5 ms·

You beat me to it! But I doubt Sentry is the vector - it's a generally legitimate service that helps software devs track failures in the wild without the users

You beat me to it! But I doubt Sentry is the vector - it's a generally legitimate service that helps software devs track failures in the wild without the users having to report anything - I've worked with it for single page web applications. Of course, it could be abused to track anything. The right short-term thing to do is deny it networking access with LittleSnitch (mac) or the equivalent, while buying time to produce a privacy-preserving fork. FWIW, I don't think Sentry is appropriate for this kind of application. OSS should have opt-in error reporting only. It would also be a good opportunity for the fork to factor out the UI into something like Electron, because the Audacity UI has always been pretty bad, IMHO. (I suspect the biggest obstacle to producing a viable fork will be fights over which pun to use as a replacement name.)

sneak 5y ago
It's not legitimate because it happens without the consent of the user. It transmits their data without ever asking them if they want to be spied on.
- iakov 5y ago
  It's not Sentry's job to ask users for consent, but the software developers. If you want to be mad - be mad at the people who are doing the truly shitty things with your data, not at the legitimate vendor.
  - sneak 5y ago
    What percentage of Sentry's customers are collecting the data unethically? At some point the tool vendors share responsibility. It's like saying it's not AdWords or Facebook's fault there are so many ads everywhere, because it's the people who pay to run the ads who are at fault.
Griffinsauce 5y ago
> OSS should have opt-in error reporting only. I'm curious what's different about OSS in this regard? I thought this was an argument about the user's privacy, so what does it matter how the software was built? Also a sidenote: this whole thread feels quite pedantic and counterproductive to me. Sentry is an error reporting tool that helps solve issues in software, the alternative is your software having many, many more bugs that never get fixed. It's not used for tracking or "spying". I feel that blowing your stack about a tool like this weakens your argument against true privacy invasions. It trains people to stop listening because we whine about things that are not actually a problem.
- dgan 5y ago
  When you need to report errors from offline product, you create a dump file, zip it, and ask user to send it if he wants the problem investigated File creation can be done automatically as a segfault handler for example
  - yarcob 5y ago
    I have some experience developing desktop apps. Less than 1% of crashes are reported by users. And only around 50% of users who do report a bug will provide follow up info such as crash reports or diagnostic information. Before I had automatic crash reporting, I was blissfully unaware how bad my app was.
    - dgan 5y ago
      Well what you said is correct, but there is a difference between a commercial product, and free software I would expect users to care more about the latter. For example, I am specifically talking about open source games, where often users report errors with zipped stacktrace attached
      - duckmysick 5y ago
        In my experience it's the other way around - but the difference is not that big anyway. Commercial programs typically imply paid support, which can tease out more details when the user contacts them. The users themselves are also more invested, as they already committed their money. Open source software faces the same problems about a lack of bug reports. Check out this article and the related HN discussion: https://pointersgonewild.com/2019/11/02/they-might-never-tell-you-its-broken/ https://pointersgonewild.com/2019/11/02/they-might-never-tel... https://news.ycombinator.com/item?id=21427996 https://news.ycombinator.com/item?id=21427996
      - yarcob 5y ago
        Yes, there are some users that are really helpful. I also thought that my users are great at reporting bugs. But when I added an automatic crash reporter, I was shocked how many crashes happened that nobody bothered to report. Maybe 1 in 10 crashing bugs was reported at all. A serious bug that made the app all but unusable was reported by 2 or 3 people (out of at least 100 people who were affected before I pulled the broken update).
swiley 5y ago
>it's a generally legitimate service Opt-out network access or reporting of anything is never legitimate.
- aspaceman 5y ago
  It's opt in.

sneak 5y ago

It's not legitimate because it happens without the consent of the user. It transmits their data without ever asking them if they want to be spied on.

iakov 5y ago
It's not Sentry's job to ask users for consent, but the software developers. If you want to be mad - be mad at the people who are doing the truly shitty things with your data, not at the legitimate vendor.
- sneak 5y ago
  What percentage of Sentry's customers are collecting the data unethically? At some point the tool vendors share responsibility. It's like saying it's not AdWords or Facebook's fault there are so many ads everywhere, because it's the people who pay to run the ads who are at fault.

Griffinsauce 5y ago

> OSS should have opt-in error reporting only. I'm curious what's different about OSS in this regard? I thought this was an argument about the user's privacy, so what does it matter how the software was built? Also a sidenote: this whole thread feels quite pedantic and counterproductive to me. Sentry is an error reporting tool that helps solve issues in software, the alternative is your software having many, many more bugs that never get fixed. It's not used for tracking or "spying". I feel that blowing your stack about a tool like this weakens your argument against true privacy invasions. It trains people to stop listening because we whine about things that are not actually a problem.

dgan 5y ago
When you need to report errors from offline product, you create a dump file, zip it, and ask user to send it if he wants the problem investigated File creation can be done automatically as a segfault handler for example
- yarcob 5y ago
  I have some experience developing desktop apps. Less than 1% of crashes are reported by users. And only around 50% of users who do report a bug will provide follow up info such as crash reports or diagnostic information. Before I had automatic crash reporting, I was blissfully unaware how bad my app was.
  - dgan 5y ago
    Well what you said is correct, but there is a difference between a commercial product, and free software I would expect users to care more about the latter. For example, I am specifically talking about open source games, where often users report errors with zipped stacktrace attached
    - duckmysick 5y ago
      In my experience it's the other way around - but the difference is not that big anyway. Commercial programs typically imply paid support, which can tease out more details when the user contacts them. The users themselves are also more invested, as they already committed their money. Open source software faces the same problems about a lack of bug reports. Check out this article and the related HN discussion: https://pointersgonewild.com/2019/11/02/they-might-never-tell-you-its-broken/ https://pointersgonewild.com/2019/11/02/they-might-never-tel... https://news.ycombinator.com/item?id=21427996 https://news.ycombinator.com/item?id=21427996
    - yarcob 5y ago
      Yes, there are some users that are really helpful. I also thought that my users are great at reporting bugs. But when I added an automatic crash reporter, I was shocked how many crashes happened that nobody bothered to report. Maybe 1 in 10 crashing bugs was reported at all. A serious bug that made the app all but unusable was reported by 2 or 3 people (out of at least 100 people who were affected before I pulled the broken update).

swiley 5y ago

>it's a generally legitimate service Opt-out network access or reporting of anything is never legitimate.

aspaceman 5y ago
It's opt in.