6 ms·

Stop. Just stop. Software needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting. Branding any o

• smoldesu 5y ago
  > creating a bunch of immediately abandoned forks is a joke. This part is not inherently true. Only time will tell how Audacity reacts, and they could very well have an UnGoogled-Chromium/Codium situation on their hands.
  • orf 5y ago
    Picking two applications with less global users than a small town or a large village doesn’t make a great point. They might as well have been abandoned - no relevant mass of people use them.
    • smoldesu 5y ago
      Ah, my bad. I'll stick to S&P Top 500 companies next time.
      • orf 5y ago
        No, stick to forks that manage to reach a self-sustaining level above “one or two users cherry-picking from an upstream repo as a passion project”. My point is that a fork can be abandoned by users even if the project is still active.
        • monetus 5y ago
          Your point is worth thinking about it, audacity needs a critical mass of users. But does it have enough original users to keep from being considered abandonded already? Edit: to be clear, other software is often used instead of audacity. It isn't as well known as say photoshop, or maybe even inkscape.
    • deleted 5y ago
      [deleted]
  • sdesol 5y ago
    In the last 90 days they had 11 contributors that changed c,cpp, and c header files with at least 10 lines of code churn: https://public-001.gitsense.com/insights/github/repos?p=commits&q=file-churn%3A%3E%3D10%2Blangs%3Ac_header%2Ccpp%2Cc%2Bwindow%3A90&r=github%3Acookiengineer%2Faudacity&v=repo https://public-001.gitsense.com/insights/github/repos?p=comm... The user crsib appears to be the main contributor to audacity, so I would have to imagine others would have to pick up the slack for a fork to be viable. cookiengineer also changed 71 files https://public-001.gitsense.com/insights/github/repos?p=commits&q=authors%3Acookiengineer%40protonmail.com%2Binvolves%3Acookiengineer&r=github%3Acookiengineer%2Faudacity&v=repo https://public-001.gitsense.com/insights/github/repos?p=comm... so he/she will have to constantly monitor these files moving forward, for the fork to be stable/similar to audacity/audacity, which I am not sure if he/she/others are interested in doing this for the long term, but I guess time will tell. Full disclosure: I'm the creator of the tool that I linked to
• kennywinker 5y ago
  Software doesn’t need auto updating. The “move fast and break things” industry needs auto updating. Other than some very few exceptions (e.g. a web browser with a huge attack surface may need auto updates to protect the user). Similarly, crash reporting being opt-in works very well. On crash you present the user with a crash report, they review it - and can send if they desire to. Throw in a lil’ “don’t ask again” checkbox and you’re good to go.
  • tester756 5y ago
    How about just asking user whether he wants new version?
    • kennywinker 5y ago
      Exactly. Nobody’s complaining about a “check for updates” button.
    • anonymousab 5y ago
      The users cannot be trusted, the users are dumb, we know better than the users, we must steer the users, the goals of the project are more important than any one user's, etc. Take your pick at this point.
  • orf 5y ago
    Yes it does. Bugs need to be fixed, improvements need to be made. That’s the lifeblood of most user-facing software. Without it you end up with a huge user base running legacy versions, reporting the same bugs and asking for the same features.
    • kennywinker 5y ago
      That’s a minor inconvenience at the bug-screening level. I’ve used audacity for over a decade, updating it once every year or two - either when i got a new computer, or when it occurred to me there’s probably a new version out there.
• slackfan 5y ago
  "needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting" Software needs not do any such thing. Developers may want this thing, but users absolutely do not need it, and neither does software.
  • orf 5y ago
    Wrong, users absolutely do need their software to not crash and to stay relevant. The user doesn’t have to update it (so no silent upgrades), but showing something when a new version is released is a great thing for moving your user-base off legacy versions containing bugs fixed in later versions.
    • sneak 5y ago
      "moving your user-base" shows your bias here. The developer doesn't get to move their user base, the users get to decide what version of software they wish to run. You don't need to perpetually run the latest release to "stay relevant". All of my workstations are still on Catalina and they're fine.
    • nitrogen 5y ago
      Show a button to check for updates on any version timestamped older than X months where the button hasn't been clicked in a while. Show the button on the crash dialog. Don't open a single socket without approval. Let the user decide. This is a fundamental principle of human interaction -- ask first before touching someone's stuff.
      • BugWatch 5y ago
        Having written my rant(s) elsewhere in this thread, I'm just gonna telepathically project the "(slams the palm on the desk) THANK YOU!" gif.
      • CJefferson 5y ago
        The problem nowadays, is with everything connected to everything else, some bugs need fixing fast. Imagine if there is a buffer overflow in Audacity, meaning someone can take over your machine with a malformed sound file. I'd want to know about that ASAP -- not after a month. On average, I believe most users benefit from an automated check for updates. It should be possible to disable it, but we should first worry about keeping users safe.
