4 ms·

I don't seem to understand the "let's take back our data" theme here. If someone builds a frontend website that you use, do you have the right to not have any m

I don't seem to understand the "let's take back our data" theme here. If someone builds a frontend website that you use, do you have the right to not have any metrics gathered about how you use their frontend that they built? What about server logs? If I send an http request to a server, do I have any right to say they can't log that request? What about the database metrics?

alextheparrot 4y ago
This is talking specifically about the frameworks people use forwarding telemetry to the developers of those frameworks
Nicksil 4y ago
>If someone builds a frontend website that you use, do you have the right to not have any metrics gathered about how you use their frontend that they built? Yes, absolutely. That website's code is being executing on my machine, consuming my power, then using my internet service to phone home with a data package of arbitrary size.
intelVISA 4y ago
If walking into Walmart you were stopped and had your pockets turned over by a greeter and had to record your car registration, DOB and favorite Electron app "just having a look bud, now carry on" would you go back?
- EthicalSimilar 4y ago
  Yes because wanting to collect metrics on which devices your users are using to better aid in the design and development of your application is similar to giving your DOB and VRN to Walmart.
  - JohnFen 4y ago
    I'm not disagreeing with your point, but did want to add in that what a developer's intentions are don't mean a great deal, because there's a serious trust problem. It's very difficult to tell what data is really being reported by an application. The majority of the time, all we have to go by is what the developer says is being collected. But the developer claims cannot be considered trustworthy by default. Many developers have simply lied in the past about what they collect. And even if the developer is truthful, they can only speak for what the software is doing at the moment. There's no guarantee that the developer won't change their mind in the future, or the product won't be sold to another company that isn't so considerate of their users.
- pimterry 4y ago
  This is a poor analogy - while it's certainly a debatable practice, nobody is being 'stopped', and this isn't comparable to going through anybody's pockets or digging up other unrelated info about their lives. Even the article here explicitly assumes that all the data is not personally identifiable, and I'd be very surprised if that's not correct (because otherwise they'd be begging for a GDPR problem). Also though, interestingly Walmart actually really does do the equivalent of this: https://bernardmarr.com/walmart-big-data-analytics-at-the-worlds-biggest-retailer/ https://bernardmarr.com/walmart-big-data-analytics-at-the-wo.... They have real-time detailed metrics for individual customer transaction behaviour in stores, and I would not be surprised at all if they tracked lots more, e.g. the total number of cars in parking lots, how long different cohorts of customers spend in stores, etc.
  - cowl 4y ago
    In fact the article is wrong. Doesn't matter what data they do collect, they need to establish a connection to the telemetry server and that exposes the IP (which is Personally Identifiable information) without the user's consent. https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ And the problem is even bigger, how do i know what data is being collected? even if it declared publicly somewhere, do i need to check on each update if the collected data has changed? > otherwise they'd be begging for a GDPR problem They have in fact a GDPR problem but like in the case above where it was not Google to answer for the GDPR Problem but the site that used Google CDN, in this case too, most probably it will not be these toolmakers who are taken to court but the companies that asking their employees to use these tools without disclosing this personal IP leak. If this becomes the norm how much burdon do we have to go through to verify each tool whether we need to ammend the employee GDPR consents or not? I see this already having an effect... Just standardise only on Microsoft tools so at least we need to gather GDPR consent only for Exposing data to Microsoft...
JohnFen 4y ago
> If someone builds a frontend website that you use, do you have the right to not have any metrics gathered about how you use their frontend that they built? Data about me, my machines, or my use of my machines is private data. Nobody has any right to it besides me. If it's being collected without my informed consent, that's just spying.
sholladay 4y ago
Privacy matters, no matter what layer of the tech stack we are talking about. The developer is not legally required to build an on/off switch for telemetry in most jurisdictions, but they should anyway. It’s the right thing to do. It could be a switch for the whole stack or you could provide more granular options. Personally, I like to implement a “Report a bug” button which sends detailed telemetry when it really matters. To keep an eye on more general usage data, I use Cloudflare Web Analytics. It’s easy to build a toggle for analytics. Personally, I find that more than sufficient, especially when combined with traditional user studies. Having the backend respect the toggle too wouldn’t be that hard. https://www.cloudflare.com/web-analytics/ https://www.cloudflare.com/web-analytics/

alextheparrot 4y ago

This is talking specifically about the frameworks people use forwarding telemetry to the developers of those frameworks

