12 ms·

I have no horse in this race, but wouldn't it be better to keep crash reports in there? Of course it should be disabled by default, and it would never be upload

by gizdan 5y ago

I have no horse in this race, but wouldn't it be better to keep crash reports in there? Of course it should be disabled by default, and it would never be uploaded. That way individuals can raise issues and attach the crashreports if they need to.

jitl 5y ago
I think the reaction is completely overblown, the telemetry and crash reporting are already opt-in. The auto-update-checker (opt-out) only reveals OS, as part of HTTP user-agent, and IP, as part of the TCP connection.
- sneak 5y ago
  Yeah, an offline audio editing program should not phone home in any way without advance consent. The autoupdate check serves as telemetry.
  - orf 5y ago
    Stop. Just stop. Software needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting. Branding any of this as telemetry then creating a bunch of immediately abandoned forks is a joke. Before you say “well make this opt-in” - that doesn’t work for crash reporting nor does it really work for auto-updating. Things change. The internet needs Javascript, distributing desktop apps using electron makes a lot of sense and developers need automated feedback. Please stop.
    - smoldesu 5y ago
      > creating a bunch of immediately abandoned forks is a joke. This part is not inherently true. Only time will tell how Audacity reacts, and they could very well have an UnGoogled-Chromium/Codium situation on their hands.
      - orf 5y ago
        Picking two applications with less global users than a small town or a large village doesn’t make a great point. They might as well have been abandoned - no relevant mass of people use them.
        smoldesu 5y ago
        Ah, my bad. I'll stick to S&P Top 500 companies next time.
        orf 5y ago
        No, stick to forks that manage to reach a self-sustaining level above “one or two users cherry-picking from an upstream repo as a passion project”. My point is that a fork can be abandoned by users even if the project is still active.
        monetus 5y ago
        Your point is worth thinking about it, audacity needs a critical mass of users. But does it have enough original users to keep from being considered abandonded already? Edit: to be clear, other software is often used instead of audacity. It isn't as well known as say photoshop, or maybe even inkscape.
        deleted 5y ago
        [deleted]
      - sdesol 5y ago
        In the last 90 days they had 11 contributors that changed c,cpp, and c header files with at least 10 lines of code churn: https://public-001.gitsense.com/insights/github/repos?p=commits&q=file-churn%3A%3E%3D10%2Blangs%3Ac_header%2Ccpp%2Cc%2Bwindow%3A90&r=github%3Acookiengineer%2Faudacity&v=repo https://public-001.gitsense.com/insights/github/repos?p=comm... The user crsib appears to be the main contributor to audacity, so I would have to imagine others would have to pick up the slack for a fork to be viable. cookiengineer also changed 71 files https://public-001.gitsense.com/insights/github/repos?p=commits&q=authors%3Acookiengineer%40protonmail.com%2Binvolves%3Acookiengineer&r=github%3Acookiengineer%2Faudacity&v=repo https://public-001.gitsense.com/insights/github/repos?p=comm... so he/she will have to constantly monitor these files moving forward, for the fork to be stable/similar to audacity/audacity, which I am not sure if he/she/others are interested in doing this for the long term, but I guess time will tell. Full disclosure: I'm the creator of the tool that I linked to
    - kennywinker 5y ago
      Software doesn’t need auto updating. The “move fast and break things” industry needs auto updating. Other than some very few exceptions (e.g. a web browser with a huge attack surface may need auto updates to protect the user). Similarly, crash reporting being opt-in works very well. On crash you present the user with a crash report, they review it - and can send if they desire to. Throw in a lil’ “don’t ask again” checkbox and you’re good to go.
      - tester756 5y ago
        How about just asking user whether he wants new version?
        kennywinker 5y ago
        Exactly. Nobody’s complaining about a “check for updates” button.
        anonymousab 5y ago
        The users cannot be trusted, the users are dumb, we know better than the users, we must steer the users, the goals of the project are more important than any one user's, etc. Take your pick at this point.
      - orf 5y ago
        Yes it does. Bugs need to be fixed, improvements need to be made. That’s the lifeblood of most user-facing software. Without it you end up with a huge user base running legacy versions, reporting the same bugs and asking for the same features.
        kennywinker 5y ago
        That’s a minor inconvenience at the bug-screening level. I’ve used audacity for over a decade, updating it once every year or two - either when i got a new computer, or when it occurred to me there’s probably a new version out there.
    - slackfan 5y ago
      "needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting" Software needs not do any such thing. Developers may want this thing, but users absolutely do not need it, and neither does software.
      - orf 5y ago
        Wrong, users absolutely do need their software to not crash and to stay relevant. The user doesn’t have to update it (so no silent upgrades), but showing something when a new version is released is a great thing for moving your user-base off legacy versions containing bugs fixed in later versions.
        sneak 5y ago
        "moving your user-base" shows your bias here. The developer doesn't get to move their user base, the users get to decide what version of software they wish to run. You don't need to perpetually run the latest release to "stay relevant". All of my workstations are still on Catalina and they're fine.
        nitrogen 5y ago
        Show a button to check for updates on any version timestamped older than X months where the button hasn't been clicked in a while. Show the button on the crash dialog. Don't open a single socket without approval. Let the user decide. This is a fundamental principle of human interaction -- ask first before touching someone's stuff.
        BugWatch 5y ago
        Having written my rant(s) elsewhere in this thread, I'm just gonna telepathically project the "(slams the palm on the desk) THANK YOU!" gif.
        CJefferson 5y ago
        The problem nowadays, is with everything connected to everything else, some bugs need fixing fast. Imagine if there is a buffer overflow in Audacity, meaning someone can take over your machine with a malformed sound file. I'd want to know about that ASAP -- not after a month. On average, I believe most users benefit from an automated check for updates. It should be possible to disable it, but we should first worry about keeping users safe.
    - krono 5y ago
      Neither crash reports nor auto-updates are vital to the functioning of the program. It doesn't seem so weird to me to have an application ask for permission first. Something most applications do anyway.
      - cyral 5y ago
        But it does ask: https://github.com/audacity/audacity/pull/835 https://github.com/audacity/audacity/pull/835
