5 ms·

For everyone blindly rage triggered by the presence of the bytes "t-e-l-e-m-e-t-r-y", cogman10 elsewhere ITT [1] summarized that concern well: > It's like bein

For everyone blindly rage triggered by the presence of the bytes "t-e-l-e-m-e-t-r-y", cogman10 elsewhere ITT [1] summarized that concern well: > It's like being afraid your browser profiler is being used to spy on you. Could it do that? Sure. but there are so many easier ways to accomplish the same task. So take a second to straighten out your panties and then actually look at the thing first. It's just an open-source (!) APM protocol that competes with (edit: more like, adjacent to) DataDog, DynaTrace, New Relic etc etc. It's not even a suitable tool for spying. [1]: https://news.ycombinator.com/item?id=27296419 https://news.ycombinator.com/item?id=27296419

cogman10 5y ago
Doesn't even compete with them :) Each of those have opentelemetry adapters. You'd write your opentelemitry traces throughout your code and at some top level point in your app you configure and say "Hey, OpenTelemetry, report to New Relic". By itself, OpenTelemetry does nothing. It's usefulness is that someone writing a lib can add OpenTelemetry calls throughout and anyone using that lib can then collect metrics/traces into whatever metrics solution they are currently usings (be it DynaTrace, DataDog, or New Relic).
wdb 5y ago
It doesn't really compete Datadog, Dynatrace, Honeycomb, Lightstep, new Relic are all partners in defining the specification and help implementing it. Most of them already allowing ingesting traces over the OLTP protocol
- porker 5y ago
  Yes, where it helps is every programming language and framework can have one integration with OpenTelemetry, rather than custom ones for each separate telemetry system.
rektide 5y ago
I tend to think computing itself has been in kind of a dumb rut. Right now, OpenTelemetry is just logging & tracing, imagined as tools for ops, but over time, I fully expect we begin to see this as an event-stream in itself, something we can use for Event Sourcing, to watch & trigger new compute based off of. That's not in the cards today. But longer term, I think "knowing what computers are doing" is big business. And, I am very sad to say, eventually it will the obvious & logical way to spy on folks too. Because it will be the obvious & logical way to do many many many things, not because it's tech that's built or intended for spying. But right now computing is ephemeral, we don't persist any of the stack traces we compute through, and fundamentally, tracing really is about distilling out & keeping higher level stack traces. It's something computing needs to have been doing, that will bring us to a radically higher level of understanding (but it also does have some scary uses). It's been a couple years, but tracing is a powerful new basis with which to start re-engaging the "Turning the datqbase inside out"[1] / "I <3 Logs" view of data-storage (& computing) that had some buzz for a bit. We're not at all here yet, but I think it's coming. [1] https://martin.kleppmann.com/2015/11/05/database-inside-out-at-oredev.html https://martin.kleppmann.com/2015/11/05/database-inside-out-...
- cogman10 5y ago
  Who will be doing this spying? It certainly wouldn't be opentelemetry itself as that's just a interface you add adapters to. Are you thinking a man in the middle would spy? How would that work? This information is pushed over secure connections on the backend likely in a VPN. On the front end, it'd be transmitted over HTTPS. Shouldn't we be more fearful of information collected from DNS than encrypted data sent over HTTPS? Or are you thinking the metrics aggregators are going to do the spying? How would that impact their business model? Do you think a company would continue to pay the likes of new relic if they were caught giving access to metrics data to outside groups? Do you worry about postgres or prometheus sharing your data with 3rd parties? What about SQL server? What is the risk model and how would it be different from say the risk model of making an REST call or using a 3rd party library? Or is it just that "because this is well integrated throughout, it could be used to spy"? Because, generally speaking, these traces don't have enough information to identify what individual users are doing to the system. Even if they did, that wouldn't be a great way to track a user, you'd simply put that tracking information right at the front end of the system. Plumbing it from one end of the system to the other gives little value for a spy. It's adding a bunch of noise to the question you'd want to ask "what are the user's behaviors with our product?" And even if the demand is there, why would you do this through tracing an not a purpose built spy tool. Wouldn't it be easier for a nefarious lib writer to make a plugin purpose built to collect evil data? If that sells, why wouldn't a tech company buy that instead of buying a solution which combs 3 layers of separation to get worse answer? Why wouldn't google analytics still exist?
  - rektide 5y ago
    We're forming the best, most complete, competent view of computing-that's-happened that we've ever formed. You have a bunch of weird straw men that I don't get. I tried to de-emphasize the role of behavioral analytics & user-tracking, because I think it's just one small part of what this will be used for. But I am fairly confident we will eventually start to do more user-tracking via these systems. I've used half a dozen different user-tracking products at various companies, and they all read like ultra-low-fi versions of the ops tools. Ops tools have been evolving, at a far faster rate, far more in the public domain, and at some point, it just wont make sense to instrument your product twice. I want to re-iterate that I see this as one of the smallest, least interesting aspects of a coming Event-Sourcing-powered-by-tracing world. There's far more profound implications for what could happen to computing in general here (a de-wiring of the request/response microservice world & a shift towards async, reactive systems). But even today, it feels to me like folks work very hard to draw a distinction between their ops tools & their behavioral analytics tool. As a developer, they often work, I often interface with them in very very similar fashion. The desire to draw the distinction has felt illogical, and felt unsupported. Especially as the ops tools advance, I think it will be harder to reconcile the idea that there are & ought be separate systems of tracking/viewing/understanding.
nonbirithm 5y ago
It's interesting how names can send signals without any substance of the actual product being relevant. (The thread over 'bro pages' was one example.) This specific instance is rather revealing of one of the biases of some HN users. I look at myself and I find that many opinions on technology that I hold have clearly been shaped by how much time I've spent on HN. Data-exfiltration telemetry is one example. But I now think about a lot of things I might not have given much thought to before, like how being backed by a VC can shape the direction of a service for the worse. I also find that I'm unnecessarily hardline on topics like paid services versus open source, and shut out anything positive people have to say about advertising as a revenue source. I sometimes imagine what would happen if I was born inside the borders of a different country. Some countries have very nationalistic citizens. How much of my thought processes are a result of the people and signals I surround myself with? How many of those signals will reach me whether or not I consent to seeing them (advertisements being one example)? I think I could have been a very different person if I was raised even a hundred miles from where I actually grew up, despite having a similar chemical makeup. That makes me be more conscious about where I'm likely to seek information, and to try not to look for opinions that I already agree with entirely.
userbinator 5y ago
The knee-jerk reactions are unfortunately because the word "telemetry" has been perverted into having that connotation by those who don't want to call what they're doing "spyware". It certainly doesn't help to see that word along with "GitHub", who is now owned by a company which is doing exactly that. Other relevant euphemisms that have appeared within the past few years: "analytics", "diagnostics", "usage reporting", "connected experiences", "experience improvement".

