6 ms·

Another misstep for Audacity

83 points by signa11 5y ago

nixpulvis 5y ago
> The company's compliance with law enforcement is limited to what is actually required by law. I'm distressed at how quickly the article brushes this off. What could The Law possibly demand of a music editors users? What am I misunderstanding here?
- wyldfire 5y ago
  I believe that once your open source software vendor collects telemetry, it becomes a concern to the users what kind of a custodian they will be for the data they collect. "Would they volunteer their users' data if asked by law enforcement?" for example would be a concern. And this answer seems to be "No, but they would comply with lawful court orders to produce their users' data."
  - nixpulvis 5y ago
    I meam it's just such a strange statement. Are they really equipped to judge what is and isn't "actually required by law"? Would they be morally obligated to report the rogue officials illegally demanding information?
    - wyldfire 5y ago
      It's not illegal for law enforcement officials to ask companies for records nor is it illegal for the companies to give it unless it's explicitly privileged (like medicine, religious/legal counsel, etc). The law enforcement agents asking for the info are not rogue. It's tantamount to interviewing someone who might have information about a crime. The difference is that it's so terribly easy to go fishing for an enormous amount of information and companies can legally just go ahead and comply. I think it's actually occurred in the past (many times?) which is why it's identified as an item of concern.
      - nixpulvis 5y ago
        If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no?
        wyldfire 5y ago
        Well, yeah hire lawyers! > I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no? shrug throw it on the pile of sorely needed legislative changes. The laws just haven't kept up with things.
        autoexec 5y ago
        > If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. In the US you may not even be given any choice in the matter. They just hand you a national security letter and you're forced to give them access to anything they want for as long as they want it while being forbidden from ever telling anyone (your customers, your shareholders, the press, etc) that it's even happening. The laws really need to be changed, but how do you petition government to give up so much power? Hell, the NSA has outright lied to congress about what they're doing so our lawmakers can't even know about the data collection going on until some brave whistleblower comes along who is willing to sacrifice everything to let us know.
        samus 5y ago
        A agent with black sunglasses and a national security letter is a very different case from cops going on a fishing trip. It's a bad idea to ignore the former. But there is probably (IANAL) no requirement to answer to queries of the latter, unless they also have a court order.
    - michaelmrose 5y ago
      They would be liable to be required by law NOT to report that.
  - autoexec 5y ago
    Why collect the data in the first place? When you aren't collecting IP addresses or CPU and OS details you don't need to worry about things like who is going to be responsible for maintaining, securing, removing, or providing that data when law enforcement (or the state) comes knocking. Nobody using the software is asking for this data collection. Even with their "assurance" that data isn't kept for more than 24 hours, that's more than enough time for it to copied and shared with any number of parties and without independent audits we have no means to be certain the data is being cared for or removed as they claim. Just don't collect any more info that you absolutely need and users don't have to put their faith in you that it won't be abused, you don't have to deal with the headaches and if law enforcement should ever come around asking you can just say "Sorry, we don't collect that information" and you don't have waste time dealing with those requests either.
    - void_mint 5y ago
      > Why collect the data in the first place? To sell, obviously.
      - TedDoesntTalk 5y ago
        No, not really. It’s clarified here: https://github.com/audacity/audacity/discussions/1353 https://github.com/audacity/audacity/discussions/1353 They want to know when it’s safe to drop support for a particular operating system version.
        pmontra 5y ago
        They don't need the IP address for that. Of course their routers will see the address but they don't have to store it. If they store it it's because they need it for some reason.
        TedDoesntTalk 5y ago
        They’re not storing IP addresses. Read the post on GitHub.
- babypuncher 5y ago
  That doesn't really matter, once you have data and the cops show up with a warrant asking for it, you are required by law to hand it over
  - gizdan 5y ago
