4 ms·

The meta-problem here is that the bar is unreasonably higher for free software than proprietary. Apple, who is known for being pro-privacy, makes your Mac "pho

The meta-problem here is that the bar is unreasonably higher for free software than proprietary. Apple, who is known for being pro-privacy, makes your Mac "phone home to obtain a special boot signature, known in Apple jargon as a 'ticket'" just so it can boot after an update.[0] It's also known that macOS has checked app signatures online for over 2 years [1] in the past, not sure if it still does. I'm happily using a MacBook nevertheless and I bet a lot of people browsing HN also do. Free software should be better than that, but we (their users) should also make their developers' lives easier. You can't expect high-quality software from mostly-volunteering engineers if they are fighting fires, and data-driven decisions if there is no data to begin with. [0] https://mjtsai.com/blog/2022/06/16/apple-reneged-on-ocsp-privacy/ https://mjtsai.com/blog/2022/06/16/apple-reneged-on-ocsp-pri... [1] https://eclecticlight.co/2020/11/25/macos-has-checked-app-signatures-online-for-over-2-years/ https://eclecticlight.co/2020/11/25/macos-has-checked-app-si...

haskman 2y ago
That's true, but also true is the fact that a large part of the reason for using alternatives is to avoid this kind of data collection. So it's reasonable to expect to lose users with a decision like this.
- graemep 2y ago
  Data collection like what? It is still much less data, and does not allow them to identify you AFAIK. Even if they go with opt-in (not yet decided - it seems to be being debated and thy are asking for feedback) it is still far better than proprietary OSes.
  - TeMPOraL 2y ago
    > Data collection like what? Like any at all? There's this deep sense of entitlement coming from software devs and vendors, that's completely unjustified. Comparisons on the amount and type of data collected is missing the point. It doesn't matter whether Manjaro is sending more or less telemetry than MacOS - neither of them should be doing it in the first place. They have no actual right to that data, no matter how much having it makes the devs' jobs easier. What they should do is ask for it, honestly and convincingly, like asking users for a favor, because it's exactly what it is (and it's not like anyone is considering compensating user for the service).
    - eth0up 2y ago
      Spot on! Well said. I frequently wonder what breed of human sincerely disagrees. I sometimes think the realm of software encourages through detachment (remoteness, distance from the users) a sense of liberty for the id. If this shit was attempted physically, in person, there'd be a lot of missing teeth.
      - coldpie 2y ago
        What? It happens all the time. Retail stores count the rate at which people enter their doors to help determine how to staff the store. Traffic engineers count how many vehicles and pedestrians use certain roadways so they know which modes to optimize for. Your ISP gathers aggregate statistics about how much bandwidth is being used across regions to decide where to upgrade their network. Data collection can be harmful, but it's also extremely useful to know how people are using products and infrastructure. There's a balance, and if you're on the "zero data collection" side, I think you need to justify making the devs' lives harder by explaining what harms will come from the proposed collection.
        JohnFen 2y ago
        > I think you need to justify making the devs' lives harder by explaining what harms will come from the proposed collection. I disagree. I don't need to show actual harm to reasonably object to being spied on. At least Manjaro isn't talking about making this mandatory, but opt-out is is still a very poor look that would make me avoid using it as long as there are other options that are more respectful.
        coldpie 2y ago
        > being spied on Please explain what specifically Manjaro is proposing to do that you classify as being "spied on." Don't handwave this away, actually answer the question.
        JohnFen 2y ago
  - JohnFen 2y ago
    > it is still far better than proprietary OSes. That's an incredibly low bar. I think that good software should aim much, much higher than that.
  - jethro_tell 2y ago
    The problem is that you cannot guess which users are working to fly completely under the radar because of their specific threat profile.
serbuvlad 2y ago
I don't think the bar is unreasonably higher for free software, I think the bar is unreasonably lower for Apple. Apple has a few advantages that make this the case: a) they have really good marketing and b) they will always be compared against Google, Meta and Microsoft, which make their money from selling your data (either directly or through targeted advertising); whereas Apple makes their money from selling overpriced hardware. But Apple is not pro-privacy, it is just less anti-privacy than other companies. And there are still people like me which would never use their products on principle.
Santosh83 2y ago
Whether it is commercial or open source the solution has always been to explain to the user and ask informed consent. No one is so busy or so stupid that they cannot read a small para of text (possibly linking to a detailed document if they're so interested) and press one of two/three choices at some point during system setup or usage. Of course these permission prompts tend to grow out of hand as we can see from commercial operating systems but this is something Linux distributions can do better since nearly all software just want usage data and not user data like their commercial counterparts do.
- boramalper 2y ago
  > ask informed consent I think it's a bit cliché; where do you draw the line? Should free software also display a copy of their license at first start and ask their users to click "I agree"? When you start using a piece of software (free or not), there is a set of terms and conditions that you agree to (explicitly as is often the case with proprietary software or implicitly as with free software), which may include opt-out telemetry. As long as this is communicated, I don't see any problem with it. To give credit where its due, I agree that Manjaro users may have never accepted opt-out telemetry when they first started using the OS and now this is being rolled out after the fact. Still, for a general-purpose OS that makes no privacy claims (e.g. Tails), I don't see how collecting their screen resolution etc makes a big difference. An average webpage today collects more than that in a single page view.