Nicksil 4y ago

>If someone builds a frontend website that you use, do you have the right to not have any metrics gathered about how you use their frontend that they built? Yes, absolutely. That website's code is being executing on my machine, consuming my power, then using my internet service to phone home with a data package of arbitrary size.

intelVISA 4y ago

If walking into Walmart you were stopped and had your pockets turned over by a greeter and had to record your car registration, DOB and favorite Electron app "just having a look bud, now carry on" would you go back?

EthicalSimilar 4y ago
Yes because wanting to collect metrics on which devices your users are using to better aid in the design and development of your application is similar to giving your DOB and VRN to Walmart.
- JohnFen 4y ago
  I'm not disagreeing with your point, but did want to add in that what a developer's intentions are don't mean a great deal, because there's a serious trust problem. It's very difficult to tell what data is really being reported by an application. The majority of the time, all we have to go by is what the developer says is being collected. But the developer claims cannot be considered trustworthy by default. Many developers have simply lied in the past about what they collect. And even if the developer is truthful, they can only speak for what the software is doing at the moment. There's no guarantee that the developer won't change their mind in the future, or the product won't be sold to another company that isn't so considerate of their users.
pimterry 4y ago
This is a poor analogy - while it's certainly a debatable practice, nobody is being 'stopped', and this isn't comparable to going through anybody's pockets or digging up other unrelated info about their lives. Even the article here explicitly assumes that all the data is not personally identifiable, and I'd be very surprised if that's not correct (because otherwise they'd be begging for a GDPR problem). Also though, interestingly Walmart actually really does do the equivalent of this: https://bernardmarr.com/walmart-big-data-analytics-at-the-worlds-biggest-retailer/ https://bernardmarr.com/walmart-big-data-analytics-at-the-wo.... They have real-time detailed metrics for individual customer transaction behaviour in stores, and I would not be surprised at all if they tracked lots more, e.g. the total number of cars in parking lots, how long different cohorts of customers spend in stores, etc.
- cowl 4y ago
  In fact the article is wrong. Doesn't matter what data they do collect, they need to establish a connection to the telemetry server and that exposes the IP (which is Personally Identifiable information) without the user's consent. https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ And the problem is even bigger, how do i know what data is being collected? even if it declared publicly somewhere, do i need to check on each update if the collected data has changed? > otherwise they'd be begging for a GDPR problem They have in fact a GDPR problem but like in the case above where it was not Google to answer for the GDPR Problem but the site that used Google CDN, in this case too, most probably it will not be these toolmakers who are taken to court but the companies that asking their employees to use these tools without disclosing this personal IP leak. If this becomes the norm how much burdon do we have to go through to verify each tool whether we need to ammend the employee GDPR consents or not? I see this already having an effect... Just standardise only on Microsoft tools so at least we need to gather GDPR consent only for Exposing data to Microsoft...

JohnFen 4y ago

> If someone builds a frontend website that you use, do you have the right to not have any metrics gathered about how you use their frontend that they built? Data about me, my machines, or my use of my machines is private data. Nobody has any right to it besides me. If it's being collected without my informed consent, that's just spying.

sholladay 4y ago

Privacy matters, no matter what layer of the tech stack we are talking about. The developer is not legally required to build an on/off switch for telemetry in most jurisdictions, but they should anyway. It’s the right thing to do. It could be a switch for the whole stack or you could provide more granular options. Personally, I like to implement a “Report a bug” button which sends detailed telemetry when it really matters. To keep an eye on more general usage data, I use Cloudflare Web Analytics. It’s easy to build a toggle for analytics. Personally, I find that more than sufficient, especially when combined with traditional user studies. Having the backend respect the toggle too wouldn’t be that hard. https://www.cloudflare.com/web-analytics/ https://www.cloudflare.com/web-analytics/