14 ms·

Telemetry in Front-End Tools

130 points by gravitate 4y ago

pabs3 4y ago
There are lots of other types of privacy issues in open source out there, this wiki page documents some of them: https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues
z3t4 4y ago
I guess this is only what you can find out from tcpdump and strace ? Reading the EULA/privacy policy is way scarier, for example content of files, network information, other apps on your computer, and web searches. If you are using a free - as in free beer - and not free as in free software - you are the product!
- JohnFen 4y ago
  > If you are using a free - as in free beer - and not free as in free software - you are the product! True. And increasingly, paying for the software doesn't make this any better.
- timseverien 4y ago
  The currently available information is all from browsing documentation and scanning source code. Some people suggested looking into JetBrains IDEs, which isn’t open-source, and thus would require packet sniffing.
JohnFen 4y ago
Hopefully, this sort of thing can at least be stopped by very restrictive outbound firewall rules, but it's getting to the point where you have to seriously consider only using dev tools on air-gapped machines anymore.
- readerbaza 4y ago
  This is the only way. Just deny by default. I never liked Postman and that's how I mostly stopped using it. Completely stops working on analytics request denial and then starts sending reports to Sentry (but even if you allow those, they don't learn, I've tried)
palijer 4y ago
I don't seem to understand the "let's take back our data" theme here. If someone builds a frontend website that you use, do you have the right to not have any metrics gathered about how you use their frontend that they built? What about server logs? If I send an http request to a server, do I have any right to say they can't log that request? What about the database metrics?
- alextheparrot 4y ago
  This is talking specifically about the frameworks people use forwarding telemetry to the developers of those frameworks
- Nicksil 4y ago
  >If someone builds a frontend website that you use, do you have the right to not have any metrics gathered about how you use their frontend that they built? Yes, absolutely. That website's code is being executing on my machine, consuming my power, then using my internet service to phone home with a data package of arbitrary size.
- intelVISA 4y ago
  If walking into Walmart you were stopped and had your pockets turned over by a greeter and had to record your car registration, DOB and favorite Electron app "just having a look bud, now carry on" would you go back?
  - EthicalSimilar 4y ago
    Yes because wanting to collect metrics on which devices your users are using to better aid in the design and development of your application is similar to giving your DOB and VRN to Walmart.
    - JohnFen 4y ago
      I'm not disagreeing with your point, but did want to add in that what a developer's intentions are don't mean a great deal, because there's a serious trust problem. It's very difficult to tell what data is really being reported by an application. The majority of the time, all we have to go by is what the developer says is being collected. But the developer claims cannot be considered trustworthy by default. Many developers have simply lied in the past about what they collect. And even if the developer is truthful, they can only speak for what the software is doing at the moment. There's no guarantee that the developer won't change their mind in the future, or the product won't be sold to another company that isn't so considerate of their users.
RodgerTheGreat 4y ago
Telemetry in webapps is incredibly tempting, because it's just so easy to collect. Even without JavaScript, web browsers offer a dazzling array of ways for applications to call home with fingerprinting and tracking information. Because it is easy, it is commonplace, and many will use this as a justification for their own decisions. It is true that, in some cases, telemetry can make it faster and easier to improve software, but this is ultimately placing the convenience of the developers ahead of the privacy and autonomy of the users. I believe that software should serve the interests of users, and informed, affirmative consent for phoning home is an absolute baseline for respecting their wishes.
- Entinel 4y ago
  > but this is ultimately placing the convenience of the developers ahead of the privacy and autonomy of the users. Is it though? Putting aside the issue of whether you trust the person collecting telemetry for a second. You can collect telemetry completely anonymized. You don't have store IPs or any sort of personal identifier. I know a certain crowd still won't like it but in practice how does that harm the privacy of the user?
  - JohnFen 4y ago
