6 ms·

Telemetry

92 points by davedx 3y ago

ricardobeat 3y ago
Submission title is a bit confusing: “opt-in” means you have to opt-in, that is, the default is “off”. The sentence “opt-in by default” is the opposite of what I assume the poster meant. Storybook’s telemetry is opt-out as stated at the top of the page. This also looks like something that should be posted as a text submission with commentary - simply editorializing a link + title is discouraged in HN.
- kioleanu 3y ago
  I find the title to be pretty accurate and I am by no means a native speaker
  - K0balt 3y ago
    It definitely can be interpreted to mean that the telemetry is opt-in, or that it is opt-out. (“Opt-in by default” is a double positive, a less common sibling of the dreaded double negative)
    - Keirmot 3y ago
      Correct me if I’m wrong, but isn’t a double positive just a positive while a double negative is a positive? Opt-in by default: you are in You can’t not select opt-in: you are in
      - deleted 3y ago
        [deleted]
      - Y_Y 3y ago
        Yeah right
      - __MatrixMan__ 3y ago
        That's correct, but it's a relatively new thing. 150 years ago two or more negatives meant an emphatic no. The switch was caused by Frege and contemporaries.
      - K0balt 3y ago
        Yeah, this is more complex than a double positive isn’t it. Hmm. “Opt in , by default” would seem to mean you have to opt in, unless some unnamed external condition was met, so normally you would have to choose to participate… which is the opposite of this case , where to NOT participate you must, by default, opt OUT. And if you do not you are automatically committed to participate.
  - ptx 3y ago
    "Opt" means to "To choose; select" [0]. If you opt in (i.e. make the choice to go in), that implies that you were not already in. In other words, it implies that the default (when you don't make a choice) is "out", i.e. disabled. "Opt-in" and "opt-out" describe what the default is, so adding "by default" doesn't make any sense. If you can choose to go in ("opt-in"), then the default is "out". If you can choose to go out ("opt-out"), then the default is "in". Some companies appear to be trying to twist this into "The choice is yours, and we have taken the liberty of making that choice on your behalf.". [0] https://en.wiktionary.org/wiki/opt#English https://en.wiktionary.org/wiki/opt#English
    - jstummbillig 3y ago
      Opt in by participation is implicit all the time. If I play soccer I am not "opting in" to get hit by a ball, but rest assured, it is going to happen. There are topics dear to every subgroups heart, that the members will claim, surely must be exempt from this. As far as I can tell, the exemptions are mostly arbitrary.
      - ricardobeat 3y ago
        You’re completely ignoring the context. This is essentially about checkboxes. “Enabled by default” would mean tracking is always on, but doesn’t tell you if it can be disabled by the user. In the realm of privacy choices in software, we then started referring to these as “opt-in” (default off) or “opt-out” (default on) to communicate the default setting + the ability to change it. Advertising trackers, for example, are mandated by law to be “opt-in” (they pre-select the checkbox for you of course, without submitting, but that’s a whole other story).
      - ptx 3y ago
        In the soccer scenario, as you say, the only choice to make is whether to participate. Whether to get hit by the ball can't be chosen independently. So the only opting you can do is playing (and getting hit) or not playing (and not getting hit). In that scenario, the default is to not play soccer. If you want to play, you have to choose it, i.e. opt to play soccer, i.e. "opt in". So the default is that you're "out". Thus, playing soccer is "opt-in". If people were born into soccer matches and had to actively try to escape, that would be "opt-out". You make a choice (opt) to escape out of the soccer match. Notice that "opt-in" and "opt-out" describe the inverse of the default value: "opt-in" is the same as "out by default" and "opt-out" the same as "in by default". Mixing these phrases with opposite meanings (e.g. "opt-in by default") creates confusion, perhaps intentionally, about what the default value is.