        krono 5y ago
        I was more responding to the - in my opinion ridiculous - notion that even apps that don't require the internet to function at all should be expected to phone home by default, and that auto updates are an essential. Nevertheless, it's good to know they've chosen an opt-in construction for Audacity!
    - geofft 5y ago
      Crash reporting is only needed if you write software that crashes in the first place. Do you think the SQLite developers have ever felt like they need automated crash reporting from their users? (see https://corecursive.com/066-sqlite-with-richard-hipp/ https://corecursive.com/066-sqlite-with-richard-hipp/ , which got discussed recently: https://news.ycombinator.com/item?id=27718701 https://news.ycombinator.com/item?id=27718701 ) And SQLite accepts way richer input (SQL queries) from users than Audacity does (audio files). There are many ways to reduce bugs. Extensive coverage-guided testing, like SQLite does, is one. Automated fuzzing is another. Writing in languages with strong type systems that let you statically verify the program's behavior is another. Collecting crash reports is another, and it's certainly one valid way, but it's not the only way. It's pretty clear that Audacity's users, in aggregate, aren't that concerned about needing crashes fixed - or at least are less concerned about it than about their privacy. Maybe Audacity already is sufficiently bug-free for their needs! While I also think that the "telemetry" argument is overblown, and I think automated updates are basically table stakes, and I wholeheartedly agree with you re JS and Electron, I think it's entirely reasonable for users to say that they don't find automated crash reporting valuable, and I don't think that it's particularly reasonable for developers to say "We know better than you."
      - zxzax 5y ago
        I completely disagree with your assessment, Audacity just crashed twice for me yesterday. Also, with SQLite, it seems the major people reporting bugs are people who have paid support contracts with drh, which most likely requires sending identifying information.
      - orf 5y ago
        I’ve found several bugs in SQLite, one of them pretty fundamental and obvious. It’s a complete nightmare to report them, forcing you to use some utterly terrible forum software with limited searching, visibility and a shockingly poor UI. Genuinely the worst and most confusing thing I’ve had to use in the last decade. Sourceforge issue trackers are a step up from this. They also offer no convenient way to test your system using the latest RC/beta/alpha/whatever without manually staying on-top of the releases page and updating it. I don’t think the rest of the comment warrants much discussion, but I wanted to point that out.
    - sneak 5y ago
      > much-needed functionality such as auto-updating I don't want any software on any of my machines to auto-update. Auto-update is a remote code execution vulnerability, as Solarwinds demonstrated. > Things change. The internet needs Javascript, I browse the web with javascript off, on Edward Snowden's recommendation.
    - Zandikar 5y ago
      > Software needs to reach out to the internet... No, you stop. It absolutely does NOT need this functionality. Is it nice? sure. But it should be opt in and prompted, not opt out and automatic. > that doesn’t work for crash reporting It does. > nor does it really work for auto-updating. Good. > The internet needs Javascript No it doesn't. The ad economy depends on it to bypass consent. Do not confuse that with the ad economy requiring it to function nor does it mean the internet requires it. Again, is it useful? of course, there are many instances where it can (keyword can) enhance the experience, but it is not necessary for 99% of applications (no, your infinite scroll SPA is not a necessary function). Is it necessary? Absolutely not. > and developers need automated feedback No they dont. The only things you're referring to are necessary for are forcing things by your users without their knowledge or consent, and for superfluous flair and form. It's possible to build opt-in, privacy respecting, informed consent software diagnostics and telemetry without forcing this nonsense on them, especially with respect to the topic at hand, which is not a web application, but an offline native desktop application.
      - nokya 5y ago
        +1 The web and mobile world is plagued with prompts stating that "X needs to access your data Y" or "X needs permission Z" to "do the job". Worst part of it? Developers and architects are often the first ones to believe this nonsense. When you're surrounded by developers, users and managers who believe in werewolves, best thing to do is just to nod :)
      - azangru 5y ago
        > > The internet needs Javascript > No it doesn't. Do you prefer the web from 1995? No youtube, no github, no google docs, no google maps, no real-time in-browser messengers/chats, no hangouts/google_meet/jitsi, etc. etc.?
        badsectoracula 5y ago
        Half of those aren't really needed and are better server by native apps anyway. However the Internet isn't the Web, so certainly the Internet doesn't need Javascript. Also neither does the web, but for sites that can provide functionality which wouldn't be possible without javascript it can be a nice optional feature. Though all of the examples you gave either do not need javascript (youtube, github) or are better as native apps (google docs, google maps, IMs).
    - syshum 5y ago
      Stop. Just Stop. Software does not need to violate a users privacy to provide functionality that is not really needed at all such as auto-updating, nor crash reporting. Calling any of this as anything other than Telemetry data is factually incorrect The movement around forking is NOT just over this new privacy policy, but is a culmination several actions by the new owners of the project to go agaist some very basic norms of Open Source stewardship. Further they are more or less giving the Linux Maintainer community a "FU" over their use of custom / modified version wxwidgets which makes packaging the 3x version of Audacity problematic for many linux distribution for security reasons. As to the statement that "opt-in does not work with crash reporting" Sure it does, Many applications (including Microsoft, and Mozilla) have a dialog that ASKS the user if they would like to submit crash reporting data to the vendor on a per crash basis, There is LITERALLY zero technical reason for automatic, opt-out crash reporting
    - detaro 5y ago
      > Before you say “well make this opt-in” - that doesn’t work for crash reporting Well Audacity thought it would work for them: https://github.com/audacity/audacity/pull/836 https://github.com/audacity/audacity/pull/836
    - chc 5y ago
      They literally say they're collecting information to share with law enforcement and sell to analytics firms.
    - viraptor 5y ago
      Crash reporting is telemetry. Not in the "omg spying" sense people seem to treat that word sometimes. It's collecting remote data - it's telemetry.
    - jjulius 5y ago
      And yet somehow Audacity has done just fine without this for 21 years.
    - deleted 5y ago
      [deleted]