    > You can collect telemetry completely anonymized. You can't. You can decide to discard identifying information (although only if you aggregate and don't insert some sort of "anonymous" identifier), sure. But you're still going to collect it. So it all boils down to trusting not only the developer, but any company or interest that might acquire the developer or product in the future. And I think it has been repeatedly demonstrated that this trust is not well-placed.
    - notpushkin 4y ago
      > You can't. Of course you can! Just route telemetry through Tor.
  - Lammy 4y ago
    The very act of making a network connection (data points: network address + time of use) makes it impossible to be truly anonymous https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/ https://kieranhealy.org/blog/archives/2013/06/09/using-metad...
laerios 4y ago
Products by JetBrains are notoriously missing.
- ricardobeat 4y ago
  That’s very different isn’t it? Telemetry on an application you are a customer of, especially one with a GUI is expected. Tracking on a framework that you install, maybe even as a third party dependency, is not. Can you picture every major software dependency you use phoning home when you start a project?
  - RodgerTheGreat 4y ago
    The only real differences are who the user is (possibly a developer vs. an "end user") and how many hands are rifling through the user's pockets without permission. In an audience composed of mostly developers the attitude toward these scenarios may be different, but the fundamental ethical calculus is the same.
- m463 4y ago
  Meaning that they don't collect telemetry, or that they DO collect telemetry and it's not mentioned?
  - laerios 4y ago
    Opt-in telemetry, as well as unspecified telemetry while phoning home for license checks. I gather from memory that IDEs based on the IntelliJ platform scour the local network in search for other local network-connected machines running instances of their IDEs - e.g. in order to detect forbidden duplication of licenses. It is not apparently clear what details are(n't) transmitted back to the mothership. This example requires a finer-grained analysis than the broadly chosen "opt-in" and "opt-out" categories to describe telemetry collection, and I wish for this information initiative to improve in clarity and thoroughness (e.g. does VSCode also scour the local network?). Addendum: Thanks for asking for clarification. The grandparent comment could've been ambiguous in intent.
ricardobeat 4y ago
Personally I find this unacceptable. It’s ok to do it within your own company environment, but not for a public open-source project. This is a slippery slope for “understanding more about our users” and I challenge anyone to show a meaningful improvement that derived from telemetry of this kind. There are better ways to figure out how a project is used without harming privacy (ex: analyzers like BuiltWith). Projects doing this should get a red mark to discourage it.
- JohnFen 4y ago
  I actually think it would be OK if the telemetry were opt-in. At this point, I'd even settle for just having the software actually warn you about the data collection on first use.
  - ikiris 4y ago
    you opt in by using the product. especially if its open source.
    - teej 4y ago
      Tracking my usage was never part of the social contract of OSS. This post is a reminder of that.
      - martypitt 4y ago
        What social contract is that? As far as I'm aware, the contract of OSS is "you can fork this to change it, if you don't like it" (license permitting). A big part of the reason people advocate for OSS is so they can read the source code to understand what's going on, and change the parts they don't like. Telemtry sits squarely under that usecase. I agree that it's good manners for projects made users aware of telemetry, but there's no "contract" that implies they have to.
        JohnFen 4y ago
        He was talking about the social contract, not the license. OSS is a community that has mores, expectations, and social contracts like any other community. Spying is very much in opposition to that social contract.
hankchinaski 4y ago
People that keep whining about privacy and all have never tried to build a business where you need insights and data to not put your company out of business. It’s all a matter of perspective and not all black and white. The truth is to be found in the middle
- JohnFen 4y ago
  This isn't true at all. I've been in this business a long time, and have developed several very successful products. I know that this sort of data is very useful to a business. But I also know that it's abusive and wrong to extract this data without my customers agreeing to it. While this data is very valuable, not having it isn't an existential issue for any company (or, if it is, that's because there's something very wrong with how the company operates.) > The truth is to be found in the middle Hard disagree. This is an issue of consent, and I don't see how there's a middle ground for consent.
- barnabee 4y ago