- iamacyborg 3y ago
  It’d be clearer if they just said “opted-in by default”.
  - azangru 3y ago
    I thought the opting is something that is done by the user. If someone else has opted you in, that's... something different.
  - larschdk 3y ago
    No. To "opt" literally means "to make a choice". If the choice has been made for you, you are not "opted-in", you are in.
    - deleted 3y ago
      [deleted]
    - Y_Y 3y ago
      Maybe you could Newspeakify it into "co-opt-in"
      - Obscurity4340 3y ago
        No. Opt-out means you have to affirmatively make the choice to not be tracked or whtatever.
        deleted 3y ago
        [deleted]
    - iamacyborg 3y ago
      That’s being needlessly pedantic and being opted-in clearly details what has happened.
      - JohnFen 3y ago
        I could not disagree more. You can't "opt-in" someone else because they're not opting in at all. I think this is an important and meaningful distinction that we should call out, particularly since we're seeing more companies being deceptive on this point and trying to trick people through this confusing language.
- azangru 3y ago
  Yes, good point; if it's opt-out, it should say opt-out.
- ekanes 3y ago
  Sorta. The policy is "opt out" but you are "opted in" by default.
  - deleted 3y ago
    [deleted]
  - Timon3 3y ago
    You cannot be "opted in" by someone else. Only you can opt-in or opt-out.
  - deleted 3y ago
    [deleted]
- tjoff 3y ago
  When discussing the title, as people often do, copy the title verbatim when doing so. The title is now "Telemetry" and 90% of the discussions makes no sense anymore.
  - firtoz 3y ago
    > PSA: Storybook sends telemetry data, opt-in by default
    - rrrrrrrrrrrrr 3y ago
      Fixed: Storybook sends telemetry data, opt-out
justusw 3y ago
May I perhaps add my rant 50 cents here and link to my post about this? https://www.justus.pw/garden/telemetry.html https://www.justus.pw/garden/telemetry.html It’s opt out, and it doesn’t even completely disable it (unless given an env var as well) The devs know about this: https://github.com/storybookjs/storybook/discussions/19910 https://github.com/storybookjs/storybook/discussions/19910
bmacho 3y ago
Isn't there a telemetry manifesto? I understand that developers want to peek into what their users are doing. That is the fruit of their labor after all. However telemetry became increasingly easy lately, and it is impossible (in theory and in practice) to do it right. Collecting data of your users is - stupid - illegal - harming your users - makes your software a spyware so in summary, don't do that. Instead, do the exact opposite, and excessively delete any data that you may store. Also make sure that your users are exposed against 3rd party (isp, cnds and such) to the minimum when they check and get new updates. (Randomized update checks over TOR, for example.) They trust you, and allow your program to handle their network, so use it wisely. Also there are sane methods to know what your users are doing, for example you can buy usage blogposts from them, which you can showcase, and link in the manuals and support.
- tjoff 3y ago
  This is pretty basic stuff, but developers and the HN audience have a hard time to accept that. Ask yourself what value you got from your telemetry lately. Also how much effort you put into it. Do you even look at it regularly? Does it still make sense? Maybe consider the legality? Hint - if it isn't opt-in you are most likely doing something illegal. Congratulations! Does it still make sense? Maybe consider not being a total jackass and insult your users? Does it still make sense?
tilne 3y ago
I don’t mean to dismiss the importance of users owning and controlling their data, but isn’t telemetry a valid tool for software projects to gain valuable insights into how their product is being used and thus how to improve it? Yes, it can be (and, probably frequently is) abused. Yes there should be a way to opt-out of telemetry if a user desires for whatever reason. But I can’t help but feel this is posted in the spirit of “telemetry by default is bad” and I don’t really agree. Full disclosure: this is the first I’ve ever heard of Storybook, so if there’s something particularly gross about telemetry for this use case I’m not aware of it.