cogman10 5y ago

Doesn't even compete with them :) Each of those have opentelemetry adapters. You'd write your opentelemitry traces throughout your code and at some top level point in your app you configure and say "Hey, OpenTelemetry, report to New Relic". By itself, OpenTelemetry does nothing. It's usefulness is that someone writing a lib can add OpenTelemetry calls throughout and anyone using that lib can then collect metrics/traces into whatever metrics solution they are currently usings (be it DynaTrace, DataDog, or New Relic).

wdb 5y ago

It doesn't really compete Datadog, Dynatrace, Honeycomb, Lightstep, new Relic are all partners in defining the specification and help implementing it. Most of them already allowing ingesting traces over the OLTP protocol

porker 5y ago
Yes, where it helps is every programming language and framework can have one integration with OpenTelemetry, rather than custom ones for each separate telemetry system.

rektide 5y ago

I tend to think computing itself has been in kind of a dumb rut. Right now, OpenTelemetry is just logging & tracing, imagined as tools for ops, but over time, I fully expect we begin to see this as an event-stream in itself, something we can use for Event Sourcing, to watch & trigger new compute based off of. That's not in the cards today. But longer term, I think "knowing what computers are doing" is big business. And, I am very sad to say, eventually it will the obvious & logical way to spy on folks too. Because it will be the obvious & logical way to do many many many things, not because it's tech that's built or intended for spying. But right now computing is ephemeral, we don't persist any of the stack traces we compute through, and fundamentally, tracing really is about distilling out & keeping higher level stack traces. It's something computing needs to have been doing, that will bring us to a radically higher level of understanding (but it also does have some scary uses). It's been a couple years, but tracing is a powerful new basis with which to start re-engaging the "Turning the datqbase inside out"[1] / "I <3 Logs" view of data-storage (& computing) that had some buzz for a bit. We're not at all here yet, but I think it's coming. [1] https://martin.kleppmann.com/2015/11/05/database-inside-out-at-oredev.html https://martin.kleppmann.com/2015/11/05/database-inside-out-...

