6 ms·

So, is it time to fork the go codebase and have a telemetry-free version? I understand that there are uses for such data to help make the tooling better. I do

So, is it time to fork the go codebase and have a telemetry-free version? I understand that there are uses for such data to help make the tooling better. I don't understand how Google and its cult can be so disingenuously surprised that people are wary of it in 2023. This makes me trust them even less than normal - i suspect they'll follow the MS playbook and "accidentally" make the opt-out fail and eventually the idea of opt-out will be completely removed from the product because "everyone seems to be happy with it... No one turns it off anyway".

rocqua 4y ago
The idea would include an opt-out. It would probably be easier to use the opt-out rather than maintaining a fork.
- jonhohle 4y ago
  But the feature should be opt-in to begin with. Opt-out is an anti/dark-pattern that should rightfully be derided.
  - alkonaut 4y ago
    Opt-in greatly reduces the statistical quality of the data. That said, there are many forms of Opt-out. It's one thing to show a checkbox in the setup of a desktop applicatoin saying "send anonymous usage data" and have the checkbox pre-checked. That's a form of opt out, but it's not hidden. It's quite different to have a system enabled which is only possible to switch off by googling a solution or digging in a settings menu. That's also opt-out, but it's a much darker pattern than the pre-checked checkbox. Obviously, a command line tool doesn't have the luxury of an interactive setup, so the same patterns don't apply, but whether or not something is "opt out" or "opt in" isn't the entire story. I find the "default" to be the important thing. Developers need "the default" to be enabled to get reasonable coverage. That doesn't mean it needs to be "secretly" enabled.
    - throwntoday 4y ago
      This doesn't change what the parent comment said. Opt-out is inherently a dark pattern. The hope is that the person installing the software doesn't actually read and uncheck the box. It's no different to "install bing toolbar" for example being pre-checked and snuck in to directx.
      - alkonaut 4y ago
        > The hope is that the person installing the software doesn't actually read and uncheck the box Yes. Because you have the "don't care" group being the important group. The users are split into a small group being positive (The would-opt-ins) and a small group being negative (the people arguing it must be opt in) and a large group who don't care. The central "don't care" group is so large that the data is almost useless without them - i.e. you could just as well not have the system at all if you were going to do a full opt-in. So the unchecked box alternative really isn't an alternative.
        Lio 4y ago
        You've missed out a group there, it's: * Would-opt-ins * Would-opt-outs * Don't-cares * Did-not-know-that-google-are-going-to-run-telemetrys By making it opt-out Google will be conveniently hoovering up the people that would say objects if they knew along with the don't cares.
        alkonaut 4y ago
        Yes my 3-group would be the case for the checkbox-during-installer-of-desktop-app.
    - layer8 4y ago
      The checkbox being pre-checked is still not legal in some countries, exactly because it favors the non privacy protecting option.
      - 4y ago
growse 4y ago
> So, is it time to fork the go codebase and have a telemetry-free version? Why is maintaining a fork and remembering to use it everywhere easier than just setting an environment variable? > ... product because "everyone seems to be happy with it... No one turns it off anyway". How would they know who turns it off?
- carapace 4y ago
  > Why is maintaining a fork and remembering to use it everywhere easier than just setting an environment variable? 1) Presumably, you're just deleting a few bits of code here and there. 2) It's not going to stop at one lil ENV var, eh?
- blibble 4y ago
  20 years ago no software had telemetry (any reporting back was "spyware") in 20 years from now will I need 700 environment variables, one for nearly every piece of software on my machine? LS_TELEMETRY=off VI_TELEMETRY=off BASH_TELEMETRY=off CAT_TELEMETRY=off
  - jeroenhd 4y ago
    You joke, but I already have a couple telemetry env variables in my env file because of various tools using them for opt-outs. It's infuriating.
  - jefftk 4y ago
    There's a proposal for DO_NOT_TRACK=1 https://consoledonottrack.com https://consoledonottrack.com Unfortunately it's not been widely adopted. My guess is this is running into the same problem that DNT=1 in the browser did, which is that different people mean different things by "tracking" and it's very hard to come to agreement on where to draw the lines.
  - WhyNotHugo 4y ago
    20 years from now? Try disabling all telemetry in Firefox.
  - remram 4y ago
thiht 4y ago
> So, is it time to fork the go codebase and have a telemetry-free version? Or you know, be reasonable and set the GO_DISABLE_TELEMETRY=1 env variable, IF telemetry actually ends up being added some day. I'm not in favor of any kind of telemetry in my devtools but there's no reason to go nuclear at this point. Honestly the proposal by rsc is even reasonable to me, I'm mostly against it because I have no trust in Google regarding any kind of data, personal or not. > eventually the idea of opt-out will be completely removed from the product That's never happened anywhere, and it's entirely illegal.
- sophacles 4y ago
  Google isn't particularly well known for caring about the laws related to privacy. Besides, opt out via env var is a broken idea. It forces me to go through all sorts of dockerfiles, ci config, dev machine scripts, etc to make sure its set. Not to mention the ongoing maintenance of keeping it that way. Id rather just use the go-with-at-least-some-minimal-respect fork and write scripts to verify that's the base docker image, installed golang, etc. It actually seems easier to do that than verify every environment that runs golang has that env var set.
- anon291 4y ago
  > That's never happened anywhere, and it's entirely illegal Jokes on you... Open source software is provided as is
  - bmacho 4y ago
    That's my problem too. I have a website, then A LOT of companies know a lot about my users. From their ISP to Microsoft (I host on github) they all know when my users poop, when my users go on vacation, or when my users are cheating their husbands and checking in from someone elses computer. It is so hard to create something, because of the dangers lurking everywhere. I think I need a reasonable creators license.
  - remram 4y ago
    "to the extent permitted by law"
creepycrawler 4y ago
In practice, I can imagine the software packagers of various Linux distributions would set an environment variable to disable the offending behavior. This may be good enough for the majority of the software's stakeholders (users).
- jeroenhd 4y ago
  The go devs discuss this, they intend on adding a Go env file that package managers and users can use to set global flags for Go. That would rely on installing Go from the distro repositories, though, and that's not what the official Go docs tell you to do.
  - creepycrawler 4y ago
    I hope software packagers for the various Linux distributions will disable this behavior, one or way or another, with or without the assistance of the Go developers. The official Go documentation can say whatever it wants, but in my experience the installation on Linux mostly happens via the distribution's package manager. The result would be that the software running for the majority of users will not send information to Google. It's not perfect, and won't do for some people (like me; I will remove Go and not write Go code in the future), but I think that'll remove the need for a fork for many people.
    - jeroenhd 4y ago
      I've met quite a few (junior) devs who will follow guides instead of using their package manager because they come from Windows and aren't used to using their distro's tools. I expect many professionals who do use Linux to run on stable possibly LTS versions of their distribution of choice and those rarely come with up to date tools for languages like Go or Rust or even Docker. I wish installation would only come through package managers, but the amount of people I've had to help upgrade their Ubuntu to a newer version because they added a whole bunch of external repositories without realising the impact has taught me otherwise. It's possible that distros will come out if the box with a /usr/share/go/env file even if Go isn't installed, but that'll take a while.