    You cannot hand over what you don't have. A software being offline has that advantage going for it. You don't see law enforcement going to the GIMP's development team saying "we need this persons GIMP data", which is arguably more likely to be abused.
    - babypuncher 5y ago
      Right, but I'm just explaining why there is nothing unusual or alarming about a privacy policy saying that they will comply with law enforcement when legally required. This is all a non-issue since the telemetry is entirely opt-in and can even be stripped out entirely with a single make flag.
- michaelmrose 5y ago
  You could be leaking enough data about the hash or acoustic fingerprint of files users are editing which could be correlated with enough unique information to identify a user. On the positive side you could identify the user who created ransom_message.mp3 in the exceedingly unlikely case this scenario comes to pass. More realistically you could identify the creator of unpopular_religious_message005.mp3 or how about helping a repressive regime locate any and all creators of any of 385 banned religious or political ideas?
- viraptor 5y ago
  It's common to include that in privacy policies and it's more of a FYI. This will apply whether they include it in the policy or not.
PostThisTooFast 5y ago
This article is old, and has been discussed already. The "telemetry" hysteria was dumb. But the licensing complaints are legit.
dubrocks 5y ago
Another schism over ownership issues, plus ca change
- wyldfire 5y ago
  "plus ça change, plus c'est la même chose" translates as "the more things change, the more they stay the same." The only reason I know this is from Rush lyrics ;)
chovybizzass 5y ago
...the audacity of Audacity. smh
PaulDavisThe1st 5y ago
Articles is from July 8th. This is a fast moving story. The current state of affairs (from Muse Group's perspective) is here: https://github.com/audacity/audacity/discussions/1353 https://github.com/audacity/audacity/discussions/1353 (published today)
- Karunamon 5y ago
  From the Github thread: >I have been doing 3.0.3 Release Candidate testing and all seems good: >a) error and crash reporting are one-off opt-in each time you get such a dialog, >b) the update checking dialog that you get on initial launch of 3.0.3 enables you to turn off update checking in Application prefs BEFORE you hit the OK button - and thus no data is sent. Everything is now as opt-in as it can be expected to, and the privacy policy has nothing untoward in it. I'm not super happy with how long it took to get to this point, but at least the wound has been debrided.
- infogulch 5y ago
  This seems like a reasonable and thorough response. They revised and cut unnecessary bits and added clarification where possible within a reasonable time frame for these matters. Good job. I really don't get the wailing and gnashing of teeth against even the principle of adding update checking and error reporting features. Real, regular people will get tangible benefits from these features. Their scope is so limited and implementation (now) drawn down to such a sharp point I can't really sympathize with a hard-line counterposition that these features must be defacto evil.
  - TeMPOraL 5y ago
    The "wailing and gnashing of teeth" is against updates and error checking being opt-out, or even not opt-outable at all. Sometimes this gets mixed with observations that telemetry and auto-updates are modern-day antipatterns, encouraging bad software development practices and resulting in subpar products. Personally, I feel that a ToS/privacy policy for Audacity would be more palatable if it explicitly limited scope of data collection to optional features of update checks and error reports.
mcguire 5y ago
"Hopefully the Muse Group will learn from these missteps and proceed a bit more carefully from here on out. A focus on real improvements for users and better communication with the user community would help to rebuild trust. It would also be nice if the Internet would learn to damp its reactions a bit — but there seems to be little hope of that. If the Audacity project can find a way to reconnect with its wider community, though, at least one thing will have gotten a little better." Once you have lost your users' trust, it is very hard to get that trust back. Especially if your "better communication" is simply to walk back (er, "clarify") some of your more outrageous statements. (Pro tip for these kind of situations: start by demanding the moon. Then, when you settle for merely owning, say, California, you look generous.)
ryanmcdonough 5y ago
The audacity of these people!
michaelmrose 5y ago
This is incidentally before their "Head of Strategy" tried to shut down the equivalent of youtube-dl for sheet music by threatening to work with the Chinese government to get at a Chinese dissident living abroad potentially facing death or imprisonment at home.
- bvm 5y ago
  https://github.com/Xmader/musescore-downloader/issues/5#issuecomment-882516952 https://github.com/Xmader/musescore-downloader/issues/5#issu... wow