  The success of your business isn't my problem. The fact that you may have incentives to do bad things is just a reason society should make laws against you doing them, not a reason I should feel sorry for you and let you spy on me.
- earthling8118 4y ago
  Okay, I'll offer up a perspective for you: the company should just go out of business then. If you need it that bad for success, then that is a signal that you aren't supposed to succeed. Full stop.
- toastercat 4y ago
  Just make it opt-in. The real problem here is that is that these products send data by default without explicit consent. Ask yourself this question: do you think most people who use these tools know that their data is being sent? Probably not, right? OK, of those people, do you think 100% of them will be totally OK with their data being collected once they find out? Probably not, right? Then why the fuck do this? > But then no one opts in! OK that is your business' problem to solve.
m463 4y ago
some stuff I remember on mac: docker ce - collects telemetry in the installer before you have even installed anything brew - telemetry on by default balena etcher - telemetry anything apple
- notpushkin 4y ago
  > balena etcher Holy shit! A glorified dd if=/of= that uses Electron and has telemetry – now that's something
Jackevansevo 4y ago
I couldn't care less if it's phoning home by default, the data helps build a better product. Opt in telemetry is basically useless as you're self selecting for people that discover/care enough to enable the feature. In a world where we have companies like Google/Facebook and massive levels of surveillance it's bizarre to me that this is the hill some of you want to die on. The tools themselves provide a way to disable it, so I don't see what any of the fuss is about. This happened recently with a telemetry proposal in the Go community and everyone threw their toys out of the pram. The Go team was forced to back peddle and now the telemetry collected by the toolchain is worse off because of this.
- fbdab103 4y ago
  Go famously does not listen to users. Am I to believe that the one thing holding back Go development was tabulated data?
  - mseepgood 4y ago
    Why do you say that when this is a prime example that they actually do listen to users?
    - fbdab103 4y ago
      Ha, fair point.
  - Jackevansevo 4y ago
    Except this time they did listen to users (to the detriment of their telemetry data)
- toastercat 4y ago
  That's cool that you don't care, but some people do care, or else this site wouldn't exist in the first place.
- saagarjha 4y ago
  Just because Google or Facebook does something doesn’t mean everyone else should get away with something a little less bad.
chrsjxn 4y ago
This site would be a lot more useful if it talked about _what_ data was collected, rather than just assigning 25 for "Data sensitivity". It's also pretty interesting to see the comments here, in a privacy focused thread, and contrast them with comments elsewhere about software performance. If you like faster software, developers need to measure it.
- timseverien 4y ago
  I tried doing that on the tool-specific detail page, but they’re broad categories, e.g. “Device, Environment, Usage” for Next.js. Do you think that’s sufficient?
  - chrsjxn 4y ago
    I saw (after posting) that all the tool specific pages do link specifically to each project's documentation about what telemetry data is collected. Those categories feel a little too broad to me, especially without clearly stated definitions. "Environment" in particular made me second guess if dev tools were leaking secrets. But, thankfully, the projects I looked at were very clear that they don't collect anything from the shell environments. Maybe all it really needs is some detail for what's in the category. "Device (OS, core count, available memory)" or "Usage (command, plugins, timing)"?
moi2388 4y ago
There should be laws against the collection of data without explicit opt-in consent. Oh wait, there already is, it’s just being completely ignored
- Vinnl 4y ago
  I don't know which law you're referring to specifically, but often they relate to personally identifiable information, and have carve-outs for non-PII data.
  - hexo 4y ago
    IP address is personal info.
    - Vinnl 4y ago
      That's fair enough, and I believe just not storing it is not even enough. I'm not sure how they deal with that.
  - Nextgrid 4y ago
    The GDPR for example, which enforces opt-in for anything not strictly necessary for the provision of the service (and no, telemetry doesn't count as "strictly necessary"), enforces the concept of data minimization (which means you must collect & process as little personal data as possible to fullfil your objective) and considers IP addresses as personal data.
    - timseverien 4y ago
