<![CDATA[⚠️ Github CLI now has telemetry spyware built in:]]>⚠️ Github CLI now has telemetry spyware built in:

Link Preview Image
Telemetry

Take GitHub to the command line

favicon

GitHub CLI (cli.github.com)

They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.

Run `gh config set telemetry disabled` to disable it.

]]>https://board.circlewithadot.net/topic/12fcf9f2-af85-48e5-976b-f2370a9b3b2f/github-cli-now-has-telemetry-spyware-built-inRSS for NodeSat, 02 May 2026 19:42:03 GMTWed, 22 Apr 2026 13:07:08 GMT60<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Sun, 26 Apr 2026 14:06:21 GMT]]>@josepvives @nuclearplayer Yeah. I can see that some random anecdote from a Microsoft employee is not any kind of assurance. It is frustrating from my perspective because we have to jump through hoops to get any kind of useful data to be "data driven" in our product work but from the outside world we are perceived to be partying on everyone's private data. More transparency would be good for everyone.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116471390631671110https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116471390631671110Sun, 26 Apr 2026 14:06:21 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Sun, 26 Apr 2026 14:01:25 GMT]]>@darrel_miller @nuclearplayer Sure. But the background issue is how the privacy guarantee can be audited externally. Statements are not enough

]]>https://board.circlewithadot.net/post/https://mastodont.cat/users/josepvives/statuses/116471371225203067https://board.circlewithadot.net/post/https://mastodont.cat/users/josepvives/statuses/116471371225203067Sun, 26 Apr 2026 14:01:25 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Sun, 26 Apr 2026 12:17:44 GMT]]>@darrel_miller @nuclearplayer The "accept cookies mess" is not legal and is an attempt malicious faux compliance to misdirect user ire against regulation rather than against the companies putting nags in their faces.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/dalias/statuses/116470963537640426https://board.circlewithadot.net/post/https://hachyderm.io/users/dalias/statuses/116470963537640426Sun, 26 Apr 2026 12:17:44 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Sun, 26 Apr 2026 12:14:05 GMT]]>@nuclearplayer @dalias the "legitimate interests" GDPR clause for pseudonymous information does seem to make this a grey area, but IANAL and I am not trying to make a judgement on what GitHub did. I'm trying to learn about the objections. I understand the desire for consent but we can see from the "accept cookie" mess that users can just be coerced to consent via fatigue. I wish we had a standardized opt-out mechanism like DNT tried to do.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116470949207134290https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116470949207134290Sun, 26 Apr 2026 12:14:05 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Sun, 26 Apr 2026 11:57:39 GMT]]>@josepvives @nuclearplayer Sure it is technically a simple problem. But there are many processes in place that prevent that from happening. Accessing customer content is very tightly controlled. Privacy is something I care about and it is one of the reasons I chose to work at Microsoft rather one of the other big tech companies that do not have the same guardrails in place.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116470884592853922https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116470884592853922Sun, 26 Apr 2026 11:57:39 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Sun, 26 Apr 2026 11:43:27 GMT]]>@darrel_miller @nuclearplayer i'm sorry, "in my experience" is no an relevant argument. The matter is can Microsot do and for what, and if it is accountable.

In big pkatforms, deanonymize it's easy and trivial.

]]>https://board.circlewithadot.net/post/https://mastodont.cat/users/josepvives/statuses/116470828755969418https://board.circlewithadot.net/post/https://mastodont.cat/users/josepvives/statuses/116470828755969418Sun, 26 Apr 2026 11:43:27 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Fri, 24 Apr 2026 18:52:15 GMT]]>@nuclearplayer Though the linked GH page says that the first two environment variables take precedence over the third, actual config setting.

Because reasons, I guess?

]]>https://board.circlewithadot.net/post/https://mas.to/users/jumile/statuses/116461190192285513https://board.circlewithadot.net/post/https://mas.to/users/jumile/statuses/116461190192285513Fri, 24 Apr 2026 18:52:15 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Fri, 24 Apr 2026 15:29:10 GMT]]>
CC: @_aD@hachyderm.io
]]>https://board.circlewithadot.net/post/https://11n.org/w/p/1777044550.517079https://board.circlewithadot.net/post/https://11n.org/w/p/1777044550.517079Fri, 24 Apr 2026 15:29:10 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Fri, 24 Apr 2026 15:17:37 GMT]]>@_aD @w I don't think anyone feels entitled. I think the product owners want to provide the best experience for their users and knowing how the product is used helps. For tools that primarily are clients for a backend service, then the service will know whenever a service call is made. I'm trying to fully understand the objection to capturing some additional usage information that doesn't make a service call. Is it the "slippery slope " problem?

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116460346218688848https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116460346218688848Fri, 24 Apr 2026 15:17:37 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Fri, 24 Apr 2026 15:09:43 GMT]]>]]>https://board.circlewithadot.net/post/https://11n.org/w/p/1777043383.946731https://board.circlewithadot.net/post/https://11n.org/w/p/1777043383.946731Fri, 24 Apr 2026 15:09:43 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Fri, 24 Apr 2026 14:53:04 GMT]]>@w Why do you think it's your computer? *cries in Secure Boot, attestation and age verification laws*

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/_aD/statuses/116460249695073650https://board.circlewithadot.net/post/https://hachyderm.io/users/_aD/statuses/116460249695073650Fri, 24 Apr 2026 14:53:04 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Fri, 24 Apr 2026 14:49:36 GMT]]>]]>https://board.circlewithadot.net/post/https://11n.org/w/p/1777042176.844361https://board.circlewithadot.net/post/https://11n.org/w/p/1777042176.844361Fri, 24 Apr 2026 14:49:36 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Fri, 24 Apr 2026 14:24:58 GMT]]>@darrel_miller@mastodon.social @nuclearplayer@fosstodon.org It's basically false. This is all PII, and not "pseudonymous" data.
(And from GDPR point of view, pseudonymous data are still PII. Only anonymous one are out of scope. Which is not the case here. And so still targeting ppl and not only app)

Link Preview Image
]]>https://board.circlewithadot.net/post/https://firefish.imirhil.fr/notes/algkgnp5sgnh00aghttps://board.circlewithadot.net/post/https://firefish.imirhil.fr/notes/algkgnp5sgnh00agFri, 24 Apr 2026 14:24:58 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Fri, 24 Apr 2026 14:18:34 GMT]]>@darrel_miller @nuclearplayer This term "product owners" says everything we need to know about how GitHub is wrong on this.

