3 ms·

… sure, and why not just publish the binaries on CD-ROM?

axguscbklp 5y ago
Would they still need to publish legalese if they made it so that updates and sending of error reports required the user to click a button every time, and under the button there was some text explaining exactly what data was going to be sent?
- ohgodplsno 5y ago
  Yes. Laws _require_ you to have a privacy notice. Just because your license says the software is provided AS IS does not mean it's enough. Noone is going to bother you if it's a small open source project by a bunch of maintainers, but as soon as you're a company, you have to.
  - TedDoesntTalk 5y ago
    For the USA, that's not always true: https://www.swlaw.com/blog/data-security/2015/03/12/why-you-need-a-privacy-policy-part-2-avoiding-three-common-fumbles/#:~:text=There%20is%20no%20general%20federal,that%20can%20lead%20to%20liability https://www.swlaw.com/blog/data-security/2015/03/12/why-you-.... But I know Audacity has a sizable European userbase, too.
selfhoster11 5y ago
Are you suggesting that Audacity is something that needs a lot of auto-updating? It's not like an OS. Updating it can wait.
- dkdbejwi383 5y ago
  A vast majority of users are non-technical. Manually checking for updates for software can seem like a trivial thing to someone who knows how to use a computer, but many folks don't know how to do these things, and would miss out on fixes and features if they aren't made aware of updates. Also, it's an optional feature. You can just turn it off if it's not a benefit to you.
  - jonathankoren 5y ago
    If these updates are compelling, people will know. Outside of security updates, there’s not often a reason update unless there’s a née feature you require. I swear it seems like there’s a whole generation that doesn’t understand that how to build software that isn’t always phoning home and requires a subscription fee.
    - TedDoesntTalk 5y ago
      Every major browser phones home for version updates. Do you have a problem with them, too?
      - robbedpeter 5y ago
        Yes. People should have control of and be responsible for their hardware and software. If people want to cede the responsibility and control, there's no problem with having that option, but it's a bad default.
      - selfhoster11 5y ago
        The browser almost exclusively executes untrusted input and mediates access to user data. Not keeping such a thing updated is irresponsible. An audio editor has an incomparably smaller network attack surface - perhaps even none, if it's sandboxed and makes no use of the network at all.
        PaulDavisThe1st 5y ago
        DAWs and audio editors have a very large (non-network) attack surface, in the form of plugins, which run in-process, with zero "protection" between them and the host [0]. A plugin can do anything the host app can or could do, including full access to user files, network access and more. [0] some plugin host apps do "sandbox" the plugins by running them in a separate process, but this is absolutely nothing like the sandboxing done by browsers. The separate processes run with all the priviledges of the host app process.
jonathankoren 5y ago
I know you’re being sarcastic, but seriously. What’s the problem? It’s an audio recorder.

Would they still need to publish legalese if they made it so that updates and sending of error reports required the user to click a button every time, and under the button there was some text explaining exactly what data was going to be sent?

ohgodplsno 5y ago
Yes. Laws _require_ you to have a privacy notice. Just because your license says the software is provided AS IS does not mean it's enough. Noone is going to bother you if it's a small open source project by a bunch of maintainers, but as soon as you're a company, you have to.
- TedDoesntTalk 5y ago
  For the USA, that's not always true: https://www.swlaw.com/blog/data-security/2015/03/12/why-you-need-a-privacy-policy-part-2-avoiding-three-common-fumbles/#:~:text=There%20is%20no%20general%20federal,that%20can%20lead%20to%20liability https://www.swlaw.com/blog/data-security/2015/03/12/why-you-.... But I know Audacity has a sizable European userbase, too.

selfhoster11 5y ago

Are you suggesting that Audacity is something that needs a lot of auto-updating? It's not like an OS. Updating it can wait.

dkdbejwi383 5y ago
A vast majority of users are non-technical. Manually checking for updates for software can seem like a trivial thing to someone who knows how to use a computer, but many folks don't know how to do these things, and would miss out on fixes and features if they aren't made aware of updates. Also, it's an optional feature. You can just turn it off if it's not a benefit to you.
- jonathankoren 5y ago
  If these updates are compelling, people will know. Outside of security updates, there’s not often a reason update unless there’s a née feature you require. I swear it seems like there’s a whole generation that doesn’t understand that how to build software that isn’t always phoning home and requires a subscription fee.
  - TedDoesntTalk 5y ago
    Every major browser phones home for version updates. Do you have a problem with them, too?
    - robbedpeter 5y ago
      Yes. People should have control of and be responsible for their hardware and software. If people want to cede the responsibility and control, there's no problem with having that option, but it's a bad default.
    - selfhoster11 5y ago
      The browser almost exclusively executes untrusted input and mediates access to user data. Not keeping such a thing updated is irresponsible. An audio editor has an incomparably smaller network attack surface - perhaps even none, if it's sandboxed and makes no use of the network at all.
      - PaulDavisThe1st 5y ago
        DAWs and audio editors have a very large (non-network) attack surface, in the form of plugins, which run in-process, with zero "protection" between them and the host [0]. A plugin can do anything the host app can or could do, including full access to user files, network access and more. [0] some plugin host apps do "sandbox" the plugins by running them in a separate process, but this is absolutely nothing like the sandboxing done by browsers. The separate processes run with all the priviledges of the host app process.

jonathankoren 5y ago

I know you’re being sarcastic, but seriously. What’s the problem? It’s an audio recorder.