2 ms·

Telemetry in open source exists for a long time. Debian has the popcon package that can be installed and reports weekly usage of the software packages. The tel

Telemetry in open source exists for a long time. Debian has the popcon package that can be installed and reports weekly usage of the software packages. The telemetry data are published in the open. The Debian popcon FAQ could be used as guideline for other telemetry needs. https://popcon.debian.org/ https://popcon.debian.org/

ptx 4y ago
It does sound quite similar. But in addition to the crucial difference of opt-in vs. opt-out there's also an interesting contrast in how it's framed. Debian talks about what you, the user, can do: help out, participate and vote. If you choose to do so. The Go team talks about what the developers and their software will do to the user's machine, but the user is completely passive in their description. This is also reflected in the term "telemetry" itself: the software is not a tool in the user's hands but rather a remote-controlled probe in the user's habitat that pokes at the user to elicit interesting responses.
agwa 4y ago
popcon should not be used as an example of how to do telemetry, as it is far worse for privacy than the Go proposal: 1. Sends names of private packages to the server, and publishes them. 2. Sends a unique identifier (a UUID stored in /etc/popularity-contest.conf) to the server, which is stored. 3. Doesn't use sampling, so if you use popcon you will be submitting a report once a week (Go's telemetry would average just one report a year). 4. Submits over plaintext protocols by default. popcon may be opt-in (in the sense that the prompt during installation has "No" selected by default) but the prompt doesn't disclose the large privacy risks. People are not appreciating the thought that has gone into the Go proposal to minimize the collection of private data, either intentionally or by accident, such as the client-enforced requirement that the the names of counters be published in a tamper-proof log so anyone can verify that, for example, no private package names are being disclosed. Everyone is focusing on opt-in vs out-out, but to me these other details are far more important.
msla 4y ago
> Debian has the popcon package that can be installed and reports weekly usage of the software packages. Right. That's fully opt-in, to the point the package isn't even installed by default, which is the only moral way to do this.

ptx 4y ago

It does sound quite similar. But in addition to the crucial difference of opt-in vs. opt-out there's also an interesting contrast in how it's framed. Debian talks about what you, the user, can do: help out, participate and vote. If you choose to do so. The Go team talks about what the developers and their software will do to the user's machine, but the user is completely passive in their description. This is also reflected in the term "telemetry" itself: the software is not a tool in the user's hands but rather a remote-controlled probe in the user's habitat that pokes at the user to elicit interesting responses.

agwa 4y ago

popcon should not be used as an example of how to do telemetry, as it is far worse for privacy than the Go proposal: 1. Sends names of private packages to the server, and publishes them. 2. Sends a unique identifier (a UUID stored in /etc/popularity-contest.conf) to the server, which is stored. 3. Doesn't use sampling, so if you use popcon you will be submitting a report once a week (Go's telemetry would average just one report a year). 4. Submits over plaintext protocols by default. popcon may be opt-in (in the sense that the prompt during installation has "No" selected by default) but the prompt doesn't disclose the large privacy risks. People are not appreciating the thought that has gone into the Go proposal to minimize the collection of private data, either intentionally or by accident, such as the client-enforced requirement that the the names of counters be published in a tamper-proof log so anyone can verify that, for example, no private package names are being disclosed. Everyone is focusing on opt-in vs out-out, but to me these other details are far more important.

msla 4y ago

> Debian has the popcon package that can be installed and reports weekly usage of the software packages. Right. That's fully opt-in, to the point the package isn't even installed by default, which is the only moral way to do this.