5 ms·

I've forked the codebase and removed most of the code related to networking, crash reports or sentry telemetry. While I have been cautious and was trying to ma

I've forked the codebase and removed most of the code related to networking, crash reports or sentry telemetry. While I have been cautious and was trying to make sure that not any code could run by mistake (or false environment variable / ifdef checks down the line), I have to say that The Muse Group's intent seem to have been clearly that the code can be built without any of the tracking. All networking related features seem to have been optional, and could be disabled via environment variables like `HAS_NETWORKING` or `HAS_SENTRY_REPORTING` etc. I've detailed this more in my comment in the GitHub repository's issue [1] to make sure others will read about it, too. Personally I think this is a classical miscommunication error, and it seems as the intent of Muse Group was to be as legally compliant as possible. Of course, a dialog where end-users could opt-in to everything would've been nicer than enabling/disabling it via build environment flags - but that could've been a simple rational discussion. My current temporary (and building) fork is available at GitHub, too [2] and I would love to see this project being governed by a community of developers rather than a single owner that can potentially dictate integration of tracking mechanisms on others. [1] https://github.com/audacity/audacity/issues/1213#issuecomment-873547330 https://github.com/audacity/audacity/issues/1213#issuecommen... [2] https://github.com/cookiengineer/audacity https://github.com/cookiengineer/audacity

MikeUt 5y ago
> it seems as the intent of Muse Group was to be as legally compliant as possible. They deliberately and unnecessarily put themselves in a position where legal compliance could mean betrayal of their users.
perihelions 5y ago
"Personally I think this is a classical miscommunication error, and it seems as the intent of Muse Group was to be as legally compliant as possible." To be clear, this legal compliance is with the laws and government of Russia, where the parent company is domiciled. >"For the purposes of this Notice, WSM Group with registered office at Moskovsky pr-t,40-1301, Kaliningrad, Russia, 236004 (“Audacity“, “us“, “we“, or “our“) acts as the data controller for the Personal Data that is collected via the App and through the App." >"All your personal data is stored on our servers in the European Economic Area (EEA). However, we are occasionally required to share your personal data with our main office in Russia and our external counsel in the USA." https://www.audacityteam.org/about/desktop-privacy-notice/ https://www.audacityteam.org/about/desktop-privacy-notice/
- deleted 5y ago
  [deleted]
- jeltz 5y ago
  But what law requires them to send crash reports to their servers?
  - rattray 5y ago
    Come on. Everybody sends crash reports so their developers can fix bugs that cause crashes. Audacity doesn't have incriminating data about its users. Are you seriously worried that the KGB is gonna request your extradition because of the filenames of some mp3s you were editing when a crash occurred?
    - tohnjitor 5y ago
      Are you seriously not?
      - rattray 5y ago
        :) I am seriously not! EDIT: I am worried about governments coming after some people, but I am not worried that Audacity's ToS telemetry or ToS will be pivotal to their success in doing so. Just look at Assange – they got him on falsified rape charges, not his history of torrents or website visits.
        CRConrad 5y ago
        The rape charges against Assange may have been partly exaggerated, but calling them "falsified" is so much of an exaggeration that it itself comes closer to being a falsification than the charges ever were.
        CRConrad 5y ago
        Downvotes are still not all that convincing as logical arguments.
_0ffh 5y ago
Genuine question here, why go through all the trouble of manually removing the networking code? Wouldn't it be much easier to replace the import/include/whatever of the low level networking bindings with a stub library where all functions just immediately return with a networking error, as if the computer was off line? That would make it all but trivial to keep up with upstream code changes, and keep the disconnected version up to date.
- bb123 5y ago
  Or you could just block it connecting to the internet with an application firewall…
  - _0ffh 5y ago
    Nah, I think it still makes sense to have a connectionless version. There are Linux folks who object to the concept of application firewalls and don't use any.
    - blibble 5y ago
      there's so many ways round it on Linux they're essentially useless e.g. call python, call netcat, call perl, call wget, ...
- martinkunev 5y ago
  This can cause problems. Imagine the code is written as to keep trying to reconnect or write logs every time it fails to connect. It's probably more convinient to remove the code trying to access the network than to inspect what this code does in case it is unable to connect to the network (and possibly modify it).
m1el 5y ago
Hey, just wanted to tell you that the code you have currently doesn't compile. `SentryHelper.h` is required for `ADD_EXCEPTION_CONTEXT` macro, which can be empty. `HelpMenus.cpp` has a syntax error in preprocessor directives and an extra comma.
- cookiengineer 5y ago
  Hey, thanks for the hint :) I thought I amended those changes to the latest commit, but I seem to have forgotten to push those fixes. Originally I just injected the macro via command line as it didn't do anything when reporting was disabled. Can you please confirm that your HEAD contains the ":bug: Fixes" commit? [1] - I'll upload the built Arch package to the GitHub releases as soon as it's built again. I was using the "audacity-git" [2] AUR package's PKGBUILD file (replaced repo URL with my one) to generate my package and it seemed to work without issues with those fixes applied. There was also a "pthread_cleanup_pop(1)" patch in the PKGBUILD for the alsa library which I wondered about why it hasn't been pull requested upstream...but no idea what's up with that tbh. [1] https://github.com/cookiengineer/audacity/commit/d9f30b2b729becf7f3810b32c5b55f3886687e63 https://github.com/cookiengineer/audacity/commit/d9f30b2b729... [2] https://aur.archlinux.org/packages/audacity-git/ https://aur.archlinux.org/packages/audacity-git/
  - m1el 5y ago
    Yes, it does build.
cgtyoder 5y ago
Thanks for doing this. Any chance of providing pre-built binaries for those who don't have the tools handy/aren't that skilled in building?