- have_faith 3y ago
  > there should be a way to opt-out of telemetry There should be a way to opt-in. Anything else is egregious.
  - tilne 3y ago
    That’s fair. If the telemetry really is helpful to building a better product it should be an easy case to make to users.
    - sf_rob 3y ago
      If Telemetry is valuable, it's largely valuable to the degree it's representative. Opt-in sacrifices this and even a well optimized opt-in process won't prevent that. This is not to say that Telemetry should be opt-out, just that you place other justifications ahead of the usefulness of Telemetry (which is fine).
      - quickthrower2 3y ago
        These days I reckon running an LLM over the storybook discord and reddits would yield more valuable data. How big peoples projects are on average doesn’t matter. 100 people asking the same question does.
        3y ago
croes 3y ago
- Timestamp of the occurrence. - Storybook unique identifier: One-way hash generated during Storybook - One way hash of the IP address I really doubt that that's "completely anonymous data"
Etheryte 3y ago
I took some interest in the concept of hashing IPs to avoid PII issues [0], and it turns out that since there's only so few IPv4 addresses, it's trivial to simply take the salt the project uses and calculate all the hashes. On my laptop it would take around two hours with the most naive implementation, so I don't really think this solves anything. This problem would be sidestepped by IPv6, but we all know how that is going so far. [0] https://github.com/storybookjs/storybook/discussions/19910#discussioncomment-7069903 https://github.com/storybookjs/storybook/discussions/19910#d...
- buildfocus 3y ago
  The classic better approach would be to drop part of the IP address entirely, so it's impossible to recreate the full value. For example, dropping the last octet (turning 123.4.5.6 into 123.4.5.0) means you can usually still do useful IP things (where in the world do our users come from, very roughly) while making it impossible to track unique users, or to definitively recognize real individuals. I've seen one octet masking used as standard, probably just because it's easy, but you could do any other similar change you like, optimising for more or less anonymity/granularity as required.
faichai 3y ago
Storybook is one of those projects, like Postman, that has completely lost the plot. It's unclear what objectives they are pursuing but in terms of developer experience they seem increasingly developer hostile. The CSF format is an unreadable joke and doesn't play that well with TypeScript, the number of plugins you need to do anything sane is ridiculous, and this telemetry story is a farce - open source should not skim data by default. I remember writing a super simple wrapper around Jasmine to do the same kind of thing, and was glad when I could ditch it for Storybook many moons ago. But if I was starting a project now I would probably rawdog it again, Storybook just causes too much pain. Is anyone aware of any similar projects that are more developer friendly?
- morbicer 3y ago
  It indeed became Sorrybook. https://github.com/tajo/ladle https://github.com/tajo/ladle looks promising if you use React
- microflash 3y ago
  There's also Histoire[1] for Svelte and Vuejs. [1]: https://histoire.dev/ https://histoire.dev/
- andrewmcwatters 3y ago
  What should people use instead of Postman these days? It seems to still be the only decent client for testing particular protocols, like OAuth 2.0. There's no way I'm using curl for that.
a_c 3y ago
The HN crowd seem to largely against “telemetry”. I wonder how do you know the things you build is useful if you don’t know it is being, well, used? On the other hand, back in the server side everything days, I can have more or less all metrics I want from nginx log. I wonder was it equally frowned upon or is the frowned upon an SPA phenomenon?

