5 ms·

> I'll be honest, I don't really see the complaint here. There is no explicit consent.

CJefferson 4y ago
But dropbox already has huge amounts of information about you, in particular the names, contents, and history of all of your files.
- zorked 4y ago
  They have consent for that. It's not hard. Also consent to store does not imply consent to read, process, make use of.
  - NoZebra120vClip 4y ago
    I keep searching xkcd, but all my efforts are frustrated, and this is as close as I get: https://xkcd.com/908/ https://xkcd.com/908/ I distinctly recall a webcomic in the past few years lampooning cloud storage. There was a guy who said "hey, there's this guy down the street who lets me keep stuff on shelves in his garage." "What does he charge you?" "Nothing, he says it's just cool if I keep it there." and then the stuff is sold off or tampered with, the guy is irate, and the moral of the story is essentially "why did you trust a random guy with a garage to keep your stuff?"
    - zamnos 4y ago
      https://xkcd.com/1150/ https://xkcd.com/1150/ ?
      - NoZebra120vClip 4y ago
        THANK YOU, zamnos! No wonder I couldn't find it. It was a current-events piece about a change in Instagram's TOS. Explanation here: https://www.explainxkcd.com/wiki/index.php/1150:_Instagram https://www.explainxkcd.com/wiki/index.php/1150:_Instagram
        Dylan16807 4y ago
        But also the comic as you remembered it has a different moral from the actual comic, and would be very insulting to apply to non-paying dropbox users. It's okay for a free service to change how they operate with a take-it-or-leave-it offer. It is not okay for a free service to invade your privacy without permission. Additionally, all users should be able to trust Dropbox just as much as the paying users.
sharken 4y ago
Exactly, as a paying user having the option to disable telemetry is not unreasonable. Too bad Dropbox does not see it that way.
- senko 4y ago
  Indeed, as a paying user I would also want an option to disable them reading the files off my disk. To bad they just start scanning everything in ~/Dropbox.
- bheadmaster 4y ago
  I see a trend of software engineers that don't see users as someone who they are providing service to - they see them as just one element of a machine they're optimizing to make their software better. They feel that the engineering quest itself is the most important thing in the world, so they feel entitled to any and all data they are technically capable of collecting. It's a shame. I wish more engineers would see things through Richard Stallman's eyes, and realize that software is supposed to serve its users, not its creators. But, as the saying goes: "It is difficult to get a man to understand something, when his salary depends on his not understanding it."
  - weberer 4y ago
    If you asked me which part of the company decided to shove telemetry in the product, my last guess would be the software engineers.
    - rcxdude 4y ago
      There is a reason it's popular: it's extremely useful for software development to a) have actual hard data on how your software is being used, and b) have a large selection of crash data for debugging rare issues. If it's not the software engineers who want it, it's the technical management who see the immense value in having it.
      - weberer 4y ago
Tepix 4y ago
In particular, consent may be a requirement by the GDPR.
- alkonaut 4y ago
  It's obvious from the discussion that the GDPR isn't an issue here as there is no PII involved (as should be the case with all telemetry)
  - zamnos 4y ago
    The GDPR lists IP addresses as PII, and not to be all "your IP address is leaking" but in order to send the telemetry, your computer's IP (or that of your VPN) is being sent to Dropbox, potentially to be logged.
    - planede 4y ago
      AFAIK, it's only an issue if it's actually logged. Also, pretty much all services need to know the IP address during a session. It's fine if it's only used for the purpose of providing the service and not logged.
    - alkonaut 4y ago
      That’s not a GDPR issue other than if stored. And remember this is an app that already must send requests to the same place in order to function at all.
      - zamnos 4y ago
        Yes but because your computer is sending its IP to Dropbox, you can't say, a priori, make the claim that the GDPR isn't an issue.
        alkonaut 4y ago
        Of course not. It might send your medical records too. It will send the IP regardless of whether telemetry is enabled. But they do claim that no PII is stored for telemetry. Whenever the topic of Telemetry comes up I try to keep to the discussion about properly anonymous telemetry, simply because that’s where there is any discussion at all. If anyone transmit or stores anything they aren’t entitled to it’s obviously always wrong so that’s not an interesting discussion. Dropbox of course already stores PII (your files) but that doesn’t mean they can do so for other info or other purposes.
alkonaut 4y ago
It's polite to be transparent about telemetry, but it's not like there is a requirement in any regulation anywhere to ask for explicit consent (e.g. similar to how GDPR works when PII is involved)
- WhyNotHugo 4y ago
  There might not be a hard legal requirement, but it's still a valid complaint. There's no legal requirement for someone to be polite to a cashier at a supermarket, yet complaining when somebody is an asshole is still a valid complaint.
- krono 4y ago
  You're mixing several things together here. Transparency is one of GDPRs cornerstones and very much not just nice to provide, but a deeply serious and non-negotiable hard requirement regardless of how you legitimise the data collection.
  - alkonaut 4y ago
    What I’m saying is that the GDPR is irrelevant unless there is data collected that counts as PII. Collecting non PII isn’t covered by the GDPR. So yes there are two things: GDPR which is irrelevant here, and storage of non-PII which should be done transparently because it’s polite to be transparent, but not a regulatory requirement.
    - krono 4y ago
      False, I will rephrase: it is a regulatory requirement under the GDPR to disclose the fact that you are collecting data, to provide a detailed and easily accessible specification of the information contents, a precise definition of how this data is processed and used, and your legal justification(s) for doing so, and to do so for each separate type or kind of collection involving individuals, regardless of whether this includes any PII or not. The few exceptions that exist are only applicable in cases where there is no potentially identifiable data collected at all, which is obviously not the case here. Here is a very accessible (although non-official) GDPR resource that I've come across: https://gdpr-info.eu/ https://gdpr-info.eu/ Obligatory "I am not a lawyer" disclaimer :)