rocqua 4y ago

The idea would include an opt-out. It would probably be easier to use the opt-out rather than maintaining a fork.

jonhohle 4y ago
But the feature should be opt-in to begin with. Opt-out is an anti/dark-pattern that should rightfully be derided.
- alkonaut 4y ago
  Opt-in greatly reduces the statistical quality of the data. That said, there are many forms of Opt-out. It's one thing to show a checkbox in the setup of a desktop applicatoin saying "send anonymous usage data" and have the checkbox pre-checked. That's a form of opt out, but it's not hidden. It's quite different to have a system enabled which is only possible to switch off by googling a solution or digging in a settings menu. That's also opt-out, but it's a much darker pattern than the pre-checked checkbox. Obviously, a command line tool doesn't have the luxury of an interactive setup, so the same patterns don't apply, but whether or not something is "opt out" or "opt in" isn't the entire story. I find the "default" to be the important thing. Developers need "the default" to be enabled to get reasonable coverage. That doesn't mean it needs to be "secretly" enabled.
  - throwntoday 4y ago
    This doesn't change what the parent comment said. Opt-out is inherently a dark pattern. The hope is that the person installing the software doesn't actually read and uncheck the box. It's no different to "install bing toolbar" for example being pre-checked and snuck in to directx.
    - alkonaut 4y ago
      > The hope is that the person installing the software doesn't actually read and uncheck the box Yes. Because you have the "don't care" group being the important group. The users are split into a small group being positive (The would-opt-ins) and a small group being negative (the people arguing it must be opt in) and a large group who don't care. The central "don't care" group is so large that the data is almost useless without them - i.e. you could just as well not have the system at all if you were going to do a full opt-in. So the unchecked box alternative really isn't an alternative.
      - Lio 4y ago
        You've missed out a group there, it's: * Would-opt-ins * Would-opt-outs * Don't-cares * Did-not-know-that-google-are-going-to-run-telemetrys By making it opt-out Google will be conveniently hoovering up the people that would say objects if they knew along with the don't cares.
        alkonaut 4y ago
        Yes my 3-group would be the case for the checkbox-during-installer-of-desktop-app.
  - layer8 4y ago
    The checkbox being pre-checked is still not legal in some countries, exactly because it favors the non privacy protecting option.
    - 4y ago

growse 4y ago

> So, is it time to fork the go codebase and have a telemetry-free version? Why is maintaining a fork and remembering to use it everywhere easier than just setting an environment variable? > ... product because "everyone seems to be happy with it... No one turns it off anyway". How would they know who turns it off?

