11 ms·

Go claims telemetry objectors arguing in bad faith and violating Code of Conduct

200 points by pabs3 4y ago

NeveHanter 4y ago
Any source for this other than this unknown/random (for me) Twitter handle? GitHub issue link or some forum/board with context/discussion on this topic?
- 4ad 4y ago
  https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409 https://news.ycombinator.com/item?id=34707583 https://news.ycombinator.com/item?id=34707583 https://news.ycombinator.com/item?id=34750782 https://news.ycombinator.com/item?id=34750782
- ergonaught 4y ago
  Discussion was here: https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409 I think this assertion and the various sentiment around it is nonsensical and partly demonstrates why "they" were actively moderating as they attempted to have a rational discussion about a topic with human beings online. Some of the moderator decisions were stupid; many were not ("You can stick your telemetry where the sun doesn't shine" is no doubt sincere but it's not LKML I suppose); much of it seems to have been attempting to keep stuff organized and not-repetitive.
- probably_wrong 4y ago
  This article from The Register [1] has a good general overview, and it leads you to the GitHub discussion [2]. Searching for "bad faith" and "conduct" in that thread yields some results, but not strong enough for me to agree with the poster. There are hidden comments too, but not enough nor eloquent enough (IMHO) to support the claims of bad faith. [1] https://www.theregister.com/2023/02/10/googles_go_programming_language_telemetry_debate/ https://www.theregister.com/2023/02/10/googles_go_programmin... [2] https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409
foldr 4y ago
[flagged]
- weberer 4y ago
  I don't get it. Do you have a something against British people?
  - foldr 4y ago
    They’re not all men. I am British myself, FWIW.
    - baobabKoodaa 4y ago
      Can you point to an example where a non-lad is utilizing the CoC to suppress opposition in this issue?
      - foldr 4y ago
        In the tweet, ‘lads’ refers to ‘the Go maintainers’ referenced in the first paragraph.
        baobabKoodaa 4y ago
        No, it doesn't. It refers to the subset of Go maintainers who are (allegedly) using the CoC to suppress opposition. I ask again: which specific Go-maintainers have both suppressed opposition with CoC and also are non-lads?
        foldr 4y ago
        Anyone can read the tweet and decide for themselves. To me the intended reference is clear. The “Go maintainers” are accused of doing various things in the first paragraph and are then referred to in the second paragraph as ‘lads’; no salient subset is introduced as a potential discourse referent. In any case, my comment was obviously based on my own understanding of what was said. > the Go maintainers are now claiming that objectors to Google's opt-out telemetry proposal on the Go compiler - yes, really - are arguing in bad faith and violating the Code of Conduct, and their comments are getting hidden. > well done lads, you just keep doing that as hard as possible. i'm sure it'll work out great.
typical182 4y ago
Some additional context in this comment: https://news.ycombinator.com/item?id=34754632 https://news.ycombinator.com/item?id=34754632
arp242 4y ago
Quite a number of people were argueing in bad faith and I left the discussion because of that. The insinuation that all comments opposing the telemetry are hidden is bullshit, as a simple check will confirm: https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409
- ocdtrekkie 4y ago
  Yeah fwiw I am strongly opposed to the proposal, and Russ Cox acknowledged that they considered many of the posts against telemetry or for opt in only as valid discussion, and gave examples of some of the inappropriate comments they referred to as being in "bad faith". I appreciated his clarity there in answering about what he considered bad faith posts. There were definitely comments that got quite heated and probably fell outside good discourse practices, largely because people are very passionate about privacy and also tend to get very upset when they feel betrayed.
  - lqrtr 4y ago
    If a ruling class or inner circle has already decided on a course of action, you rarely change anything with good discourse practices. CoCs are always protecting the inner circle and their opinions. In the early days of open source, flame wars were considered a legitimate way for voicing opinions. Now, in corporate controlled "open" source, the dominance hierarchy must be protected.
    - gtirloni 4y ago
      > If a ruling class or inner circle has already decided on a course of action, you rarely change anything with good discourse practices. Quite true. Especially in the worksplace where RFC/design meetings are only done to validate what has already been decided. > CoCs are always protecting the inner circle and their opinions CoC are 99% not doing that. Of course people can abuse it but I don't see it in practice most of the time. It's just that the abuse/drama gets more attention. > In the early days of open source, flame wars were considered a legitimate way for voicing opinions Flame wars have always been discouraged. As soon as one starts, mods usually step in and shut it down. > Now, in corporate controlled "open" source, the dominance hierarchy must be protected. Yes, very few corporate-backed open source projects are truly open to collaboration, especially when it changes the feature set. If you want to submit bug reports, help users or a PR for a tiny bug, that's all good. In their defense, the employees of those companies do the most work so they get to decide. But they do benefit enormously from having the code open (something they very often forget).
sophacles 4y ago
So, is it time to fork the go codebase and have a telemetry-free version? I understand that there are uses for such data to help make the tooling better. I don't understand how Google and its cult can be so disingenuously surprised that people are wary of it in 2023. This makes me trust them even less than normal - i suspect they'll follow the MS playbook and "accidentally" make the opt-out fail and eventually the idea of opt-out will be completely removed from the product because "everyone seems to be happy with it... No one turns it off anyway".
- rocqua 4y ago
  The idea would include an opt-out. It would probably be easier to use the opt-out rather than maintaining a fork.
  - jonhohle 4y ago
    But the feature should be opt-in to begin with. Opt-out is an anti/dark-pattern that should rightfully be derided.
    - alkonaut 4y ago
      Opt-in greatly reduces the statistical quality of the data. That said, there are many forms of Opt-out. It's one thing to show a checkbox in the setup of a desktop applicatoin saying "send anonymous usage data" and have the checkbox pre-checked. That's a form of opt out, but it's not hidden. It's quite different to have a system enabled which is only possible to switch off by googling a solution or digging in a settings menu. That's also opt-out, but it's a much darker pattern than the pre-checked checkbox. Obviously, a command line tool doesn't have the luxury of an interactive setup, so the same patterns don't apply, but whether or not something is "opt out" or "opt in" isn't the entire story. I find the "default" to be the important thing. Developers need "the default" to be enabled to get reasonable coverage. That doesn't mean it needs to be "secretly" enabled.
      - throwntoday 4y ago
hulitu 4y ago
> How do software developers understand which parts of their software are being used and whether they are performing as expected? By asking nicely. Not by siphoning data out of my system. Where is this world going ? Do i really have to treat every program as spyware and restrict its internet access ? And anyway, why would a compiler need internet access ?
- fancl20 4y ago
  Asking nicely doesn't work in pratice because people willing to answer the question is not a randomly sampled group of people and usually highly biased. You can check how polling works and why it doesn't work. The problem is always how to randomly sample people and AFAIK there is no good way except randomly sample people (a.k.a telemetry). You can argue that developers shouldn't care that much about their software are being used and whether they are performing as expected, but asking nicely really is not a solution. APPENDED: PLEASE NOTE I'm saying asking nicely is not a solution to get correct data from statistical standpoint. You can argure the data accuracy is not important in this context.
  - ballenf 4y ago
    Isn't it contradictory to "care" about how privacy objectors use Go, while denigrating those people by suppressing their voices?
  - hobom 4y ago
    While true in general, it is really not that necessary to have a representative sample for checking whether your software works. With large enough sample size a convenience sample will find almost all of the bugs that telemetry would have found.
  - hn92726819 4y ago
    > Asking nicely doesn't work in pratice LLVM, GCC, rust, zig, D, etc don't have telementry and they seem to be doing fine. What makes go special? They aren't trying to be more efficient than rust. It isn't more widely used than GCC. I would argue they don't need this telemetry at all.
_aaed 4y ago
This is really rustling my jimmies, do we jump ship?
- WesolyKubeczek 4y ago
  I, for one, would welcome a GCC Go frontend.
  - vips7L 4y ago
    That already exists.
r0ckysharma 4y ago
It's time to move to Rust or Nim or Crystal? telemetry is definitely not a solution half of the industry would be happy about. It's polite way of saying - I want to know what you are doing!
- gtirloni 4y ago
  On one hand, you have to disable it yourself through a configuration option. On the other, you have to possibly learn a new language, tools, libraries, etc, new community, new release cadence, different feature set, etc. Tough choice.
  - badcppdev 4y ago
    Though tough, through thorough thought; a choice
    - gtirloni 4y ago
      Thanks, I've fixed it. English is not my first language.
BaculumMeumEst 4y ago
The telemetry they’re going to add is going to help the go team improve the language and it’s ecosystem. It’s going to be utterly inconsequential for everyone who leaves it enabled. People who are raging about the change are not crusaders for privacy and freedom, they’re petulant children who “don’t like the idea of it” and are throwing tantrums. If it’s that important, there are plenty of languages that put idealism over pragmatism to choose from.
