6 ms·

Spot on! Well said. I frequently wonder what breed of human sincerely disagrees. I sometimes think the realm of software encourages through detachment (remoten

by eth0up 2y ago

Spot on! Well said. I frequently wonder what breed of human sincerely disagrees. I sometimes think the realm of software encourages through detachment (remoteness, distance from the users) a sense of liberty for the id. If this shit was attempted physically, in person, there'd be a lot of missing teeth.

coldpie 2y ago
What? It happens all the time. Retail stores count the rate at which people enter their doors to help determine how to staff the store. Traffic engineers count how many vehicles and pedestrians use certain roadways so they know which modes to optimize for. Your ISP gathers aggregate statistics about how much bandwidth is being used across regions to decide where to upgrade their network. Data collection can be harmful, but it's also extremely useful to know how people are using products and infrastructure. There's a balance, and if you're on the "zero data collection" side, I think you need to justify making the devs' lives harder by explaining what harms will come from the proposed collection.
- JohnFen 2y ago
  > I think you need to justify making the devs' lives harder by explaining what harms will come from the proposed collection. I disagree. I don't need to show actual harm to reasonably object to being spied on. At least Manjaro isn't talking about making this mandatory, but opt-out is is still a very poor look that would make me avoid using it as long as there are other options that are more respectful.
  - coldpie 2y ago
    > being spied on Please explain what specifically Manjaro is proposing to do that you classify as being "spied on." Don't handwave this away, actually answer the question.
    - JohnFen 2y ago
      The collection of any data about me, my machines, or my use of my machines without my explicit informed consent is spying.
      - coldpie 2y ago
        What data is Manjaro collecting?
        JohnFen 2y ago
        I had trouble finding exactly what MDD collects, but my assumption is that it collects data about the hardware in use and what packages are installed, at a minimum.
        coldpie 2y ago
        Okay. So you can't explain how you are harmed by this data collection, and you have an opt-out mechanism you can use to disable it anyway. What are we complaining about?
        JohnFen 2y ago
        I'm not saying I can't explain harm, I'm saying that the presence or absence of harm is orthogonal to the issue. What I'm complaining about is the evasion of having to get informed consent to collect personal data. Opt-out is a way to try to cover your ass while at the same time being able to avoid asking for consent. The argument for it is always the same: if we make it opt-in, then not enough people will opt in. Which is another way of saying "if people won't give us permission to collect data about them, then we need to stop asking permission."
        coldpie 2y ago
        Well, yeah. If opt-in doesn't lead to useful results, then you may as well not have the feature at all. But they want the feature, because it helps them improve their software. So, "collect data in a way that preserves as much privacy as possible by default, and provide a mechanism to opt-out entirely" is the least-bad option. It gives them the data they want, and it provides an opt-out mechanism for people who don't trust them with the collected data. It seems like the best compromise to me.
  - pdimitar 2y ago
    What spying on, dude? Have you ever wrote telemetry handlers even once in your software? I've done so, no less than 15 times in the last ~9 years. We always took special care to never include anything personally identifiable; it was a hard requirement and was enforced in code reviews and because of that we ended up hashing user IDs because we still wanted to do flame graphs and various distribution statistics of API endpoint usage and user IDs were one of the axii (two others were hours of day and days of week), but we didn't care who the user was. Seriously, a little less extremism helps. I am a programmer, likely just like you. We are trying to get some data to improve our software. In several of my previous gigs even the CTOs barely cared about the telemetry graphs and aggregation dashboards and only looked at them at the middle of the quarter to make sure we're not spending too much on Grafana so the executives won't bite their heads off. And the CEO / marketing? Forget it, they don't care. Of course there are some very predatory companies out there, no doubt. But I think we would be very hard-pressed to put the team of an open Linux distribution among them.
