⚠️ Github CLI now has telemetry spyware built in:
-
️ Github CLI now has telemetry spyware built in:They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
Enable telemetry without env var by williammartin · Pull Request #13254 · cli/cli
GitHub’s official command line tool. Contribute to cli/cli development by creating an account on GitHub.
GitHub (github.com)
The PR that enables the spyware without much deliberation.
-
R relay@relay.infosec.exchange shared this topic
-
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
To disable:
export GH_TELEMETRY=false
export DO_NOT_TRACK=true
gh config set telemetry disabled
Each of these work individually too.
-
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
@nuclearplayer don't use GitHub CLI
-
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
I asked @EUCommission multiple times how this can be legal ...
I forgot their level of corruption so it is understandable that nobody answers there. -
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
@nuclearplayer@fosstodon.org I think the correct command is
apt autoremove --purge gh. -
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
@nuclearplayer lol
$ gh config set telemetry disabled
! warning: 'telemetry' is not a known configuration key -
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
@nuclearplayer my favorite part is how it has a hard-coded "oh god we'll get in so much trouble" killswitch if it detects a GHES token.
-
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
@nuclearplayer or don't use their weird #CLI tool and instead go with their regular #API & #git that any decent #IDE can use…
-
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
@nuclearplayer I've always been confused why people use gh instead of vanilla git.
-
@nuclearplayer I've always been confused why people use gh instead of vanilla git.
@danni_storm the feature set is quite different https://cli.github.com/manual/gh
-
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
@nuclearplayer@fosstodon.orgRun gh config set telemetry disabled to disable it.
Better yet, stop using Github! -
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
@nuclearplayer Let's all switch to @andrewnez 's Forge CLI
-
️ Github CLI now has telemetry spyware built in:
They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.
Run `gh config set telemetry disabled` to disable it.
@nuclearplayer better to just #GiveUpGitHub
-
Enable telemetry without env var by williammartin · Pull Request #13254 · cli/cli
GitHub’s official command line tool. Contribute to cli/cli development by creating an account on GitHub.
GitHub (github.com)
The PR that enables the spyware without much deliberation.
@nuclearplayer I'm going to put on my lead lined suit here and ask a question because I genuinely want to learn. This issue comes up time and time again. The GitHub CLI telemetry provides product owners with information about how their product is used. You can see what it captures here https://cli.github.com/telemetry It is pseudonymous data. There is no user identifying data there. So yes the telemetry is spying on what the app is doing, but not on which user is doing it.
-
@nuclearplayer I'm going to put on my lead lined suit here and ask a question because I genuinely want to learn. This issue comes up time and time again. The GitHub CLI telemetry provides product owners with information about how their product is used. You can see what it captures here https://cli.github.com/telemetry It is pseudonymous data. There is no user identifying data there. So yes the telemetry is spying on what the app is doing, but not on which user is doing it.
@nuclearplayer When you call an API or make a git request to some remote repo, there are going to be logs of that activity on that remote site. We acknowledge that site owners need some visibility into what is happening on their service. However, when it comes to code that is downloaded and executed on a local machine there seems to be an expectation that the code owners no longer have any rights to see how that code is executing. Help me understand why the rules are different.
-
@nuclearplayer When you call an API or make a git request to some remote repo, there are going to be logs of that activity on that remote site. We acknowledge that site owners need some visibility into what is happening on their service. However, when it comes to code that is downloaded and executed on a local machine there seems to be an expectation that the code owners no longer have any rights to see how that code is executing. Help me understand why the rules are different.
@nuclearplayer I would think the important thing is what data is being collected, not the the fact that any data is being collected. If that remote site is collecting end user identifiable information, that should be as big a problem as if a local tool is doing it. What is good about a "source-open" collecting the telemetry is that you can see and verify what is being collected. You can't with a remote service.
-
@nuclearplayer I would think the important thing is what data is being collected, not the the fact that any data is being collected. If that remote site is collecting end user identifiable information, that should be as big a problem as if a local tool is doing it. What is good about a "source-open" collecting the telemetry is that you can see and verify what is being collected. You can't with a remote service.
@nuclearplayer And as a Microsoft employee, my experience has been that we are extremely careful about not logging any information that directly identifies users and any customer created content. It isn't lip service to privacy. I've seen projects delayed while we scrub logs because a developer accidentally logged the name of some artifact that they should not have.
-
@danni_storm the feature set is quite different https://cli.github.com/manual/gh
@iain Ah thanks for clearing that up for me. That makes more sense.
-
@nuclearplayer I'm going to put on my lead lined suit here and ask a question because I genuinely want to learn. This issue comes up time and time again. The GitHub CLI telemetry provides product owners with information about how their product is used. You can see what it captures here https://cli.github.com/telemetry It is pseudonymous data. There is no user identifying data there. So yes the telemetry is spying on what the app is doing, but not on which user is doing it.
@darrel_miller How about they ask for permission first? Why is that concept so hard to grasp for Microsoft?
-
To disable:
export GH_TELEMETRY=false
export DO_NOT_TRACK=true
gh config set telemetry disabled
Each of these work individually too.
@nuclearplayer the original post was deleted?