But dropbox already has huge amounts of information about you, in particular the names, contents, and history of all of your files.

zorked 4y ago
They have consent for that. It's not hard. Also consent to store does not imply consent to read, process, make use of.
- NoZebra120vClip 4y ago
  I keep searching xkcd, but all my efforts are frustrated, and this is as close as I get: https://xkcd.com/908/ https://xkcd.com/908/ I distinctly recall a webcomic in the past few years lampooning cloud storage. There was a guy who said "hey, there's this guy down the street who lets me keep stuff on shelves in his garage." "What does he charge you?" "Nothing, he says it's just cool if I keep it there." and then the stuff is sold off or tampered with, the guy is irate, and the moral of the story is essentially "why did you trust a random guy with a garage to keep your stuff?"
  - zamnos 4y ago
    https://xkcd.com/1150/ https://xkcd.com/1150/ ?
    - NoZebra120vClip 4y ago
      THANK YOU, zamnos! No wonder I couldn't find it. It was a current-events piece about a change in Instagram's TOS. Explanation here: https://www.explainxkcd.com/wiki/index.php/1150:_Instagram https://www.explainxkcd.com/wiki/index.php/1150:_Instagram
      - Dylan16807 4y ago
        But also the comic as you remembered it has a different moral from the actual comic, and would be very insulting to apply to non-paying dropbox users. It's okay for a free service to change how they operate with a take-it-or-leave-it offer. It is not okay for a free service to invade your privacy without permission. Additionally, all users should be able to trust Dropbox just as much as the paying users.

sharken 4y ago

Exactly, as a paying user having the option to disable telemetry is not unreasonable. Too bad Dropbox does not see it that way.