    - II2II 5y ago
      > Software needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting. Crash reporting is more of a problem than telemetry. Any report that contains the contents of memory may end up leaking confidential data. That data may be considerably more sensitive than an analysis of how the software is being used. The end user should be informed of the risk, be able to review the data being shared, and have the right to block it. As for updates, there are distribution models where this is handled by a third party. In some cases, a list of packages is downloaded so the only way for the third party to know whether something is installed is when an update is retrieved. In other cases, a list of software is sent to the third party but it is a trusted third party (e.g. Google, rather than a random app developer).
      - Nextgrid 5y ago
        > but it is a trusted third party (e.g. Google, rather than a random app developer). I'd trust a random app developer way more than an ad company whose data processing consent flow is intentionally annoying and still does not comply with the GDPR.
        II2II 5y ago
        Some app developers are going to be better at respecting privacy than Google, while some are going to be worse. The problem arises when you have to assess each one: people either won't or run the risk of relying upon misinformation.
        Nextgrid 5y ago
        The kind of analytics data a typical telemetry system will collect is pretty benign in isolation. It only becomes a risk when it's in the hand of an adversary with a global view of the internet, such as Google, Facebook or large-scale analytics providers such as Mixpanel (as their libraries are integrated everywhere and they have a ton of traffic they can use to correlate and deanonymize users).
    - liketochill 5y ago
      Software is a tool that does a job for me. When I buy or download the software it does that job and should continue doing that job in the same way indefinitely. It never needs to change. It never needs to connect to the internet. Obviously this applies to offline tools and not web browsers.
    - pessimizer 5y ago
      My networking programs need to update for security reasons, but anything that isn't networking can update when I say it can, which may be never if I don't see a tangible benefit in the update.
    - squarefoot 5y ago
      > and developers need automated feedback. Am I so old that even the mere concept of beta testing doesn't make sense anymore?
      - deleted 5y ago
        [deleted]
    - mixmastamyk 5y ago
      The single worst bootlicking, uncle tom, non-spam post I've ever read on the site. What could possibly be your motivation?
    - osw89 5y ago
      Oh please, this project was doing fine for two decades with regular bug reports and it suddenly needs to collect data straight after a hostile takeover by a company with a shady privacy policy? An offline audio editor doesn't need to be connected to the net.
    - totony 5y ago
      Auto-updating: Why do you need auto updating? Why not stay on old version or rely on package managers which do that for you? Isn't that freedom the user should expect when using software? Crash reporting: Why not just generate a crashreport-date.txt and allow the user to save it and email it to you? Why should they be forced to report it?
      - orf 5y ago
        > Crash reporting: Why not just generate a crashreport-date.txt and allow the user to save it and email it to you? Why should they be forced to report it? nobody does this. It’s such an utterly naive statement and exactly in keeping with others in this discussion. It also doesn’t catch non-terminating errors. > Why not stay on old version or rely on package managers which do that for you? Why would you want this? This also doesn’t work for Windows.
        totony 5y ago
        >Why would you want this? Because maybe an old version works good enough for your needs. Every software having auto updates is the reason package managers don't catch on on windows. Then you see every single software having bulky planned tasks/start on boot auto updaters. >nobody does this Core/crash dumps are exactly that. >It also doesn’t catch non-terminating errors. Why wouldn't it?
  - tester756 5y ago
    >Yeah, an offline audio editing program should not phone home in any way without advance consent. Why? Isn't your decision to run this software some kind of consent to let it perform its basic stuff?
    - bigiain 5y ago
      I guess the question is - is online telemetry and crash reporting reasonable considered and expected to "it's stuff" for an offline audio editing program? And if so, how far down that slope is it reasonable to go before trying to claim that crypto-mining is also an essential part of off line audio editing software?
      - tester756 5y ago
        First off - I don't divide programs into "online" "offline", because what's the point? It's not like program will stop working when it tries to send crash report without internet connection (if handled correctly). >I guess the question is - is online telemetry and crash reporting reasonable considered and expected to "it's stuff" for an offline audio editing program? For me - yes. Yes, I do consider crash report as a part of software maintenance efforts and I have nothing against sending critical data e.g at which place it crashed & e.g basic informations like OS, Hardware, GPU/Sound drivers version.
  - aeturnum 5y ago
    If Audacity branded itself as as an "offline audio editing program" I would agree with you, but its headline is (and has been) "Free, open source, cross-platform audio software." I think using the internet to check for updates and report crashes is perfectly within that mission and, on balance, not using the internet in those situations seems to go against the mission. Should there be a way to disable that communication? Yes, and there is. Beyond all that - if you are seeking the level of anonymity that would require evading program update checks or crash submissions - then you should probably lock down your network as your biggest worry is probably not your open source audio software.
- geofft 5y ago
  It's possible to do this in a way that doesn't reveal your IP - run the update-checking server as a Tor onion service and embed a little client that knows how to connect to the Tor network. Then your entry node doesn't know what you're connecting to, and the remote update server only knows the IP of the relay talking to it, not your actual IP. Still, a good question is how you're getting updates in the absence of automatic updates (and for software whose goal is parsing binary file formats, chances are high that if you aren't getting updates, you have a pretty big privacy problem already). If you have no auto-update code but you're telling users to download new versions from, say, GitHub, then GitHub gets their IP addresses anyway.
  - tester756 5y ago
    Well I think hiding from GitHub is not something that average person does but if you want to do it, then feel free to purchase 3$, then type `ssh -D 8080 root@linux`, use SOCKS Proxy in Firefox's Network settings and here's your new IP
- fartcannon 5y ago
  Hey great, you can use this version of Audacity. You don't ever need to think about it again. Lucky you.
