6 ms·

Apart from the reason of ”if they spy on this, who knows what else” and ”I don’t want to waste resources on telemetry” what is the reason to not allow a vendor

Apart from the reason of ”if they spy on this, who knows what else” and ”I don’t want to waste resources on telemetry” what is the reason to not allow a vendor to see which settings page you visit? Obviously if you opt out (or rather, didn’t opt in) you shouldn’t be sending telemetry. But the line between a necessary network call and an optional one is often blurry.

userbinator 1y ago
what is the reason to not allow a vendor to see which settings page you visit? It's all about privacy; and by privacy, I don't mean the "privacy" that often gets thrown around by Big Tech to mean "only we can see what you do". What I do on my computer is none of their business.
- alkonaut 1y ago
  Anonymous usage statistics means no one stores what _you_ do though. Obviously sending a url you visit or a file you open is way over the line. That’s about what you do. I think there is a difference between that and feature usage as counters only.
  - userbinator 1y ago
    If it can be correlated (e.g. via TLS fingerprinting or other identifying information such as IP address), it's not anonymous.
    - alkonaut 1y ago
      Yes if it can be deanonymized then it’s not anonymous. Almost a tautology that. You can’t send the telemetry over http without revealing an ip, but obviously that ip can’t be stored as part of the telemetry data. That’s PII and not anonymous at all. Important: if I collect anonymous telemetry you better trust me that it’s anonymous when I say it is. Because if you don’t trust me on that then you can’t run the software at all (if it’s a piece of software that relies on web requests in some form at least). Otherwise why would you even trust that my opt in is respected? You have to trust software vendors of software that makes http requests. It’s as simple as that. You can use open source or try to inspect packets. Or firewall the software. But if it does (for example) one update check on startup which is common, then it’s almost impossible to tell whether it contains telemetry data. Because even the bare minimum request “this is FooApp 2.9.1 are there any updates” contains important usage stats: it’s +1 for the use counter and +1 for the v2.9 use counter!
triska 1y ago
As to other reasons apart from the violation of privacy: Every network call adds additional latency and slows down interactions with the OS. Every data gathering feature adds additional complexity to the implementation, takes attention away from other implementation work that could be done instead, and increases the risk of adding further mistakes to the implementation. Personally, I would like OS and application vendors to work on improving security and correctness of their programs and reducing latency instead of adding data gathering features. > But the line between a necessary network call and an optional one is often blurry. What would be an example of a necessary network call that an ideal OS (i.e., one that cannot be easily compromised and does not require updates around the clock to correct programming mistakes) has to perform on its own? If a company is interested in how users use their applications and desperately need our data for it, they may be interested in funding dedicated studies and appropriately compensating users that send their data, if it is so valuable for the company.
- jstanley 1y ago
  > What would be an example of a necessary network call that an ideal OS [...] has to perform on its own? Syncing the clock with NTP?
  - hulitu 1y ago
    > Syncing the clock with NTP? So every app, instead of querrying the OS, shall make a network call, to get the time from an NTP server ?
    - jstanley 1y ago
      I don't understand how you got that. The question was about network calls that an OS would perform on its own.
- bboygravity 1y ago
  This and also it's pretty obvious that the main goal of both Microsoft and Google is NOT to make the OS better for its users. So the claim that telemetry is used to improve products is simply a lie IMO. The fact that telemetry is sent at all for no apparent reason and deliberately without clear consent is an ironic example of this. The fact that it's been happening more and more over the past decades as the OS'es evolved is another confirmation of it.
jjav 1y ago
The best way to think of it is the software must serve me, the owner of the computer, and nobody else. Years ago when spyware was not the norm, there would be outrage if anyone caught some software sending as much as a single packet of data that was not legitimately initiated by the needs of the user/owner. We need to return to that mindset.
- alkonaut 1y ago
  I think this is really simple: telemetry should be opt in, anonymous, and _in_ the interest of the user in the long term by the improvement of the software. Because it’s _not_ possible to get this information any other way through user studies etc. If it’s hard to disable, contains any PII or sensitive info (urls, file names) then it’s not OK.
pacifika 1y ago
I had written down many reasons but the onus should not be on people explaining why they don’t want to be tracked, in a society I’m happy to live in. Software is part of society.
- alkonaut 1y ago
  But should developers not be allowed to have it in their software? So long as it has a label “this software sends usage stats, if you don’t like it don’t use it, or don’t opt in” should that be banned? Or is that acceptable?
  - timeon 1y ago
    > in their software? I made mistake thinking it was user's software.
    - alkonaut 1y ago
      If the user develops something they can do it however they want. It’s not “theirs” because it’s installed on their machine. They can’t even control how it runs on their machine short of sandboxing it. They can choose to run it as the developer wanted or not at all. You didn’t answer the question: should it be somehow banned?
AllegedAlec 1y ago
Hey, while you're not at home I'm actually using your house as a bachellor pad. Since you're not in, it doesn't affect you, so why complain about it?
- alkonaut 1y ago
  I think I’m going to opt out
  - kotaKat 1y ago
    Sorry, we didn't give you those options. You get to choose "yes" or "maybe later", but we're 100% going to be using your property. Love, Microsoft, Google, and every other tech company who thinks this is the proper form of consent <3
    - alkonaut 1y ago
      For the sake of argument, the only interesting discussion about telemetry is about whether it’s ok when done right. I don’t think anyone thinks it’s ok when it’s not done right (not anonymous, dark patterns for opt in/out, etc). So it’s not a very interesting discussion to have since there is no one arguing for it. Instead my argument is: when done right, anonymous telemetry isn’t “evil”. To be fair I don’t know if many argue it is either. There are a few absolutists that think not even opt-in telemetry is acceptable and that developers should do more expensive studies to find how their software is used. It’s really only those I disagree with.
      - hyperman1 1y ago
        'Done right' quickly becomes one of those no true scotsman arguments. Nothing in this world is fully done right. Just from the top of my head: Telemetry means extra code, hence extra bugs and maintenance overhead. It costs you in extra ram/cpu/storage/network. The networking means NSA and friends have a beacon declaring a windows computer exists, and they probably can derive other facts from the message statistics. After Snowden, we should assume they have a backdoor and get the unencrypted data if they want. All this assumes Microsoft has only the good of you as end user in mind, are not hackable, and can't be coerced by governements. All of this now and in the future. 'Done right' is not a good yardstick. There are tradeoffs needed, Microsoft decides which ones, and they decided the user has almost no voice in these tradeoffs, and doesn't even get to see te choices made. These tradeoffs are the interesting discussion.
qmr 1y ago
> what is the reason to not allow a vendor to see which settings page you visit? Because it's not their fucking computer! Nothing about this is necessary. Nothing here is "blurry".
- alkonaut 1y ago
  The shitty thing isn’t phoning home, the shitty thing is doing what’s not described on the label. If a piece of software says “this will do X if you run it” and then it does X then I don’t see the complaint (yes I realize lots of software uses dark patterns or doesn’t say what it does, especially windows, but _in principle_ I don’t think anonymous telemetry with good clear opt out/in is evil).

