10 ms·

Audacity: Clarification of Privacy Policy

133 points by anonymousab 5y ago

tlackemann 5y ago
I don't understand the pettiness around this issue. Audacity needed a maintainer to help with support and development. Developer, who has a pretty active YouTube channel covering design in music software, takes interest and leads the project. Said developer adds telemetry to help make more informed decisions. People lose their collective minds. Can someone fill me in on what this person could have done better? Honestly, it seems like pearl-clutching from a select group of users who never gave a shit in the first place and just want to whine about something they never contributed to and get to use for free.
- system16 5y ago
  I think if you read the comments in the link, it's pretty clear: changes regarding personal information were dumped on the community along with a bunch of legalese without warning, an announcement, or context. Had the new maintainers given the community a heads up via a simple blog post explaining the reasoning behind this, we wouldn't be where we are. Hopefully they can chalk this off as a learning experience and move forward to gain trust of the community.
- kennywinker 5y ago
  You missed: project purchased by ad-heavy website owner (ultimateguitar). As for how they could make it better: make it opt-in not opt-out. This is the kind of toxic behaviour we all tolerate from commercial software, but people get mad when it leaks into open source.
- Xc43 5y ago
  An example of the problem is that in the UK those below 13yo cannot give consent to telemetry. Audacity is used in their public schooling system. Newer versions of Audacity will not be usable by those students anymore. Roughly.
  - ronsor 5y ago
    So they just don't consent to it? The telemetry certainly isn't mandatory; it isn't even enabled by default from what I can tell.
    - Xc43 5y ago
      There was no opt-out. Minors were asked not to use the app. Here is the link towards the Privacy notice on the 2nd of July. https://archive.fo/d3LBR#selection-673.0-673.129 https://archive.fo/d3LBR#selection-673.0-673.129
      - xavriley 5y ago
        Asked not to is different from forbidden though, no? I’m not a legal expert but I doubt this clause is one they wanted to put in and is probably driven by some legal counsel with an eye on international law.
        rStar 5y ago
        lawyers do what they’re told. This is the acquiring company maximizing the value of their acquisition by any means possible.
        Xc43 5y ago
        In this case, children 12 and below cannot give consent but they can use the app if parental consent is given. Having children in that age range use the app would require Audacity to seek parental consent by "[making] reasonable efforts (taking into account the available technology and risks inherent in the processing) to verify that the person providing consent holds parental responsibility for the child."1 While they wrote to minors "please do not use the App", they also wrote "The App we provide is not intended for individuals below the age of 13."2 Not being a lawyer, I cannot talk about the implications of these passages. src1: https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/children/ https://ico.org.uk/for-organisations/guide-to-data-protectio... src2: link in my parent comment
        5y ago
- dantondwa 5y ago
  I think there's a misunderstanding: Tantacrul, the developer with a pretty active Youtube channel, works for the Muse Group, which acquired Audacity. This has nothing to do with him. A company acquired Audacity, not him, and he's not in charge of the Muse Group. Your portraying of the whole thing is inaccurate. People didn't lose their collective minds. The Muse Group acquired Audacity, then introduced: - a CLA (which, between other things, allows them to make closed source versions of Audacity) - telemetry - a very controversial privacy policy People aren't losing their minds. And please, do not spread misinformation.
  - maccard 5y ago
    >people aren't losing there minds Have you read this thread? See [0] as an example. [0] https://news.ycombinator.com/item?id=27740350 https://news.ycombinator.com/item?id=27740350
  - whateveracct 5y ago
    > a CLA (which, between other things, allows them to make closed source versions of Audacity) But all previous commits they'd build on are GPL..
  - zxzax 5y ago
    Controversial? This looks extremely similar to most other privacy policies. I would urge you to read the privacy policy on any other web sites that you visit, or for any other services that you use, and compare and contrast. A good starting point might be the privacy policy on your phone's app store.
    - Lammy 5y ago
      We're talking about Free Software — not about websites, services, or mobile cartels.
      - zxzax 5y ago
        I'm not sure what you're suggesting the difference is, or what specifically here is a "mobile cartel?" FOSS projects and other related things also have privacy policies, and in fact you probably want them to so that they're clear what they're doing with the data they've aggregated. Here's some examples: https://docs.github.com/en/github/site-policy/github-privacy-statement https://docs.github.com/en/github/site-policy/github-privacy... https://www.debian.org/legal/privacy.en.html https://www.debian.org/legal/privacy.en.html https://fedoraproject.org/wiki/Legal:PrivacyPolicy https://fedoraproject.org/wiki/Legal:PrivacyPolicy https://www.fsf.org/about/free-software-foundation-privacy-policy https://www.fsf.org/about/free-software-foundation-privacy-p...
- AnIdiotOnTheNet 5y ago
  > Said developer adds telemetry to help make more informed decisions. People lose their collective minds. I have never once used software I thought was actually good that was designed based on feedback from telemetry.
  - arkitaip 5y ago
    How would you know though? Telemetry is so common in desktop and web apps alike that you're probably surrounded by it.
    - rossy 5y ago
      It's only common in certain bubbles. Someone who primarily uses FOSS could easily say this. Someone who prefers software created in the era before online telemetry was widespread could also say this.
    - Kim_Bruning 5y ago