      I reviewed the source-code before adding them to the site. I can’t say for sure IP addresses aren’t stored server-side, so we have to trust them that they don’t, but most tools do find creative ways to get some kind of unique and persistent IDs. For example, Astro computes a hash for the git repository remote URL, and Storybook computes an ID by hashing the first commit hash in the repo.
kdeldycke 4y ago
Maybe it is time to revive https://consoledonottrack.com https://consoledonottrack.com , an initiative to unify the convention of having one standard environment variable to opt-out of any tracking.
deafpolygon 4y ago
This doesn't seem to be correct for PowerShell https://telemetry.timseverien.com/opt-out/ https://telemetry.timseverien.com/opt-out/
- timseverien 4y ago
  I may have not tested this thoroughly enough — I’ll be sure to revisit it soon.
deafpolygon 4y ago
To provide an extreme example; if you have sex with someone without asking them, it's rape. "But baby, I assumed you wanted it because you had a glass of wine and you were wearing that sexy outfit." - Still rape. Opt-out telemetry is like that, too, you stop only after penetration. Or another example, if architects decided to start putting cameras in the house everywhere. The camera, somehow, blocks out your face but monitors everything else. "But, we need this data to figure out which part of the house you're using and how often you're in these rooms. PINKY promise it's anonymous and no one will know who you are." Opt-in consent is the only right way.
Havoc 4y ago
While tracking is never ideal I don't personally mind tool level tracking like this if it helps the dev, especially for CLI. What command line switch I prefer seems less problematic than say my browsing habits. One hell of a slippery slope I know, but it does seem to me like a spectrum
- wootland 4y ago
  The CLI is the last place I want to be tracked. There's so much sensitive data there, and there currently exists a culture of privacy (that's under attack). Most timeless and excellent CLI tools have had zero tracking in them. Git and Vim did not get designed by spying on people's usage.
cowl 4y ago
> Assuming no personal identifyable information is saved, this is legal. This is not true in Europe Anymore. Any Optout telemetry is illegal because they have to establish a connection to the telemetry server and thus leaking the user IP (which is PII for GDPR) without the user's consent. See the latest case that even linking a font from CDNs is illegal. https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ relevant part: > It is sufficient that the defendant has the abstract possibility of identifying the persons behind the IP address. Whether the defendant or X. has the specific opportunity to link the IP address to the plaintiff is irrelevant. Any connection that is not neccessary for the primary purpose of the tool/app needs to have the consent of the user thus all opt-out telemetry is illegal because the tool/app can execute its purpose just fine without the telemetry Note that this is not a problem only of the toolmaker, this is a problem also for the employers that are exposing the developers to these tools creating unneccesary burdons for them to gather the consent of their employees.
notpushkin 4y ago
A better solution for Visual Studio Code would be to just switch to https://vscodium.com/ https://vscodium.com/ instead.
- timseverien 4y ago
  I’ll be sure to list that as an alternative!
qwery 4y ago
Applications should not have network/internet access by default. Operating systems should be competing on features that put you in control[0]. To do anything less than blocking every connection until you've allowed it is putting a lot of faith in software (vendors) that they have already demonstrated they will abuse. It's nice that some software grants you the privilege of asking it politely to not do a telemetry[1], I guess. But it (and the vendor) already demonstrated they are happy to breach your trust (and, arguably, your security) for their own arbitrary reasons. So many of these tools present themselves as free software. But if you're not in control of it, it's not free. [0] Unfortunately, it's really nice when you control the operating system, productivity software suite, game development studios & publishers, email, world's best and most helpful good boy with your best interests at heart online chat assistant, scalable web services provider, programming languages, software forge, proprietary 3D graphics stack, laptops, game consoles, ... [1] What does `telemetry = no` even mean anyway? Does the tool report that telemetry was disabled? Does the tool now do nothing on a network that isn't explicitly declared, or what is required to perform the actual work you ran it to do?
butz 4y ago
Are there any good examples of how telemetry actually improved experience for users? I don't mind if providing device hardware information will one day lead to improved performance on my old laptop. But when software tries to collect all the data and does nothing - that's just a waste of bandwidth and CPU cycles.