  - TeMPOraL 2y ago
    > When you start using a piece of software (free or not), there is a set of terms and conditions that you agree to (explicitly as is often the case with proprietary software or implicitly as with free software), which may include opt-out telemetry. ToC may include anything whatsoever, it doesn't mean it's binding (in B2C setting). Opt-out telemetry, in particular, is against reasonable expectations, and in much of the world isn't even legal in the first place.
  - alwayslikethis 2y ago
    One of the best things about using free software is you don't get any nags, terms and conditions you need to click through.
rightbyte 2y ago
The bar is no different. It is probably different people that have opinions on OS X and Linux distros. Earlier you could in practice trust Apple etc with your data since it was inpractical to spy on you if you were 'insignificant'. Machine learning changed that and now even mpre with the new LLMs, it is way cheaper to profile a random user.
LightHugger 2y ago
The bar is no higher for free software, just there are a lot of very strange people who enjoy giving a lot of money to get convinced by a company that their privacy and rights are being protected while they are being invaded. Not really sure how to snap apple customers out of their dream, but i think people just like playing pretend, and like it even more when they pay a lot of money to do so.
dogleash 2y ago
> Apple, who is known for being pro-privacy You're using weasel language. Are they known for it, or do they exhibit it? >I'm happily using a MacBook nevertheless and I bet a lot of people browsing HN also do. Yeah, of course I am too. Because when I voice certain displeasure with mass market products people tie too much of their ego to, well that makes me a cold cynical asshole subject to social rebuffing. In office after office of software professionals, I am the weirdo for caring about product features. So at the next office, I just stopped having those opinions.
blablabla123 2y ago
I remember times when supposedly low Opensource software quality was a constant complaint. On the other hand I think taking Linux as an example, I always found it to be significantly more stable than Windows. That said, it's a funny choice for Manjaro to go for opt-out telemetry. As a simplified Arch it seems to be popular among privacy conscious users. (But I don't know the project goals, maybe that's just coincidental)
- chaxor 2y ago
  Opensource contains many things, but IMO limiting to core/ packages on arch and never installing anything from AUR will get great quality software, with far better security and privacy than similar proprietary software. If one is very interested in security and privacy however, using VMs for isolation of different apps or services is important, so having an OS that helps that is useful. Bare arch _can_ do this, but requires quite a lot of script development. Qubes seems to be the answer many grab for, though much is still written in C, which comes with all of the vulnerabilities mentioned constantly. So, something like https://diosix.org/ https://diosix.org/ (a Rust-based hypervisor for Risc-V) is a great option to make a start towards decently secure system. Of course if your threat model includes state actors or something, you're SOL (change your perspective or what you're doing) since they always have an easy backdoor into any hardware, but sometimes things like diosix can protect against the constant script kiddies and other individual hackers.
tomrod 2y ago
> The meta-problem here is that the bar is unreasonably higher for free software than proprietary. No. The standard is extremely simple, and for-profit companies deviate from it because there is no regulation guarding privacy sufficiently. No opt-out telemetry, ever. Opt-in telemetry is fine. As a statistician, I get it. You want unbiased samples which an opt-out option helps to get to versus opt-in. But privacy has been violated too many times for people to be okay with opt-out telemetry. The bar appears higher for FOSS because you can see the telemetry code directly. Just because for-profit companies are failing the bar doesn't mean FOSS should too.
- ranger_danger 2y ago
  If you can see the code directly in FOSS then why is opt-out still treated as radioactive? You could also argue that opt-in telemetry still collects too much information, or programs might lie about not sending data in the first place.
  - dogleash 2y ago
    An expert in the field can conduct an investigation into what is happening behind their back without also specializing in reverse engineering? That's supposed to be an improvement that makes it Kosher? Really?
  - tomrod 2y ago
    Lying about opt-out versus opt-in ought to be legally actionable. I'm not sure your point depends on that, but wanted to call it out. Opt-in telemetry may well collect too much information _for a customer to be comfortable to use the feature_. However, it's an _option_ to an user instead of a _default_ for the user. Hence the categorical difference. Some FOSS make opt-out inclusion a required feature. Forking a complex project isn't a reasonable approach in many situations.
codedokode 2y ago
I use Linux exactly because the bar is higher. If it will start behaving like commercial systems then it will be easier just to install Windows and move on.
ranger_danger 2y ago
I think the people who believe the bar is unreasonably higher would discount the use of any Apple product entirely, or even participating in capitalist society altogether. At least this has been my experience talking to people online who are very staunch FOSS supporters... it's like they live in a totally unrealistic world and expect everyone else should want that too.

