3 ms·

The key to these sorts of issues seems to be that people hate change to privacy issues. If these had been baked in at the start most people wouldn't have cared

The key to these sorts of issues seems to be that people hate change to privacy issues. If these had been baked in at the start most people wouldn't have cared or noticed, but because they are being changed (to something which is still essentially anonymous, so doesn't affect 'digital footsteps' or whatever other silly metaphor people want to use) there's an opportunity for people to make themselves heard. At the end of the day, this makes it harder for established software products to compete against newly introduced things where this is baked in from day one as part of a generic analytics thrust.

ibrahima 14y ago
I don't think they originally changed what data they collect, they only changed whether you could opt out. After the small hubbub I think some people claimed that you could brute force an IMEI from the hash so they decided to use a more anonymous ID which I think gets regenerated on device wipe so it's actually less useful for tracking total installs... I think the whole thing is a brouhaha over nothing, the information is in no way trackable to an individual user and it gives them the clout to go to manufacturers and say "look, X people are using CyanogenMod, you should consider what we have to say." By using Google services you leak way more information so caring about this is just a little bit silly.
- Zikes 14y ago
  Saying that other companies collect more information doesn't make it right in this situation, as the people most opposed to anonymized data collection likely do not use those services or have them set up in such a way as to obscure as much of their personal information as possible.
- jen_h 14y ago
  Personally, I wouldn't have a problem with a UUID and the occasional "phone home" - if UUID X hasn't phoned home in Y days, it's no longer part of the install base. Given that more CM users tend to be obsessive device-wipers, it may make sense to phone home more often; given the limited data points they're collecting, it's a negligible hit to users' data plans (though given some Android users' network misconfigurations, may be more of a hit to CM's servers than they'd expect). Transmitting and storing md5 hashes of device IMEIs and MAC addresses, though? No bueno. That the project owners don't see a problem with this (and that they believe cracking these hashes is non-trivial, especially given the restricted address space of these two data points) worries me far more than the data collection itself.

ibrahima 14y ago

I don't think they originally changed what data they collect, they only changed whether you could opt out. After the small hubbub I think some people claimed that you could brute force an IMEI from the hash so they decided to use a more anonymous ID which I think gets regenerated on device wipe so it's actually less useful for tracking total installs... I think the whole thing is a brouhaha over nothing, the information is in no way trackable to an individual user and it gives them the clout to go to manufacturers and say "look, X people are using CyanogenMod, you should consider what we have to say." By using Google services you leak way more information so caring about this is just a little bit silly.

Zikes 14y ago
Saying that other companies collect more information doesn't make it right in this situation, as the people most opposed to anonymized data collection likely do not use those services or have them set up in such a way as to obscure as much of their personal information as possible.
jen_h 14y ago
Personally, I wouldn't have a problem with a UUID and the occasional "phone home" - if UUID X hasn't phoned home in Y days, it's no longer part of the install base. Given that more CM users tend to be obsessive device-wipers, it may make sense to phone home more often; given the limited data points they're collecting, it's a negligible hit to users' data plans (though given some Android users' network misconfigurations, may be more of a hit to CM's servers than they'd expect). Transmitting and storing md5 hashes of device IMEIs and MAC addresses, though? No bueno. That the project owners don't see a problem with this (and that they believe cracking these hashes is non-trivial, especially given the restricted address space of these two data points) worries me far more than the data collection itself.