- philprx 4y ago
  Well the problem is the privacy bait and switch isn't it? When you install a compiler who's respecting your privacy, and without opt in it starts sending telemetry, you can't expect that to go well. Now naming people like this isn't going to help either I think.
  - growse 4y ago
    > When you install a compiler who's respecting your privacy, and without opt in it starts sending telemetry, you can't expect that to go well. Are the currently deployed and used versions of the go compiler going to suddenly start sending telemetry? Or is it just a future version that someone would have to deliberately upgrade to? Personally, when a new version of golang comes out, I like to read the release notes and then adjust my build environments with the necessary environment changes for the new features.
    - nishs 4y ago
      reading release notes for upgrades is the only correct way. regardless i think we should hold open source projects to higher standards, such that telemetry isn’t introduced by default.
  - alkonaut 4y ago
    > Well the problem is the privacy bait and switch isn't it? What is the privacy bait and switch? The whole idea behind "anonymous usage statistics" is that it's statistical and anonymous, so that it by definition has no privacy consequences. If that doesn't hold up (e.g. it leaks a username, a path, anything) then there should be outrage. But this discussion isn't about that. Or about the fact that it could be worse, or have a bug. The interesting question is: is it acceptable to have telemetry that is anonymous and statistical? And if not - why? The argument "it doesn't respect my privacy" can't apply then.
aejnsn 4y ago
They’ve digressed to arguing about CC and CoC. Yikes. Stupid proposal. If I wanted telemetry, I’d implement with a trusted party, whose service I am paying to use.
incone123 4y ago
I think lads is only gender neutral in some groups and as a more recent usage. In the UK we used to have 'lads mags' which were magazines aimed at a young and specifically male audience.
thejosh 4y ago
It started with the absolute astonishing amount of data that VS Code sends back to Microsoft, now it's pretty standard. If you really want to see what your devices send back, monitor DNS on your devices. I installed a bunch of apps on a spare phone (that had no sim card) and was VERY surprised how much background data and requests Tiktok used.
- jeroenhd 4y ago
  DNS isn't enough, applications have been sneaking off data to hard-coded IPs and through other means for at least 15 years now. These days we have DoH as a standard, but way before that I spotted a Windows application execute HTTP requests to resolve IP addresses for their tracking domain. With some effort you can MitM your phone with your own certificate authority and a tool like mitmproxy in transparent mode. It still won't detect all of the trackers (detecting MitM is quite easy with certificate pinning), but it'll show you even clearer how much you're being tracked. Expect every API to also be a tracking endpoint, and expect every application you use to upload your location. There are apps that do well, but they've become the exception rather than the rule.
John23832 4y ago
The Go Team's vehemence to not just have this telemetry as off by default rubs me the wrong way. Sure, that means less people will turn it on... but that's the point. Running telemetry on your machine should not be a requirement for A COMPILER.
- thiht 4y ago
  It could even just be a prompt at first use, if an environment variable (eg. GO_DISABLE_TELEMETRY=1) is not detected. Example: Do you want to enable anonymous telemetry? yes [no] Your choice will be remembered and we won't ask you again. See our engagements and details on what we collect here: https://go.dev/telemetry
  - lawtalkinghuman 4y ago
    That'd likely break a lot of CI workloads.
    - webstrand 4y ago
      Easy enough to check for the presence of a TTY and only prompt then. CI wouldn't have a TTY and thus wouldn't prompt.
      - danpalmer 4y ago
        "Falsehoods programmers believe about CI" I mean, I completely agree with you in principle, but also there are a lot of terrible CI systems out there.
        thiht 4y ago
        Ok, then let’s admit it breaks your CI. So what? You fix it by setting an environment variable and you’re good to go after 2 minutes.
        4y ago
lbayes 4y ago
Leaving the (probably incorrect?) claim of suppression in the title aside for a moment, I just want to express my deep sadness about this decision. I'm an ex-Googler who has admired Golang for many years and have been considering it for use in my hardware startup. The fact that opt-out-only telemetry was even considered, much less appears to be already decided(?), makes me far less likely to use this tool chain at any time in the future.
- arp242 4y ago
  No decision has been made; there's just a proposal and discussion at this time.
  - JetSetIlly 4y ago
    Thank-you. This is important point. It's not even an official proposal yet. And even if it becomes a proposal there's no reason to think it'll actually happen. The speed at which this topic has escalated since the idea was raised last week is astonishing. The biggest mistake Cox has made is assuming people would at least read the three blog posts and debate the topic as presented. I'm not thrilled at the idea of opt-out telemetry but some of the rhetoric is well and truly beyond the pale.
    - arp242 4y ago
      > The biggest mistake Cox has made is assuming people would at least read the three blog posts and debate the topic as presented. Yes, I agree he was perhaps a bit naïve about this. On the other hand: I also don't really know how to do this type of discussion better. Russ obviously went out of his way to come up with a nuanced solution, which one could reasonably disagree with, but I have the impression many people didn't bother reading it, especially on HN here but also in the Go discussion about it. This thread is full of basic misunderstandings, or, if we want to be less generous about it, misinformation. I don't think most people do it on purpose, it is what it comes down to in the end. One of the really great things about internet discussions is that anyone can join in. One of the bad things about internet discussions is that anyone can join in.
wg0 4y ago
May be irrelevant here but I stumbled across a new programming langauge called V [1] that is heavily inspired by Go and does not rely on LLVM rather directly generates C. Operating system is already a spyware and next arms race is for everyone to arm their compilers. Good going, product managers. [1] https://vlang.io/ https://vlang.io/
- TwentyPosts 4y ago
  As far as I heard the V programming language is largely considered to be Vaporware (see eg. https://xeiaso.net/blog/vlang-update-2020-06-17 https://xeiaso.net/blog/vlang-update-2020-06-17, and other articles by Xe). I agree that I (in theory) quite like some of the design decisions, but as far as I know nothing of this actually works in practice. Like, it's not even close to being production ready, and people are seriously doubting whether the language will ever even come close to being a viable option. I'm not up to date on all of the issues (in the code or in the community), but the last thing I heard is that the developers of V are still working on the "auto-free" memory management model (which is supposed to infer when 'free' needs to be called), but it's not working (and afaik proven to be undecidable in general). Edit: Another reason why I'd be rather skeptical of this language is the claims it makes on the 'Compare' page: https://vlang.io/compare https://vlang.io/compare It starts off stating that "V was created because none of the existing languages had all of the following features:" and then goes and lists an incredibly ambitious list of features, which essentially amount to "As safe as Rust, but Go's simplicity and fast-compilation time, and a small compiler with zero dependencies", and more. These are hard problems, especially if you're also working on developing an experimental memory management technique.
  - wg0 4y ago
    Thanks for your insightful update. I'm not sure what are the intentions here of the language creator(s) but what I liked was the simplicity of it. They themselves don't claim it to be production ready and I don't think it is going to be anytime soon. EDIT: Typo.
bob1029 4y ago
Where could I find documentation regarding the actual information Go telemetry might contain? I really like to see the actual thing with own eyes rather than develop an understanding via layers of drama. For example, Microsoft maintains a document that covers all of the data points contained in their .NET SDK telemetry: https://learn.microsoft.com/en-us/dotnet/core/tools/telemetry https://learn.microsoft.com/en-us/dotnet/core/tools/telemetr...
- thiht 4y ago
  > Where could I find documentation regarding the actual information Go telemetry might contain? There's no telemetry for now, it's a proposal: https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409
fnord77 4y ago
another reason not to use golang (other than it is not that good of a language)
throwanem 4y ago
Especially with so much interest and momentum seeming to have shifted to Rust of late, I wonder whether Golang support is on or near Google's famously bloody chopping block, and adding analytics would help support a "data-driven" case for keeping it funded.
- thiht 4y ago
  I don't understand why people insist on comparing Go and Rust, when they clearly don't compete against each other. Rust competes with C++, Go competes with Java. The only thing they have in common is being relatively modern and recent languages, but they just don't share the same goals and don't have the same promises.
  - throwanem 4y ago
    Okay, but in my circles at least - primarily professional fullstack and mobile dev, plus a wide range of hobbyists and aspiring pros - they've competed for the same mindshare for about as long as they both have existed, and Go seems to have lost out pretty decisively. The most recent SO developer survey seems to bear that out. I don't know what goals Google, as opposed to the Golang team, has for Go. I do know Google has notoriously opaque and complex internal politics, and a long history of summarily axing projects that fail to perform over some set of internal metrics, no matter how large and invested a userbase they happen to have. So I don't think it is unreasonable to consider the question. Sure, the technologies aren't fungible, but it isn't a technological question I'm asking; every longstanding human enterprise necessarily involves politics, and it's the politics I'm wondering about here.