MikeUt 5y ago

> it seems as the intent of Muse Group was to be as legally compliant as possible. They deliberately and unnecessarily put themselves in a position where legal compliance could mean betrayal of their users.

perihelions 5y ago

"Personally I think this is a classical miscommunication error, and it seems as the intent of Muse Group was to be as legally compliant as possible." To be clear, this legal compliance is with the laws and government of Russia, where the parent company is domiciled. >"For the purposes of this Notice, WSM Group with registered office at Moskovsky pr-t,40-1301, Kaliningrad, Russia, 236004 (“Audacity“, “us“, “we“, or “our“) acts as the data controller for the Personal Data that is collected via the App and through the App." >"All your personal data is stored on our servers in the European Economic Area (EEA). However, we are occasionally required to share your personal data with our main office in Russia and our external counsel in the USA." https://www.audacityteam.org/about/desktop-privacy-notice/ https://www.audacityteam.org/about/desktop-privacy-notice/

deleted 5y ago
[deleted]
jeltz 5y ago
But what law requires them to send crash reports to their servers?
- rattray 5y ago
  Come on. Everybody sends crash reports so their developers can fix bugs that cause crashes. Audacity doesn't have incriminating data about its users. Are you seriously worried that the KGB is gonna request your extradition because of the filenames of some mp3s you were editing when a crash occurred?
  - tohnjitor 5y ago
    Are you seriously not?
    - rattray 5y ago
      :) I am seriously not! EDIT: I am worried about governments coming after some people, but I am not worried that Audacity's ToS telemetry or ToS will be pivotal to their success in doing so. Just look at Assange – they got him on falsified rape charges, not his history of torrents or website visits.
      - CRConrad 5y ago
        The rape charges against Assange may have been partly exaggerated, but calling them "falsified" is so much of an exaggeration that it itself comes closer to being a falsification than the charges ever were.
        CRConrad 5y ago
        Downvotes are still not all that convincing as logical arguments.

_0ffh 5y ago

Genuine question here, why go through all the trouble of manually removing the networking code? Wouldn't it be much easier to replace the import/include/whatever of the low level networking bindings with a stub library where all functions just immediately return with a networking error, as if the computer was off line? That would make it all but trivial to keep up with upstream code changes, and keep the disconnected version up to date.

bb123 5y ago
Or you could just block it connecting to the internet with an application firewall…
- _0ffh 5y ago
  Nah, I think it still makes sense to have a connectionless version. There are Linux folks who object to the concept of application firewalls and don't use any.
  - blibble 5y ago
    there's so many ways round it on Linux they're essentially useless e.g. call python, call netcat, call perl, call wget, ...
martinkunev 5y ago
This can cause problems. Imagine the code is written as to keep trying to reconnect or write logs every time it fails to connect. It's probably more convinient to remove the code trying to access the network than to inspect what this code does in case it is unable to connect to the network (and possibly modify it).

m1el 5y ago

Hey, just wanted to tell you that the code you have currently doesn't compile. `SentryHelper.h` is required for `ADD_EXCEPTION_CONTEXT` macro, which can be empty. `HelpMenus.cpp` has a syntax error in preprocessor directives and an extra comma.

cookiengineer 5y ago
Hey, thanks for the hint :) I thought I amended those changes to the latest commit, but I seem to have forgotten to push those fixes. Originally I just injected the macro via command line as it didn't do anything when reporting was disabled. Can you please confirm that your HEAD contains the ":bug: Fixes" commit? [1] - I'll upload the built Arch package to the GitHub releases as soon as it's built again. I was using the "audacity-git" [2] AUR package's PKGBUILD file (replaced repo URL with my one) to generate my package and it seemed to work without issues with those fixes applied. There was also a "pthread_cleanup_pop(1)" patch in the PKGBUILD for the alsa library which I wondered about why it hasn't been pull requested upstream...but no idea what's up with that tbh. [1] https://github.com/cookiengineer/audacity/commit/d9f30b2b729becf7f3810b32c5b55f3886687e63 https://github.com/cookiengineer/audacity/commit/d9f30b2b729... [2] https://aur.archlinux.org/packages/audacity-git/ https://aur.archlinux.org/packages/audacity-git/
- m1el 5y ago
  Yes, it does build.

cgtyoder 5y ago

Thanks for doing this. Any chance of providing pre-built binaries for those who don't have the tools handy/aren't that skilled in building?