4 ms·

If you look in the source code for this software which is provided for everyone to see you will realize that Kevin Goslar is entirely innocent of this heinous c

by vinckr 3y ago

If you look in the source code for this software which is provided for everyone to see you will realize that Kevin Goslar is entirely innocent of this heinous crime. He merely added the copyright headers to each file. You misunderstand the purpose of the SQA telemetry. There are some reasons for SQA telemetry listed in the doc you posted: - Be able to say how many production deployments exist. - Understand which features are used and how. - Understand how much throughput deployments handle. - Evaluate how frequently specific features are used. - Detect issues introduced by new features (such as a buggy releases). - Identify problems at scale (such as slow endpoints). - Understand which versions are deployed. If you have concerns about privacy as you rightly noted you can turn it off with a simple flag (--sqa-opt-out) and if you don't like the version ping you can block in your network. Hundreds of users are running Ory Kratos without any telemetry sent without any extra work. So if this is a plot to produce open source spyware it's not the best.

lmeyerov 3y ago
This practice being considered acceptable has been a nightmare - we had OSS libraries add spying later, change their APIs for disabling it, etc. When it's a nested dependency, even worse. Now and then we run our stack with mitm monitor just to sniff out this dangerous crap. More recently, we are seeing it in ML libraries. For a security vendor to do it is extra bad because they can't claim not understanding why it's bad and often illegal.
sneak 3y ago
Developers are not entitled to knowledge of what software runs or does not run on machines that do not belong to them. To co-opt those machines without the consent of the user or device owner means your software is malware. To do so even after the user has explicitly opted out is even worse, and in my opinion, is criminal behavior. With consent, it’s fine. Without consent, it is the same as any other spying.

by vinckr 3y ago

lmeyerov 3y ago

This practice being considered acceptable has been a nightmare - we had OSS libraries add spying later, change their APIs for disabling it, etc. When it's a nested dependency, even worse. Now and then we run our stack with mitm monitor just to sniff out this dangerous crap. More recently, we are seeing it in ML libraries. For a security vendor to do it is extra bad because they can't claim not understanding why it's bad and often illegal.

sneak 3y ago

Developers are not entitled to knowledge of what software runs or does not run on machines that do not belong to them. To co-opt those machines without the consent of the user or device owner means your software is malware. To do so even after the user has explicitly opted out is even worse, and in my opinion, is criminal behavior. With consent, it’s fine. Without consent, it is the same as any other spying.