haskman 2y ago

That's true, but also true is the fact that a large part of the reason for using alternatives is to avoid this kind of data collection. So it's reasonable to expect to lose users with a decision like this.

graemep 2y ago
Data collection like what? It is still much less data, and does not allow them to identify you AFAIK. Even if they go with opt-in (not yet decided - it seems to be being debated and thy are asking for feedback) it is still far better than proprietary OSes.
- TeMPOraL 2y ago
  > Data collection like what? Like any at all? There's this deep sense of entitlement coming from software devs and vendors, that's completely unjustified. Comparisons on the amount and type of data collected is missing the point. It doesn't matter whether Manjaro is sending more or less telemetry than MacOS - neither of them should be doing it in the first place. They have no actual right to that data, no matter how much having it makes the devs' jobs easier. What they should do is ask for it, honestly and convincingly, like asking users for a favor, because it's exactly what it is (and it's not like anyone is considering compensating user for the service).
  - eth0up 2y ago
    Spot on! Well said. I frequently wonder what breed of human sincerely disagrees. I sometimes think the realm of software encourages through detachment (remoteness, distance from the users) a sense of liberty for the id. If this shit was attempted physically, in person, there'd be a lot of missing teeth.
    - coldpie 2y ago
      What? It happens all the time. Retail stores count the rate at which people enter their doors to help determine how to staff the store. Traffic engineers count how many vehicles and pedestrians use certain roadways so they know which modes to optimize for. Your ISP gathers aggregate statistics about how much bandwidth is being used across regions to decide where to upgrade their network. Data collection can be harmful, but it's also extremely useful to know how people are using products and infrastructure. There's a balance, and if you're on the "zero data collection" side, I think you need to justify making the devs' lives harder by explaining what harms will come from the proposed collection.
      - JohnFen 2y ago
        > I think you need to justify making the devs' lives harder by explaining what harms will come from the proposed collection. I disagree. I don't need to show actual harm to reasonably object to being spied on. At least Manjaro isn't talking about making this mandatory, but opt-out is is still a very poor look that would make me avoid using it as long as there are other options that are more respectful.
        coldpie 2y ago
        > being spied on Please explain what specifically Manjaro is proposing to do that you classify as being "spied on." Don't handwave this away, actually answer the question.
        JohnFen 2y ago
- JohnFen 2y ago
  > it is still far better than proprietary OSes. That's an incredibly low bar. I think that good software should aim much, much higher than that.
- jethro_tell 2y ago
  The problem is that you cannot guess which users are working to fly completely under the radar because of their specific threat profile.

serbuvlad 2y ago

I don't think the bar is unreasonably higher for free software, I think the bar is unreasonably lower for Apple. Apple has a few advantages that make this the case: a) they have really good marketing and b) they will always be compared against Google, Meta and Microsoft, which make their money from selling your data (either directly or through targeted advertising); whereas Apple makes their money from selling overpriced hardware. But Apple is not pro-privacy, it is just less anti-privacy than other companies. And there are still people like me which would never use their products on principle.

Santosh83 2y ago

Whether it is commercial or open source the solution has always been to explain to the user and ask informed consent. No one is so busy or so stupid that they cannot read a small para of text (possibly linking to a detailed document if they're so interested) and press one of two/three choices at some point during system setup or usage. Of course these permission prompts tend to grow out of hand as we can see from commercial operating systems but this is something Linux distributions can do better since nearly all software just want usage data and not user data like their commercial counterparts do.

boramalper 2y ago
> ask informed consent I think it's a bit cliché; where do you draw the line? Should free software also display a copy of their license at first start and ask their users to click "I agree"? When you start using a piece of software (free or not), there is a set of terms and conditions that you agree to (explicitly as is often the case with proprietary software or implicitly as with free software), which may include opt-out telemetry. As long as this is communicated, I don't see any problem with it. To give credit where its due, I agree that Manjaro users may have never accepted opt-out telemetry when they first started using the OS and now this is being rolled out after the fact. Still, for a general-purpose OS that makes no privacy claims (e.g. Tails), I don't see how collecting their screen resolution etc makes a big difference. An average webpage today collects more than that in a single page view.
- TeMPOraL 2y ago
  > When you start using a piece of software (free or not), there is a set of terms and conditions that you agree to (explicitly as is often the case with proprietary software or implicitly as with free software), which may include opt-out telemetry. ToC may include anything whatsoever, it doesn't mean it's binding (in B2C setting). Opt-out telemetry, in particular, is against reasonable expectations, and in much of the world isn't even legal in the first place.
- alwayslikethis 2y ago
  One of the best things about using free software is you don't get any nags, terms and conditions you need to click through.