senko 4y ago
Indeed, as a paying user I would also want an option to disable them reading the files off my disk. To bad they just start scanning everything in ~/Dropbox.
bheadmaster 4y ago
I see a trend of software engineers that don't see users as someone who they are providing service to - they see them as just one element of a machine they're optimizing to make their software better. They feel that the engineering quest itself is the most important thing in the world, so they feel entitled to any and all data they are technically capable of collecting. It's a shame. I wish more engineers would see things through Richard Stallman's eyes, and realize that software is supposed to serve its users, not its creators. But, as the saying goes: "It is difficult to get a man to understand something, when his salary depends on his not understanding it."
- weberer 4y ago
  If you asked me which part of the company decided to shove telemetry in the product, my last guess would be the software engineers.
  - rcxdude 4y ago
    There is a reason it's popular: it's extremely useful for software development to a) have actual hard data on how your software is being used, and b) have a large selection of crash data for debugging rare issues. If it's not the software engineers who want it, it's the technical management who see the immense value in having it.
    - weberer 4y ago

Tepix 4y ago

In particular, consent may be a requirement by the GDPR.

alkonaut 4y ago
It's obvious from the discussion that the GDPR isn't an issue here as there is no PII involved (as should be the case with all telemetry)
- zamnos 4y ago
  The GDPR lists IP addresses as PII, and not to be all "your IP address is leaking" but in order to send the telemetry, your computer's IP (or that of your VPN) is being sent to Dropbox, potentially to be logged.
  - planede 4y ago
    AFAIK, it's only an issue if it's actually logged. Also, pretty much all services need to know the IP address during a session. It's fine if it's only used for the purpose of providing the service and not logged.
  - alkonaut 4y ago
    That’s not a GDPR issue other than if stored. And remember this is an app that already must send requests to the same place in order to function at all.
    - zamnos 4y ago
      Yes but because your computer is sending its IP to Dropbox, you can't say, a priori, make the claim that the GDPR isn't an issue.
      - alkonaut 4y ago
        Of course not. It might send your medical records too. It will send the IP regardless of whether telemetry is enabled. But they do claim that no PII is stored for telemetry. Whenever the topic of Telemetry comes up I try to keep to the discussion about properly anonymous telemetry, simply because that’s where there is any discussion at all. If anyone transmit or stores anything they aren’t entitled to it’s obviously always wrong so that’s not an interesting discussion. Dropbox of course already stores PII (your files) but that doesn’t mean they can do so for other info or other purposes.

alkonaut 4y ago

It's polite to be transparent about telemetry, but it's not like there is a requirement in any regulation anywhere to ask for explicit consent (e.g. similar to how GDPR works when PII is involved)

WhyNotHugo 4y ago
There might not be a hard legal requirement, but it's still a valid complaint. There's no legal requirement for someone to be polite to a cashier at a supermarket, yet complaining when somebody is an asshole is still a valid complaint.
krono 4y ago
You're mixing several things together here. Transparency is one of GDPRs cornerstones and very much not just nice to provide, but a deeply serious and non-negotiable hard requirement regardless of how you legitimise the data collection.
- alkonaut 4y ago
  What I’m saying is that the GDPR is irrelevant unless there is data collected that counts as PII. Collecting non PII isn’t covered by the GDPR. So yes there are two things: GDPR which is irrelevant here, and storage of non-PII which should be done transparently because it’s polite to be transparent, but not a regulatory requirement.
  - krono 4y ago
    False, I will rephrase: it is a regulatory requirement under the GDPR to disclose the fact that you are collecting data, to provide a detailed and easily accessible specification of the information contents, a precise definition of how this data is processed and used, and your legal justification(s) for doing so, and to do so for each separate type or kind of collection involving individuals, regardless of whether this includes any PII or not. The few exceptions that exist are only applicable in cases where there is no potentially identifiable data collected at all, which is obviously not the case here. Here is a very accessible (although non-official) GDPR resource that I've come across: https://gdpr-info.eu/ https://gdpr-info.eu/ Obligatory "I am not a lawyer" disclaimer :)