3 ms·
> Just because it has access to your whole machine doesn't mean it's going to convert into spyware and start keylogging you. Never said it meant that. The prob
by jolmg 5y ago
> Just because it has access to your whole machine doesn't mean it's going to convert into spyware and start keylogging you.
Never said it meant that. The problem is not with the existence of locally-run programs.
The problem is with outright saying (in the second row, first column of the table in the privacy policy) that they'll collect whatever they feel necessary for whatever requests come in.
As an example of how the privacy policy is worded, if a request comes in to know everything you typed between datetime A and datetime B, they would have to keylog in order to obtain the "Data necessary for law enforcement, litigation and authorities' requests".
The reasonable, standard way to comply with the law would be to instead take the content of column 2 and 3 of row 2 and put them in column 2 and 3 of row 1, and delete column 1 of row 2.
IOW, you collect data for the reasonable operation of your business, and you provide access to that data to authorities when given a warrant. You don't just say you'll collect whatever is requested of you.
> It sends very specific telemetry data home, and I think that's what this document covers.
No, that's part of what the document covers. Specifically, it's what the first row of the table in the privacy policy covers.
But the problem is not the first row; it's the second.
- phendrenad2 5y agoI think you're reading it too literally. There are real-world considerations outside of the fantasy world of legalese. They can only collect data that they specifically read using code. The code is open-source. So they need to either build a keylogger right into their public source, or send you a special update that adds a keylogger before the fact.
- jolmg 5y agoCertainly there's little to no practical risk in this particular case, but that doesn't make the policy ok. It would really suck if accepting this signaled that it's ok to make such policies for closed-source software, for example, eventually leading to the legitimizing and normalization of keyloggers and/or other spyware-like behavior under the excuse that law enforcement may eventually want it. What really irks here is saying that such a policy is normal now and therefore ok, when it's obviously a large new overreach. The response that it's OK if they say they'll behave like spyware because there's little chance they'll succeed also irks. But worse are the multiple people saying that people can't recognize a standard policy boilerplate when it obviously is not. If we're being really generous, it's possible that the current wording was not intended to mean what it says, but that also doesn't make it ok.
- phendrenad2 5y agoAh I see, so the wording is actually worse than the wording regarding current closed-source programs?
- jolmg 5y agoYes. For example, Adobe's[1] which describes the policy for Photoshop and their other apps describes what specific data they may collect which is all related to the operation of their apps and services, and then they say they may provide it to authorities on request. I've never seen a privacy policy be as vague and overreaching as Audacity's. [1] https://www.adobe.com/privacy/policy.html https://www.adobe.com/privacy/policy.html