130 points by gravitate 4y ago

There are lots of other types of privacy issues in open source out there, this wiki page documents some of them: https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues

z3t4 4y ago

I guess this is only what you can find out from tcpdump and strace ? Reading the EULA/privacy policy is way scarier, for example content of files, network information, other apps on your computer, and web searches. If you are using a free - as in free beer - and not free as in free software - you are the product!

JohnFen 4y ago
> If you are using a free - as in free beer - and not free as in free software - you are the product! True. And increasingly, paying for the software doesn't make this any better.
timseverien 4y ago
The currently available information is all from browsing documentation and scanning source code. Some people suggested looking into JetBrains IDEs, which isn’t open-source, and thus would require packet sniffing.

JohnFen 4y ago

Hopefully, this sort of thing can at least be stopped by very restrictive outbound firewall rules, but it's getting to the point where you have to seriously consider only using dev tools on air-gapped machines anymore.

readerbaza 4y ago
This is the only way. Just deny by default. I never liked Postman and that's how I mostly stopped using it. Completely stops working on analytics request denial and then starts sending reports to Sentry (but even if you allow those, they don't learn, I've tried)

palijer 4y ago

I don't seem to understand the "let's take back our data" theme here. If someone builds a frontend website that you use, do you have the right to not have any metrics gathered about how you use their frontend that they built? What about server logs? If I send an http request to a server, do I have any right to say they can't log that request? What about the database metrics?

alextheparrot 4y ago
This is talking specifically about the frameworks people use forwarding telemetry to the developers of those frameworks
Nicksil 4y ago
>If someone builds a frontend website that you use, do you have the right to not have any metrics gathered about how you use their frontend that they built? Yes, absolutely. That website's code is being executing on my machine, consuming my power, then using my internet service to phone home with a data package of arbitrary size.
intelVISA 4y ago
If walking into Walmart you were stopped and had your pockets turned over by a greeter and had to record your car registration, DOB and favorite Electron app "just having a look bud, now carry on" would you go back?
- EthicalSimilar 4y ago
  Yes because wanting to collect metrics on which devices your users are using to better aid in the design and development of your application is similar to giving your DOB and VRN to Walmart.
  - JohnFen 4y ago
    I'm not disagreeing with your point, but did want to add in that what a developer's intentions are don't mean a great deal, because there's a serious trust problem. It's very difficult to tell what data is really being reported by an application. The majority of the time, all we have to go by is what the developer says is being collected. But the developer claims cannot be considered trustworthy by default. Many developers have simply lied in the past about what they collect. And even if the developer is truthful, they can only speak for what the software is doing at the moment. There's no guarantee that the developer won't change their mind in the future, or the product won't be sold to another company that isn't so considerate of their users.

RodgerTheGreat 4y ago

Telemetry in webapps is incredibly tempting, because it's just so easy to collect. Even without JavaScript, web browsers offer a dazzling array of ways for applications to call home with fingerprinting and tracking information. Because it is easy, it is commonplace, and many will use this as a justification for their own decisions. It is true that, in some cases, telemetry can make it faster and easier to improve software, but this is ultimately placing the convenience of the developers ahead of the privacy and autonomy of the users. I believe that software should serve the interests of users, and informed, affirmative consent for phoning home is an absolute baseline for respecting their wishes.

