4 ms·

Seems as though crash reporting is now deemed harmful. Strange take by the community.

by MAGZine 5y ago

Ygg2 5y ago
Why does crash reporting need my IP address?
- 0x4d4c 5y ago
  Consider multiple similar crash reports from one IP address or subnet - that could indicate, that there is something odd ie. with DNS resolution in particular network (corporate or whatever). But that's the case only for apps, that rely on internet connectivity heavily.
- carlhjerpe 5y ago
  I agree, but how do you plan on submitting the crash report without submitting your IP address?
  - hanche 5y ago
    Obviously the receiving end will see it, but they could decide not to log it.
  - deleted 5y ago
    [deleted]
- arp242 5y ago
  One possible reason would be to "group" reports: if 95% (or even 100%) of a certain error come from a single computer then there's either a very obscure bug or something wrong with that computer. If all reports come from different computers then it's a much more serious issue. IP addresses aren't really super-reliable for this (corporate networks, ISP NAT), but many people still are under the misapprehension that they are, and it's probably reliable enough for this purpose. I don't know if that's the reason; but it could be.
  - hanche 5y ago
    It seems more natural for the app to create a UUID for the purpose, then stash it in a prefs file for later use?
    - arp242 5y ago
      That's how I would do it as well, but that doesn't mean that Audacity's developers do.
      - l1n 5y ago
        They do hash IPs before sending them.
TeMPOraL 5y ago
Always has been. That is, crash reporting that happens automatically, without user's consent. It's not people suddenly objecting a standard practice - it's another episode of the ongoing fight against attempts to normalize this practice.
johannes1234321 5y ago
Crash reporting is only a part of that telemetry
tirpen 5y ago
No, people are think that them collecting "Data necessary for law enforcement, litigation and authorities’ requests (if any)" harmful. That has nothing to do with crash reporting, and there is no sane reason for a desktop, offline audio editor to collect such data.
the8472 5y ago
Take a look at their privacy policy, that seems quite broad for "crash reporting". https://archive.fo/d3LBR https://archive.fo/d3LBR
ArnoVW 5y ago
I believe the issue is that the update to the T's & C's is worded in a very wide and vague way. If I interpret that in a generous way, it's because their lawyers told them to be generic so as to be "always in compliance". The thinking being, no-one ever reads the conditions anyway. I've seen the same thinking in previous companies where I worked. The problem arrives when people start actually reading these vague and wide conditions. It's a bit like when you tell your son or daughter to take some money to go to the movies, and when you find out they have taken 500$ they say "don't worry, I won't use it all, but at least I'll be sure to have enough". If they would have explicitly stated what they were logging, and for what purpose, I think reactions would have been much less. Personally, I would have asked for permission upon crashing, with a button to show what is being sent.
galgalesh 5y ago
This is a strawman argument. The policy specifically says the following. > "data necessary for law enforcement, litigation, and authorities' requests (if any)," This is very different from "crash reporting".
ddtaylor 5y ago
You don't need a reverse shell to do crash reporting.
barrkel 5y ago
Crash reporting is an obvious vector for leaking of private and personal information.

Seems as though crash reporting is now deemed harmful. Strange take by the community.

Ygg2 5y ago

Why does crash reporting need my IP address?

0x4d4c 5y ago
Consider multiple similar crash reports from one IP address or subnet - that could indicate, that there is something odd ie. with DNS resolution in particular network (corporate or whatever). But that's the case only for apps, that rely on internet connectivity heavily.
carlhjerpe 5y ago
I agree, but how do you plan on submitting the crash report without submitting your IP address?
- hanche 5y ago
  Obviously the receiving end will see it, but they could decide not to log it.
- deleted 5y ago
  [deleted]
arp242 5y ago
One possible reason would be to "group" reports: if 95% (or even 100%) of a certain error come from a single computer then there's either a very obscure bug or something wrong with that computer. If all reports come from different computers then it's a much more serious issue. IP addresses aren't really super-reliable for this (corporate networks, ISP NAT), but many people still are under the misapprehension that they are, and it's probably reliable enough for this purpose. I don't know if that's the reason; but it could be.
- hanche 5y ago
  It seems more natural for the app to create a UUID for the purpose, then stash it in a prefs file for later use?
  - arp242 5y ago
    That's how I would do it as well, but that doesn't mean that Audacity's developers do.
    - l1n 5y ago
      They do hash IPs before sending them.

TeMPOraL 5y ago

Always has been. That is, crash reporting that happens automatically, without user's consent. It's not people suddenly objecting a standard practice - it's another episode of the ongoing fight against attempts to normalize this practice.

johannes1234321 5y ago

Crash reporting is only a part of that telemetry

tirpen 5y ago

No, people are think that them collecting "Data necessary for law enforcement, litigation and authorities’ requests (if any)" harmful. That has nothing to do with crash reporting, and there is no sane reason for a desktop, offline audio editor to collect such data.

the8472 5y ago

Take a look at their privacy policy, that seems quite broad for "crash reporting". https://archive.fo/d3LBR https://archive.fo/d3LBR

ArnoVW 5y ago

I believe the issue is that the update to the T's & C's is worded in a very wide and vague way. If I interpret that in a generous way, it's because their lawyers told them to be generic so as to be "always in compliance". The thinking being, no-one ever reads the conditions anyway. I've seen the same thinking in previous companies where I worked. The problem arrives when people start actually reading these vague and wide conditions. It's a bit like when you tell your son or daughter to take some money to go to the movies, and when you find out they have taken 500$ they say "don't worry, I won't use it all, but at least I'll be sure to have enough". If they would have explicitly stated what they were logging, and for what purpose, I think reactions would have been much less. Personally, I would have asked for permission upon crashing, with a button to show what is being sent.

galgalesh 5y ago

This is a strawman argument. The policy specifically says the following. > "data necessary for law enforcement, litigation, and authorities' requests (if any)," This is very different from "crash reporting".

ddtaylor 5y ago

You don't need a reverse shell to do crash reporting.

barrkel 5y ago

Crash reporting is an obvious vector for leaking of private and personal information.