userbinator 1y ago

what is the reason to not allow a vendor to see which settings page you visit? It's all about privacy; and by privacy, I don't mean the "privacy" that often gets thrown around by Big Tech to mean "only we can see what you do". What I do on my computer is none of their business.

alkonaut 1y ago
Anonymous usage statistics means no one stores what _you_ do though. Obviously sending a url you visit or a file you open is way over the line. That’s about what you do. I think there is a difference between that and feature usage as counters only.
- userbinator 1y ago
  If it can be correlated (e.g. via TLS fingerprinting or other identifying information such as IP address), it's not anonymous.
  - alkonaut 1y ago
    Yes if it can be deanonymized then it’s not anonymous. Almost a tautology that. You can’t send the telemetry over http without revealing an ip, but obviously that ip can’t be stored as part of the telemetry data. That’s PII and not anonymous at all. Important: if I collect anonymous telemetry you better trust me that it’s anonymous when I say it is. Because if you don’t trust me on that then you can’t run the software at all (if it’s a piece of software that relies on web requests in some form at least). Otherwise why would you even trust that my opt in is respected? You have to trust software vendors of software that makes http requests. It’s as simple as that. You can use open source or try to inspect packets. Or firewall the software. But if it does (for example) one update check on startup which is common, then it’s almost impossible to tell whether it contains telemetry data. Because even the bare minimum request “this is FooApp 2.9.1 are there any updates” contains important usage stats: it’s +1 for the use counter and +1 for the v2.9 use counter!

triska 1y ago

As to other reasons apart from the violation of privacy: Every network call adds additional latency and slows down interactions with the OS. Every data gathering feature adds additional complexity to the implementation, takes attention away from other implementation work that could be done instead, and increases the risk of adding further mistakes to the implementation. Personally, I would like OS and application vendors to work on improving security and correctness of their programs and reducing latency instead of adding data gathering features. > But the line between a necessary network call and an optional one is often blurry. What would be an example of a necessary network call that an ideal OS (i.e., one that cannot be easily compromised and does not require updates around the clock to correct programming mistakes) has to perform on its own? If a company is interested in how users use their applications and desperately need our data for it, they may be interested in funding dedicated studies and appropriately compensating users that send their data, if it is so valuable for the company.