Entinel 4y ago
> but this is ultimately placing the convenience of the developers ahead of the privacy and autonomy of the users. Is it though? Putting aside the issue of whether you trust the person collecting telemetry for a second. You can collect telemetry completely anonymized. You don't have store IPs or any sort of personal identifier. I know a certain crowd still won't like it but in practice how does that harm the privacy of the user?
- JohnFen 4y ago
  > You can collect telemetry completely anonymized. You can't. You can decide to discard identifying information (although only if you aggregate and don't insert some sort of "anonymous" identifier), sure. But you're still going to collect it. So it all boils down to trusting not only the developer, but any company or interest that might acquire the developer or product in the future. And I think it has been repeatedly demonstrated that this trust is not well-placed.
  - notpushkin 4y ago
    > You can't. Of course you can! Just route telemetry through Tor.
- Lammy 4y ago
  The very act of making a network connection (data points: network address + time of use) makes it impossible to be truly anonymous https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/ https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

laerios 4y ago

Products by JetBrains are notoriously missing.

ricardobeat 4y ago
That’s very different isn’t it? Telemetry on an application you are a customer of, especially one with a GUI is expected. Tracking on a framework that you install, maybe even as a third party dependency, is not. Can you picture every major software dependency you use phoning home when you start a project?
- RodgerTheGreat 4y ago
  The only real differences are who the user is (possibly a developer vs. an "end user") and how many hands are rifling through the user's pockets without permission. In an audience composed of mostly developers the attitude toward these scenarios may be different, but the fundamental ethical calculus is the same.
m463 4y ago
Meaning that they don't collect telemetry, or that they DO collect telemetry and it's not mentioned?
- laerios 4y ago
  Opt-in telemetry, as well as unspecified telemetry while phoning home for license checks. I gather from memory that IDEs based on the IntelliJ platform scour the local network in search for other local network-connected machines running instances of their IDEs - e.g. in order to detect forbidden duplication of licenses. It is not apparently clear what details are(n't) transmitted back to the mothership. This example requires a finer-grained analysis than the broadly chosen "opt-in" and "opt-out" categories to describe telemetry collection, and I wish for this information initiative to improve in clarity and thoroughness (e.g. does VSCode also scour the local network?). Addendum: Thanks for asking for clarification. The grandparent comment could've been ambiguous in intent.

ricardobeat 4y ago

Personally I find this unacceptable. It’s ok to do it within your own company environment, but not for a public open-source project. This is a slippery slope for “understanding more about our users” and I challenge anyone to show a meaningful improvement that derived from telemetry of this kind. There are better ways to figure out how a project is used without harming privacy (ex: analyzers like BuiltWith). Projects doing this should get a red mark to discourage it.

JohnFen 4y ago
I actually think it would be OK if the telemetry were opt-in. At this point, I'd even settle for just having the software actually warn you about the data collection on first use.
- ikiris 4y ago
  you opt in by using the product. especially if its open source.
  - teej 4y ago
    Tracking my usage was never part of the social contract of OSS. This post is a reminder of that.
    - martypitt 4y ago
      What social contract is that? As far as I'm aware, the contract of OSS is "you can fork this to change it, if you don't like it" (license permitting). A big part of the reason people advocate for OSS is so they can read the source code to understand what's going on, and change the parts they don't like. Telemtry sits squarely under that usecase. I agree that it's good manners for projects made users aware of telemetry, but there's no "contract" that implies they have to.
      - JohnFen 4y ago
        He was talking about the social contract, not the license. OSS is a community that has mores, expectations, and social contracts like any other community. Spying is very much in opposition to that social contract.

hankchinaski 4y ago

People that keep whining about privacy and all have never tried to build a business where you need insights and data to not put your company out of business. It’s all a matter of perspective and not all black and white. The truth is to be found in the middle

JohnFen 4y ago
This isn't true at all. I've been in this business a long time, and have developed several very successful products. I know that this sort of data is very useful to a business. But I also know that it's abusive and wrong to extract this data without my customers agreeing to it. While this data is very valuable, not having it isn't an existential issue for any company (or, if it is, that's because there's something very wrong with how the company operates.) > The truth is to be found in the middle Hard disagree. This is an issue of consent, and I don't see how there's a middle ground for consent.
barnabee 4y ago
The success of your business isn't my problem. The fact that you may have incentives to do bad things is just a reason society should make laws against you doing them, not a reason I should feel sorry for you and let you spy on me.
earthling8118 4y ago
Okay, I'll offer up a perspective for you: the company should just go out of business then. If you need it that bad for success, then that is a signal that you aren't supposed to succeed. Full stop.
toastercat 4y ago
Just make it opt-in. The real problem here is that is that these products send data by default without explicit consent. Ask yourself this question: do you think most people who use these tools know that their data is being sent? Probably not, right? OK, of those people, do you think 100% of them will be totally OK with their data being collected once they find out? Probably not, right? Then why the fuck do this? > But then no one opts in! OK that is your business' problem to solve.

