4 ms·

Actually, I assumed he tried Googling the invalid numbers. And logging browser + geographic information in error handlers is standard practice.

by nyellin 14y ago

gradstudent 14y ago
"Standard practice" for whom? The CIA? Gah! The very idea that some bit of desktop software needs to surreptitiously phone home in the event of an error really rubs me the wrong way. Not only is it wholly unnecessary but it's also a serious intrusion of privacy. OP: does your software tell people up front (i.e. not hidden in some 10 page EULA) it's going to phone home? Do you allow them to opt out? If there is an option, what's the default?
- tghw 14y ago
  To make this assertion also makes it clear that you probably haven't worked on much desktop software distributed to a large number of users. There are so many different configurations that the only real way to figure out why it isn't working for a particular user is to have it phone home with a stack trace and basic system info. Otherwise, pretty much every bug would not be reproducible. If you don't like your software doing that (and, believe me, most of it does), then lock down your firewall and only let a whitelist of programs communicate with the outside world. A lot of your software will stop working, but at least you'll know that no information (well, not none, just less) is getting sent out to various servers.
  - gradstudent 14y ago
    Let me see if I have this right: instead of asking nicely for permission to send your errors and crash reports you want your users to setup a firewall and prevent your program from phoning home. What a dick move. It shows you care not a whit for your customers' privacy or consent; only the data on their computers which, for some bizarre reason, you feel entitled to.
    - tghw 14y ago
      I've stated elsewhere in this thread, I don't write Blurity. It seems that you so want someone to attack for perceived violations of user privacy that you haven't even stopped to consider who you're attacking. As I said before, most desktop software phones home. In fact, by necessity, any software that auto updates and most software that requires registration phones home. Thinking otherwise is just naive.
- aiham 14y ago
  It asks the user for a registration code. It obviously needs to communicate with a server to verify the code. When someone enters an invalid code, it will clearly be logged and the OP notified. It is not doing anything like "phone home" in secret (From what I can tell after reading the article).
  - gradstudent 14y ago
    I have two issues with this argument: 1. The user is not ever made aware that their registration attempt will involve sending out information over the Internet. The application is therefore surreptitiously phoning home. 2. There is no reason to keep logs such as the OP currently has -- the kind that enables him to segregate people into buckets like "honest", "pirate", "converted" and then crow about it online.
    - eropple 14y ago
      1. The user is not ever made aware that their registration attempt will involve sending out information over the Internet. The application is therefore surreptitiously phoning home. It's 2012. This should be assumed. Mentioning it explicitly is nice to do, but at this point it feels like it should be taken for granted that a registration key will be checked against an auth server. There's not really anything that you can categorize in good faith as "surreptitious" about it. It reads more like you just want to harsh on the guy. 2. There is no reason to keep logs such as the OP currently has -- the kind that enables him to segregate people into buckets like "honest", "pirate", "converted" and then crow about it online. Why not? Should a developer not keep track of the number of times a key (valid or not) is active? Why? It's his software. It's his business. I can't think of an argument why it wouldn't be his job to keep that data.
    - gte910h 14y ago
      I don't know what you're talking about: Registration is telling a company you have their product. Registration of a toaster is sending in a card. Registration of a phone is sometimes done by clicking the eula, sometimes by sending a post card. Registration of software downloaded over the internet is almost always done by...telling the company you have their product over the internet. Windows still lets you print out something I believe. I think you missed the definition of registration if you're surprised by the fact information is sent when you register. That's like being surprised information is sent when you email something.

Actually, I assumed he tried Googling the invalid numbers. And logging browser + geographic information in error handlers is standard practice.

by nyellin 14y ago

Actually, I assumed he tried Googling the invalid numbers. And logging browser + geographic information in error handlers is standard practice.

gradstudent 14y ago

"Standard practice" for whom? The CIA? Gah! The very idea that some bit of desktop software needs to surreptitiously phone home in the event of an error really rubs me the wrong way. Not only is it wholly unnecessary but it's also a serious intrusion of privacy. OP: does your software tell people up front (i.e. not hidden in some 10 page EULA) it's going to phone home? Do you allow them to opt out? If there is an option, what's the default?

tghw 14y ago
To make this assertion also makes it clear that you probably haven't worked on much desktop software distributed to a large number of users. There are so many different configurations that the only real way to figure out why it isn't working for a particular user is to have it phone home with a stack trace and basic system info. Otherwise, pretty much every bug would not be reproducible. If you don't like your software doing that (and, believe me, most of it does), then lock down your firewall and only let a whitelist of programs communicate with the outside world. A lot of your software will stop working, but at least you'll know that no information (well, not none, just less) is getting sent out to various servers.
- gradstudent 14y ago
  Let me see if I have this right: instead of asking nicely for permission to send your errors and crash reports you want your users to setup a firewall and prevent your program from phoning home. What a dick move. It shows you care not a whit for your customers' privacy or consent; only the data on their computers which, for some bizarre reason, you feel entitled to.
  - tghw 14y ago
    I've stated elsewhere in this thread, I don't write Blurity. It seems that you so want someone to attack for perceived violations of user privacy that you haven't even stopped to consider who you're attacking. As I said before, most desktop software phones home. In fact, by necessity, any software that auto updates and most software that requires registration phones home. Thinking otherwise is just naive.
aiham 14y ago
It asks the user for a registration code. It obviously needs to communicate with a server to verify the code. When someone enters an invalid code, it will clearly be logged and the OP notified. It is not doing anything like "phone home" in secret (From what I can tell after reading the article).
- gradstudent 14y ago
  I have two issues with this argument: 1. The user is not ever made aware that their registration attempt will involve sending out information over the Internet. The application is therefore surreptitiously phoning home. 2. There is no reason to keep logs such as the OP currently has -- the kind that enables him to segregate people into buckets like "honest", "pirate", "converted" and then crow about it online.
  - eropple 14y ago
    1. The user is not ever made aware that their registration attempt will involve sending out information over the Internet. The application is therefore surreptitiously phoning home. It's 2012. This should be assumed. Mentioning it explicitly is nice to do, but at this point it feels like it should be taken for granted that a registration key will be checked against an auth server. There's not really anything that you can categorize in good faith as "surreptitious" about it. It reads more like you just want to harsh on the guy. 2. There is no reason to keep logs such as the OP currently has -- the kind that enables him to segregate people into buckets like "honest", "pirate", "converted" and then crow about it online. Why not? Should a developer not keep track of the number of times a key (valid or not) is active? Why? It's his software. It's his business. I can't think of an argument why it wouldn't be his job to keep that data.
  - gte910h 14y ago
    I don't know what you're talking about: Registration is telling a company you have their product. Registration of a toaster is sending in a card. Registration of a phone is sometimes done by clicking the eula, sometimes by sending a post card. Registration of software downloaded over the internet is almost always done by...telling the company you have their product over the internet. Windows still lets you print out something I believe. I think you missed the definition of registration if you're surprised by the fact information is sent when you register. That's like being surprised information is sent when you email something.