      Seems to have only picked up in the last decade or so. Before that it wasn't really practical, and everything seemed to work fine without it. When I was a kid, computers weren't connected to the internet. The first time I had a connection it was at 33.6 kbit/s (at 25 cents per minute). Can you imagine if I had had all these 'modern' programs on my computer that would suddenly try to talk over that tiny straw of a connection? It'd be unusable! There are still a lot of reasons why you would like to maybe hope that a computer doesn't try to randomly talk to everyone and everything on the intertubes on a whim. For instance: said computer might be acting as a firewall, or it's being used for SCADA, needs to comply with corporate or government security policy, or is otherwise supposed to be something-gapped. I guess for regular consumer technology that hope has long fled. You'd think that floss software could automatically be trusted to be quiet-by-default, but I guess that time is now past as well. Possibly software that is quiet-by-default needs to start explicitly noting that it is so; so that if you have a particular task that really needs a quiet-by-default machine, you can draw from that subset. You are right that audacity probably doesn't need to be in the quiet-by-default category. But ...eh... somehow this feels like a retreat.
- techrat 5y ago
  https://www.independent.co.uk/life-style/gadgets-and-tech/audacity-free-collect-personal-data-russia-b1878305.html https://www.independent.co.uk/life-style/gadgets-and-tech/au...
- matheusmoreira 5y ago
  > Said developer adds telemetry to help make more informed decisions. People lose their collective minds. Their ability to make decisions doesn't matter. It is does not justify putting spyware into previously trusted software. Also, nobody believes that excuse for a second. They couldn't care less about "improving" anything but their bottom line. They are merely capitalizing on the trustworthiness of an open source project in an attempt to extract maximum value out of its users. If they wanted to improve the software, they would have hired somebody with good taste to work on it. People with good taste do not tolerate abusive spyware. > Can someone fill me in on what this person could have done better? They could have not collected any "metrics" in the first place. That way, this ridiculous privacy policy would never have been necessary.
- frobozz 5y ago
  One thing would be not violating the Open Source Definition by forbidding use by under 13s.
- McGlockenshire 5y ago
  > Said developer adds telemetry to help make more informed decisions. People lose their collective minds. I don't understand the reaction either. It's hard to talk about this stuff here because of the anti-analytics groupthink. Everyone seems to jump to the worst possible conclusion whenever it's brought up. I can't help but wonder if the people screeching about it have ever actually put analytics in their own products. Understanding how your software is used in the real world by real users is absolutely invaluable!
  - Kim_Bruning 5y ago
    The reason people jump to the worst possible conclusion is the same reason that people often do: because abuse is rampant. And sometimes that's why we can't have nice things, because too many people have misbehaved while using them. Assuming integrity, I think the people complaining about it would indeed do unto others as they would have others do unto themselves. That is to say: not include telemetry.
- zelphirkalt 5y ago
  How about just asking people for their opinion instead of trying to somehow conclude on usage patterns and stuff from telemetry data, which is not opt-in, but opt-out, which is quite sneaky in itself? "Just ask those people!" Is what I think every single time, when this kind of issue pops up. Ask the people what they find annoying about the product, ask them what they like. There are many questions you can ask and which yield a much more direct result than telemetry data, without upsetting a community and without coming across as sneaky and disrespectful of user privacy.
  - blooalien 5y ago
    Exactly! And if you really need any sort of "telemetry" to get the data that you need, then do what so many other FOSS software I've seen with any sort of "phone home features" does, and simply ask the user during the first run if it's okay to send <such and such data> for development purposes. (Also, a toggle in the preferences is always nice, too, so that I can enable such a feature on days I'm feeling particularly helpful, and still easily disable it on days I'm feeling like there's no need for my software to be sending data anywhere outside my network.) It's not uncommon for me to approve such features when I'm dealing with software I trust, and when I'm thoroughly informed of exactly what data they're collecting and why. If I see a list of reasonable data points and it's not too intrusive or overreaching (and if I can examine the data before it's sent) then I'm quite often okay with it (again, with software I already trust for other reasons).
kawsper 5y ago
> What does the OS version string contain (e.g. on Linux specifically)? Some custom kernel version strings could possibly identify someone. I actually didn't think of this, I compile my own kernels and add my own text to the kernel name.
akersten 5y ago
This is now the 2nd "clarification" that Muse group, the new team in charge of Audacity, has recently put out - the first one being here[0]. At this point, it's clear that they are taking the product in an unpopular direction. So why keep pushing an online-first privacy policy and telemetry? Certainly it is not one of the pressing needs of the core product. Honestly, it will take some convincing to make me think this isn't nefarious at this point. At a minimum, the community is not being listened to, just placated. [0]: https://github.com/audacity/audacity/discussions/880 https://github.com/audacity/audacity/discussions/880
- rStar 5y ago
  when this happens the product dies. in my mind it’s as if audacity never existed. hopefully a project emerges from a forked code base that’s useable going forward.
  - zxzax 5y ago
    I'm not sure why the word "fork" is being repeatedly mentioned or why people are thinking this is making the code unusable. At most, I would expect a patched distribution similar to VSCodium to pop up, i.e. not a hard fork. If there was willpower in the community to fork the project and fix all the other long standing issues, that would have happened already, so there is no reason to expect a fork here.