m463 4y ago

some stuff I remember on mac: docker ce - collects telemetry in the installer before you have even installed anything brew - telemetry on by default balena etcher - telemetry anything apple

notpushkin 4y ago
> balena etcher Holy shit! A glorified dd if=/of= that uses Electron and has telemetry – now that's something

Jackevansevo 4y ago

I couldn't care less if it's phoning home by default, the data helps build a better product. Opt in telemetry is basically useless as you're self selecting for people that discover/care enough to enable the feature. In a world where we have companies like Google/Facebook and massive levels of surveillance it's bizarre to me that this is the hill some of you want to die on. The tools themselves provide a way to disable it, so I don't see what any of the fuss is about. This happened recently with a telemetry proposal in the Go community and everyone threw their toys out of the pram. The Go team was forced to back peddle and now the telemetry collected by the toolchain is worse off because of this.

fbdab103 4y ago
Go famously does not listen to users. Am I to believe that the one thing holding back Go development was tabulated data?
- mseepgood 4y ago
  Why do you say that when this is a prime example that they actually do listen to users?
  - fbdab103 4y ago
    Ha, fair point.
- Jackevansevo 4y ago
  Except this time they did listen to users (to the detriment of their telemetry data)
toastercat 4y ago
That's cool that you don't care, but some people do care, or else this site wouldn't exist in the first place.
saagarjha 4y ago
Just because Google or Facebook does something doesn’t mean everyone else should get away with something a little less bad.

chrsjxn 4y ago

This site would be a lot more useful if it talked about _what_ data was collected, rather than just assigning 25 for "Data sensitivity". It's also pretty interesting to see the comments here, in a privacy focused thread, and contrast them with comments elsewhere about software performance. If you like faster software, developers need to measure it.

timseverien 4y ago
I tried doing that on the tool-specific detail page, but they’re broad categories, e.g. “Device, Environment, Usage” for Next.js. Do you think that’s sufficient?
- chrsjxn 4y ago
  I saw (after posting) that all the tool specific pages do link specifically to each project's documentation about what telemetry data is collected. Those categories feel a little too broad to me, especially without clearly stated definitions. "Environment" in particular made me second guess if dev tools were leaking secrets. But, thankfully, the projects I looked at were very clear that they don't collect anything from the shell environments. Maybe all it really needs is some detail for what's in the category. "Device (OS, core count, available memory)" or "Usage (command, plugins, timing)"?

moi2388 4y ago

There should be laws against the collection of data without explicit opt-in consent. Oh wait, there already is, it’s just being completely ignored

Vinnl 4y ago
I don't know which law you're referring to specifically, but often they relate to personally identifiable information, and have carve-outs for non-PII data.
- hexo 4y ago
  IP address is personal info.
  - Vinnl 4y ago
    That's fair enough, and I believe just not storing it is not even enough. I'm not sure how they deal with that.
- Nextgrid 4y ago
  The GDPR for example, which enforces opt-in for anything not strictly necessary for the provision of the service (and no, telemetry doesn't count as "strictly necessary"), enforces the concept of data minimization (which means you must collect & process as little personal data as possible to fullfil your objective) and considers IP addresses as personal data.
  - timseverien 4y ago
    I reviewed the source-code before adding them to the site. I can’t say for sure IP addresses aren’t stored server-side, so we have to trust them that they don’t, but most tools do find creative ways to get some kind of unique and persistent IDs. For example, Astro computes a hash for the git repository remote URL, and Storybook computes an ID by hashing the first commit hash in the repo.