83 points by signa11 5y ago

> The company's compliance with law enforcement is limited to what is actually required by law. I'm distressed at how quickly the article brushes this off. What could The Law possibly demand of a music editors users? What am I misunderstanding here?

wyldfire 5y ago
I believe that once your open source software vendor collects telemetry, it becomes a concern to the users what kind of a custodian they will be for the data they collect. "Would they volunteer their users' data if asked by law enforcement?" for example would be a concern. And this answer seems to be "No, but they would comply with lawful court orders to produce their users' data."
- nixpulvis 5y ago
  I meam it's just such a strange statement. Are they really equipped to judge what is and isn't "actually required by law"? Would they be morally obligated to report the rogue officials illegally demanding information?
  - wyldfire 5y ago
    It's not illegal for law enforcement officials to ask companies for records nor is it illegal for the companies to give it unless it's explicitly privileged (like medicine, religious/legal counsel, etc). The law enforcement agents asking for the info are not rogue. It's tantamount to interviewing someone who might have information about a crime. The difference is that it's so terribly easy to go fishing for an enormous amount of information and companies can legally just go ahead and comply. I think it's actually occurred in the past (many times?) which is why it's identified as an item of concern.
    - nixpulvis 5y ago
      If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no?
      - wyldfire 5y ago
        Well, yeah hire lawyers! > I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no? shrug throw it on the pile of sorely needed legislative changes. The laws just haven't kept up with things.
      - autoexec 5y ago
        > If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. In the US you may not even be given any choice in the matter. They just hand you a national security letter and you're forced to give them access to anything they want for as long as they want it while being forbidden from ever telling anyone (your customers, your shareholders, the press, etc) that it's even happening. The laws really need to be changed, but how do you petition government to give up so much power? Hell, the NSA has outright lied to congress about what they're doing so our lawmakers can't even know about the data collection going on until some brave whistleblower comes along who is willing to sacrifice everything to let us know.
        samus 5y ago
        A agent with black sunglasses and a national security letter is a very different case from cops going on a fishing trip. It's a bad idea to ignore the former. But there is probably (IANAL) no requirement to answer to queries of the latter, unless they also have a court order.
  - michaelmrose 5y ago
    They would be liable to be required by law NOT to report that.
- autoexec 5y ago
  Why collect the data in the first place? When you aren't collecting IP addresses or CPU and OS details you don't need to worry about things like who is going to be responsible for maintaining, securing, removing, or providing that data when law enforcement (or the state) comes knocking. Nobody using the software is asking for this data collection. Even with their "assurance" that data isn't kept for more than 24 hours, that's more than enough time for it to copied and shared with any number of parties and without independent audits we have no means to be certain the data is being cared for or removed as they claim. Just don't collect any more info that you absolutely need and users don't have to put their faith in you that it won't be abused, you don't have to deal with the headaches and if law enforcement should ever come around asking you can just say "Sorry, we don't collect that information" and you don't have waste time dealing with those requests either.
  - void_mint 5y ago
    > Why collect the data in the first place? To sell, obviously.
    - TedDoesntTalk 5y ago
      No, not really. It’s clarified here: https://github.com/audacity/audacity/discussions/1353 https://github.com/audacity/audacity/discussions/1353 They want to know when it’s safe to drop support for a particular operating system version.
      - pmontra 5y ago
        They don't need the IP address for that. Of course their routers will see the address but they don't have to store it. If they store it it's because they need it for some reason.
        TedDoesntTalk 5y ago
        They’re not storing IP addresses. Read the post on GitHub.
babypuncher 5y ago
That doesn't really matter, once you have data and the cops show up with a warrant asking for it, you are required by law to hand it over
- gizdan 5y ago
  You cannot hand over what you don't have. A software being offline has that advantage going for it. You don't see law enforcement going to the GIMP's development team saying "we need this persons GIMP data", which is arguably more likely to be abused.
  - babypuncher 5y ago
    Right, but I'm just explaining why there is nothing unusual or alarming about a privacy policy saying that they will comply with law enforcement when legally required. This is all a non-issue since the telemetry is entirely opt-in and can even be stripped out entirely with a single make flag.
michaelmrose 5y ago
You could be leaking enough data about the hash or acoustic fingerprint of files users are editing which could be correlated with enough unique information to identify a user. On the positive side you could identify the user who created ransom_message.mp3 in the exceedingly unlikely case this scenario comes to pass. More realistically you could identify the creator of unpopular_religious_message005.mp3 or how about helping a repressive regime locate any and all creators of any of 385 banned religious or political ideas?
viraptor 5y ago
It's common to include that in privacy policies and it's more of a FYI. This will apply whether they include it in the policy or not.