reaperducer 5y ago
wouldn't it be better to keep crash reports in there? Different people have different needs and different levels of sensitivity to this sort of thing. Personally, I don't want my offline audio editor talking to anything without asking. But since Audacity doesn't do that, this will be what I use instead. If Audacity were to ask before sending data, a good chunk of people wouldn't be upset. But it doesn't, so here we are. Also — and I've said it before — automatic "telemetry" and crash reporting is just lazy. It also lacks context. If you want to know what your users' experience is like, just ask them.
- floatingatoll 5y ago
  Ask who? In-product surveys would be ignored or trigger this same outrage, and requests for an email address at download time simply result in throwaway accounts and other garbage input. What successful ways can you envision that a software developer ought to be asking their users for their experience, when the software is available for free without restriction upon download or use? How would you ensure that users who are satisfied with the way Audacity is working will take an equivalent amount of time to report their satisfaction as users who aren't satisfied with the way Audacity is working, so that your feedback is representative of the userbase as a whole rather than of the vocal subset that have problems? Would you advise Audacity to stop trying to measure or assess its users and their opinions, and instead simply do whatever they think is best for Audacity without harvesting user data? If Audacity truly accepted the view that the product should never report a single byte of information back to them and that they should never attempt to collect any data whatsoever about their users, then they would be forced to make decisions about Audacity without those users' data (including their opinions!), even if those decisions could end up being disliked or contentious among a subset of the users. At that point I expect they would likely determine that product autoupdate and feature usage metrics are a valuable feature for the product and not of concern to most users, and then ship those — regardless of the cries of outrage from the subset that hold contradictory opinions — because, after all, that subset demanded not to exist to Audacity, and so their wish is fulfilled. How can the vocal contingent of Audacity users who say "my existence should remain unknown to those who make the software I use" expect to have their opinions considered relevant, when they specifically demand not to be considered as existing at all?
tester756 5y ago
>Of course it should be disabled by default, and it would never be uploaded. I believe when you make crash reports / telemetry disabled by default then you lose a lot of reports, thus make your life harder as a developer that wants to deliver high quality solution for as many OSes, hardwares, configurations, blabla. I don't have problem that e.g my IDE would report how many files and lines of code my project has, because it may allow devs to make better decisions.
- gizdan 5y ago
  > I believe when you make crash reports / telemetry disabled by default then you lose a lot of reports, Perhaps I should have been clearer. I think something similar to Firefox's crash reports. If a crash happens, prompt the user and show them the report, and finally, let them decide. Perhaps even take out the networking features and open the default client with an attachment or a path of the report so they can be attached to a github issue.
  - detaro 5y ago
    > Perhaps I should have been clearer. I think something similar to Firefox's crash reports. If a crash happens, prompt the user and show them the report, and finally, let them decide. So, like Audacity?
me551ah 5y ago
The reaction is completely overblown. As a software developer myself I know how important crash reports are to figure out which bugs are impacting the most number of users. If everyone moved to this version without telemetry, we would end up with a far buggier version of Audacity because the developer has no clue of what bugs of prioritize. Audacity runs on multiple OSs and with the huge amount of hardware devices available, it's impossible for the maintainer of an open source project to test them all. I really hope that this project doesn't catch up, for the sake of bug-free audacity.
- geofft 5y ago
  But if this project does catch on, it indicates that users prefer a pro-privacy Audacity to a bug-free Audacity. That might not be the decision you (or I) would prefer, but I think it's a legitimate decision for users to make and we ought to respect that.
  - viraptor 5y ago
    It indicates bias in reporting too. There are a few people I know using Audacity and they have not heard of this whole issue (yet?) - and I really don't expect they will care if they do. So I expect we'll have some hardline pro-privacy users keeping this fork while a majority keeps doing their work using the original upstream. Here we'll only hear the strong pro-privacy views because that's the news.
- deleted 5y ago
  [deleted]
- ploxiln 5y ago
  How did Audacity gain it's popularity over the past 15 years, without any of this stuff? Did you use computers 15 years ago? Linux desktop and open source tools? Nothing had this crap back then, and some of it was pretty good. Audacity itself is an example! Open source software is not a commercial product. You don't need to prioritize and optimize for engagement or market share or any such crap. Just fix what you want, fix what you can, interested capable users will contribute attempted fixes for their own problems and you incorporate them if they make sense to the project. I don't think telemetry has ever resulted in good software, it just pushes everything towards being an iPad with one button on it. Only skilled tasteful developers make good software, and that was true long before telemetry existed.
detaro 5y ago
I mean, the crash reports appear to be with a confirmation in upstream already? (see screenshot in https://github.com/audacity/audacity/pull/836 https://github.com/audacity/audacity/pull/836)
- gizdan 5y ago
  Honestly, in my opinion this is completely reasonable. This is exactly how many different software do this including Firefox and Android (by default anyway). As others have mentioned the blowback on this is, in my opinion, entirely unreasonable. Having said that, Sentry integration is another matter.
  - detaro 5y ago
    > Having said that, Sentry integration is another matter. How? I only know Sentry as the backend tool you use to analyze the uploaded crashdumps? Or do you mean that a "crash report" could be something smaller than a minidump? (although I personally think a minidump is not a bad compromise)
jjulius 5y ago
>I have no horse in this race, but wouldn't it be better to keep crash reports in there? Audacity has been around for 21 years, has generated a strong following from a wide range of users, and is one of the most widely-loved FOSS projects. It achieved said status without telemetry for 21 years. People keep saying the telemetry thing is "overblown", but there is clearly a large number of us who simply don't want it. It doesn't need it, and the past 21 years have demonstrated that.