- xtracto 5y ago
  I dont understand all the ruckus around this. Just fork the repo and remove the spying code (I dont want an audio editor to share my CPU and IP with anyone). It has been done for larger codebases like OpenOffice and MySql.
sneak 5y ago
> We believe concerns are due largely to unclear phrasing in the Privacy Policy This is gaslighting. It's not the wording people have an issue with, it's the nonconsensual spyware.
- akerl_ 5y ago
  How could it be nonconsensual? The policy is provided when installing the software. This may certainly be a bad decision for the Audacity team, but nobody is being forced to use their product.
  - anonymousab 5y ago
    It is nonconsensual when the starting premise is "using Audacity". "Consensual" in that case would mean opt-in telemetry.
    - akerl_ 5y ago
      That’s some serious mental gymnastics. I’ll be sure file a complaint at the supermarket for nonconsenual collections: I wanted to take the vegetables home, but they don’t let me opt out of paying.
      - elmo2you 5y ago
        Unless the telemetry is somehow a form of payment for using the (open source) product, I think your argument falls under: https://en.wikipedia.org/wiki/Reductio_ad_absurdum https://en.wikipedia.org/wiki/Reductio_ad_absurdum
        akerl_ 5y ago
        Given that the context here is “a producer of something setting the terms under which they’ll give it to somebody else”, my grocery store hardly sounds like an extreme example.
        5y ago
nxpnsv 5y ago
But, why do they need to store IP-address at all? It don't see what good it can do.
- deadbunny 5y ago
  I would assume it's from webserver logs. I could of course be wrong.
  - noobermin 5y ago
    They reference GDPR so that's exactly why they mention it.
- anonymousab 5y ago
  Logs, maybe abuse protection? For better or worse, the musescore-downloader affair has probably made them a bit pensive and defensive around potential abuse from clients. They may also simply think that it's just plainly required if they're going to run an online service that the app connects to by default. That's all speculation though, hopefully they'll answer that question on the GitHub discussion.
undfg 5y ago
This reminds me of the freenode debacle. The problem is not that audacity was purchased, the problem is that it was sold.
- arkitaip 5y ago
  I get the feeling that the community has had enough of the corporate shenanigans, that a proper fork is about to go alive any day now.
Andoryuuta 5y ago
Alongside the Audacity changes, the Muse group has also performed some highly questionable actions in the context of MuseScore, such as falsely claiming that a downloader script was illegal, and that they owned copyright of all sheet music on their site. Going as far as to state that they will "cooperate with github.com and Chinese government to physically find you and stop the illegal use of licensed content." [0]. Unfortunately, I don't believe the general users of audacity will ever hear about the groups actions, and will continue to use the audacity without knowledge of what has changed. [0]: https://github.com/Xmader/musescore-downloader/issues/5 https://github.com/Xmader/musescore-downloader/issues/5
- Xylakant 5y ago
  That thread is certainly not a good example of communication, but I cannot find any place where a representative from the Muse group says that they own the copyright to all sheet music on their site. They say (and that's to the best of my knowledge mostly correct at least here in Germany) that the arrangement for music is legally protected and even if someone else typed down the sheet, the rights to this sheet are still protected. And they point to the music industry enforcing restrictions (having worked with the music industry, I find that one entirely credible)
  - maccard 5y ago
    There's a thread on an AMA about ultimate guitar from a while back where the founder talks about when they made the decisions to start adding the features people complain about, and the impression he gives is exactly that; the rights holders of the music had them over a barrel and it was a sink or swim decision
- alpaca128 5y ago
  > Going as far as to state that they will "cooperate with github.com and Chinese government to physically find you and stop the illegal use of licensed content." Wow, that's low. It's one thing to send dumb threats, it's another to threaten someone with involvement of a government that frequently disappears people. This is how you turn your products into the PR equivalent of radioactive waste.
41209 5y ago
Any good alternatives. It's better to consider the project dead then to argue with them
- racl101 5y ago
  I'd totally get a paid product like Ableton or Pro Tools if they didn't send data about me.
- themodelplumber 5y ago
  It really depends on what you need. There are lots of non-FOSS but effectively-free alternatives. Ocenaudio is way better than Audacity in gobs of ways, except it's not multi-track. Reaper is pretty great but if you're hoping for commercial use with $20K+ gross/year, you need to pay $200+ USD. In FOSS land, Zrhythm, Qtractor, LMMS...but these are DAWs so again it depends on what you were using Audacity for. You could even learn sox and maybe benefit from some command line use, like writing scripts for things you need to do all the time. My advice: List the specific tasks you need to do, and aim to find 2-3 apps that will fill the gap. Then any extras on top of that will be gravy. Edit: Oh and you can also use FOSS like Blender and render edited sound to mp3, or KDEnlive, or other software that's video or animation related. So if you already know those tools, or like how they work (in some ways they are pretty slick!) then they may fit better than other audio-only software.
  - 41209 5y ago
    Zrhythm looks great, I think I'll switch to this !
xs 5y ago
The thing that isn't addressed. Their terms now say that people 13 and under cannot use their product. Yet this tool is taught in schools. They want to collect this data but do not want to follow COPPA laws.
dehrmann 5y ago
Dumb question: Audacity has a GPL license, so it can be forked or built and distributed by a third party, right?
- Gaelan 5y ago
  Yep. In particular, any version of audacity from a Linux distro's package manager is likely already built with telemetry off.