    - thiht 4y ago
      > they've competed for the same mindshare for about as long as they both have existed, and Go seems to have lost out pretty decisively I have no idea what you're talking about. I agree for the mindshare, because I started with Go and thought Rust looked more elegant, but after actually trying it it became pretty clear that they don't compete. I don't know where you're getting that Go somehow "lost", it sounds like bubble reasoning. Again, it didn't "lost" because they don't compete with each other. It's like saying Nadal lost against Messi because Messi is more popular when they're not playing the same sport, it doesn't make sense.
remote_phone 4y ago
How did it go from Go telemetry to trans and intersex rights? I stopped reading there because that sounded like a troll.
pabs3 4y ago
I expect that distros like Debian will be compiling Golang with the telemetry either off by default or removed from the binaries.
- deafpolygon 4y ago
  What distros like Debian should start doing is packaging without Go binaries at all. This is not going to get any better with Google at the helm. Once allow Go in Debian, then what? More packages with telemetry turned on becoming the "norm" and accepted? No.
  - pabs3 4y ago
    While I sympathise with this sentiment, it isn't really feasible, since there are too many useful programs written in Go. Since Go is Free Software, both users and distros like Debian can take advantage of that and just patch out the telemetry or disable it by default. Same goes for any new telemetry that is discovered. That is a better way forward here, since we get the programs implemented in Go but none of the telemetry.
    - deafpolygon 4y ago
      Well, then feel free to welcome your new corporate overlords. There are better ethical free and open software.
jeroenhd 4y ago
As always, these discussions get brigaded by trolls so it's no wonder lots of comments were hidden. However, several hidden comments were, as far as I could tell, made with good intent. That does create an impression that certain opinions are not welcome. The argument for hiding these comments seems to be that they've already been used in other discussions (i.e. "opt-out is illegal under GDPR" being used in a discussion about opt-in/opt-out design despite not being mentioned in that thread before). When I read the comments by the Go people, it looks like the implementation of opt-out telemetry has already been decided on. Objections like "have you checked if that's even legal" are ignored with a simple "I'm not a lawyer". As rsc puts it, "This is a technical discussion, not a negotiation.". The discussion is clearly set up wrong and I doubt it will matter in the end, now. The Github discussion is focused on technical implementation, with the moral discussion already having been decided upon; that way, people with arguments against telemetry have no place to voice their concerns. Maybe the moderators simply couldn't imagine being anti-telemetry or maybe they don't consider the position relevant, but this approach was going to stress out the moderators and cause unproductive discussion from the very start. Personally, I'm somewhat disappointed (but not surprised in the least) that this is being suggested, but I suppose this is what one should expect when running any kind of program from Google (or Microsoft, for that matter). You simply can't trust these companies and the open source developers that work for them to respect your privacy. I have to say, though, the proposal doesn't seem to take the risk of bad data injection seriously. I myself would definitely run the theoretical AdNauseam style fork of Go if the team behind the tool choose to go through with an opt-out mechanism.
deleted 4y ago
[deleted]
Clent 4y ago
Silly. If this was Apple instead of Google. These comments would not be so reasonable. Apple does this same thing with an opt-in. Google is evil. Stop supporting evil.
- jensensbutton 4y ago
  Apple also collects telemetry by default. Stop pretending this is just Google.
tom-thistime 4y ago
The answer here is not to micro-examine how badly Google needs telemetry or doesn't need telemetry. The answer is No. No telemetry to be used on people who don't want it.
cube2222 4y ago
I mean, some folks in the thread were absolutely arguing in bad faith. A lot of people just go ahead with the "telemetry=bad" message + critique of telemetry in general without even taking a look at the actual proposal[0] (which has some important points regarding collection frequency, data shared, and architecture). Not saying there should be no critique, but blanket statements that often criticize aspects that are irrelevant here don't help. They're really trying to approach this in a way that, to me, is as reasonable and transparent as effectively possible (yes, I'm on the side of "opt-in telemetry doesn't work because of the majority of people who don't care either way; won't turn off if prompted, won't turn on either", so being opt-in is in fact unreasonable to me). The Go toolchain already in a sense "calls home" by default to the Go module proxy hosted by Google. Anyway, it's open source, they're the maintainers, it's up to them, while if you want, you can fork it. Telemetry is immensely useful to understand what features or technical improvements are worth prioritizing to benefit the actual average user the most, and not just the vocal minority. Telemetry being opt-in breaks this by once again prioritizing the vocal minority that turns it on. [0]: https://research.swtch.com/telemetry-intro https://research.swtch.com/telemetry-intro
- ocdtrekkie 4y ago
  The problem with opt-out telemetry is that as soon as you admit people won't voluntarily turn it on, you've admitted it's a user hostile behavior. The usability of opt-out doesn't override the reality that it's not ethical to do it. I think if the Go authors do move forward with this proposal in any form, a fork is guaranteed. I've heard multiple sources express interest in doing so already.
  - cube2222 4y ago
    > The problem with opt-out telemetry is that as soon as you admit people won't voluntarily turn it on, you've admitted it's a user hostile behavior. That is in fact not the case. This is just one possible explanation for users not turning it on, one that I don't believe is even close to a meaningful amount in the grand scale of things. As I wrote in the first message, a huge amount of people don't care either way. They won't turn it off if they're prompted, but they also wouldn't bother turning it on. They just don't care. I'm one of these people.
room271 4y ago
I don't understand the almost religious opposition to the telemetry the Go team are proposing. It involves no PII data, would be easy to disable for those who want to do so, is minimal in scope, and the use cases are well articulated.
- deleted 4y ago
  [deleted]
- daneel_w 4y ago
  It doesn't have to involve PII data to be invasive. The heuristics applicable can be used to, in a roundabout way, fingerprint the type of software. And since it's being shipped to Google through the Internet they also know where the software is being developed and where it's being used. And this is just for starters. Once they've tackled the hurdles of people's resistance; having one foot through the door; it's easier to slide more and more telemetry functionality in. You may recognize this behavioral pattern from, uh, well, almost all of their other products.
- vorpalhex 4y ago
  It only takes them screwing up once for them to send my PII data. "Oops, we accidentally included ~.ssh"
  - titaniczero 4y ago
    Objectively speaking, how valuable would that information be if it were to be leaked? Random weekly aggregated and sampled machine data associated to random IPs that in most cases would no longer be yours (and that’s in the worst case that both servers were compromised or misused by an employee during a specific time window, because IP is not stored in the analytics server but temporally in a proxy to prevent abuse). I don’t know, I’m all for privacy but people get passionate too easily the moment someone even mentions the word telemetry and I think we should focus on actual privacy issues, like analytics in the context of ads, social networks (tiktok, fb, ig…), etc.
- jeroenhd 4y ago
  Data collection always starts out like that. An independent company may get away with that approach. However, this is Google. The problem is, we've seen it all before. When Microsoft added telemetry to dotnet, they stated the following: > The feature collects the following pieces of data: > > The command being used (e.g. “build”, “restore”) > The ExitCode of the command > For test projects, the test runner being used > The timestamp of invocation > The framework used > Whether runtime IDs are present in the “runtimes” node > The CLI version being used > > The feature will not collect any personal data, such as usernames or emails. It will not scan your code and not extract any project-level data that can be considered sensitive, such as name, repo or author (if you set those in your project.json). We want to know how the tools are used, not what you are using the tools to build. If you find sensitive data being collected, that’s a bug. Please file an issue and it will be fixed. All very useful information that doesn't tell them anything about you or your machine. Since then, Microsoft has been steadily increasing the amount of data it's been collecting, including personal identifiable information in the form of a pseudonym based on unique machine identifiers. Once data collection starts, it only ever gets worse.
justinzollars 4y ago
And they are mastodon so no one on earth can see this.
ghusto 4y ago
I see a lot of pro-opt-in arguments along the lines of "it needs to be opt-in by default, because the people we'd like to know from won't bother opting in, but wouldn't care either way". Whilst I wouldn't argument that's an inaccurate description of the people you want data from, counter point: tough? We're used to these liberties being taken in IT, so let's imagine a less technical scenario. You buy some lightbulbs from ShopX, and they'd really like to know your lightbulb usage habits in order to improve the efficiency of their lightbulbs (and nothing else, honest guv! but okay, let's give them the benefit of the doubt). They could send you a questionnaire, and as rightly pointed out in these arguments, it's unlikely you'd bother with it. Or they could ... what? Anything that involves them getting that information is a slippery slope at best, and a bit creepy already. This is the only industry where we've normalised this kind of liberty taking.
