3 ms·

My project is open source. That means I'm asking my users, explicitly or implicitly, to download the source code, download Go's tooling, and compile my code. Th

by mort96 4y ago

My project is open source. That means I'm asking my users, explicitly or implicitly, to download the source code, download Go's tooling, and compile my code. That exposes them to Google's telemetry.

verdverm 4y ago
If you are building a library, then you are likely targeting Go developers who have already made their decision. If you are building a binary you can publish those and no one has to compile them
- mort96 4y ago
  It's a CLI program with an associated library. That means anyone who wants to use it on a system I don't happen to publish binaries for, or who prefer to compile things from source rather than using pre-compiled binaries, or anyone who wants to use a commit I haven't published binaries for, or who uses a source package from their distro (Gentoo users, Arch users who use a source package from the AUR), anyone who wants to modify it to add a feature or fix a bug, all potential contributors, etc etc etc. would be exposed to Google's telemetry because of my decision to use Go. And then there's everyone who wants to make use of the library and chooses whatever language makes that easier. I've certainly used Python for some projects just because a certain library is most easily used from Python.
  - verdverm 4y ago
    Have you read their proposal and blog posts? A Go installation will send a report ~1 per year on average This is not Google telemetry or analytics, this is independent Go telemetry and is very different I suggest everyone read about Transparent Telemetry before overreacting. It's honestly quite reasonable and will benefit everyone
    - mort96 4y ago
      I'm not sure if you're aware, but the official Go tooling is developed and managed by Google; the decision makers and core developers are Google employees. Go is deeply died to Google. I'm not comfortable asking my users to send telemetry information to Google. The exact details aren't very important. People can make their own decisions about whether they're fine with it or not, but I'm not going to push people towards accepting it.
      - AeroNotix 4y ago
        Telemetry can be disabled trivially.
        mort96 4y ago
        I know it can be disabled. Whether an environment variable is "trivial" or not is certainly up for discussion. We're talking about, "never ever run the command on a system without the invonment variable set globally or in a context where the environment doesn't apply". (Did you know `sudo` strips most env vars? `sudo -u www-data go build` would send telemetry even if you added the env var to your profile) It's trivial to disable telemetry for any given invocation, but making sure that no invocation at all, across decades, is far from trivial.
        TeMPOraL 4y ago
        There was a Nobel Prize in Economics awarded specifically for recognizing that things "disabled trivially" generally won't be, and this is a fully generic method of denying people their agency. See [0]. Opt-out, in most cases, is malicious, and you only think about introducing it when you're trying to make a change that leaves your users worse off. -- [0] - https://en.wikipedia.org/wiki/Richard_Thaler#Nobel_Prize https://en.wikipedia.org/wiki/Richard_Thaler#Nobel_Prize
        kaba0 4y ago
        That’s true, but there is another side to this same coin — people won’t do the right thing if it’s opt-in. Organ donation’s percentages are the two ends of the spectrum simply depending on opt-in/out. I’m of course not comparing telemetry to organ donation, but I do feel that the problem is often overblown and is not that big of a deal. There is not much evil in trying to find out how many people used your toolings and from which OS approximately. (I dislike the Go language as much as it gets, so I am as unbiased as it gets)

by mort96 4y ago

My project is open source. That means I'm asking my users, explicitly or implicitly, to download the source code, download Go's tooling, and compile my code. That exposes them to Google's telemetry.

verdverm 4y ago

If you are building a library, then you are likely targeting Go developers who have already made their decision. If you are building a binary you can publish those and no one has to compile them

mort96 4y ago
It's a CLI program with an associated library. That means anyone who wants to use it on a system I don't happen to publish binaries for, or who prefer to compile things from source rather than using pre-compiled binaries, or anyone who wants to use a commit I haven't published binaries for, or who uses a source package from their distro (Gentoo users, Arch users who use a source package from the AUR), anyone who wants to modify it to add a feature or fix a bug, all potential contributors, etc etc etc. would be exposed to Google's telemetry because of my decision to use Go. And then there's everyone who wants to make use of the library and chooses whatever language makes that easier. I've certainly used Python for some projects just because a certain library is most easily used from Python.
- verdverm 4y ago
  Have you read their proposal and blog posts? A Go installation will send a report ~1 per year on average This is not Google telemetry or analytics, this is independent Go telemetry and is very different I suggest everyone read about Transparent Telemetry before overreacting. It's honestly quite reasonable and will benefit everyone
  - mort96 4y ago
    I'm not sure if you're aware, but the official Go tooling is developed and managed by Google; the decision makers and core developers are Google employees. Go is deeply died to Google. I'm not comfortable asking my users to send telemetry information to Google. The exact details aren't very important. People can make their own decisions about whether they're fine with it or not, but I'm not going to push people towards accepting it.
    - AeroNotix 4y ago
      Telemetry can be disabled trivially.
      - mort96 4y ago
        I know it can be disabled. Whether an environment variable is "trivial" or not is certainly up for discussion. We're talking about, "never ever run the command on a system without the invonment variable set globally or in a context where the environment doesn't apply". (Did you know `sudo` strips most env vars? `sudo -u www-data go build` would send telemetry even if you added the env var to your profile) It's trivial to disable telemetry for any given invocation, but making sure that no invocation at all, across decades, is far from trivial.
      - TeMPOraL 4y ago
        There was a Nobel Prize in Economics awarded specifically for recognizing that things "disabled trivially" generally won't be, and this is a fully generic method of denying people their agency. See [0]. Opt-out, in most cases, is malicious, and you only think about introducing it when you're trying to make a change that leaves your users worse off. -- [0] - https://en.wikipedia.org/wiki/Richard_Thaler#Nobel_Prize https://en.wikipedia.org/wiki/Richard_Thaler#Nobel_Prize
        kaba0 4y ago
        That’s true, but there is another side to this same coin — people won’t do the right thing if it’s opt-in. Organ donation’s percentages are the two ends of the spectrum simply depending on opt-in/out. I’m of course not comparing telemetry to organ donation, but I do feel that the problem is often overblown and is not that big of a deal. There is not much evil in trying to find out how many people used your toolings and from which OS approximately. (I dislike the Go language as much as it gets, so I am as unbiased as it gets)