• krono 5y ago
  Neither crash reports nor auto-updates are vital to the functioning of the program. It doesn't seem so weird to me to have an application ask for permission first. Something most applications do anyway.
  • cyral 5y ago
    But it does ask: https://github.com/audacity/audacity/pull/835 https://github.com/audacity/audacity/pull/835
    • krono 5y ago
      I was more responding to the - in my opinion ridiculous - notion that even apps that don't require the internet to function at all should be expected to phone home by default, and that auto updates are an essential. Nevertheless, it's good to know they've chosen an opt-in construction for Audacity!
• geofft 5y ago
  Crash reporting is only needed if you write software that crashes in the first place. Do you think the SQLite developers have ever felt like they need automated crash reporting from their users? (see https://corecursive.com/066-sqlite-with-richard-hipp/ https://corecursive.com/066-sqlite-with-richard-hipp/ , which got discussed recently: https://news.ycombinator.com/item?id=27718701 https://news.ycombinator.com/item?id=27718701 ) And SQLite accepts way richer input (SQL queries) from users than Audacity does (audio files). There are many ways to reduce bugs. Extensive coverage-guided testing, like SQLite does, is one. Automated fuzzing is another. Writing in languages with strong type systems that let you statically verify the program's behavior is another. Collecting crash reports is another, and it's certainly one valid way, but it's not the only way. It's pretty clear that Audacity's users, in aggregate, aren't that concerned about needing crashes fixed - or at least are less concerned about it than about their privacy. Maybe Audacity already is sufficiently bug-free for their needs! While I also think that the "telemetry" argument is overblown, and I think automated updates are basically table stakes, and I wholeheartedly agree with you re JS and Electron, I think it's entirely reasonable for users to say that they don't find automated crash reporting valuable, and I don't think that it's particularly reasonable for developers to say "We know better than you."
  • zxzax 5y ago
    I completely disagree with your assessment, Audacity just crashed twice for me yesterday. Also, with SQLite, it seems the major people reporting bugs are people who have paid support contracts with drh, which most likely requires sending identifying information.
  • orf 5y ago
    I’ve found several bugs in SQLite, one of them pretty fundamental and obvious. It’s a complete nightmare to report them, forcing you to use some utterly terrible forum software with limited searching, visibility and a shockingly poor UI. Genuinely the worst and most confusing thing I’ve had to use in the last decade. Sourceforge issue trackers are a step up from this. They also offer no convenient way to test your system using the latest RC/beta/alpha/whatever without manually staying on-top of the releases page and updating it. I don’t think the rest of the comment warrants much discussion, but I wanted to point that out.
• sneak 5y ago
  > much-needed functionality such as auto-updating I don't want any software on any of my machines to auto-update. Auto-update is a remote code execution vulnerability, as Solarwinds demonstrated. > Things change. The internet needs Javascript, I browse the web with javascript off, on Edward Snowden's recommendation.
• Zandikar 5y ago
  > Software needs to reach out to the internet... No, you stop. It absolutely does NOT need this functionality. Is it nice? sure. But it should be opt in and prompted, not opt out and automatic. > that doesn’t work for crash reporting It does. > nor does it really work for auto-updating. Good. > The internet needs Javascript No it doesn't. The ad economy depends on it to bypass consent. Do not confuse that with the ad economy requiring it to function nor does it mean the internet requires it. Again, is it useful? of course, there are many instances where it can (keyword can) enhance the experience, but it is not necessary for 99% of applications (no, your infinite scroll SPA is not a necessary function). Is it necessary? Absolutely not. > and developers need automated feedback No they dont. The only things you're referring to are necessary for are forcing things by your users without their knowledge or consent, and for superfluous flair and form. It's possible to build opt-in, privacy respecting, informed consent software diagnostics and telemetry without forcing this nonsense on them, especially with respect to the topic at hand, which is not a web application, but an offline native desktop application.
  • nokya 5y ago
    +1 The web and mobile world is plagued with prompts stating that "X needs to access your data Y" or "X needs permission Z" to "do the job". Worst part of it? Developers and architects are often the first ones to believe this nonsense. When you're surrounded by developers, users and managers who believe in werewolves, best thing to do is just to nod :)
  • azangru 5y ago
    > > The internet needs Javascript > No it doesn't. Do you prefer the web from 1995? No youtube, no github, no google docs, no google maps, no real-time in-browser messengers/chats, no hangouts/google_meet/jitsi, etc. etc.?
    • badsectoracula 5y ago
      Half of those aren't really needed and are better server by native apps anyway. However the Internet isn't the Web, so certainly the Internet doesn't need Javascript. Also neither does the web, but for sites that can provide functionality which wouldn't be possible without javascript it can be a nice optional feature. Though all of the examples you gave either do not need javascript (youtube, github) or are better as native apps (google docs, google maps, IMs).