- acdha 4y ago
  > This is the only industry where we've normalised this kind of liberty taking. Or the only one where you're personally aware of it. The kind of low-frequency limited data the Go team proposed collecting is basically the same as, say, McDonald's telling store managers to report how many people ordered mayonnaise on their sandwiches so they can decide whether to continue stocking it. It's worlds better than the kind of individual patron tracking large retailers or credit card companies routinely do, but they don't advertise that. There are two differences here: one is where data collection happens — since this is running locally rather than in the cloud we know it's happening — and the other is the larger question of Google's corporate reputation is affecting reactions. A lot of the takes on social media have been reacting to that larger issue, many by people who don't even use Go, and are alleging scenarios far beyond what would be possible with the proposed system. I think some of this also goes back to the risk of being open: I would bet that more than a few of the people who are very concerned about Go lang use tools like VSCode which collect far more data but not having the big public proposal didn't mean everyone was talking about it at the same time.
  - ghusto 4y ago
    Ay but come on, likening it to stock keeping is a bit disingenious. A company's perfectly entitled to keep track of their stock, and they don't need anything from me to do it. The credit card companies are more like it but I opt out of that game too, by not using them. Their practices are well known to me.
deleted 4y ago
[deleted]
bitwize 4y ago
From now on any anti-telemetry comments will be replaced with "farts farts farts". Seriously, though, I think this kerfuffle pretty much cements Rust as the go-to native-compiled network infrastructure language for future projects.
gregors 4y ago
Google getting their playbook from the VScode and .NET teams I see. https://code.visualstudio.com/docs/getstarted/telemetry https://code.visualstudio.com/docs/getstarted/telemetry https://stackoverflow.com/questions/64570113/how-do-i-stop-net-telemetry-to-stop-collecting-data-in-ubuntu-linux https://stackoverflow.com/questions/64570113/how-do-i-stop-n... I think it's pretty obvious that opt out telemetry rubs most people the wrong way.
- acdha 4y ago
  > I think it's pretty obvious that opt out telemetry rubs most people the wrong way. This is basically re-stating the opt-in challenge: we know that some people are vocally upset by it but we have to guess at the relative percentages of the groups of people who know and do not mind, don't know but would be upset, or don't know and wouldn't mind if they did. People who are upset are far more motivated to comment about it, so anyone looking at social media is going to see a lot of messages from them but still not know what percentage of the total community feels similarly. I've even seen people who aren't primarily in the Go community but very active on privacy issues commenting on this, which is perfectly legitimate but also not representative of the median Go developer.
  - account42 4y ago
    This exact percentages are irrelevant. Once you know that there are any people who do not want you to collect their data the only ethical thing to do is to obtain informed consent before collecting that data.
    - acdha 4y ago
      The percentages clearly do matter because otherwise people wouldn't be trying to pad their arguments by claiming large numbers support their position. It's also important to remember that "data" covers a range of sensitivities, and vague assertions don't help the conversation. For example, the proposed system records less identifying information than visiting Golang.org but relatively few people would say it's unethical for that site not to have a mandatory opt-in requirement before loading a page - most of the interest tends to be in things like disclosure and retention policies.
zajio1am 4y ago
Next step: Just compile our telemetry also to the generated code, we obviously need to know its real performance characteristics. /s
wprl 4y ago
I had been about to devote some time to learning Go, but definitely won’t be after these latest developments.
1bent 4y ago
I wouldn't have thought of this before this issue came up, but I just searched for "software written in go", and sadly, there seems to be a lot of it. I wonder if all the folks outside of Google will remember to turn this off. If your motto is "ok, don't be evil didn't pay well", this is a genius move. Craft a language good enough to appeal to others, give it away, let a community grow, then hoover up data from everyone using anything written in our language. Unless, of course, they remember to opt out.
- deleted 4y ago
  [deleted]
linuxftw 4y ago
Other projects I have seen have done opt-out telemetry on the beta/testing/development versions of their software, and it's disabled on stable builds. Win-win.
nishs 4y ago
As one of the commenters in the original GitHub discussion pointed out, the package managers of most open source operating systems ultimately will/should package Go with telemetry turned off by default, regardless of the Go project’s default behavior. Good luck getting non-operating system biased data after that. Collecting non-operating system biased data seemed to be one of the stated goals to making the telemetry turned on by default. Otherwise it was posited that Go users on open source operating systems would disproportionately choose to keep telemetry off when prompted in an opt-in model.
deleted 4y ago
[deleted]
jefftk 4y ago
The link goes to a Mastodon thread that doesn't give any context. Where can I see the Go maintainers making this claim?
WhyNotHugo 4y ago
General public: We think you should ask for consent before gathering data on user's device and sending it to Google. Google/Golang devs: You're objecting in bad faith and violating our Code of Conduct.
remram 4y ago
I look forward to the tool uploading random garbage telemetry to their collection endpoint (or dependency doing it every build). Not endorsing it but it's the logical next step if you try to do this in an open tool to a programming community. They have to be more careful than Google is used to be with their other products.
LarryMullins 4y ago
This is the purpose of "Code of Conducts", to silence dissent. They are sold to you by people who say they'll only silence the bad sort of dissent, but lo and behold the definition of 'bad' isn't locked to the seemingly reasonable scenarios with which CoCs are promoted. Try to oppose the CoC now that you see what it's really for, and the CoC will be used to silence you as well.
parasense 4y ago
WTF did I just read? The first remark to start everything was sensational, and I'd love more specific citation to learn more about the claimed allegations. Then, seemingly out of nowhere, one individual went on a major rant about "intersex" or something like that, and something-something Ada Initiative... What I want is a technical discussion about "Google's opt-out telemetry proposal on the Go compiler", which raises some alarm... the word "opt-out" seems to suggest Google would require people to unsubscribe from their intelligence gathering? Seems sensational at face value. But is that even true? And what, if anything does gender-identity drama have to do with anything about that?
scrubs 4y ago
How come https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409 Blabs on about the bureaucratic/ policy ends of collecting data from me and NOT what they want to impact? Geez not even one example of where a little data could've helped golang compiler progs and users? My immediate reaction? Def negative
vivegi 4y ago
If I want to understand my program and where it spends time, I use a profiler. If Go maintainers want telemetry, they should provide an optional profiler that adds telemetry and whoever wants to opt in can use it after twiddling the appropriate knobs. Just claiming violation of CoC and forcing it on the entire userbase is atrocious. If I have not made my code open source, stop snooping. If you want to know how your features are used, go and analyze open source codebases. And it must be default turned off. Don't use dark patterns like default telemetry on and hoping that x% of users will forget to turn it off in a week and we will get our data. Smells bad.
- bayindirh 4y ago
  To be honest, I'm pretty against telemetry in Go, but it's not about the compiled code itself. They want to telemetrize the go command and compiler itself to collect data about which language features used (I assume), and how the go command is used. Again, I'm pretty against it. My red-line is opt-in telemetry, and even that's a place I don't want to arrive.
  - vivegi 4y ago
    I think we are in agreement. The problem I have with the principle of forced telemetry is I have no way (or more precisely, time) to understand that their telemetry red-line stops with command line logging/analysis. So, I have to assume the worst with the toolchain. Microsoft .NET also introduced opt-out telemetry (ie., turned ON by default and you could opt-out by setting an environment variable DOTNET_CLI_TELEMETRY_OPTOUT=1|true|yes). These are just dark patterns by big-tech and erode developer trust. Ken Thompson's Turing Award lecture on "Trusting Trust" comes to mind. https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
    - bayindirh 4y ago
      Both of us are completely on the same page. Funnily, I have made the same reference to the same paper [0]. The comment has a "let's talk about how we stop there and not move forward than that" tone, because frankly, I don't think Go maintainers and Google will say "Oh, we overreached, sorry. Let's abandon it and never talk about it again". However, even discussing telemetry and being so adamant about it made me reconsider the extent I'm going to use Go in the future. [0]: https://github.com/golang/go/discussions/58409#discussioncomment-4928702 https://github.com/golang/go/discussions/58409#discussioncom...
parasense 4y ago
[dead]