kdeldycke 4y ago

Maybe it is time to revive https://consoledonottrack.com https://consoledonottrack.com , an initiative to unify the convention of having one standard environment variable to opt-out of any tracking.

deafpolygon 4y ago

This doesn't seem to be correct for PowerShell https://telemetry.timseverien.com/opt-out/ https://telemetry.timseverien.com/opt-out/

timseverien 4y ago
I may have not tested this thoroughly enough — I’ll be sure to revisit it soon.

deafpolygon 4y ago

To provide an extreme example; if you have sex with someone without asking them, it's rape. "But baby, I assumed you wanted it because you had a glass of wine and you were wearing that sexy outfit." - Still rape. Opt-out telemetry is like that, too, you stop only after penetration. Or another example, if architects decided to start putting cameras in the house everywhere. The camera, somehow, blocks out your face but monitors everything else. "But, we need this data to figure out which part of the house you're using and how often you're in these rooms. PINKY promise it's anonymous and no one will know who you are." Opt-in consent is the only right way.

Havoc 4y ago

While tracking is never ideal I don't personally mind tool level tracking like this if it helps the dev, especially for CLI. What command line switch I prefer seems less problematic than say my browsing habits. One hell of a slippery slope I know, but it does seem to me like a spectrum

wootland 4y ago
The CLI is the last place I want to be tracked. There's so much sensitive data there, and there currently exists a culture of privacy (that's under attack). Most timeless and excellent CLI tools have had zero tracking in them. Git and Vim did not get designed by spying on people's usage.

cowl 4y ago

> Assuming no personal identifyable information is saved, this is legal. This is not true in Europe Anymore. Any Optout telemetry is illegal because they have to establish a connection to the telemetry server and thus leaking the user IP (which is PII for GDPR) without the user's consent. See the latest case that even linking a font from CDNs is illegal. https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ relevant part: > It is sufficient that the defendant has the abstract possibility of identifying the persons behind the IP address. Whether the defendant or X. has the specific opportunity to link the IP address to the plaintiff is irrelevant. Any connection that is not neccessary for the primary purpose of the tool/app needs to have the consent of the user thus all opt-out telemetry is illegal because the tool/app can execute its purpose just fine without the telemetry Note that this is not a problem only of the toolmaker, this is a problem also for the employers that are exposing the developers to these tools creating unneccesary burdons for them to gather the consent of their employees.

notpushkin 4y ago

A better solution for Visual Studio Code would be to just switch to https://vscodium.com/ https://vscodium.com/ instead.

timseverien 4y ago
I’ll be sure to list that as an alternative!

qwery 4y ago

Applications should not have network/internet access by default. Operating systems should be competing on features that put you in control[0]. To do anything less than blocking every connection until you've allowed it is putting a lot of faith in software (vendors) that they have already demonstrated they will abuse. It's nice that some software grants you the privilege of asking it politely to not do a telemetry[1], I guess. But it (and the vendor) already demonstrated they are happy to breach your trust (and, arguably, your security) for their own arbitrary reasons. So many of these tools present themselves as free software. But if you're not in control of it, it's not free. [0] Unfortunately, it's really nice when you control the operating system, productivity software suite, game development studios & publishers, email, world's best and most helpful good boy with your best interests at heart online chat assistant, scalable web services provider, programming languages, software forge, proprietary 3D graphics stack, laptops, game consoles, ... [1] What does `telemetry = no` even mean anyway? Does the tool report that telemetry was disabled? Does the tool now do nothing on a network that isn't explicitly declared, or what is required to perform the actual work you ran it to do?

butz 4y ago

Are there any good examples of how telemetry actually improved experience for users? I don't mind if providing device hardware information will one day lead to improved performance on my old laptop. But when software tries to collect all the data and does nothing - that's just a waste of bandwidth and CPU cycles.