by gizdan 5y ago

jitl 5y ago

I think the reaction is completely overblown, the telemetry and crash reporting are already opt-in. The auto-update-checker (opt-out) only reveals OS, as part of HTTP user-agent, and IP, as part of the TCP connection.

sneak 5y ago
Yeah, an offline audio editing program should not phone home in any way without advance consent. The autoupdate check serves as telemetry.
- orf 5y ago
  Stop. Just stop. Software needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting. Branding any of this as telemetry then creating a bunch of immediately abandoned forks is a joke. Before you say “well make this opt-in” - that doesn’t work for crash reporting nor does it really work for auto-updating. Things change. The internet needs Javascript, distributing desktop apps using electron makes a lot of sense and developers need automated feedback. Please stop.
  - smoldesu 5y ago
    > creating a bunch of immediately abandoned forks is a joke. This part is not inherently true. Only time will tell how Audacity reacts, and they could very well have an UnGoogled-Chromium/Codium situation on their hands.
    - orf 5y ago
      Picking two applications with less global users than a small town or a large village doesn’t make a great point. They might as well have been abandoned - no relevant mass of people use them.
      - smoldesu 5y ago
        Ah, my bad. I'll stick to S&P Top 500 companies next time.
        orf 5y ago
        No, stick to forks that manage to reach a self-sustaining level above “one or two users cherry-picking from an upstream repo as a passion project”. My point is that a fork can be abandoned by users even if the project is still active.
        monetus 5y ago
        Your point is worth thinking about it, audacity needs a critical mass of users. But does it have enough original users to keep from being considered abandonded already? Edit: to be clear, other software is often used instead of audacity. It isn't as well known as say photoshop, or maybe even inkscape.
      - deleted 5y ago
        [deleted]
    - sdesol 5y ago
      In the last 90 days they had 11 contributors that changed c,cpp, and c header files with at least 10 lines of code churn: https://public-001.gitsense.com/insights/github/repos?p=commits&q=file-churn%3A%3E%3D10%2Blangs%3Ac_header%2Ccpp%2Cc%2Bwindow%3A90&r=github%3Acookiengineer%2Faudacity&v=repo https://public-001.gitsense.com/insights/github/repos?p=comm... The user crsib appears to be the main contributor to audacity, so I would have to imagine others would have to pick up the slack for a fork to be viable. cookiengineer also changed 71 files https://public-001.gitsense.com/insights/github/repos?p=commits&q=authors%3Acookiengineer%40protonmail.com%2Binvolves%3Acookiengineer&r=github%3Acookiengineer%2Faudacity&v=repo https://public-001.gitsense.com/insights/github/repos?p=comm... so he/she will have to constantly monitor these files moving forward, for the fork to be stable/similar to audacity/audacity, which I am not sure if he/she/others are interested in doing this for the long term, but I guess time will tell. Full disclosure: I'm the creator of the tool that I linked to
  - kennywinker 5y ago
    Software doesn’t need auto updating. The “move fast and break things” industry needs auto updating. Other than some very few exceptions (e.g. a web browser with a huge attack surface may need auto updates to protect the user). Similarly, crash reporting being opt-in works very well. On crash you present the user with a crash report, they review it - and can send if they desire to. Throw in a lil’ “don’t ask again” checkbox and you’re good to go.
    - tester756 5y ago
      How about just asking user whether he wants new version?
      - kennywinker 5y ago
        Exactly. Nobody’s complaining about a “check for updates” button.
      - anonymousab 5y ago
        The users cannot be trusted, the users are dumb, we know better than the users, we must steer the users, the goals of the project are more important than any one user's, etc. Take your pick at this point.
    - orf 5y ago
      Yes it does. Bugs need to be fixed, improvements need to be made. That’s the lifeblood of most user-facing software. Without it you end up with a huge user base running legacy versions, reporting the same bugs and asking for the same features.
      - kennywinker 5y ago
        That’s a minor inconvenience at the bug-screening level. I’ve used audacity for over a decade, updating it once every year or two - either when i got a new computer, or when it occurred to me there’s probably a new version out there.
  - slackfan 5y ago
    "needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting" Software needs not do any such thing. Developers may want this thing, but users absolutely do not need it, and neither does software.
    - orf 5y ago
      Wrong, users absolutely do need their software to not crash and to stay relevant. The user doesn’t have to update it (so no silent upgrades), but showing something when a new version is released is a great thing for moving your user-base off legacy versions containing bugs fixed in later versions.
      - sneak 5y ago
        "moving your user-base" shows your bias here. The developer doesn't get to move their user base, the users get to decide what version of software they wish to run. You don't need to perpetually run the latest release to "stay relevant". All of my workstations are still on Catalina and they're fine.
      - nitrogen 5y ago
        Show a button to check for updates on any version timestamped older than X months where the button hasn't been clicked in a while. Show the button on the crash dialog. Don't open a single socket without approval. Let the user decide. This is a fundamental principle of human interaction -- ask first before touching someone's stuff.
        BugWatch 5y ago
        Having written my rant(s) elsewhere in this thread, I'm just gonna telepathically project the "(slams the palm on the desk) THANK YOU!" gif.
        CJefferson 5y ago
        The problem nowadays, is with everything connected to everything else, some bugs need fixing fast. Imagine if there is a buffer overflow in Audacity, meaning someone can take over your machine with a malformed sound file. I'd want to know about that ASAP -- not after a month. On average, I believe most users benefit from an automated check for updates. It should be possible to disable it, but we should first worry about keeping users safe.
  - krono 5y ago
    Neither crash reports nor auto-updates are vital to the functioning of the program. It doesn't seem so weird to me to have an application ask for permission first. Something most applications do anyway.
    - cyral 5y ago
      But it does ask: https://github.com/audacity/audacity/pull/835 https://github.com/audacity/audacity/pull/835
      - krono 5y ago
        I was more responding to the - in my opinion ridiculous - notion that even apps that don't require the internet to function at all should be expected to phone home by default, and that auto updates are an essential. Nevertheless, it's good to know they've chosen an opt-in construction for Audacity!
