4 ms·

Why collect the data in the first place? When you aren't collecting IP addresses or CPU and OS details you don't need to worry about things like who is going to

Why collect the data in the first place? When you aren't collecting IP addresses or CPU and OS details you don't need to worry about things like who is going to be responsible for maintaining, securing, removing, or providing that data when law enforcement (or the state) comes knocking. Nobody using the software is asking for this data collection. Even with their "assurance" that data isn't kept for more than 24 hours, that's more than enough time for it to copied and shared with any number of parties and without independent audits we have no means to be certain the data is being cared for or removed as they claim. Just don't collect any more info that you absolutely need and users don't have to put their faith in you that it won't be abused, you don't have to deal with the headaches and if law enforcement should ever come around asking you can just say "Sorry, we don't collect that information" and you don't have waste time dealing with those requests either.

void_mint 5y ago
> Why collect the data in the first place? To sell, obviously.
- TedDoesntTalk 5y ago
  No, not really. It’s clarified here: https://github.com/audacity/audacity/discussions/1353 https://github.com/audacity/audacity/discussions/1353 They want to know when it’s safe to drop support for a particular operating system version.
  - pmontra 5y ago
    They don't need the IP address for that. Of course their routers will see the address but they don't have to store it. If they store it it's because they need it for some reason.
    - TedDoesntTalk 5y ago
      They’re not storing IP addresses. Read the post on GitHub.
      - danuker 5y ago
        > We have taken steps to ensure that we never store a full IP address (we now truncate it before hashing or discard it entirely) and have reflected this change in the privacy policy document Depending on how much they are truncating, it might still be easily de-anonymized.
  - void_mint 5y ago
    To be clear, your assertion is that companies and organizations that expand data collection only use data for their publicly-defined purpose?
  - autoexec 5y ago
    There are other ways to do that besides pulling the data off the host machine. For example, they could prompt users to choose their OS prior to downloading and track downloads. Give different (or even identical) copies of the installer version numbers depending on the OS that was selected so updates only have to see what version you have installed to know which OS is in use. Maybe add a prompt letting users whose OS doesn't match the version they're running know that if they have issues to download the version for their OS... Seems over-complicated (and it is because they could just decide to stop supporting an old OS on their own using any number of criteria), but still probably less work than collecting and securely storing IP addresses and computer details, trying to anonymize that data, controlling access to that data, making sure it's all deleted appropriately, having lawyers review court orders for the data they've collected, etc.

void_mint 5y ago

> Why collect the data in the first place? To sell, obviously.

TedDoesntTalk 5y ago
No, not really. It’s clarified here: https://github.com/audacity/audacity/discussions/1353 https://github.com/audacity/audacity/discussions/1353 They want to know when it’s safe to drop support for a particular operating system version.
- pmontra 5y ago
  They don't need the IP address for that. Of course their routers will see the address but they don't have to store it. If they store it it's because they need it for some reason.
  - TedDoesntTalk 5y ago
    They’re not storing IP addresses. Read the post on GitHub.
    - danuker 5y ago
      > We have taken steps to ensure that we never store a full IP address (we now truncate it before hashing or discard it entirely) and have reflected this change in the privacy policy document Depending on how much they are truncating, it might still be easily de-anonymized.
- void_mint 5y ago
  To be clear, your assertion is that companies and organizations that expand data collection only use data for their publicly-defined purpose?
- autoexec 5y ago
  There are other ways to do that besides pulling the data off the host machine. For example, they could prompt users to choose their OS prior to downloading and track downloads. Give different (or even identical) copies of the installer version numbers depending on the OS that was selected so updates only have to see what version you have installed to know which OS is in use. Maybe add a prompt letting users whose OS doesn't match the version they're running know that if they have issues to download the version for their OS... Seems over-complicated (and it is because they could just decide to stop supporting an old OS on their own using any number of criteria), but still probably less work than collecting and securely storing IP addresses and computer details, trying to anonymize that data, controlling access to that data, making sure it's all deleted appropriately, having lawyers review court orders for the data they've collected, etc.