    - JohnFen 2y ago
      > We always took special care to never include anything personally identifiable Sure, but that's not really the point. First, in every company I've worked at that has dealt with PII, their definition of "PII" excludes quite a lot of data that should count. But even if all PII is properly excluded and everything is actually anonymized, that still doesn't address the point. The point is all about consent. Consent seems like it should be table stakes, no?
      - pdimitar 2y ago
        > Consent seems like it should be table stakes, no? I agreed for most of my career but not anymore. Truth is, everywhere I worked, the voluntary user surveys had extremely low engagement rate -- which was frustrating for the dev team who wanted to make sure their users like the product. Sometimes that means deprecating / removing parts of the software. I get your idea and I don't generally disagree. It's just that practice has shown that collecting anonymous telemetry is the only really viable way of getting information of what's being used, how much, does it perform well (I used telemetry stats to optimize a hot code path on a number of occasions) both in terms of hardware efficiency and business terms, and others. It's one of those things that I solved for myself by trusting or not trusting each piece of software individually. That's why I am currently slowly migrating back to Linux (from macOS); Apple overdid the telemetry to downright complete spying and sometimes censorship so I am no longer okay with them.
- eth0up 2y ago
  First, yes, data is extraordinarily valuable. No doubt. While it may be commonly accepted by most, I don't want my personal computer crawling with telemetry. I despise the idea. The harm is, in my opinion, partly in creep, where just a little more, here and there, leads to a festering, unchecked data brothel. And regarding 'harm' as a necessary parameter for maintaining privacy, dignity, etc; it would cause absolutely no harm to me if I was watched every time I used the bathroom, provided responsible handling of the acquired video. But I don't want this and would object to any effort otherwise. I don't think harm is the only factor.
pdimitar 2y ago
> I frequently wonder what breed of human sincerely disagrees. People who genuinely care to fine-tune their software to work better for their users. What monsters.
- account42 2y ago
  Those people can ask their users what they actually need instead of using statistics to validate their own prior assumptions.
  - pdimitar 2y ago
    I hear they tried, many times, and less than 0.1% of users responded. I personally don't think it's such a monster move to send some anonymous usage data, especially if you present a box with a choice once the program starts for the first time. (Granted that's not what Manjaro is doing here.)
- eth0up 2y ago
  When it gets to Microsoft-level telemetry, yes, I'd say monsters. This situation? Less so. But how it so easily approaches such levels needs consideration. There's simply a prevailing view with data where "if it exists and we can access it, it are belong to us" and collectively it is monstrous. I'd rather people become overly (even unreasonably) sensitive to it than keep going with the flow. It's too easy to start with innocent bits, then more and more until real-time surveillance style Windows Recall shittery.
  - pdimitar 2y ago
    > When it gets to Microsoft-level telemetry, yes, I'd say monsters. This situation? Less so. That was my point, yes. And I'll agree it's a slippery slope.
    - eth0up 2y ago
      I'll also remind you of Audacity's opt-out telemetry proposal [0]. This is a rare exception in Linux presently and I'd hate to see it become the rule. 0. Only link I could quickly find: https://www.reddit.com/r/linux/comments/nbio7c/audacity_response_to_criticism_on_telemetry_pull/ https://www.reddit.com/r/linux/comments/nbio7c/audacity_resp...