  - geofft 5y ago
    Crash reporting is only needed if you write software that crashes in the first place. Do you think the SQLite developers have ever felt like they need automated crash reporting from their users? (see https://corecursive.com/066-sqlite-with-richard-hipp/ https://corecursive.com/066-sqlite-with-richard-hipp/ , which got discussed recently: https://news.ycombinator.com/item?id=27718701 https://news.ycombinator.com/item?id=27718701 ) And SQLite accepts way richer input (SQL queries) from users than Audacity does (audio files). There are many ways to reduce bugs. Extensive coverage-guided testing, like SQLite does, is one. Automated fuzzing is another. Writing in languages with strong type systems that let you statically verify the program's behavior is another. Collecting crash reports is another, and it's certainly one valid way, but it's not the only way. It's pretty clear that Audacity's users, in aggregate, aren't that concerned about needing crashes fixed - or at least are less concerned about it than about their privacy. Maybe Audacity already is sufficiently bug-free for their needs! While I also think that the "telemetry" argument is overblown, and I think automated updates are basically table stakes, and I wholeheartedly agree with you re JS and Electron, I think it's entirely reasonable for users to say that they don't find automated crash reporting valuable, and I don't think that it's particularly reasonable for developers to say "We know better than you."
    - zxzax 5y ago
      I completely disagree with your assessment, Audacity just crashed twice for me yesterday. Also, with SQLite, it seems the major people reporting bugs are people who have paid support contracts with drh, which most likely requires sending identifying information.
    - orf 5y ago
      I’ve found several bugs in SQLite, one of them pretty fundamental and obvious. It’s a complete nightmare to report them, forcing you to use some utterly terrible forum software with limited searching, visibility and a shockingly poor UI. Genuinely the worst and most confusing thing I’ve had to use in the last decade. Sourceforge issue trackers are a step up from this. They also offer no convenient way to test your system using the latest RC/beta/alpha/whatever without manually staying on-top of the releases page and updating it. I don’t think the rest of the comment warrants much discussion, but I wanted to point that out.
  - sneak 5y ago
    > much-needed functionality such as auto-updating I don't want any software on any of my machines to auto-update. Auto-update is a remote code execution vulnerability, as Solarwinds demonstrated. > Things change. The internet needs Javascript, I browse the web with javascript off, on Edward Snowden's recommendation.
  - Zandikar 5y ago
    > Software needs to reach out to the internet... No, you stop. It absolutely does NOT need this functionality. Is it nice? sure. But it should be opt in and prompted, not opt out and automatic. > that doesn’t work for crash reporting It does. > nor does it really work for auto-updating. Good. > The internet needs Javascript No it doesn't. The ad economy depends on it to bypass consent. Do not confuse that with the ad economy requiring it to function nor does it mean the internet requires it. Again, is it useful? of course, there are many instances where it can (keyword can) enhance the experience, but it is not necessary for 99% of applications (no, your infinite scroll SPA is not a necessary function). Is it necessary? Absolutely not. > and developers need automated feedback No they dont. The only things you're referring to are necessary for are forcing things by your users without their knowledge or consent, and for superfluous flair and form. It's possible to build opt-in, privacy respecting, informed consent software diagnostics and telemetry without forcing this nonsense on them, especially with respect to the topic at hand, which is not a web application, but an offline native desktop application.
    - nokya 5y ago
      +1 The web and mobile world is plagued with prompts stating that "X needs to access your data Y" or "X needs permission Z" to "do the job". Worst part of it? Developers and architects are often the first ones to believe this nonsense. When you're surrounded by developers, users and managers who believe in werewolves, best thing to do is just to nod :)
    - azangru 5y ago
      > > The internet needs Javascript > No it doesn't. Do you prefer the web from 1995? No youtube, no github, no google docs, no google maps, no real-time in-browser messengers/chats, no hangouts/google_meet/jitsi, etc. etc.?
      - badsectoracula 5y ago
        Half of those aren't really needed and are better server by native apps anyway. However the Internet isn't the Web, so certainly the Internet doesn't need Javascript. Also neither does the web, but for sites that can provide functionality which wouldn't be possible without javascript it can be a nice optional feature. Though all of the examples you gave either do not need javascript (youtube, github) or are better as native apps (google docs, google maps, IMs).
  - syshum 5y ago
    Stop. Just Stop. Software does not need to violate a users privacy to provide functionality that is not really needed at all such as auto-updating, nor crash reporting. Calling any of this as anything other than Telemetry data is factually incorrect The movement around forking is NOT just over this new privacy policy, but is a culmination several actions by the new owners of the project to go agaist some very basic norms of Open Source stewardship. Further they are more or less giving the Linux Maintainer community a "FU" over their use of custom / modified version wxwidgets which makes packaging the 3x version of Audacity problematic for many linux distribution for security reasons. As to the statement that "opt-in does not work with crash reporting" Sure it does, Many applications (including Microsoft, and Mozilla) have a dialog that ASKS the user if they would like to submit crash reporting data to the vendor on a per crash basis, There is LITERALLY zero technical reason for automatic, opt-out crash reporting
  - detaro 5y ago
    > Before you say “well make this opt-in” - that doesn’t work for crash reporting Well Audacity thought it would work for them: https://github.com/audacity/audacity/pull/836 https://github.com/audacity/audacity/pull/836
  - chc 5y ago
    They literally say they're collecting information to share with law enforcement and sell to analytics firms.
  - viraptor 5y ago
    Crash reporting is telemetry. Not in the "omg spying" sense people seem to treat that word sometimes. It's collecting remote data - it's telemetry.
  - jjulius 5y ago
    And yet somehow Audacity has done just fine without this for 21 years.
  - deleted 5y ago
    [deleted]
  - II2II 5y ago