jstanley 1y ago
> What would be an example of a necessary network call that an ideal OS [...] has to perform on its own? Syncing the clock with NTP?
- hulitu 1y ago
  > Syncing the clock with NTP? So every app, instead of querrying the OS, shall make a network call, to get the time from an NTP server ?
  - jstanley 1y ago
    I don't understand how you got that. The question was about network calls that an OS would perform on its own.
bboygravity 1y ago
This and also it's pretty obvious that the main goal of both Microsoft and Google is NOT to make the OS better for its users. So the claim that telemetry is used to improve products is simply a lie IMO. The fact that telemetry is sent at all for no apparent reason and deliberately without clear consent is an ironic example of this. The fact that it's been happening more and more over the past decades as the OS'es evolved is another confirmation of it.

jjav 1y ago

The best way to think of it is the software must serve me, the owner of the computer, and nobody else. Years ago when spyware was not the norm, there would be outrage if anyone caught some software sending as much as a single packet of data that was not legitimately initiated by the needs of the user/owner. We need to return to that mindset.

alkonaut 1y ago
I think this is really simple: telemetry should be opt in, anonymous, and _in_ the interest of the user in the long term by the improvement of the software. Because it’s _not_ possible to get this information any other way through user studies etc. If it’s hard to disable, contains any PII or sensitive info (urls, file names) then it’s not OK.

pacifika 1y ago

I had written down many reasons but the onus should not be on people explaining why they don’t want to be tracked, in a society I’m happy to live in. Software is part of society.

alkonaut 1y ago
But should developers not be allowed to have it in their software? So long as it has a label “this software sends usage stats, if you don’t like it don’t use it, or don’t opt in” should that be banned? Or is that acceptable?
- timeon 1y ago
  > in their software? I made mistake thinking it was user's software.
  - alkonaut 1y ago
    If the user develops something they can do it however they want. It’s not “theirs” because it’s installed on their machine. They can’t even control how it runs on their machine short of sandboxing it. They can choose to run it as the developer wanted or not at all. You didn’t answer the question: should it be somehow banned?

AllegedAlec 1y ago

Hey, while you're not at home I'm actually using your house as a bachellor pad. Since you're not in, it doesn't affect you, so why complain about it?

alkonaut 1y ago
I think I’m going to opt out
- kotaKat 1y ago
  Sorry, we didn't give you those options. You get to choose "yes" or "maybe later", but we're 100% going to be using your property. Love, Microsoft, Google, and every other tech company who thinks this is the proper form of consent <3
  - alkonaut 1y ago
    For the sake of argument, the only interesting discussion about telemetry is about whether it’s ok when done right. I don’t think anyone thinks it’s ok when it’s not done right (not anonymous, dark patterns for opt in/out, etc). So it’s not a very interesting discussion to have since there is no one arguing for it. Instead my argument is: when done right, anonymous telemetry isn’t “evil”. To be fair I don’t know if many argue it is either. There are a few absolutists that think not even opt-in telemetry is acceptable and that developers should do more expensive studies to find how their software is used. It’s really only those I disagree with.
    - hyperman1 1y ago
      'Done right' quickly becomes one of those no true scotsman arguments. Nothing in this world is fully done right. Just from the top of my head: Telemetry means extra code, hence extra bugs and maintenance overhead. It costs you in extra ram/cpu/storage/network. The networking means NSA and friends have a beacon declaring a windows computer exists, and they probably can derive other facts from the message statistics. After Snowden, we should assume they have a backdoor and get the unencrypted data if they want. All this assumes Microsoft has only the good of you as end user in mind, are not hackable, and can't be coerced by governements. All of this now and in the future. 'Done right' is not a good yardstick. There are tradeoffs needed, Microsoft decides which ones, and they decided the user has almost no voice in these tradeoffs, and doesn't even get to see te choices made. These tradeoffs are the interesting discussion.

qmr 1y ago

> what is the reason to not allow a vendor to see which settings page you visit? Because it's not their fucking computer! Nothing about this is necessary. Nothing here is "blurry".

alkonaut 1y ago
The shitty thing isn’t phoning home, the shitty thing is doing what’s not described on the label. If a piece of software says “this will do X if you run it” and then it does X then I don’t see the complaint (yes I realize lots of software uses dark patterns or doesn’t say what it does, especially windows, but _in principle_ I don’t think anonymous telemetry with good clear opt out/in is evil).