GitHub is NOT the "product owner" of my computer or anything running on it. I am.

They are the "product owner" of the service running on their website, but this still does not entitle them to collect personal information without consent, regardless of whether it is "pseudonymous"/"anonymous". This is a basic principle of data protection anyone familiat with relevant law and ethics should be aware of.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/dalias/statuses/116460114033112914https://board.circlewithadot.net/post/https://hachyderm.io/users/dalias/statuses/116460114033112914Fri, 24 Apr 2026 14:18:34 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Fri, 24 Apr 2026 05:28:01 GMT]]>@nuclearplayer the original post was deleted?

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/stevenodb/statuses/116458027840530126https://board.circlewithadot.net/post/https://mastodon.social/users/stevenodb/statuses/116458027840530126Fri, 24 Apr 2026 05:28:01 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Thu, 23 Apr 2026 15:08:09 GMT]]>@darrel_miller How about they ask for permission first? Why is that concept so hard to grasp for Microsoft?

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/nuclearplayer/statuses/116454646698759664https://board.circlewithadot.net/post/https://fosstodon.org/users/nuclearplayer/statuses/116454646698759664Thu, 23 Apr 2026 15:08:09 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Thu, 23 Apr 2026 13:57:37 GMT]]>@iain Ah thanks for clearing that up for me. That makes more sense.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/danni_storm/statuses/116454369393414229https://board.circlewithadot.net/post/https://hachyderm.io/users/danni_storm/statuses/116454369393414229Thu, 23 Apr 2026 13:57:37 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Thu, 23 Apr 2026 12:48:14 GMT]]>@nuclearplayer And as a Microsoft employee, my experience has been that we are extremely careful about not logging any information that directly identifies users and any customer created content. It isn't lip service to privacy. I've seen projects delayed while we scrub logs because a developer accidentally logged the name of some artifact that they should not have.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116454096536216356https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116454096536216356Thu, 23 Apr 2026 12:48:14 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Thu, 23 Apr 2026 12:42:21 GMT]]>@nuclearplayer I would think the important thing is what data is being collected, not the the fact that any data is being collected. If that remote site is collecting end user identifiable information, that should be as big a problem as if a local tool is doing it. What is good about a "source-open" collecting the telemetry is that you can see and verify what is being collected. You can't with a remote service.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116454073374931880https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116454073374931880Thu, 23 Apr 2026 12:42:21 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Thu, 23 Apr 2026 12:39:18 GMT]]>@nuclearplayer When you call an API or make a git request to some remote repo, there are going to be logs of that activity on that remote site. We acknowledge that site owners need some visibility into what is happening on their service. However, when it comes to code that is downloaded and executed on a local machine there seems to be an expectation that the code owners no longer have any rights to see how that code is executing. Help me understand why the rules are different.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116454061401535348https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116454061401535348Thu, 23 Apr 2026 12:39:18 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Thu, 23 Apr 2026 12:35:12 GMT]]>@nuclearplayer I'm going to put on my lead lined suit here and ask a question because I genuinely want to learn. This issue comes up time and time again. The GitHub CLI telemetry provides product owners with information about how their product is used. You can see what it captures here https://cli.github.com/telemetry It is pseudonymous data. There is no user identifying data there. So yes the telemetry is spying on what the app is doing, but not on which user is doing it.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116454045308277532https://board.circlewithadot.net/post/https://mastodon.social/users/darrel_miller/statuses/116454045308277532Thu, 23 Apr 2026 12:35:12 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Thu, 23 Apr 2026 10:15:16 GMT]]>@nuclearplayer better to just

]]>https://board.circlewithadot.net/post/https://toot.io/users/justin/statuses/116453495035231278https://board.circlewithadot.net/post/https://toot.io/users/justin/statuses/116453495035231278Thu, 23 Apr 2026 10:15:16 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Thu, 23 Apr 2026 09:26:42 GMT]]>@nuclearplayer Let's all switch to @andrewnez 's Forge CLI

Link Preview Image
Forge

A unified CLI for GitHub, GitLab, Gitea, Forgejo, and Bitbucket.

favicon

Andrew Nesbitt (nesbitt.io)

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/ringods/statuses/116453304041956853https://board.circlewithadot.net/post/https://hachyderm.io/users/ringods/statuses/116453304041956853Thu, 23 Apr 2026 09:26:42 GMT<![CDATA[Reply to ⚠️ Github CLI now has telemetry spyware built in: on Thu, 23 Apr 2026 09:03:05 GMT]]>@nuclearplayer@fosstodon.org
Run gh config set telemetry disabled to disable it.
Better yet, stop using Github!]]>https://board.circlewithadot.net/post/https://fedi.tyil.nl/notes/aletiuyq9dhttps://board.circlewithadot.net/post/https://fedi.tyil.nl/notes/aletiuyq9dThu, 23 Apr 2026 09:03:05 GMT