speaking no you should not raise the minimum OS version on a ubiquitous piece of software like this. Either work with the library vendor to find a way to support old and new, or use a different library. At a minimum keep the old versions around, there are no doubt offline installations out there running on old kit. Don't force everyone to upgrade their hardware/OS (it's expensive, and with apple products also means usable hardware going to the landfill) > We have a known issue with the new file format introduced in Audacity 3.0. We found it with the great help of the community members on our forum. However, there is no way for us to estimate the impact of these issues on users. Is it just a random case? Do we need to rush the work on the recovery tool or help the users one by one? Or do we need to rethink the file format to make it safer and more easily recoverable? Again, use the estimate metrics from downloads and user agents. And in any event you should prioritize fixes by the severity of the actual bug, not by "how many people does it affect". Just focus on writing stable software.

h_anna_h 6y ago

Are these related? https://news.ycombinator.com/item?id=26995610 https://news.ycombinator.com/item?id=26995610 https://news.ycombinator.com/item?id=27004688 https://news.ycombinator.com/item?id=27004688