carapace 4y ago
> Why is maintaining a fork and remembering to use it everywhere easier than just setting an environment variable? 1) Presumably, you're just deleting a few bits of code here and there. 2) It's not going to stop at one lil ENV var, eh?
blibble 4y ago
20 years ago no software had telemetry (any reporting back was "spyware") in 20 years from now will I need 700 environment variables, one for nearly every piece of software on my machine? LS_TELEMETRY=off VI_TELEMETRY=off BASH_TELEMETRY=off CAT_TELEMETRY=off
- jeroenhd 4y ago
  You joke, but I already have a couple telemetry env variables in my env file because of various tools using them for opt-outs. It's infuriating.
- jefftk 4y ago
  There's a proposal for DO_NOT_TRACK=1 https://consoledonottrack.com https://consoledonottrack.com Unfortunately it's not been widely adopted. My guess is this is running into the same problem that DNT=1 in the browser did, which is that different people mean different things by "tracking" and it's very hard to come to agreement on where to draw the lines.
- WhyNotHugo 4y ago
  20 years from now? Try disabling all telemetry in Firefox.
- remram 4y ago

thiht 4y ago

> So, is it time to fork the go codebase and have a telemetry-free version? Or you know, be reasonable and set the GO_DISABLE_TELEMETRY=1 env variable, IF telemetry actually ends up being added some day. I'm not in favor of any kind of telemetry in my devtools but there's no reason to go nuclear at this point. Honestly the proposal by rsc is even reasonable to me, I'm mostly against it because I have no trust in Google regarding any kind of data, personal or not. > eventually the idea of opt-out will be completely removed from the product That's never happened anywhere, and it's entirely illegal.

sophacles 4y ago
Google isn't particularly well known for caring about the laws related to privacy. Besides, opt out via env var is a broken idea. It forces me to go through all sorts of dockerfiles, ci config, dev machine scripts, etc to make sure its set. Not to mention the ongoing maintenance of keeping it that way. Id rather just use the go-with-at-least-some-minimal-respect fork and write scripts to verify that's the base docker image, installed golang, etc. It actually seems easier to do that than verify every environment that runs golang has that env var set.
anon291 4y ago
> That's never happened anywhere, and it's entirely illegal Jokes on you... Open source software is provided as is
- bmacho 4y ago
  That's my problem too. I have a website, then A LOT of companies know a lot about my users. From their ISP to Microsoft (I host on github) they all know when my users poop, when my users go on vacation, or when my users are cheating their husbands and checking in from someone elses computer. It is so hard to create something, because of the dangers lurking everywhere. I think I need a reasonable creators license.
- remram 4y ago
  "to the extent permitted by law"

creepycrawler 4y ago

In practice, I can imagine the software packagers of various Linux distributions would set an environment variable to disable the offending behavior. This may be good enough for the majority of the software's stakeholders (users).

jeroenhd 4y ago
The go devs discuss this, they intend on adding a Go env file that package managers and users can use to set global flags for Go. That would rely on installing Go from the distro repositories, though, and that's not what the official Go docs tell you to do.
- creepycrawler 4y ago
  I hope software packagers for the various Linux distributions will disable this behavior, one or way or another, with or without the assistance of the Go developers. The official Go documentation can say whatever it wants, but in my experience the installation on Linux mostly happens via the distribution's package manager. The result would be that the software running for the majority of users will not send information to Google. It's not perfect, and won't do for some people (like me; I will remove Go and not write Go code in the future), but I think that'll remove the need for a fork for many people.
  - jeroenhd 4y ago
    I've met quite a few (junior) devs who will follow guides instead of using their package manager because they come from Windows and aren't used to using their distro's tools. I expect many professionals who do use Linux to run on stable possibly LTS versions of their distribution of choice and those rarely come with up to date tools for languages like Go or Rust or even Docker. I wish installation would only come through package managers, but the amount of people I've had to help upgrade their Ubuntu to a newer version because they added a whole bunch of external repositories without realising the impact has taught me otherwise. It's possible that distros will come out if the box with a /usr/share/go/env file even if Go isn't installed, but that'll take a while.