PostThisTooFast 5y ago

This article is old, and has been discussed already. The "telemetry" hysteria was dumb. But the licensing complaints are legit.

dubrocks 5y ago

Another schism over ownership issues, plus ca change

wyldfire 5y ago
"plus ça change, plus c'est la même chose" translates as "the more things change, the more they stay the same." The only reason I know this is from Rush lyrics ;)

chovybizzass 5y ago

...the audacity of Audacity. smh

PaulDavisThe1st 5y ago

Articles is from July 8th. This is a fast moving story. The current state of affairs (from Muse Group's perspective) is here: https://github.com/audacity/audacity/discussions/1353 https://github.com/audacity/audacity/discussions/1353 (published today)

Karunamon 5y ago
From the Github thread: >I have been doing 3.0.3 Release Candidate testing and all seems good: >a) error and crash reporting are one-off opt-in each time you get such a dialog, >b) the update checking dialog that you get on initial launch of 3.0.3 enables you to turn off update checking in Application prefs BEFORE you hit the OK button - and thus no data is sent. Everything is now as opt-in as it can be expected to, and the privacy policy has nothing untoward in it. I'm not super happy with how long it took to get to this point, but at least the wound has been debrided.
infogulch 5y ago
This seems like a reasonable and thorough response. They revised and cut unnecessary bits and added clarification where possible within a reasonable time frame for these matters. Good job. I really don't get the wailing and gnashing of teeth against even the principle of adding update checking and error reporting features. Real, regular people will get tangible benefits from these features. Their scope is so limited and implementation (now) drawn down to such a sharp point I can't really sympathize with a hard-line counterposition that these features must be defacto evil.
- TeMPOraL 5y ago
  The "wailing and gnashing of teeth" is against updates and error checking being opt-out, or even not opt-outable at all. Sometimes this gets mixed with observations that telemetry and auto-updates are modern-day antipatterns, encouraging bad software development practices and resulting in subpar products. Personally, I feel that a ToS/privacy policy for Audacity would be more palatable if it explicitly limited scope of data collection to optional features of update checks and error reports.

mcguire 5y ago

"Hopefully the Muse Group will learn from these missteps and proceed a bit more carefully from here on out. A focus on real improvements for users and better communication with the user community would help to rebuild trust. It would also be nice if the Internet would learn to damp its reactions a bit — but there seems to be little hope of that. If the Audacity project can find a way to reconnect with its wider community, though, at least one thing will have gotten a little better." Once you have lost your users' trust, it is very hard to get that trust back. Especially if your "better communication" is simply to walk back (er, "clarify") some of your more outrageous statements. (Pro tip for these kind of situations: start by demanding the moon. Then, when you settle for merely owning, say, California, you look generous.)

ryanmcdonough 5y ago

The audacity of these people!

michaelmrose 5y ago

This is incidentally before their "Head of Strategy" tried to shut down the equivalent of youtube-dl for sheet music by threatening to work with the Chinese government to get at a Chinese dissident living abroad potentially facing death or imprisonment at home.

bvm 5y ago
https://github.com/Xmader/musescore-downloader/issues/5#issuecomment-882516952 https://github.com/Xmader/musescore-downloader/issues/5#issu... wow