200 points by pabs3 4y ago

Any source for this other than this unknown/random (for me) Twitter handle? GitHub issue link or some forum/board with context/discussion on this topic?

4ad 4y ago
https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409 https://news.ycombinator.com/item?id=34707583 https://news.ycombinator.com/item?id=34707583 https://news.ycombinator.com/item?id=34750782 https://news.ycombinator.com/item?id=34750782
ergonaught 4y ago
Discussion was here: https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409 I think this assertion and the various sentiment around it is nonsensical and partly demonstrates why "they" were actively moderating as they attempted to have a rational discussion about a topic with human beings online. Some of the moderator decisions were stupid; many were not ("You can stick your telemetry where the sun doesn't shine" is no doubt sincere but it's not LKML I suppose); much of it seems to have been attempting to keep stuff organized and not-repetitive.
probably_wrong 4y ago
This article from The Register [1] has a good general overview, and it leads you to the GitHub discussion [2]. Searching for "bad faith" and "conduct" in that thread yields some results, but not strong enough for me to agree with the poster. There are hidden comments too, but not enough nor eloquent enough (IMHO) to support the claims of bad faith. [1] https://www.theregister.com/2023/02/10/googles_go_programming_language_telemetry_debate/ https://www.theregister.com/2023/02/10/googles_go_programmin... [2] https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409

foldr 4y ago

[flagged]

weberer 4y ago
I don't get it. Do you have a something against British people?
- foldr 4y ago
  They’re not all men. I am British myself, FWIW.
  - baobabKoodaa 4y ago
    Can you point to an example where a non-lad is utilizing the CoC to suppress opposition in this issue?
    - foldr 4y ago
      In the tweet, ‘lads’ refers to ‘the Go maintainers’ referenced in the first paragraph.
      - baobabKoodaa 4y ago
        No, it doesn't. It refers to the subset of Go maintainers who are (allegedly) using the CoC to suppress opposition. I ask again: which specific Go-maintainers have both suppressed opposition with CoC and also are non-lads?
        foldr 4y ago
        Anyone can read the tweet and decide for themselves. To me the intended reference is clear. The “Go maintainers” are accused of doing various things in the first paragraph and are then referred to in the second paragraph as ‘lads’; no salient subset is introduced as a potential discourse referent. In any case, my comment was obviously based on my own understanding of what was said. > the Go maintainers are now claiming that objectors to Google's opt-out telemetry proposal on the Go compiler - yes, really - are arguing in bad faith and violating the Code of Conduct, and their comments are getting hidden. > well done lads, you just keep doing that as hard as possible. i'm sure it'll work out great.

typical182 4y ago

Some additional context in this comment: https://news.ycombinator.com/item?id=34754632 https://news.ycombinator.com/item?id=34754632

arp242 4y ago

Quite a number of people were argueing in bad faith and I left the discussion because of that. The insinuation that all comments opposing the telemetry are hidden is bullshit, as a simple check will confirm: https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409

ocdtrekkie 4y ago
Yeah fwiw I am strongly opposed to the proposal, and Russ Cox acknowledged that they considered many of the posts against telemetry or for opt in only as valid discussion, and gave examples of some of the inappropriate comments they referred to as being in "bad faith". I appreciated his clarity there in answering about what he considered bad faith posts. There were definitely comments that got quite heated and probably fell outside good discourse practices, largely because people are very passionate about privacy and also tend to get very upset when they feel betrayed.
- lqrtr 4y ago
  If a ruling class or inner circle has already decided on a course of action, you rarely change anything with good discourse practices. CoCs are always protecting the inner circle and their opinions. In the early days of open source, flame wars were considered a legitimate way for voicing opinions. Now, in corporate controlled "open" source, the dominance hierarchy must be protected.
  - gtirloni 4y ago
    > If a ruling class or inner circle has already decided on a course of action, you rarely change anything with good discourse practices. Quite true. Especially in the worksplace where RFC/design meetings are only done to validate what has already been decided. > CoCs are always protecting the inner circle and their opinions CoC are 99% not doing that. Of course people can abuse it but I don't see it in practice most of the time. It's just that the abuse/drama gets more attention. > In the early days of open source, flame wars were considered a legitimate way for voicing opinions Flame wars have always been discouraged. As soon as one starts, mods usually step in and shut it down. > Now, in corporate controlled "open" source, the dominance hierarchy must be protected. Yes, very few corporate-backed open source projects are truly open to collaboration, especially when it changes the feature set. If you want to submit bug reports, help users or a PR for a tiny bug, that's all good. In their defense, the employees of those companies do the most work so they get to decide. But they do benefit enormously from having the code open (something they very often forget).

sophacles 4y ago

So, is it time to fork the go codebase and have a telemetry-free version? I understand that there are uses for such data to help make the tooling better. I don't understand how Google and its cult can be so disingenuously surprised that people are wary of it in 2023. This makes me trust them even less than normal - i suspect they'll follow the MS playbook and "accidentally" make the opt-out fail and eventually the idea of opt-out will be completely removed from the product because "everyone seems to be happy with it... No one turns it off anyway".

rocqua 4y ago
The idea would include an opt-out. It would probably be easier to use the opt-out rather than maintaining a fork.
- jonhohle 4y ago
  But the feature should be opt-in to begin with. Opt-out is an anti/dark-pattern that should rightfully be derided.
  - alkonaut 4y ago
    Opt-in greatly reduces the statistical quality of the data. That said, there are many forms of Opt-out. It's one thing to show a checkbox in the setup of a desktop applicatoin saying "send anonymous usage data" and have the checkbox pre-checked. That's a form of opt out, but it's not hidden. It's quite different to have a system enabled which is only possible to switch off by googling a solution or digging in a settings menu. That's also opt-out, but it's a much darker pattern than the pre-checked checkbox. Obviously, a command line tool doesn't have the luxury of an interactive setup, so the same patterns don't apply, but whether or not something is "opt out" or "opt in" isn't the entire story. I find the "default" to be the important thing. Developers need "the default" to be enabled to get reasonable coverage. That doesn't mean it needs to be "secretly" enabled.
    - throwntoday 4y ago

hulitu 4y ago

> How do software developers understand which parts of their software are being used and whether they are performing as expected? By asking nicely. Not by siphoning data out of my system. Where is this world going ? Do i really have to treat every program as spyware and restrict its internet access ? And anyway, why would a compiler need internet access ?

fancl20 4y ago
Asking nicely doesn't work in pratice because people willing to answer the question is not a randomly sampled group of people and usually highly biased. You can check how polling works and why it doesn't work. The problem is always how to randomly sample people and AFAIK there is no good way except randomly sample people (a.k.a telemetry). You can argue that developers shouldn't care that much about their software are being used and whether they are performing as expected, but asking nicely really is not a solution. APPENDED: PLEASE NOTE I'm saying asking nicely is not a solution to get correct data from statistical standpoint. You can argure the data accuracy is not important in this context.
- ballenf 4y ago
  Isn't it contradictory to "care" about how privacy objectors use Go, while denigrating those people by suppressing their voices?
- hobom 4y ago
  While true in general, it is really not that necessary to have a representative sample for checking whether your software works. With large enough sample size a convenience sample will find almost all of the bugs that telemetry would have found.
- hn92726819 4y ago
  > Asking nicely doesn't work in pratice LLVM, GCC, rust, zig, D, etc don't have telementry and they seem to be doing fine. What makes go special? They aren't trying to be more efficient than rust. It isn't more widely used than GCC. I would argue they don't need this telemetry at all.

_aaed 4y ago

This is really rustling my jimmies, do we jump ship?

WesolyKubeczek 4y ago
I, for one, would welcome a GCC Go frontend.
- vips7L 4y ago
  That already exists.

r0ckysharma 4y ago

It's time to move to Rust or Nim or Crystal? telemetry is definitely not a solution half of the industry would be happy about. It's polite way of saying - I want to know what you are doing!

gtirloni 4y ago
On one hand, you have to disable it yourself through a configuration option. On the other, you have to possibly learn a new language, tools, libraries, etc, new community, new release cadence, different feature set, etc. Tough choice.
- badcppdev 4y ago
  Though tough, through thorough thought; a choice
  - gtirloni 4y ago
    Thanks, I've fixed it. English is not my first language.