theden 5y ago
Pretty laughable they have to post even more walls of text to convince folks that it's okay for an _offline_ application to spy on you. Frankly, this would have probably been tolerated or largely ignored if there wasn't a long history of Audacity not doing this and for the most part working well. Time to either move to hard fork (if it happens) or find an alternative IMO, they can choose to die on this hill. We're already tracked by so many apps (and at the OS-level for many) I think a lot of people are pushing back hard (maybe unfairly) because it's something they can control since it's FOSS. Audacity has been around for over 20 years! It's takes some serious ego to drop in CLAs and telemetry on the community months after acquiring it.
- jitl 5y ago
  Telemetry and error reporting are opt-in. Error reporting uses industry-standard Sentry (also an OSS), which is not a nefarious data seller. Auto-update checked are opt-count and send a very basic user-agent with less data than an average web browser HTTP request. There is no spying here.
  - theden 5y ago
    Yeah maybe by modern software which doesn't respect the user's privacy and resource usage it's nothing to worry about. I'd say this is a regression, and adding all that networking code makes it easier for them to push it further down the line, and adds more vectors for attacks. At best it's bloat. Developers were able to write good software without pulling in user's data before, it says more about the devs if they think it's so necessary. Okay say it's not spying—you now have another app on your system pinging hosts, and depending on how much you trust Muse, you have to check the changelog every time to ensure they haven't added more bloat or juiced up the telemetry. I'd posit that spying has been normalised we don't even recognise it anymore. Opt-in isn't a get out of jail free card, since your avg user will just click whatever.
    - noobermin 5y ago
      Can't you just turn off auto update and not get this? FFS, any time you connect to a website they know your IP address. A log will save it, perhaps, and they say they prune their logs after 24 hours which is reasonable. Literally wget sends this sort of info, you can try it wget -d example.com unless now wget is spyware too. This whole thing is a nothingburger at best and just a pr disaster at worst.
yoyomamamama 5y ago
Audacity is over as soon as a fork gets some momentum.
- Barrin92 5y ago
  depends on someone actually paying the developers because I don't think development is community driven but done by Muse. People need to keep in mind that open source software doesn't automatically develop itself just because you can fork the code. Audacity is a pretty big, complicated piece of software.
- reikonomusha 5y ago
  I’m not sure the developer who manages to remove telemetry is also ready to start maintaining fast Fourier transforms…
thayne 5y ago
As a linux user, I have absolutely no need for an auto-update feature. Hopefully that is something that can be disabled at both build time and run time.
miles 5y ago
CoasterGhost has uploaded[1] 31 versions of Audacity and Github source code for 18 versions to archive.org[2] for posterity. [1] https://old.reddit.com/r/DataHoarder/comments/oe2opu/due_to_the_new_audacity_terms_of_service_i/ https://old.reddit.com/r/DataHoarder/comments/oe2opu/due_to_... [2] https://archive.org/details/AudacityArchive https://archive.org/details/AudacityArchive
dang 5y ago
Recent and related: Audacity 3.0 called spyware over data collection changes by new owner - https://news.ycombinator.com/item?id=27736151 https://news.ycombinator.com/item?id=27736151 - July 2021 (70 comments) Audacity may collect “Data necessary for law enforcement, litigation” and more - https://news.ycombinator.com/item?id=27727150 https://news.ycombinator.com/item?id=27727150 - July 2021 (254 comments) New [July 2, 2021] Audacity Data Collection Policy - https://news.ycombinator.com/item?id=27724389 https://news.ycombinator.com/item?id=27724389 - July 2021 (34 comments)
gigatexal 5y ago
Too much ill-will generated with this sudden takeover of audacity. Best to move on to alternatives and forks and forget about Audacity's new owners. https://ardour.org/ https://ardour.org/
- Xylakant 5y ago
  ardour may have worded that better than the audacity folks, but make no mistake, as per it's privacy policy ardour will phone home (to check for new versions), store information about bugs and comply with requests from law enforcement. If you download and use a ready-to-run version of Ardour from ardour.org, the program will attempt to contact ardour.org at startup to determine if you should be notified about a new release of the software. If the computer where you use Ardour is connected to the internet, this process will store the computer's internet address and an identifier for its operating system. If you report a bug to our bug tracker, we will store whatever information you provide as part of the bug report. When Do We Privately Share Personal Data? Never, unless required to by law.
userbinator 5y ago
Microsoft popularised telemetry in otherwise-offline applications with Windows 10. Now every other trendchasing company thinks they should do it too. They always claim it improves software, but all that seems to happen is it just gets dumbed down and features removed, making it worse for experienced/power users.
- noobermin 5y ago
  This isn't telemetry though.
noobermin 5y ago
It looks like just info you pick up if you visit the site for download. May be the initial communication was an issue but this doesn't make it spyware necessarily. They also say it has nothing to do with "offline use." May be the story is as I said the initial communication now, not with the privacy policy changes, no? I'm starting to feel had, there is literally no telemetry here, that's just internet hype and rumors. EDIT: there is telemetry for bug reporting...okay that's optional so I'm still seeing no fire.
BugWatch 5y ago
Fork name suggestion: Gaudacity. As in Ye Olde "G(ood) Audacity". Intentional misspelling of "gouda" (but sounds the same), has original name as a substring, and should come with appropriately cheesy wedge located between the headphones. Bonus points: reference to plugging one's ears with cheese. ...what? My dad humor is showing? But in all frankness, I'm serious.