rightbyte 2y ago

The bar is no different. It is probably different people that have opinions on OS X and Linux distros. Earlier you could in practice trust Apple etc with your data since it was inpractical to spy on you if you were 'insignificant'. Machine learning changed that and now even mpre with the new LLMs, it is way cheaper to profile a random user.

LightHugger 2y ago

The bar is no higher for free software, just there are a lot of very strange people who enjoy giving a lot of money to get convinced by a company that their privacy and rights are being protected while they are being invaded. Not really sure how to snap apple customers out of their dream, but i think people just like playing pretend, and like it even more when they pay a lot of money to do so.

dogleash 2y ago

> Apple, who is known for being pro-privacy You're using weasel language. Are they known for it, or do they exhibit it? >I'm happily using a MacBook nevertheless and I bet a lot of people browsing HN also do. Yeah, of course I am too. Because when I voice certain displeasure with mass market products people tie too much of their ego to, well that makes me a cold cynical asshole subject to social rebuffing. In office after office of software professionals, I am the weirdo for caring about product features. So at the next office, I just stopped having those opinions.

blablabla123 2y ago

I remember times when supposedly low Opensource software quality was a constant complaint. On the other hand I think taking Linux as an example, I always found it to be significantly more stable than Windows. That said, it's a funny choice for Manjaro to go for opt-out telemetry. As a simplified Arch it seems to be popular among privacy conscious users. (But I don't know the project goals, maybe that's just coincidental)

chaxor 2y ago
Opensource contains many things, but IMO limiting to core/ packages on arch and never installing anything from AUR will get great quality software, with far better security and privacy than similar proprietary software. If one is very interested in security and privacy however, using VMs for isolation of different apps or services is important, so having an OS that helps that is useful. Bare arch _can_ do this, but requires quite a lot of script development. Qubes seems to be the answer many grab for, though much is still written in C, which comes with all of the vulnerabilities mentioned constantly. So, something like https://diosix.org/ https://diosix.org/ (a Rust-based hypervisor for Risc-V) is a great option to make a start towards decently secure system. Of course if your threat model includes state actors or something, you're SOL (change your perspective or what you're doing) since they always have an easy backdoor into any hardware, but sometimes things like diosix can protect against the constant script kiddies and other individual hackers.

tomrod 2y ago

> The meta-problem here is that the bar is unreasonably higher for free software than proprietary. No. The standard is extremely simple, and for-profit companies deviate from it because there is no regulation guarding privacy sufficiently. No opt-out telemetry, ever. Opt-in telemetry is fine. As a statistician, I get it. You want unbiased samples which an opt-out option helps to get to versus opt-in. But privacy has been violated too many times for people to be okay with opt-out telemetry. The bar appears higher for FOSS because you can see the telemetry code directly. Just because for-profit companies are failing the bar doesn't mean FOSS should too.

ranger_danger 2y ago
If you can see the code directly in FOSS then why is opt-out still treated as radioactive? You could also argue that opt-in telemetry still collects too much information, or programs might lie about not sending data in the first place.
- dogleash 2y ago
  An expert in the field can conduct an investigation into what is happening behind their back without also specializing in reverse engineering? That's supposed to be an improvement that makes it Kosher? Really?
- tomrod 2y ago
  Lying about opt-out versus opt-in ought to be legally actionable. I'm not sure your point depends on that, but wanted to call it out. Opt-in telemetry may well collect too much information _for a customer to be comfortable to use the feature_. However, it's an _option_ to an user instead of a _default_ for the user. Hence the categorical difference. Some FOSS make opt-out inclusion a required feature. Forking a complex project isn't a reasonable approach in many situations.

codedokode 2y ago

I use Linux exactly because the bar is higher. If it will start behaving like commercial systems then it will be easier just to install Windows and move on.

ranger_danger 2y ago

I think the people who believe the bar is unreasonably higher would discount the use of any Apple product entirely, or even participating in capitalist society altogether. At least this has been my experience talking to people online who are very staunch FOSS supporters... it's like they live in a totally unrealistic world and expect everyone else should want that too.