BaculumMeumEst 4y ago

The telemetry they’re going to add is going to help the go team improve the language and it’s ecosystem. It’s going to be utterly inconsequential for everyone who leaves it enabled. People who are raging about the change are not crusaders for privacy and freedom, they’re petulant children who “don’t like the idea of it” and are throwing tantrums. If it’s that important, there are plenty of languages that put idealism over pragmatism to choose from.

philprx 4y ago
Well the problem is the privacy bait and switch isn't it? When you install a compiler who's respecting your privacy, and without opt in it starts sending telemetry, you can't expect that to go well. Now naming people like this isn't going to help either I think.
- growse 4y ago
  > When you install a compiler who's respecting your privacy, and without opt in it starts sending telemetry, you can't expect that to go well. Are the currently deployed and used versions of the go compiler going to suddenly start sending telemetry? Or is it just a future version that someone would have to deliberately upgrade to? Personally, when a new version of golang comes out, I like to read the release notes and then adjust my build environments with the necessary environment changes for the new features.
  - nishs 4y ago
    reading release notes for upgrades is the only correct way. regardless i think we should hold open source projects to higher standards, such that telemetry isn’t introduced by default.
- alkonaut 4y ago
  > Well the problem is the privacy bait and switch isn't it? What is the privacy bait and switch? The whole idea behind "anonymous usage statistics" is that it's statistical and anonymous, so that it by definition has no privacy consequences. If that doesn't hold up (e.g. it leaks a username, a path, anything) then there should be outrage. But this discussion isn't about that. Or about the fact that it could be worse, or have a bug. The interesting question is: is it acceptable to have telemetry that is anonymous and statistical? And if not - why? The argument "it doesn't respect my privacy" can't apply then.

aejnsn 4y ago

They’ve digressed to arguing about CC and CoC. Yikes. Stupid proposal. If I wanted telemetry, I’d implement with a trusted party, whose service I am paying to use.

incone123 4y ago

I think lads is only gender neutral in some groups and as a more recent usage. In the UK we used to have 'lads mags' which were magazines aimed at a young and specifically male audience.

thejosh 4y ago

It started with the absolute astonishing amount of data that VS Code sends back to Microsoft, now it's pretty standard. If you really want to see what your devices send back, monitor DNS on your devices. I installed a bunch of apps on a spare phone (that had no sim card) and was VERY surprised how much background data and requests Tiktok used.

jeroenhd 4y ago
DNS isn't enough, applications have been sneaking off data to hard-coded IPs and through other means for at least 15 years now. These days we have DoH as a standard, but way before that I spotted a Windows application execute HTTP requests to resolve IP addresses for their tracking domain. With some effort you can MitM your phone with your own certificate authority and a tool like mitmproxy in transparent mode. It still won't detect all of the trackers (detecting MitM is quite easy with certificate pinning), but it'll show you even clearer how much you're being tracked. Expect every API to also be a tracking endpoint, and expect every application you use to upload your location. There are apps that do well, but they've become the exception rather than the rule.

John23832 4y ago

The Go Team's vehemence to not just have this telemetry as off by default rubs me the wrong way. Sure, that means less people will turn it on... but that's the point. Running telemetry on your machine should not be a requirement for A COMPILER.

thiht 4y ago
It could even just be a prompt at first use, if an environment variable (eg. GO_DISABLE_TELEMETRY=1) is not detected. Example: Do you want to enable anonymous telemetry? yes [no] Your choice will be remembered and we won't ask you again. See our engagements and details on what we collect here: https://go.dev/telemetry
- lawtalkinghuman 4y ago
  That'd likely break a lot of CI workloads.
  - webstrand 4y ago
    Easy enough to check for the presence of a TTY and only prompt then. CI wouldn't have a TTY and thus wouldn't prompt.
    - danpalmer 4y ago
      "Falsehoods programmers believe about CI" I mean, I completely agree with you in principle, but also there are a lot of terrible CI systems out there.
      - thiht 4y ago
        Ok, then let’s admit it breaks your CI. So what? You fix it by setting an environment variable and you’re good to go after 2 minutes.
        4y ago

lbayes 4y ago

Leaving the (probably incorrect?) claim of suppression in the title aside for a moment, I just want to express my deep sadness about this decision. I'm an ex-Googler who has admired Golang for many years and have been considering it for use in my hardware startup. The fact that opt-out-only telemetry was even considered, much less appears to be already decided(?), makes me far less likely to use this tool chain at any time in the future.

arp242 4y ago
No decision has been made; there's just a proposal and discussion at this time.
- JetSetIlly 4y ago
  Thank-you. This is important point. It's not even an official proposal yet. And even if it becomes a proposal there's no reason to think it'll actually happen. The speed at which this topic has escalated since the idea was raised last week is astonishing. The biggest mistake Cox has made is assuming people would at least read the three blog posts and debate the topic as presented. I'm not thrilled at the idea of opt-out telemetry but some of the rhetoric is well and truly beyond the pale.
  - arp242 4y ago
    > The biggest mistake Cox has made is assuming people would at least read the three blog posts and debate the topic as presented. Yes, I agree he was perhaps a bit naïve about this. On the other hand: I also don't really know how to do this type of discussion better. Russ obviously went out of his way to come up with a nuanced solution, which one could reasonably disagree with, but I have the impression many people didn't bother reading it, especially on HN here but also in the Go discussion about it. This thread is full of basic misunderstandings, or, if we want to be less generous about it, misinformation. I don't think most people do it on purpose, it is what it comes down to in the end. One of the really great things about internet discussions is that anyone can join in. One of the bad things about internet discussions is that anyone can join in.

wg0 4y ago

May be irrelevant here but I stumbled across a new programming langauge called V [1] that is heavily inspired by Go and does not rely on LLVM rather directly generates C. Operating system is already a spyware and next arms race is for everyone to arm their compilers. Good going, product managers. [1] https://vlang.io/ https://vlang.io/

TwentyPosts 4y ago
As far as I heard the V programming language is largely considered to be Vaporware (see eg. https://xeiaso.net/blog/vlang-update-2020-06-17 https://xeiaso.net/blog/vlang-update-2020-06-17, and other articles by Xe). I agree that I (in theory) quite like some of the design decisions, but as far as I know nothing of this actually works in practice. Like, it's not even close to being production ready, and people are seriously doubting whether the language will ever even come close to being a viable option. I'm not up to date on all of the issues (in the code or in the community), but the last thing I heard is that the developers of V are still working on the "auto-free" memory management model (which is supposed to infer when 'free' needs to be called), but it's not working (and afaik proven to be undecidable in general). Edit: Another reason why I'd be rather skeptical of this language is the claims it makes on the 'Compare' page: https://vlang.io/compare https://vlang.io/compare It starts off stating that "V was created because none of the existing languages had all of the following features:" and then goes and lists an incredibly ambitious list of features, which essentially amount to "As safe as Rust, but Go's simplicity and fast-compilation time, and a small compiler with zero dependencies", and more. These are hard problems, especially if you're also working on developing an experimental memory management technique.
- wg0 4y ago
  Thanks for your insightful update. I'm not sure what are the intentions here of the language creator(s) but what I liked was the simplicity of it. They themselves don't claim it to be production ready and I don't think it is going to be anytime soon. EDIT: Typo.

bob1029 4y ago

Where could I find documentation regarding the actual information Go telemetry might contain? I really like to see the actual thing with own eyes rather than develop an understanding via layers of drama. For example, Microsoft maintains a document that covers all of the data points contained in their .NET SDK telemetry: https://learn.microsoft.com/en-us/dotnet/core/tools/telemetry https://learn.microsoft.com/en-us/dotnet/core/tools/telemetr...

thiht 4y ago
> Where could I find documentation regarding the actual information Go telemetry might contain? There's no telemetry for now, it's a proposal: https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409

fnord77 4y ago

another reason not to use golang (other than it is not that good of a language)

throwanem 4y ago

Especially with so much interest and momentum seeming to have shifted to Rust of late, I wonder whether Golang support is on or near Google's famously bloody chopping block, and adding analytics would help support a "data-driven" case for keeping it funded.