• syshum 5y ago
  Stop. Just Stop. Software does not need to violate a users privacy to provide functionality that is not really needed at all such as auto-updating, nor crash reporting. Calling any of this as anything other than Telemetry data is factually incorrect The movement around forking is NOT just over this new privacy policy, but is a culmination several actions by the new owners of the project to go agaist some very basic norms of Open Source stewardship. Further they are more or less giving the Linux Maintainer community a "FU" over their use of custom / modified version wxwidgets which makes packaging the 3x version of Audacity problematic for many linux distribution for security reasons. As to the statement that "opt-in does not work with crash reporting" Sure it does, Many applications (including Microsoft, and Mozilla) have a dialog that ASKS the user if they would like to submit crash reporting data to the vendor on a per crash basis, There is LITERALLY zero technical reason for automatic, opt-out crash reporting
• detaro 5y ago
  > Before you say “well make this opt-in” - that doesn’t work for crash reporting Well Audacity thought it would work for them: https://github.com/audacity/audacity/pull/836 https://github.com/audacity/audacity/pull/836
• chc 5y ago
  They literally say they're collecting information to share with law enforcement and sell to analytics firms.
• viraptor 5y ago
  Crash reporting is telemetry. Not in the "omg spying" sense people seem to treat that word sometimes. It's collecting remote data - it's telemetry.
• jjulius 5y ago
  And yet somehow Audacity has done just fine without this for 21 years.
• deleted 5y ago
  [deleted]
• II2II 5y ago
  > Software needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting. Crash reporting is more of a problem than telemetry. Any report that contains the contents of memory may end up leaking confidential data. That data may be considerably more sensitive than an analysis of how the software is being used. The end user should be informed of the risk, be able to review the data being shared, and have the right to block it. As for updates, there are distribution models where this is handled by a third party. In some cases, a list of packages is downloaded so the only way for the third party to know whether something is installed is when an update is retrieved. In other cases, a list of software is sent to the third party but it is a trusted third party (e.g. Google, rather than a random app developer).
  • Nextgrid 5y ago
    > but it is a trusted third party (e.g. Google, rather than a random app developer). I'd trust a random app developer way more than an ad company whose data processing consent flow is intentionally annoying and still does not comply with the GDPR.
    • II2II 5y ago
      Some app developers are going to be better at respecting privacy than Google, while some are going to be worse. The problem arises when you have to assess each one: people either won't or run the risk of relying upon misinformation.
      • Nextgrid 5y ago
        The kind of analytics data a typical telemetry system will collect is pretty benign in isolation. It only becomes a risk when it's in the hand of an adversary with a global view of the internet, such as Google, Facebook or large-scale analytics providers such as Mixpanel (as their libraries are integrated everywhere and they have a ton of traffic they can use to correlate and deanonymize users).
• liketochill 5y ago
  Software is a tool that does a job for me. When I buy or download the software it does that job and should continue doing that job in the same way indefinitely. It never needs to change. It never needs to connect to the internet. Obviously this applies to offline tools and not web browsers.
• pessimizer 5y ago
  My networking programs need to update for security reasons, but anything that isn't networking can update when I say it can, which may be never if I don't see a tangible benefit in the update.
• squarefoot 5y ago
  > and developers need automated feedback. Am I so old that even the mere concept of beta testing doesn't make sense anymore?
  • deleted 5y ago
    [deleted]
• mixmastamyk 5y ago
  The single worst bootlicking, uncle tom, non-spam post I've ever read on the site. What could possibly be your motivation?
• osw89 5y ago
  Oh please, this project was doing fine for two decades with regular bug reports and it suddenly needs to collect data straight after a hostile takeover by a company with a shady privacy policy? An offline audio editor doesn't need to be connected to the net.
• totony 5y ago
  Auto-updating: Why do you need auto updating? Why not stay on old version or rely on package managers which do that for you? Isn't that freedom the user should expect when using software? Crash reporting: Why not just generate a crashreport-date.txt and allow the user to save it and email it to you? Why should they be forced to report it?
  • orf 5y ago
    > Crash reporting: Why not just generate a crashreport-date.txt and allow the user to save it and email it to you? Why should they be forced to report it? nobody does this. It’s such an utterly naive statement and exactly in keeping with others in this discussion. It also doesn’t catch non-terminating errors. > Why not stay on old version or rely on package managers which do that for you? Why would you want this? This also doesn’t work for Windows.
    • totony 5y ago
      >Why would you want this? Because maybe an old version works good enough for your needs. Every software having auto updates is the reason package managers don't catch on on windows. Then you see every single software having bulky planned tasks/start on boot auto updaters. >nobody does this Core/crash dumps are exactly that. >It also doesn’t catch non-terminating errors. Why wouldn't it?