3 ms·
> Software needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting. Crash reporting is more of a
by II2II 5y ago
> Software needs to reach out to the internet to provide some much-needed functionality such as auto-updating or crash reporting.
Crash reporting is more of a problem than telemetry. Any report that contains the contents of memory may end up leaking confidential data. That data may be considerably more sensitive than an analysis of how the software is being used. The end user should be informed of the risk, be able to review the data being shared, and have the right to block it.
As for updates, there are distribution models where this is handled by a third party. In some cases, a list of packages is downloaded so the only way for the third party to know whether something is installed is when an update is retrieved. In other cases, a list of software is sent to the third party but it is a trusted third party (e.g. Google, rather than a random app developer).
- Nextgrid 5y ago> but it is a trusted third party (e.g. Google, rather than a random app developer). I'd trust a random app developer way more than an ad company whose data processing consent flow is intentionally annoying and still does not comply with the GDPR.
- II2II 5y agoSome app developers are going to be better at respecting privacy than Google, while some are going to be worse. The problem arises when you have to assess each one: people either won't or run the risk of relying upon misinformation.
- Nextgrid 5y agoThe kind of analytics data a typical telemetry system will collect is pretty benign in isolation. It only becomes a risk when it's in the hand of an adversary with a global view of the internet, such as Google, Facebook or large-scale analytics providers such as Mixpanel (as their libraries are integrated everywhere and they have a ton of traffic they can use to correlate and deanonymize users).