thiht 4y ago
I don't understand why people insist on comparing Go and Rust, when they clearly don't compete against each other. Rust competes with C++, Go competes with Java. The only thing they have in common is being relatively modern and recent languages, but they just don't share the same goals and don't have the same promises.
- throwanem 4y ago
  Okay, but in my circles at least - primarily professional fullstack and mobile dev, plus a wide range of hobbyists and aspiring pros - they've competed for the same mindshare for about as long as they both have existed, and Go seems to have lost out pretty decisively. The most recent SO developer survey seems to bear that out. I don't know what goals Google, as opposed to the Golang team, has for Go. I do know Google has notoriously opaque and complex internal politics, and a long history of summarily axing projects that fail to perform over some set of internal metrics, no matter how large and invested a userbase they happen to have. So I don't think it is unreasonable to consider the question. Sure, the technologies aren't fungible, but it isn't a technological question I'm asking; every longstanding human enterprise necessarily involves politics, and it's the politics I'm wondering about here.
  - thiht 4y ago
    > they've competed for the same mindshare for about as long as they both have existed, and Go seems to have lost out pretty decisively I have no idea what you're talking about. I agree for the mindshare, because I started with Go and thought Rust looked more elegant, but after actually trying it it became pretty clear that they don't compete. I don't know where you're getting that Go somehow "lost", it sounds like bubble reasoning. Again, it didn't "lost" because they don't compete with each other. It's like saying Nadal lost against Messi because Messi is more popular when they're not playing the same sport, it doesn't make sense.

remote_phone 4y ago

How did it go from Go telemetry to trans and intersex rights? I stopped reading there because that sounded like a troll.

pabs3 4y ago

I expect that distros like Debian will be compiling Golang with the telemetry either off by default or removed from the binaries.

deafpolygon 4y ago
What distros like Debian should start doing is packaging without Go binaries at all. This is not going to get any better with Google at the helm. Once allow Go in Debian, then what? More packages with telemetry turned on becoming the "norm" and accepted? No.
- pabs3 4y ago
  While I sympathise with this sentiment, it isn't really feasible, since there are too many useful programs written in Go. Since Go is Free Software, both users and distros like Debian can take advantage of that and just patch out the telemetry or disable it by default. Same goes for any new telemetry that is discovered. That is a better way forward here, since we get the programs implemented in Go but none of the telemetry.
  - deafpolygon 4y ago
    Well, then feel free to welcome your new corporate overlords. There are better ethical free and open software.

jeroenhd 4y ago

As always, these discussions get brigaded by trolls so it's no wonder lots of comments were hidden. However, several hidden comments were, as far as I could tell, made with good intent. That does create an impression that certain opinions are not welcome. The argument for hiding these comments seems to be that they've already been used in other discussions (i.e. "opt-out is illegal under GDPR" being used in a discussion about opt-in/opt-out design despite not being mentioned in that thread before). When I read the comments by the Go people, it looks like the implementation of opt-out telemetry has already been decided on. Objections like "have you checked if that's even legal" are ignored with a simple "I'm not a lawyer". As rsc puts it, "This is a technical discussion, not a negotiation.". The discussion is clearly set up wrong and I doubt it will matter in the end, now. The Github discussion is focused on technical implementation, with the moral discussion already having been decided upon; that way, people with arguments against telemetry have no place to voice their concerns. Maybe the moderators simply couldn't imagine being anti-telemetry or maybe they don't consider the position relevant, but this approach was going to stress out the moderators and cause unproductive discussion from the very start. Personally, I'm somewhat disappointed (but not surprised in the least) that this is being suggested, but I suppose this is what one should expect when running any kind of program from Google (or Microsoft, for that matter). You simply can't trust these companies and the open source developers that work for them to respect your privacy. I have to say, though, the proposal doesn't seem to take the risk of bad data injection seriously. I myself would definitely run the theoretical AdNauseam style fork of Go if the team behind the tool choose to go through with an opt-out mechanism.

deleted 4y ago

[deleted]

Clent 4y ago

Silly. If this was Apple instead of Google. These comments would not be so reasonable. Apple does this same thing with an opt-in. Google is evil. Stop supporting evil.

jensensbutton 4y ago
Apple also collects telemetry by default. Stop pretending this is just Google.

tom-thistime 4y ago

The answer here is not to micro-examine how badly Google needs telemetry or doesn't need telemetry. The answer is No. No telemetry to be used on people who don't want it.

cube2222 4y ago

I mean, some folks in the thread were absolutely arguing in bad faith. A lot of people just go ahead with the "telemetry=bad" message + critique of telemetry in general without even taking a look at the actual proposal[0] (which has some important points regarding collection frequency, data shared, and architecture). Not saying there should be no critique, but blanket statements that often criticize aspects that are irrelevant here don't help. They're really trying to approach this in a way that, to me, is as reasonable and transparent as effectively possible (yes, I'm on the side of "opt-in telemetry doesn't work because of the majority of people who don't care either way; won't turn off if prompted, won't turn on either", so being opt-in is in fact unreasonable to me). The Go toolchain already in a sense "calls home" by default to the Go module proxy hosted by Google. Anyway, it's open source, they're the maintainers, it's up to them, while if you want, you can fork it. Telemetry is immensely useful to understand what features or technical improvements are worth prioritizing to benefit the actual average user the most, and not just the vocal minority. Telemetry being opt-in breaks this by once again prioritizing the vocal minority that turns it on. [0]: https://research.swtch.com/telemetry-intro https://research.swtch.com/telemetry-intro

ocdtrekkie 4y ago
The problem with opt-out telemetry is that as soon as you admit people won't voluntarily turn it on, you've admitted it's a user hostile behavior. The usability of opt-out doesn't override the reality that it's not ethical to do it. I think if the Go authors do move forward with this proposal in any form, a fork is guaranteed. I've heard multiple sources express interest in doing so already.
- cube2222 4y ago
  > The problem with opt-out telemetry is that as soon as you admit people won't voluntarily turn it on, you've admitted it's a user hostile behavior. That is in fact not the case. This is just one possible explanation for users not turning it on, one that I don't believe is even close to a meaningful amount in the grand scale of things. As I wrote in the first message, a huge amount of people don't care either way. They won't turn it off if they're prompted, but they also wouldn't bother turning it on. They just don't care. I'm one of these people.

room271 4y ago

I don't understand the almost religious opposition to the telemetry the Go team are proposing. It involves no PII data, would be easy to disable for those who want to do so, is minimal in scope, and the use cases are well articulated.

deleted 4y ago
[deleted]
daneel_w 4y ago
It doesn't have to involve PII data to be invasive. The heuristics applicable can be used to, in a roundabout way, fingerprint the type of software. And since it's being shipped to Google through the Internet they also know where the software is being developed and where it's being used. And this is just for starters. Once they've tackled the hurdles of people's resistance; having one foot through the door; it's easier to slide more and more telemetry functionality in. You may recognize this behavioral pattern from, uh, well, almost all of their other products.
vorpalhex 4y ago
It only takes them screwing up once for them to send my PII data. "Oops, we accidentally included ~.ssh"
- titaniczero 4y ago
  Objectively speaking, how valuable would that information be if it were to be leaked? Random weekly aggregated and sampled machine data associated to random IPs that in most cases would no longer be yours (and that’s in the worst case that both servers were compromised or misused by an employee during a specific time window, because IP is not stored in the analytics server but temporally in a proxy to prevent abuse). I don’t know, I’m all for privacy but people get passionate too easily the moment someone even mentions the word telemetry and I think we should focus on actual privacy issues, like analytics in the context of ads, social networks (tiktok, fb, ig…), etc.
jeroenhd 4y ago
Data collection always starts out like that. An independent company may get away with that approach. However, this is Google. The problem is, we've seen it all before. When Microsoft added telemetry to dotnet, they stated the following: > The feature collects the following pieces of data: > > The command being used (e.g. “build”, “restore”) > The ExitCode of the command > For test projects, the test runner being used > The timestamp of invocation > The framework used > Whether runtime IDs are present in the “runtimes” node > The CLI version being used > > The feature will not collect any personal data, such as usernames or emails. It will not scan your code and not extract any project-level data that can be considered sensitive, such as name, repo or author (if you set those in your project.json). We want to know how the tools are used, not what you are using the tools to build. If you find sensitive data being collected, that’s a bug. Please file an issue and it will be fixed. All very useful information that doesn't tell them anything about you or your machine. Since then, Microsoft has been steadily increasing the amount of data it's been collecting, including personal identifiable information in the form of a pseudonym based on unique machine identifiers. Once data collection starts, it only ever gets worse.

justinzollars 4y ago

And they are mastodon so no one on earth can see this.