133 points by anonymousab 5y ago

I don't understand the pettiness around this issue. Audacity needed a maintainer to help with support and development. Developer, who has a pretty active YouTube channel covering design in music software, takes interest and leads the project. Said developer adds telemetry to help make more informed decisions. People lose their collective minds. Can someone fill me in on what this person could have done better? Honestly, it seems like pearl-clutching from a select group of users who never gave a shit in the first place and just want to whine about something they never contributed to and get to use for free.

system16 5y ago
I think if you read the comments in the link, it's pretty clear: changes regarding personal information were dumped on the community along with a bunch of legalese without warning, an announcement, or context. Had the new maintainers given the community a heads up via a simple blog post explaining the reasoning behind this, we wouldn't be where we are. Hopefully they can chalk this off as a learning experience and move forward to gain trust of the community.
kennywinker 5y ago
You missed: project purchased by ad-heavy website owner (ultimateguitar). As for how they could make it better: make it opt-in not opt-out. This is the kind of toxic behaviour we all tolerate from commercial software, but people get mad when it leaks into open source.
Xc43 5y ago
An example of the problem is that in the UK those below 13yo cannot give consent to telemetry. Audacity is used in their public schooling system. Newer versions of Audacity will not be usable by those students anymore. Roughly.
- ronsor 5y ago
  So they just don't consent to it? The telemetry certainly isn't mandatory; it isn't even enabled by default from what I can tell.
  - Xc43 5y ago
    There was no opt-out. Minors were asked not to use the app. Here is the link towards the Privacy notice on the 2nd of July. https://archive.fo/d3LBR#selection-673.0-673.129 https://archive.fo/d3LBR#selection-673.0-673.129
    - xavriley 5y ago
      Asked not to is different from forbidden though, no? I’m not a legal expert but I doubt this clause is one they wanted to put in and is probably driven by some legal counsel with an eye on international law.
      - rStar 5y ago
        lawyers do what they’re told. This is the acquiring company maximizing the value of their acquisition by any means possible.
      - Xc43 5y ago
        In this case, children 12 and below cannot give consent but they can use the app if parental consent is given. Having children in that age range use the app would require Audacity to seek parental consent by "[making] reasonable efforts (taking into account the available technology and risks inherent in the processing) to verify that the person providing consent holds parental responsibility for the child."1 While they wrote to minors "please do not use the App", they also wrote "The App we provide is not intended for individuals below the age of 13."2 Not being a lawyer, I cannot talk about the implications of these passages. src1: https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/children/ https://ico.org.uk/for-organisations/guide-to-data-protectio... src2: link in my parent comment
      - 5y ago
dantondwa 5y ago
I think there's a misunderstanding: Tantacrul, the developer with a pretty active Youtube channel, works for the Muse Group, which acquired Audacity. This has nothing to do with him. A company acquired Audacity, not him, and he's not in charge of the Muse Group. Your portraying of the whole thing is inaccurate. People didn't lose their collective minds. The Muse Group acquired Audacity, then introduced: - a CLA (which, between other things, allows them to make closed source versions of Audacity) - telemetry - a very controversial privacy policy People aren't losing their minds. And please, do not spread misinformation.
- maccard 5y ago
  >people aren't losing there minds Have you read this thread? See [0] as an example. [0] https://news.ycombinator.com/item?id=27740350 https://news.ycombinator.com/item?id=27740350
- whateveracct 5y ago
  > a CLA (which, between other things, allows them to make closed source versions of Audacity) But all previous commits they'd build on are GPL..
- zxzax 5y ago
  Controversial? This looks extremely similar to most other privacy policies. I would urge you to read the privacy policy on any other web sites that you visit, or for any other services that you use, and compare and contrast. A good starting point might be the privacy policy on your phone's app store.
  - Lammy 5y ago
    We're talking about Free Software — not about websites, services, or mobile cartels.
    - zxzax 5y ago
      I'm not sure what you're suggesting the difference is, or what specifically here is a "mobile cartel?" FOSS projects and other related things also have privacy policies, and in fact you probably want them to so that they're clear what they're doing with the data they've aggregated. Here's some examples: https://docs.github.com/en/github/site-policy/github-privacy-statement https://docs.github.com/en/github/site-policy/github-privacy... https://www.debian.org/legal/privacy.en.html https://www.debian.org/legal/privacy.en.html https://fedoraproject.org/wiki/Legal:PrivacyPolicy https://fedoraproject.org/wiki/Legal:PrivacyPolicy https://www.fsf.org/about/free-software-foundation-privacy-policy https://www.fsf.org/about/free-software-foundation-privacy-p...
AnIdiotOnTheNet 5y ago
> Said developer adds telemetry to help make more informed decisions. People lose their collective minds. I have never once used software I thought was actually good that was designed based on feedback from telemetry.
- arkitaip 5y ago
  How would you know though? Telemetry is so common in desktop and web apps alike that you're probably surrounded by it.
  - rossy 5y ago
    It's only common in certain bubbles. Someone who primarily uses FOSS could easily say this. Someone who prefers software created in the era before online telemetry was widespread could also say this.
  - Kim_Bruning 5y ago
    Seems to have only picked up in the last decade or so. Before that it wasn't really practical, and everything seemed to work fine without it. When I was a kid, computers weren't connected to the internet. The first time I had a connection it was at 33.6 kbit/s (at 25 cents per minute). Can you imagine if I had had all these 'modern' programs on my computer that would suddenly try to talk over that tiny straw of a connection? It'd be unusable! There are still a lot of reasons why you would like to maybe hope that a computer doesn't try to randomly talk to everyone and everything on the intertubes on a whim. For instance: said computer might be acting as a firewall, or it's being used for SCADA, needs to comply with corporate or government security policy, or is otherwise supposed to be something-gapped. I guess for regular consumer technology that hope has long fled. You'd think that floss software could automatically be trusted to be quiet-by-default, but I guess that time is now past as well. Possibly software that is quiet-by-default needs to start explicitly noting that it is so; so that if you have a particular task that really needs a quiet-by-default machine, you can draw from that subset. You are right that audacity probably doesn't need to be in the quiet-by-default category. But ...eh... somehow this feels like a retreat.
techrat 5y ago
https://www.independent.co.uk/life-style/gadgets-and-tech/audacity-free-collect-personal-data-russia-b1878305.html https://www.independent.co.uk/life-style/gadgets-and-tech/au...
matheusmoreira 5y ago
> Said developer adds telemetry to help make more informed decisions. People lose their collective minds. Their ability to make decisions doesn't matter. It is does not justify putting spyware into previously trusted software. Also, nobody believes that excuse for a second. They couldn't care less about "improving" anything but their bottom line. They are merely capitalizing on the trustworthiness of an open source project in an attempt to extract maximum value out of its users. If they wanted to improve the software, they would have hired somebody with good taste to work on it. People with good taste do not tolerate abusive spyware. > Can someone fill me in on what this person could have done better? They could have not collected any "metrics" in the first place. That way, this ridiculous privacy policy would never have been necessary.
frobozz 5y ago
One thing would be not violating the Open Source Definition by forbidding use by under 13s.
McGlockenshire 5y ago
> Said developer adds telemetry to help make more informed decisions. People lose their collective minds. I don't understand the reaction either. It's hard to talk about this stuff here because of the anti-analytics groupthink. Everyone seems to jump to the worst possible conclusion whenever it's brought up. I can't help but wonder if the people screeching about it have ever actually put analytics in their own products. Understanding how your software is used in the real world by real users is absolutely invaluable!
- Kim_Bruning 5y ago
  The reason people jump to the worst possible conclusion is the same reason that people often do: because abuse is rampant. And sometimes that's why we can't have nice things, because too many people have misbehaved while using them. Assuming integrity, I think the people complaining about it would indeed do unto others as they would have others do unto themselves. That is to say: not include telemetry.
zelphirkalt 5y ago
How about just asking people for their opinion instead of trying to somehow conclude on usage patterns and stuff from telemetry data, which is not opt-in, but opt-out, which is quite sneaky in itself? "Just ask those people!" Is what I think every single time, when this kind of issue pops up. Ask the people what they find annoying about the product, ask them what they like. There are many questions you can ask and which yield a much more direct result than telemetry data, without upsetting a community and without coming across as sneaky and disrespectful of user privacy.
- blooalien 5y ago
  Exactly! And if you really need any sort of "telemetry" to get the data that you need, then do what so many other FOSS software I've seen with any sort of "phone home features" does, and simply ask the user during the first run if it's okay to send <such and such data> for development purposes. (Also, a toggle in the preferences is always nice, too, so that I can enable such a feature on days I'm feeling particularly helpful, and still easily disable it on days I'm feeling like there's no need for my software to be sending data anywhere outside my network.) It's not uncommon for me to approve such features when I'm dealing with software I trust, and when I'm thoroughly informed of exactly what data they're collecting and why. If I see a list of reasonable data points and it's not too intrusive or overreaching (and if I can examine the data before it's sent) then I'm quite often okay with it (again, with software I already trust for other reasons).