    > Software needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting. Crash reporting is more of a problem than telemetry. Any report that contains the contents of memory may end up leaking confidential data. That data may be considerably more sensitive than an analysis of how the software is being used. The end user should be informed of the risk, be able to review the data being shared, and have the right to block it. As for updates, there are distribution models where this is handled by a third party. In some cases, a list of packages is downloaded so the only way for the third party to know whether something is installed is when an update is retrieved. In other cases, a list of software is sent to the third party but it is a trusted third party (e.g. Google, rather than a random app developer).
    - Nextgrid 5y ago
      > but it is a trusted third party (e.g. Google, rather than a random app developer). I'd trust a random app developer way more than an ad company whose data processing consent flow is intentionally annoying and still does not comply with the GDPR.
      - II2II 5y ago
        Some app developers are going to be better at respecting privacy than Google, while some are going to be worse. The problem arises when you have to assess each one: people either won't or run the risk of relying upon misinformation.
        Nextgrid 5y ago
        The kind of analytics data a typical telemetry system will collect is pretty benign in isolation. It only becomes a risk when it's in the hand of an adversary with a global view of the internet, such as Google, Facebook or large-scale analytics providers such as Mixpanel (as their libraries are integrated everywhere and they have a ton of traffic they can use to correlate and deanonymize users).
  - liketochill 5y ago
    Software is a tool that does a job for me. When I buy or download the software it does that job and should continue doing that job in the same way indefinitely. It never needs to change. It never needs to connect to the internet. Obviously this applies to offline tools and not web browsers.
  - pessimizer 5y ago
    My networking programs need to update for security reasons, but anything that isn't networking can update when I say it can, which may be never if I don't see a tangible benefit in the update.
  - squarefoot 5y ago
    > and developers need automated feedback. Am I so old that even the mere concept of beta testing doesn't make sense anymore?
    - deleted 5y ago
      [deleted]
  - mixmastamyk 5y ago
    The single worst bootlicking, uncle tom, non-spam post I've ever read on the site. What could possibly be your motivation?
  - osw89 5y ago
    Oh please, this project was doing fine for two decades with regular bug reports and it suddenly needs to collect data straight after a hostile takeover by a company with a shady privacy policy? An offline audio editor doesn't need to be connected to the net.
  - totony 5y ago
    Auto-updating: Why do you need auto updating? Why not stay on old version or rely on package managers which do that for you? Isn't that freedom the user should expect when using software? Crash reporting: Why not just generate a crashreport-date.txt and allow the user to save it and email it to you? Why should they be forced to report it?
    - orf 5y ago
      > Crash reporting: Why not just generate a crashreport-date.txt and allow the user to save it and email it to you? Why should they be forced to report it? nobody does this. It’s such an utterly naive statement and exactly in keeping with others in this discussion. It also doesn’t catch non-terminating errors. > Why not stay on old version or rely on package managers which do that for you? Why would you want this? This also doesn’t work for Windows.
      - totony 5y ago
        >Why would you want this? Because maybe an old version works good enough for your needs. Every software having auto updates is the reason package managers don't catch on on windows. Then you see every single software having bulky planned tasks/start on boot auto updaters. >nobody does this Core/crash dumps are exactly that. >It also doesn’t catch non-terminating errors. Why wouldn't it?
- tester756 5y ago
  >Yeah, an offline audio editing program should not phone home in any way without advance consent. Why? Isn't your decision to run this software some kind of consent to let it perform its basic stuff?
  - bigiain 5y ago
    I guess the question is - is online telemetry and crash reporting reasonable considered and expected to "it's stuff" for an offline audio editing program? And if so, how far down that slope is it reasonable to go before trying to claim that crypto-mining is also an essential part of off line audio editing software?
    - tester756 5y ago
      First off - I don't divide programs into "online" "offline", because what's the point? It's not like program will stop working when it tries to send crash report without internet connection (if handled correctly). >I guess the question is - is online telemetry and crash reporting reasonable considered and expected to "it's stuff" for an offline audio editing program? For me - yes. Yes, I do consider crash report as a part of software maintenance efforts and I have nothing against sending critical data e.g at which place it crashed & e.g basic informations like OS, Hardware, GPU/Sound drivers version.
- aeturnum 5y ago
  If Audacity branded itself as as an "offline audio editing program" I would agree with you, but its headline is (and has been) "Free, open source, cross-platform audio software." I think using the internet to check for updates and report crashes is perfectly within that mission and, on balance, not using the internet in those situations seems to go against the mission. Should there be a way to disable that communication? Yes, and there is. Beyond all that - if you are seeking the level of anonymity that would require evading program update checks or crash submissions - then you should probably lock down your network as your biggest worry is probably not your open source audio software.
geofft 5y ago
It's possible to do this in a way that doesn't reveal your IP - run the update-checking server as a Tor onion service and embed a little client that knows how to connect to the Tor network. Then your entry node doesn't know what you're connecting to, and the remote update server only knows the IP of the relay talking to it, not your actual IP. Still, a good question is how you're getting updates in the absence of automatic updates (and for software whose goal is parsing binary file formats, chances are high that if you aren't getting updates, you have a pretty big privacy problem already). If you have no auto-update code but you're telling users to download new versions from, say, GitHub, then GitHub gets their IP addresses anyway.
- tester756 5y ago
  Well I think hiding from GitHub is not something that average person does but if you want to do it, then feel free to purchase 3$, then type `ssh -D 8080 root@linux`, use SOCKS Proxy in Firefox's Network settings and here's your new IP
fartcannon 5y ago
Hey great, you can use this version of Audacity. You don't ever need to think about it again. Lucky you.