ghusto 4y ago

I see a lot of pro-opt-in arguments along the lines of "it needs to be opt-in by default, because the people we'd like to know from won't bother opting in, but wouldn't care either way". Whilst I wouldn't argument that's an inaccurate description of the people you want data from, counter point: tough? We're used to these liberties being taken in IT, so let's imagine a less technical scenario. You buy some lightbulbs from ShopX, and they'd really like to know your lightbulb usage habits in order to improve the efficiency of their lightbulbs (and nothing else, honest guv! but okay, let's give them the benefit of the doubt). They could send you a questionnaire, and as rightly pointed out in these arguments, it's unlikely you'd bother with it. Or they could ... what? Anything that involves them getting that information is a slippery slope at best, and a bit creepy already. This is the only industry where we've normalised this kind of liberty taking.

acdha 4y ago
> This is the only industry where we've normalised this kind of liberty taking. Or the only one where you're personally aware of it. The kind of low-frequency limited data the Go team proposed collecting is basically the same as, say, McDonald's telling store managers to report how many people ordered mayonnaise on their sandwiches so they can decide whether to continue stocking it. It's worlds better than the kind of individual patron tracking large retailers or credit card companies routinely do, but they don't advertise that. There are two differences here: one is where data collection happens — since this is running locally rather than in the cloud we know it's happening — and the other is the larger question of Google's corporate reputation is affecting reactions. A lot of the takes on social media have been reacting to that larger issue, many by people who don't even use Go, and are alleging scenarios far beyond what would be possible with the proposed system. I think some of this also goes back to the risk of being open: I would bet that more than a few of the people who are very concerned about Go lang use tools like VSCode which collect far more data but not having the big public proposal didn't mean everyone was talking about it at the same time.
- ghusto 4y ago
  Ay but come on, likening it to stock keeping is a bit disingenious. A company's perfectly entitled to keep track of their stock, and they don't need anything from me to do it. The credit card companies are more like it but I opt out of that game too, by not using them. Their practices are well known to me.

deleted 4y ago

[deleted]

bitwize 4y ago

From now on any anti-telemetry comments will be replaced with "farts farts farts". Seriously, though, I think this kerfuffle pretty much cements Rust as the go-to native-compiled network infrastructure language for future projects.

gregors 4y ago

Google getting their playbook from the VScode and .NET teams I see. https://code.visualstudio.com/docs/getstarted/telemetry https://code.visualstudio.com/docs/getstarted/telemetry https://stackoverflow.com/questions/64570113/how-do-i-stop-net-telemetry-to-stop-collecting-data-in-ubuntu-linux https://stackoverflow.com/questions/64570113/how-do-i-stop-n... I think it's pretty obvious that opt out telemetry rubs most people the wrong way.

acdha 4y ago
> I think it's pretty obvious that opt out telemetry rubs most people the wrong way. This is basically re-stating the opt-in challenge: we know that some people are vocally upset by it but we have to guess at the relative percentages of the groups of people who know and do not mind, don't know but would be upset, or don't know and wouldn't mind if they did. People who are upset are far more motivated to comment about it, so anyone looking at social media is going to see a lot of messages from them but still not know what percentage of the total community feels similarly. I've even seen people who aren't primarily in the Go community but very active on privacy issues commenting on this, which is perfectly legitimate but also not representative of the median Go developer.
- account42 4y ago
  This exact percentages are irrelevant. Once you know that there are any people who do not want you to collect their data the only ethical thing to do is to obtain informed consent before collecting that data.
  - acdha 4y ago
    The percentages clearly do matter because otherwise people wouldn't be trying to pad their arguments by claiming large numbers support their position. It's also important to remember that "data" covers a range of sensitivities, and vague assertions don't help the conversation. For example, the proposed system records less identifying information than visiting Golang.org but relatively few people would say it's unethical for that site not to have a mandatory opt-in requirement before loading a page - most of the interest tends to be in things like disclosure and retention policies.

zajio1am 4y ago

Next step: Just compile our telemetry also to the generated code, we obviously need to know its real performance characteristics. /s

wprl 4y ago

I had been about to devote some time to learning Go, but definitely won’t be after these latest developments.

1bent 4y ago

I wouldn't have thought of this before this issue came up, but I just searched for "software written in go", and sadly, there seems to be a lot of it. I wonder if all the folks outside of Google will remember to turn this off. If your motto is "ok, don't be evil didn't pay well", this is a genius move. Craft a language good enough to appeal to others, give it away, let a community grow, then hoover up data from everyone using anything written in our language. Unless, of course, they remember to opt out.

deleted 4y ago
[deleted]

linuxftw 4y ago

Other projects I have seen have done opt-out telemetry on the beta/testing/development versions of their software, and it's disabled on stable builds. Win-win.

nishs 4y ago

As one of the commenters in the original GitHub discussion pointed out, the package managers of most open source operating systems ultimately will/should package Go with telemetry turned off by default, regardless of the Go project’s default behavior. Good luck getting non-operating system biased data after that. Collecting non-operating system biased data seemed to be one of the stated goals to making the telemetry turned on by default. Otherwise it was posited that Go users on open source operating systems would disproportionately choose to keep telemetry off when prompted in an opt-in model.

deleted 4y ago

[deleted]

jefftk 4y ago

The link goes to a Mastodon thread that doesn't give any context. Where can I see the Go maintainers making this claim?

WhyNotHugo 4y ago

General public: We think you should ask for consent before gathering data on user's device and sending it to Google. Google/Golang devs: You're objecting in bad faith and violating our Code of Conduct.

remram 4y ago

I look forward to the tool uploading random garbage telemetry to their collection endpoint (or dependency doing it every build). Not endorsing it but it's the logical next step if you try to do this in an open tool to a programming community. They have to be more careful than Google is used to be with their other products.

LarryMullins 4y ago

This is the purpose of "Code of Conducts", to silence dissent. They are sold to you by people who say they'll only silence the bad sort of dissent, but lo and behold the definition of 'bad' isn't locked to the seemingly reasonable scenarios with which CoCs are promoted. Try to oppose the CoC now that you see what it's really for, and the CoC will be used to silence you as well.

parasense 4y ago

WTF did I just read? The first remark to start everything was sensational, and I'd love more specific citation to learn more about the claimed allegations. Then, seemingly out of nowhere, one individual went on a major rant about "intersex" or something like that, and something-something Ada Initiative... What I want is a technical discussion about "Google's opt-out telemetry proposal on the Go compiler", which raises some alarm... the word "opt-out" seems to suggest Google would require people to unsubscribe from their intelligence gathering? Seems sensational at face value. But is that even true? And what, if anything does gender-identity drama have to do with anything about that?

scrubs 4y ago

How come https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409 Blabs on about the bureaucratic/ policy ends of collecting data from me and NOT what they want to impact? Geez not even one example of where a little data could've helped golang compiler progs and users? My immediate reaction? Def negative

vivegi 4y ago

If I want to understand my program and where it spends time, I use a profiler. If Go maintainers want telemetry, they should provide an optional profiler that adds telemetry and whoever wants to opt in can use it after twiddling the appropriate knobs. Just claiming violation of CoC and forcing it on the entire userbase is atrocious. If I have not made my code open source, stop snooping. If you want to know how your features are used, go and analyze open source codebases. And it must be default turned off. Don't use dark patterns like default telemetry on and hoping that x% of users will forget to turn it off in a week and we will get our data. Smells bad.

bayindirh 4y ago
To be honest, I'm pretty against telemetry in Go, but it's not about the compiled code itself. They want to telemetrize the go command and compiler itself to collect data about which language features used (I assume), and how the go command is used. Again, I'm pretty against it. My red-line is opt-in telemetry, and even that's a place I don't want to arrive.
- vivegi 4y ago
  I think we are in agreement. The problem I have with the principle of forced telemetry is I have no way (or more precisely, time) to understand that their telemetry red-line stops with command line logging/analysis. So, I have to assume the worst with the toolchain. Microsoft .NET also introduced opt-out telemetry (ie., turned ON by default and you could opt-out by setting an environment variable DOTNET_CLI_TELEMETRY_OPTOUT=1|true|yes). These are just dark patterns by big-tech and erode developer trust. Ken Thompson's Turing Award lecture on "Trusting Trust" comes to mind. https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
  - bayindirh 4y ago
    Both of us are completely on the same page. Funnily, I have made the same reference to the same paper [0]. The comment has a "let's talk about how we stop there and not move forward than that" tone, because frankly, I don't think Go maintainers and Google will say "Oh, we overreached, sorry. Let's abandon it and never talk about it again". However, even discussing telemetry and being so adamant about it made me reconsider the extent I'm going to use Go in the future. [0]: https://github.com/golang/go/discussions/58409#discussioncomment-4928702 https://github.com/golang/go/discussions/58409#discussioncom...

parasense 4y ago

[dead]