⚠️ Github CLI now has telemetry spyware built in:
-
@w Why do you think it's your computer? *cries in Secure Boot, attestation and age verification laws*
-
@w Why do you think it's your computer? *cries in Secure Boot, attestation and age verification laws*
because I will do my best to turn off and avoid as many of those things as I can for as long as I can, even if I have to accept what most people might call a degraded computing experience to do it, what remains is mine
-
because I will do my best to turn off and avoid as many of those things as I can for as long as I can, even if I have to accept what most people might call a degraded computing experience to do it, what remains is mine
@_aD @w I don't think anyone feels entitled. I think the product owners want to provide the best experience for their users and knowing how the product is used helps. For tools that primarily are clients for a backend service, then the service will know whenever a service call is made. I'm trying to fully understand the objection to capturing some additional usage information that doesn't make a service call. Is it the "slippery slope " problem?
-
@_aD @w I don't think anyone feels entitled. I think the product owners want to provide the best experience for their users and knowing how the product is used helps. For tools that primarily are clients for a backend service, then the service will know whenever a service call is made. I'm trying to fully understand the objection to capturing some additional usage information that doesn't make a service call. Is it the "slippery slope " problem?
making it opt-out is entitlement. you're not asking me permission, you're telling me that you're taking it unless I stop you.
CC: @_aD@hachyderm.io
-
To disable:
export GH_TELEMETRY=false
export DO_NOT_TRACK=true
gh config set telemetry disabled
Each of these work individually too.
@nuclearplayer Though the linked GH page says that the first two environment variables take precedence over the third, actual config setting.
Because reasons, I guess?
-
@nuclearplayer And as a Microsoft employee, my experience has been that we are extremely careful about not logging any information that directly identifies users and any customer created content. It isn't lip service to privacy. I've seen projects delayed while we scrub logs because a developer accidentally logged the name of some artifact that they should not have.
@darrel_miller @nuclearplayer i'm sorry, "in my experience" is no an relevant argument. The matter is can Microsot do and for what, and if it is accountable.
In big pkatforms, deanonymize it's easy and trivial.
-
@darrel_miller @nuclearplayer i'm sorry, "in my experience" is no an relevant argument. The matter is can Microsot do and for what, and if it is accountable.
In big pkatforms, deanonymize it's easy and trivial.
@josepvives @nuclearplayer Sure it is technically a simple problem. But there are many processes in place that prevent that from happening. Accessing customer content is very tightly controlled. Privacy is something I care about and it is one of the reasons I chose to work at Microsoft rather one of the other big tech companies that do not have the same guardrails in place.
-
@darrel_miller @nuclearplayer This term "product owners" says everything we need to know about how GitHub is wrong on this.
GitHub is NOT the "product owner" of my computer or anything running on it. I am.
They are the "product owner" of the service running on their website, but this still does not entitle them to collect personal information without consent, regardless of whether it is "pseudonymous"/"anonymous". This is a basic principle of data protection anyone familiat with relevant law and ethics should be aware of.
@nuclearplayer @dalias the "legitimate interests" GDPR clause for pseudonymous information does seem to make this a grey area, but IANAL and I am not trying to make a judgement on what GitHub did. I'm trying to learn about the objections. I understand the desire for consent but we can see from the "accept cookie" mess that users can just be coerced to consent via fatigue. I wish we had a standardized opt-out mechanism like DNT tried to do.
-
@nuclearplayer @dalias the "legitimate interests" GDPR clause for pseudonymous information does seem to make this a grey area, but IANAL and I am not trying to make a judgement on what GitHub did. I'm trying to learn about the objections. I understand the desire for consent but we can see from the "accept cookie" mess that users can just be coerced to consent via fatigue. I wish we had a standardized opt-out mechanism like DNT tried to do.
@darrel_miller @nuclearplayer The "accept cookies mess" is not legal and is an attempt malicious faux compliance to misdirect user ire against regulation rather than against the companies putting nags in their faces.
-
@josepvives @nuclearplayer Sure it is technically a simple problem. But there are many processes in place that prevent that from happening. Accessing customer content is very tightly controlled. Privacy is something I care about and it is one of the reasons I chose to work at Microsoft rather one of the other big tech companies that do not have the same guardrails in place.
@darrel_miller @nuclearplayer Sure. But the background issue is how the privacy guarantee can be audited externally. Statements are not enough
-
@darrel_miller @nuclearplayer Sure. But the background issue is how the privacy guarantee can be audited externally. Statements are not enough
@josepvives @nuclearplayer Yeah. I can see that some random anecdote from a Microsoft employee is not any kind of assurance. It is frustrating from my perspective because we have to jump through hoops to get any kind of useful data to be "data driven" in our product work but from the outside world we are perceived to be partying on everyone's private data. More transparency would be good for everyone.