kawsper 5y ago

> What does the OS version string contain (e.g. on Linux specifically)? Some custom kernel version strings could possibly identify someone. I actually didn't think of this, I compile my own kernels and add my own text to the kernel name.

akersten 5y ago

This is now the 2nd "clarification" that Muse group, the new team in charge of Audacity, has recently put out - the first one being here[0]. At this point, it's clear that they are taking the product in an unpopular direction. So why keep pushing an online-first privacy policy and telemetry? Certainly it is not one of the pressing needs of the core product. Honestly, it will take some convincing to make me think this isn't nefarious at this point. At a minimum, the community is not being listened to, just placated. [0]: https://github.com/audacity/audacity/discussions/880 https://github.com/audacity/audacity/discussions/880

rStar 5y ago
when this happens the product dies. in my mind it’s as if audacity never existed. hopefully a project emerges from a forked code base that’s useable going forward.
- zxzax 5y ago
  I'm not sure why the word "fork" is being repeatedly mentioned or why people are thinking this is making the code unusable. At most, I would expect a patched distribution similar to VSCodium to pop up, i.e. not a hard fork. If there was willpower in the community to fork the project and fix all the other long standing issues, that would have happened already, so there is no reason to expect a fork here.
xtracto 5y ago
I dont understand all the ruckus around this. Just fork the repo and remove the spying code (I dont want an audio editor to share my CPU and IP with anyone). It has been done for larger codebases like OpenOffice and MySql.