by eth0up 2y ago

coldpie 2y ago

What? It happens all the time. Retail stores count the rate at which people enter their doors to help determine how to staff the store. Traffic engineers count how many vehicles and pedestrians use certain roadways so they know which modes to optimize for. Your ISP gathers aggregate statistics about how much bandwidth is being used across regions to decide where to upgrade their network. Data collection can be harmful, but it's also extremely useful to know how people are using products and infrastructure. There's a balance, and if you're on the "zero data collection" side, I think you need to justify making the devs' lives harder by explaining what harms will come from the proposed collection.

JohnFen 2y ago
> I think you need to justify making the devs' lives harder by explaining what harms will come from the proposed collection. I disagree. I don't need to show actual harm to reasonably object to being spied on. At least Manjaro isn't talking about making this mandatory, but opt-out is is still a very poor look that would make me avoid using it as long as there are other options that are more respectful.
- coldpie 2y ago
  > being spied on Please explain what specifically Manjaro is proposing to do that you classify as being "spied on." Don't handwave this away, actually answer the question.
  - JohnFen 2y ago
    The collection of any data about me, my machines, or my use of my machines without my explicit informed consent is spying.
    - coldpie 2y ago
      What data is Manjaro collecting?
      - JohnFen 2y ago
        I had trouble finding exactly what MDD collects, but my assumption is that it collects data about the hardware in use and what packages are installed, at a minimum.
        coldpie 2y ago
        Okay. So you can't explain how you are harmed by this data collection, and you have an opt-out mechanism you can use to disable it anyway. What are we complaining about?
        JohnFen 2y ago
        I'm not saying I can't explain harm, I'm saying that the presence or absence of harm is orthogonal to the issue. What I'm complaining about is the evasion of having to get informed consent to collect personal data. Opt-out is a way to try to cover your ass while at the same time being able to avoid asking for consent. The argument for it is always the same: if we make it opt-in, then not enough people will opt in. Which is another way of saying "if people won't give us permission to collect data about them, then we need to stop asking permission."
        coldpie 2y ago
        Well, yeah. If opt-in doesn't lead to useful results, then you may as well not have the feature at all. But they want the feature, because it helps them improve their software. So, "collect data in a way that preserves as much privacy as possible by default, and provide a mechanism to opt-out entirely" is the least-bad option. It gives them the data they want, and it provides an opt-out mechanism for people who don't trust them with the collected data. It seems like the best compromise to me.
- pdimitar 2y ago
  What spying on, dude? Have you ever wrote telemetry handlers even once in your software? I've done so, no less than 15 times in the last ~9 years. We always took special care to never include anything personally identifiable; it was a hard requirement and was enforced in code reviews and because of that we ended up hashing user IDs because we still wanted to do flame graphs and various distribution statistics of API endpoint usage and user IDs were one of the axii (two others were hours of day and days of week), but we didn't care who the user was. Seriously, a little less extremism helps. I am a programmer, likely just like you. We are trying to get some data to improve our software. In several of my previous gigs even the CTOs barely cared about the telemetry graphs and aggregation dashboards and only looked at them at the middle of the quarter to make sure we're not spending too much on Grafana so the executives won't bite their heads off. And the CEO / marketing? Forget it, they don't care. Of course there are some very predatory companies out there, no doubt. But I think we would be very hard-pressed to put the team of an open Linux distribution among them.
  - JohnFen 2y ago
    > We always took special care to never include anything personally identifiable Sure, but that's not really the point. First, in every company I've worked at that has dealt with PII, their definition of "PII" excludes quite a lot of data that should count. But even if all PII is properly excluded and everything is actually anonymized, that still doesn't address the point. The point is all about consent. Consent seems like it should be table stakes, no?
    - pdimitar 2y ago
      > Consent seems like it should be table stakes, no? I agreed for most of my career but not anymore. Truth is, everywhere I worked, the voluntary user surveys had extremely low engagement rate -- which was frustrating for the dev team who wanted to make sure their users like the product. Sometimes that means deprecating / removing parts of the software. I get your idea and I don't generally disagree. It's just that practice has shown that collecting anonymous telemetry is the only really viable way of getting information of what's being used, how much, does it perform well (I used telemetry stats to optimize a hot code path on a number of occasions) both in terms of hardware efficiency and business terms, and others. It's one of those things that I solved for myself by trusting or not trusting each piece of software individually. That's why I am currently slowly migrating back to Linux (from macOS); Apple overdid the telemetry to downright complete spying and sometimes censorship so I am no longer okay with them.
eth0up 2y ago
First, yes, data is extraordinarily valuable. No doubt. While it may be commonly accepted by most, I don't want my personal computer crawling with telemetry. I despise the idea. The harm is, in my opinion, partly in creep, where just a little more, here and there, leads to a festering, unchecked data brothel. And regarding 'harm' as a necessary parameter for maintaining privacy, dignity, etc; it would cause absolutely no harm to me if I was watched every time I used the bathroom, provided responsible handling of the acquired video. But I don't want this and would object to any effort otherwise. I don't think harm is the only factor.

pdimitar 2y ago

> I frequently wonder what breed of human sincerely disagrees. People who genuinely care to fine-tune their software to work better for their users. What monsters.

account42 2y ago
Those people can ask their users what they actually need instead of using statistics to validate their own prior assumptions.
- pdimitar 2y ago
  I hear they tried, many times, and less than 0.1% of users responded. I personally don't think it's such a monster move to send some anonymous usage data, especially if you present a box with a choice once the program starts for the first time. (Granted that's not what Manjaro is doing here.)
eth0up 2y ago
When it gets to Microsoft-level telemetry, yes, I'd say monsters. This situation? Less so. But how it so easily approaches such levels needs consideration. There's simply a prevailing view with data where "if it exists and we can access it, it are belong to us" and collectively it is monstrous. I'd rather people become overly (even unreasonably) sensitive to it than keep going with the flow. It's too easy to start with innocent bits, then more and more until real-time surveillance style Windows Recall shittery.
- pdimitar 2y ago
  > When it gets to Microsoft-level telemetry, yes, I'd say monsters. This situation? Less so. That was my point, yes. And I'll agree it's a slippery slope.
  - eth0up 2y ago
    I'll also remind you of Audacity's opt-out telemetry proposal [0]. This is a rare exception in Linux presently and I'd hate to see it become the rule. 0. Only link I could quickly find: https://www.reddit.com/r/linux/comments/nbio7c/audacity_response_to_criticism_on_telemetry_pull/ https://www.reddit.com/r/linux/comments/nbio7c/audacity_resp...