92 points by davedx 3y ago

Submission title is a bit confusing: “opt-in” means you have to opt-in, that is, the default is “off”. The sentence “opt-in by default” is the opposite of what I assume the poster meant. Storybook’s telemetry is opt-out as stated at the top of the page. This also looks like something that should be posted as a text submission with commentary - simply editorializing a link + title is discouraged in HN.

kioleanu 3y ago
I find the title to be pretty accurate and I am by no means a native speaker
- K0balt 3y ago
  It definitely can be interpreted to mean that the telemetry is opt-in, or that it is opt-out. (“Opt-in by default” is a double positive, a less common sibling of the dreaded double negative)
  - Keirmot 3y ago
    Correct me if I’m wrong, but isn’t a double positive just a positive while a double negative is a positive? Opt-in by default: you are in You can’t not select opt-in: you are in
    - deleted 3y ago
      [deleted]
    - Y_Y 3y ago
      Yeah right
    - __MatrixMan__ 3y ago
      That's correct, but it's a relatively new thing. 150 years ago two or more negatives meant an emphatic no. The switch was caused by Frege and contemporaries.
    - K0balt 3y ago
      Yeah, this is more complex than a double positive isn’t it. Hmm. “Opt in , by default” would seem to mean you have to opt in, unless some unnamed external condition was met, so normally you would have to choose to participate… which is the opposite of this case , where to NOT participate you must, by default, opt OUT. And if you do not you are automatically committed to participate.
- ptx 3y ago
  "Opt" means to "To choose; select" [0]. If you opt in (i.e. make the choice to go in), that implies that you were not already in. In other words, it implies that the default (when you don't make a choice) is "out", i.e. disabled. "Opt-in" and "opt-out" describe what the default is, so adding "by default" doesn't make any sense. If you can choose to go in ("opt-in"), then the default is "out". If you can choose to go out ("opt-out"), then the default is "in". Some companies appear to be trying to twist this into "The choice is yours, and we have taken the liberty of making that choice on your behalf.". [0] https://en.wiktionary.org/wiki/opt#English https://en.wiktionary.org/wiki/opt#English
  - jstummbillig 3y ago
    Opt in by participation is implicit all the time. If I play soccer I am not "opting in" to get hit by a ball, but rest assured, it is going to happen. There are topics dear to every subgroups heart, that the members will claim, surely must be exempt from this. As far as I can tell, the exemptions are mostly arbitrary.
    - ricardobeat 3y ago
      You’re completely ignoring the context. This is essentially about checkboxes. “Enabled by default” would mean tracking is always on, but doesn’t tell you if it can be disabled by the user. In the realm of privacy choices in software, we then started referring to these as “opt-in” (default off) or “opt-out” (default on) to communicate the default setting + the ability to change it. Advertising trackers, for example, are mandated by law to be “opt-in” (they pre-select the checkbox for you of course, without submitting, but that’s a whole other story).
    - ptx 3y ago
      In the soccer scenario, as you say, the only choice to make is whether to participate. Whether to get hit by the ball can't be chosen independently. So the only opting you can do is playing (and getting hit) or not playing (and not getting hit). In that scenario, the default is to not play soccer. If you want to play, you have to choose it, i.e. opt to play soccer, i.e. "opt in". So the default is that you're "out". Thus, playing soccer is "opt-in". If people were born into soccer matches and had to actively try to escape, that would be "opt-out". You make a choice (opt) to escape out of the soccer match. Notice that "opt-in" and "opt-out" describe the inverse of the default value: "opt-in" is the same as "out by default" and "opt-out" the same as "in by default". Mixing these phrases with opposite meanings (e.g. "opt-in by default") creates confusion, perhaps intentionally, about what the default value is.
iamacyborg 3y ago
It’d be clearer if they just said “opted-in by default”.
- azangru 3y ago
  I thought the opting is something that is done by the user. If someone else has opted you in, that's... something different.
- larschdk 3y ago
  No. To "opt" literally means "to make a choice". If the choice has been made for you, you are not "opted-in", you are in.
  - deleted 3y ago
    [deleted]
  - Y_Y 3y ago
    Maybe you could Newspeakify it into "co-opt-in"
    - Obscurity4340 3y ago
      No. Opt-out means you have to affirmatively make the choice to not be tracked or whtatever.
      - deleted 3y ago
        [deleted]
  - iamacyborg 3y ago
    That’s being needlessly pedantic and being opted-in clearly details what has happened.
    - JohnFen 3y ago
      I could not disagree more. You can't "opt-in" someone else because they're not opting in at all. I think this is an important and meaningful distinction that we should call out, particularly since we're seeing more companies being deceptive on this point and trying to trick people through this confusing language.
azangru 3y ago
Yes, good point; if it's opt-out, it should say opt-out.
ekanes 3y ago
Sorta. The policy is "opt out" but you are "opted in" by default.
- deleted 3y ago
  [deleted]
- Timon3 3y ago
  You cannot be "opted in" by someone else. Only you can opt-in or opt-out.
- deleted 3y ago
  [deleted]
tjoff 3y ago
When discussing the title, as people often do, copy the title verbatim when doing so. The title is now "Telemetry" and 90% of the discussions makes no sense anymore.
- firtoz 3y ago
  > PSA: Storybook sends telemetry data, opt-in by default
  - rrrrrrrrrrrrr 3y ago
    Fixed: Storybook sends telemetry data, opt-out

justusw 3y ago

May I perhaps add my rant 50 cents here and link to my post about this? https://www.justus.pw/garden/telemetry.html https://www.justus.pw/garden/telemetry.html It’s opt out, and it doesn’t even completely disable it (unless given an env var as well) The devs know about this: https://github.com/storybookjs/storybook/discussions/19910 https://github.com/storybookjs/storybook/discussions/19910

bmacho 3y ago

Isn't there a telemetry manifesto? I understand that developers want to peek into what their users are doing. That is the fruit of their labor after all. However telemetry became increasingly easy lately, and it is impossible (in theory and in practice) to do it right. Collecting data of your users is - stupid - illegal - harming your users - makes your software a spyware so in summary, don't do that. Instead, do the exact opposite, and excessively delete any data that you may store. Also make sure that your users are exposed against 3rd party (isp, cnds and such) to the minimum when they check and get new updates. (Randomized update checks over TOR, for example.) They trust you, and allow your program to handle their network, so use it wisely. Also there are sane methods to know what your users are doing, for example you can buy usage blogposts from them, which you can showcase, and link in the manuals and support.