cogman10 5y ago
Who will be doing this spying? It certainly wouldn't be opentelemetry itself as that's just a interface you add adapters to. Are you thinking a man in the middle would spy? How would that work? This information is pushed over secure connections on the backend likely in a VPN. On the front end, it'd be transmitted over HTTPS. Shouldn't we be more fearful of information collected from DNS than encrypted data sent over HTTPS? Or are you thinking the metrics aggregators are going to do the spying? How would that impact their business model? Do you think a company would continue to pay the likes of new relic if they were caught giving access to metrics data to outside groups? Do you worry about postgres or prometheus sharing your data with 3rd parties? What about SQL server? What is the risk model and how would it be different from say the risk model of making an REST call or using a 3rd party library? Or is it just that "because this is well integrated throughout, it could be used to spy"? Because, generally speaking, these traces don't have enough information to identify what individual users are doing to the system. Even if they did, that wouldn't be a great way to track a user, you'd simply put that tracking information right at the front end of the system. Plumbing it from one end of the system to the other gives little value for a spy. It's adding a bunch of noise to the question you'd want to ask "what are the user's behaviors with our product?" And even if the demand is there, why would you do this through tracing an not a purpose built spy tool. Wouldn't it be easier for a nefarious lib writer to make a plugin purpose built to collect evil data? If that sells, why wouldn't a tech company buy that instead of buying a solution which combs 3 layers of separation to get worse answer? Why wouldn't google analytics still exist?
- rektide 5y ago
  We're forming the best, most complete, competent view of computing-that's-happened that we've ever formed. You have a bunch of weird straw men that I don't get. I tried to de-emphasize the role of behavioral analytics & user-tracking, because I think it's just one small part of what this will be used for. But I am fairly confident we will eventually start to do more user-tracking via these systems. I've used half a dozen different user-tracking products at various companies, and they all read like ultra-low-fi versions of the ops tools. Ops tools have been evolving, at a far faster rate, far more in the public domain, and at some point, it just wont make sense to instrument your product twice. I want to re-iterate that I see this as one of the smallest, least interesting aspects of a coming Event-Sourcing-powered-by-tracing world. There's far more profound implications for what could happen to computing in general here (a de-wiring of the request/response microservice world & a shift towards async, reactive systems). But even today, it feels to me like folks work very hard to draw a distinction between their ops tools & their behavioral analytics tool. As a developer, they often work, I often interface with them in very very similar fashion. The desire to draw the distinction has felt illogical, and felt unsupported. Especially as the ops tools advance, I think it will be harder to reconcile the idea that there are & ought be separate systems of tracking/viewing/understanding.

nonbirithm 5y ago

It's interesting how names can send signals without any substance of the actual product being relevant. (The thread over 'bro pages' was one example.) This specific instance is rather revealing of one of the biases of some HN users. I look at myself and I find that many opinions on technology that I hold have clearly been shaped by how much time I've spent on HN. Data-exfiltration telemetry is one example. But I now think about a lot of things I might not have given much thought to before, like how being backed by a VC can shape the direction of a service for the worse. I also find that I'm unnecessarily hardline on topics like paid services versus open source, and shut out anything positive people have to say about advertising as a revenue source. I sometimes imagine what would happen if I was born inside the borders of a different country. Some countries have very nationalistic citizens. How much of my thought processes are a result of the people and signals I surround myself with? How many of those signals will reach me whether or not I consent to seeing them (advertisements being one example)? I think I could have been a very different person if I was raised even a hundred miles from where I actually grew up, despite having a similar chemical makeup. That makes me be more conscious about where I'm likely to seek information, and to try not to look for opinions that I already agree with entirely.

userbinator 5y ago

The knee-jerk reactions are unfortunately because the word "telemetry" has been perverted into having that connotation by those who don't want to call what they're doing "spyware". It certainly doesn't help to see that word along with "GitHub", who is now owned by a company which is doing exactly that. Other relevant euphemisms that have appeared within the past few years: "analytics", "diagnostics", "usage reporting", "connected experiences", "experience improvement".