reaperducer 5y ago

wouldn't it be better to keep crash reports in there? Different people have different needs and different levels of sensitivity to this sort of thing. Personally, I don't want my offline audio editor talking to anything without asking. But since Audacity doesn't do that, this will be what I use instead. If Audacity were to ask before sending data, a good chunk of people wouldn't be upset. But it doesn't, so here we are. Also — and I've said it before — automatic "telemetry" and crash reporting is just lazy. It also lacks context. If you want to know what your users' experience is like, just ask them.

floatingatoll 5y ago
Ask who? In-product surveys would be ignored or trigger this same outrage, and requests for an email address at download time simply result in throwaway accounts and other garbage input. What successful ways can you envision that a software developer ought to be asking their users for their experience, when the software is available for free without restriction upon download or use? How would you ensure that users who are satisfied with the way Audacity is working will take an equivalent amount of time to report their satisfaction as users who aren't satisfied with the way Audacity is working, so that your feedback is representative of the userbase as a whole rather than of the vocal subset that have problems? Would you advise Audacity to stop trying to measure or assess its users and their opinions, and instead simply do whatever they think is best for Audacity without harvesting user data? If Audacity truly accepted the view that the product should never report a single byte of information back to them and that they should never attempt to collect any data whatsoever about their users, then they would be forced to make decisions about Audacity without those users' data (including their opinions!), even if those decisions could end up being disliked or contentious among a subset of the users. At that point I expect they would likely determine that product autoupdate and feature usage metrics are a valuable feature for the product and not of concern to most users, and then ship those — regardless of the cries of outrage from the subset that hold contradictory opinions — because, after all, that subset demanded not to exist to Audacity, and so their wish is fulfilled. How can the vocal contingent of Audacity users who say "my existence should remain unknown to those who make the software I use" expect to have their opinions considered relevant, when they specifically demand not to be considered as existing at all?

tester756 5y ago

>Of course it should be disabled by default, and it would never be uploaded. I believe when you make crash reports / telemetry disabled by default then you lose a lot of reports, thus make your life harder as a developer that wants to deliver high quality solution for as many OSes, hardwares, configurations, blabla. I don't have problem that e.g my IDE would report how many files and lines of code my project has, because it may allow devs to make better decisions.

gizdan 5y ago
> I believe when you make crash reports / telemetry disabled by default then you lose a lot of reports, Perhaps I should have been clearer. I think something similar to Firefox's crash reports. If a crash happens, prompt the user and show them the report, and finally, let them decide. Perhaps even take out the networking features and open the default client with an attachment or a path of the report so they can be attached to a github issue.
- detaro 5y ago
  > Perhaps I should have been clearer. I think something similar to Firefox's crash reports. If a crash happens, prompt the user and show them the report, and finally, let them decide. So, like Audacity?

me551ah 5y ago

The reaction is completely overblown. As a software developer myself I know how important crash reports are to figure out which bugs are impacting the most number of users. If everyone moved to this version without telemetry, we would end up with a far buggier version of Audacity because the developer has no clue of what bugs of prioritize. Audacity runs on multiple OSs and with the huge amount of hardware devices available, it's impossible for the maintainer of an open source project to test them all. I really hope that this project doesn't catch up, for the sake of bug-free audacity.

geofft 5y ago
But if this project does catch on, it indicates that users prefer a pro-privacy Audacity to a bug-free Audacity. That might not be the decision you (or I) would prefer, but I think it's a legitimate decision for users to make and we ought to respect that.
- viraptor 5y ago
  It indicates bias in reporting too. There are a few people I know using Audacity and they have not heard of this whole issue (yet?) - and I really don't expect they will care if they do. So I expect we'll have some hardline pro-privacy users keeping this fork while a majority keeps doing their work using the original upstream. Here we'll only hear the strong pro-privacy views because that's the news.
deleted 5y ago
[deleted]
ploxiln 5y ago
How did Audacity gain it's popularity over the past 15 years, without any of this stuff? Did you use computers 15 years ago? Linux desktop and open source tools? Nothing had this crap back then, and some of it was pretty good. Audacity itself is an example! Open source software is not a commercial product. You don't need to prioritize and optimize for engagement or market share or any such crap. Just fix what you want, fix what you can, interested capable users will contribute attempted fixes for their own problems and you incorporate them if they make sense to the project. I don't think telemetry has ever resulted in good software, it just pushes everything towards being an iPad with one button on it. Only skilled tasteful developers make good software, and that was true long before telemetry existed.

detaro 5y ago

I mean, the crash reports appear to be with a confirmation in upstream already? (see screenshot in https://github.com/audacity/audacity/pull/836 https://github.com/audacity/audacity/pull/836)

gizdan 5y ago
Honestly, in my opinion this is completely reasonable. This is exactly how many different software do this including Firefox and Android (by default anyway). As others have mentioned the blowback on this is, in my opinion, entirely unreasonable. Having said that, Sentry integration is another matter.
- detaro 5y ago
  > Having said that, Sentry integration is another matter. How? I only know Sentry as the backend tool you use to analyze the uploaded crashdumps? Or do you mean that a "crash report" could be something smaller than a minidump? (although I personally think a minidump is not a bad compromise)

jjulius 5y ago

>I have no horse in this race, but wouldn't it be better to keep crash reports in there? Audacity has been around for 21 years, has generated a strong following from a wide range of users, and is one of the most widely-loved FOSS projects. It achieved said status without telemetry for 21 years. People keep saying the telemetry thing is "overblown", but there is clearly a large number of us who simply don't want it. It doesn't need it, and the past 21 years have demonstrated that.