sneak 5y ago

> We believe concerns are due largely to unclear phrasing in the Privacy Policy This is gaslighting. It's not the wording people have an issue with, it's the nonconsensual spyware.

akerl_ 5y ago
How could it be nonconsensual? The policy is provided when installing the software. This may certainly be a bad decision for the Audacity team, but nobody is being forced to use their product.
- anonymousab 5y ago
  It is nonconsensual when the starting premise is "using Audacity". "Consensual" in that case would mean opt-in telemetry.
  - akerl_ 5y ago
    That’s some serious mental gymnastics. I’ll be sure file a complaint at the supermarket for nonconsenual collections: I wanted to take the vegetables home, but they don’t let me opt out of paying.
    - elmo2you 5y ago
      Unless the telemetry is somehow a form of payment for using the (open source) product, I think your argument falls under: https://en.wikipedia.org/wiki/Reductio_ad_absurdum https://en.wikipedia.org/wiki/Reductio_ad_absurdum
      - akerl_ 5y ago
        Given that the context here is “a producer of something setting the terms under which they’ll give it to somebody else”, my grocery store hardly sounds like an extreme example.
        5y ago

nxpnsv 5y ago

But, why do they need to store IP-address at all? It don't see what good it can do.

deadbunny 5y ago
I would assume it's from webserver logs. I could of course be wrong.
- noobermin 5y ago
  They reference GDPR so that's exactly why they mention it.
anonymousab 5y ago
Logs, maybe abuse protection? For better or worse, the musescore-downloader affair has probably made them a bit pensive and defensive around potential abuse from clients. They may also simply think that it's just plainly required if they're going to run an online service that the app connects to by default. That's all speculation though, hopefully they'll answer that question on the GitHub discussion.

undfg 5y ago

This reminds me of the freenode debacle. The problem is not that audacity was purchased, the problem is that it was sold.

arkitaip 5y ago
I get the feeling that the community has had enough of the corporate shenanigans, that a proper fork is about to go alive any day now.

Andoryuuta 5y ago

Alongside the Audacity changes, the Muse group has also performed some highly questionable actions in the context of MuseScore, such as falsely claiming that a downloader script was illegal, and that they owned copyright of all sheet music on their site. Going as far as to state that they will "cooperate with github.com and Chinese government to physically find you and stop the illegal use of licensed content." [0]. Unfortunately, I don't believe the general users of audacity will ever hear about the groups actions, and will continue to use the audacity without knowledge of what has changed. [0]: https://github.com/Xmader/musescore-downloader/issues/5 https://github.com/Xmader/musescore-downloader/issues/5

Xylakant 5y ago
That thread is certainly not a good example of communication, but I cannot find any place where a representative from the Muse group says that they own the copyright to all sheet music on their site. They say (and that's to the best of my knowledge mostly correct at least here in Germany) that the arrangement for music is legally protected and even if someone else typed down the sheet, the rights to this sheet are still protected. And they point to the music industry enforcing restrictions (having worked with the music industry, I find that one entirely credible)
- maccard 5y ago
  There's a thread on an AMA about ultimate guitar from a while back where the founder talks about when they made the decisions to start adding the features people complain about, and the impression he gives is exactly that; the rights holders of the music had them over a barrel and it was a sink or swim decision
alpaca128 5y ago
> Going as far as to state that they will "cooperate with github.com and Chinese government to physically find you and stop the illegal use of licensed content." Wow, that's low. It's one thing to send dumb threats, it's another to threaten someone with involvement of a government that frequently disappears people. This is how you turn your products into the PR equivalent of radioactive waste.

41209 5y ago

Any good alternatives. It's better to consider the project dead then to argue with them

racl101 5y ago
I'd totally get a paid product like Ableton or Pro Tools if they didn't send data about me.
themodelplumber 5y ago
It really depends on what you need. There are lots of non-FOSS but effectively-free alternatives. Ocenaudio is way better than Audacity in gobs of ways, except it's not multi-track. Reaper is pretty great but if you're hoping for commercial use with $20K+ gross/year, you need to pay $200+ USD. In FOSS land, Zrhythm, Qtractor, LMMS...but these are DAWs so again it depends on what you were using Audacity for. You could even learn sox and maybe benefit from some command line use, like writing scripts for things you need to do all the time. My advice: List the specific tasks you need to do, and aim to find 2-3 apps that will fill the gap. Then any extras on top of that will be gravy. Edit: Oh and you can also use FOSS like Blender and render edited sound to mp3, or KDEnlive, or other software that's video or animation related. So if you already know those tools, or like how they work (in some ways they are pretty slick!) then they may fit better than other audio-only software.
- 41209 5y ago
  Zrhythm looks great, I think I'll switch to this !

xs 5y ago

The thing that isn't addressed. Their terms now say that people 13 and under cannot use their product. Yet this tool is taught in schools. They want to collect this data but do not want to follow COPPA laws.

dehrmann 5y ago

Dumb question: Audacity has a GPL license, so it can be forked or built and distributed by a third party, right?