tjoff 3y ago
This is pretty basic stuff, but developers and the HN audience have a hard time to accept that. Ask yourself what value you got from your telemetry lately. Also how much effort you put into it. Do you even look at it regularly? Does it still make sense? Maybe consider the legality? Hint - if it isn't opt-in you are most likely doing something illegal. Congratulations! Does it still make sense? Maybe consider not being a total jackass and insult your users? Does it still make sense?

tilne 3y ago

I don’t mean to dismiss the importance of users owning and controlling their data, but isn’t telemetry a valid tool for software projects to gain valuable insights into how their product is being used and thus how to improve it? Yes, it can be (and, probably frequently is) abused. Yes there should be a way to opt-out of telemetry if a user desires for whatever reason. But I can’t help but feel this is posted in the spirit of “telemetry by default is bad” and I don’t really agree. Full disclosure: this is the first I’ve ever heard of Storybook, so if there’s something particularly gross about telemetry for this use case I’m not aware of it.

have_faith 3y ago
> there should be a way to opt-out of telemetry There should be a way to opt-in. Anything else is egregious.
- tilne 3y ago
  That’s fair. If the telemetry really is helpful to building a better product it should be an easy case to make to users.
  - sf_rob 3y ago
    If Telemetry is valuable, it's largely valuable to the degree it's representative. Opt-in sacrifices this and even a well optimized opt-in process won't prevent that. This is not to say that Telemetry should be opt-out, just that you place other justifications ahead of the usefulness of Telemetry (which is fine).
    - quickthrower2 3y ago
      These days I reckon running an LLM over the storybook discord and reddits would yield more valuable data. How big peoples projects are on average doesn’t matter. 100 people asking the same question does.
      - 3y ago

croes 3y ago

- Timestamp of the occurrence. - Storybook unique identifier: One-way hash generated during Storybook - One way hash of the IP address I really doubt that that's "completely anonymous data"

Etheryte 3y ago

I took some interest in the concept of hashing IPs to avoid PII issues [0], and it turns out that since there's only so few IPv4 addresses, it's trivial to simply take the salt the project uses and calculate all the hashes. On my laptop it would take around two hours with the most naive implementation, so I don't really think this solves anything. This problem would be sidestepped by IPv6, but we all know how that is going so far. [0] https://github.com/storybookjs/storybook/discussions/19910#discussioncomment-7069903 https://github.com/storybookjs/storybook/discussions/19910#d...

buildfocus 3y ago
The classic better approach would be to drop part of the IP address entirely, so it's impossible to recreate the full value. For example, dropping the last octet (turning 123.4.5.6 into 123.4.5.0) means you can usually still do useful IP things (where in the world do our users come from, very roughly) while making it impossible to track unique users, or to definitively recognize real individuals. I've seen one octet masking used as standard, probably just because it's easy, but you could do any other similar change you like, optimising for more or less anonymity/granularity as required.

faichai 3y ago

Storybook is one of those projects, like Postman, that has completely lost the plot. It's unclear what objectives they are pursuing but in terms of developer experience they seem increasingly developer hostile. The CSF format is an unreadable joke and doesn't play that well with TypeScript, the number of plugins you need to do anything sane is ridiculous, and this telemetry story is a farce - open source should not skim data by default. I remember writing a super simple wrapper around Jasmine to do the same kind of thing, and was glad when I could ditch it for Storybook many moons ago. But if I was starting a project now I would probably rawdog it again, Storybook just causes too much pain. Is anyone aware of any similar projects that are more developer friendly?

morbicer 3y ago
It indeed became Sorrybook. https://github.com/tajo/ladle https://github.com/tajo/ladle looks promising if you use React
microflash 3y ago
There's also Histoire[1] for Svelte and Vuejs. [1]: https://histoire.dev/ https://histoire.dev/
andrewmcwatters 3y ago
What should people use instead of Postman these days? It seems to still be the only decent client for testing particular protocols, like OAuth 2.0. There's no way I'm using curl for that.

a_c 3y ago

The HN crowd seem to largely against “telemetry”. I wonder how do you know the things you build is useful if you don’t know it is being, well, used? On the other hand, back in the server side everything days, I can have more or less all metrics I want from nginx log. I wonder was it equally frowned upon or is the frowned upon an SPA phenomenon?