Gaelan 5y ago
Yep. In particular, any version of audacity from a Linux distro's package manager is likely already built with telemetry off.

theden 5y ago

Pretty laughable they have to post even more walls of text to convince folks that it's okay for an _offline_ application to spy on you. Frankly, this would have probably been tolerated or largely ignored if there wasn't a long history of Audacity not doing this and for the most part working well. Time to either move to hard fork (if it happens) or find an alternative IMO, they can choose to die on this hill. We're already tracked by so many apps (and at the OS-level for many) I think a lot of people are pushing back hard (maybe unfairly) because it's something they can control since it's FOSS. Audacity has been around for over 20 years! It's takes some serious ego to drop in CLAs and telemetry on the community months after acquiring it.

jitl 5y ago
Telemetry and error reporting are opt-in. Error reporting uses industry-standard Sentry (also an OSS), which is not a nefarious data seller. Auto-update checked are opt-count and send a very basic user-agent with less data than an average web browser HTTP request. There is no spying here.
- theden 5y ago
  Yeah maybe by modern software which doesn't respect the user's privacy and resource usage it's nothing to worry about. I'd say this is a regression, and adding all that networking code makes it easier for them to push it further down the line, and adds more vectors for attacks. At best it's bloat. Developers were able to write good software without pulling in user's data before, it says more about the devs if they think it's so necessary. Okay say it's not spying—you now have another app on your system pinging hosts, and depending on how much you trust Muse, you have to check the changelog every time to ensure they haven't added more bloat or juiced up the telemetry. I'd posit that spying has been normalised we don't even recognise it anymore. Opt-in isn't a get out of jail free card, since your avg user will just click whatever.
  - noobermin 5y ago
    Can't you just turn off auto update and not get this? FFS, any time you connect to a website they know your IP address. A log will save it, perhaps, and they say they prune their logs after 24 hours which is reasonable. Literally wget sends this sort of info, you can try it wget -d example.com unless now wget is spyware too. This whole thing is a nothingburger at best and just a pr disaster at worst.

yoyomamamama 5y ago

Audacity is over as soon as a fork gets some momentum.

Barrin92 5y ago
depends on someone actually paying the developers because I don't think development is community driven but done by Muse. People need to keep in mind that open source software doesn't automatically develop itself just because you can fork the code. Audacity is a pretty big, complicated piece of software.
reikonomusha 5y ago
I’m not sure the developer who manages to remove telemetry is also ready to start maintaining fast Fourier transforms…

thayne 5y ago

As a linux user, I have absolutely no need for an auto-update feature. Hopefully that is something that can be disabled at both build time and run time.

miles 5y ago

CoasterGhost has uploaded[1] 31 versions of Audacity and Github source code for 18 versions to archive.org[2] for posterity. [1] https://old.reddit.com/r/DataHoarder/comments/oe2opu/due_to_the_new_audacity_terms_of_service_i/ https://old.reddit.com/r/DataHoarder/comments/oe2opu/due_to_... [2] https://archive.org/details/AudacityArchive https://archive.org/details/AudacityArchive

dang 5y ago

Recent and related: Audacity 3.0 called spyware over data collection changes by new owner - https://news.ycombinator.com/item?id=27736151 https://news.ycombinator.com/item?id=27736151 - July 2021 (70 comments) Audacity may collect “Data necessary for law enforcement, litigation” and more - https://news.ycombinator.com/item?id=27727150 https://news.ycombinator.com/item?id=27727150 - July 2021 (254 comments) New [July 2, 2021] Audacity Data Collection Policy - https://news.ycombinator.com/item?id=27724389 https://news.ycombinator.com/item?id=27724389 - July 2021 (34 comments)

gigatexal 5y ago

Too much ill-will generated with this sudden takeover of audacity. Best to move on to alternatives and forks and forget about Audacity's new owners. https://ardour.org/ https://ardour.org/

Xylakant 5y ago
ardour may have worded that better than the audacity folks, but make no mistake, as per it's privacy policy ardour will phone home (to check for new versions), store information about bugs and comply with requests from law enforcement. If you download and use a ready-to-run version of Ardour from ardour.org, the program will attempt to contact ardour.org at startup to determine if you should be notified about a new release of the software. If the computer where you use Ardour is connected to the internet, this process will store the computer's internet address and an identifier for its operating system. If you report a bug to our bug tracker, we will store whatever information you provide as part of the bug report. When Do We Privately Share Personal Data? Never, unless required to by law.

userbinator 5y ago

Microsoft popularised telemetry in otherwise-offline applications with Windows 10. Now every other trendchasing company thinks they should do it too. They always claim it improves software, but all that seems to happen is it just gets dumbed down and features removed, making it worse for experienced/power users.

noobermin 5y ago
This isn't telemetry though.

noobermin 5y ago

It looks like just info you pick up if you visit the site for download. May be the initial communication was an issue but this doesn't make it spyware necessarily. They also say it has nothing to do with "offline use." May be the story is as I said the initial communication now, not with the privacy policy changes, no? I'm starting to feel had, there is literally no telemetry here, that's just internet hype and rumors. EDIT: there is telemetry for bug reporting...okay that's optional so I'm still seeing no fire.

BugWatch 5y ago

Fork name suggestion: Gaudacity. As in Ye Olde "G(ood) Audacity". Intentional misspelling of "gouda" (but sounds the same), has original name as a substring, and should come with appropriately cheesy wedge located between the headphones. Bonus points: reference to plugging one's ears with cheese. ...what? My dad humor is showing? But in all frankness, I'm serious.