No, open source Audacity audio editor is not “spyware”
arstechnica.com
arstechnica.com
On web services, which don't have access to your whole machine. Also perhaps in closed-source software, which many FOSS users use nothing of.
FOSS doing the same is pretty far from fact of life in 2021.
That's exactly what it says. The part of the privacy policy in discussion is about what they collect, not what they do with data they collect for other reasons.
That's very different from the standard boilerplate, specially for a locally running program.
It's an unfortunate catch-22 really. The best way to improve your program's performance is to collect telemetry, but that opens the door to law enforcement asking for the telemetry data, and you also need (IANAL) to provide a scary privacy policy like this.
If the data you are collecting is useful to law enforcement, for prosecuting an individual, you aren't anonymizing it enough.
The simple response to any law enforcement request should be simple, "We have no way of providing you with data identifiable to an individual."
FOSS has existed for decades without telemetry, it isn't needed to make good software, the convenience of it shouldn't come at the risk to your users, and should not represent a commercial benefit that is required from them to provide to you for use of your product.
It's simple, and the rest of these justifications is noise.
Its just a stupid move that rightly gives the "muse" guys a PR stink.
Never said it meant that. The problem is not with the existence of locally-run programs.
The problem is with outright saying (in the second row, first column of the table in the privacy policy) that they'll collect whatever they feel necessary for whatever requests come in.
As an example of how the privacy policy is worded, if a request comes in to know everything you typed between datetime A and datetime B, they would have to keylog in order to obtain the "Data necessary for law enforcement, litigation and authorities' requests".
The reasonable, standard way to comply with the law would be to instead take the content of column 2 and 3 of row 2 and put them in column 2 and 3 of row 1, and delete column 1 of row 2.
IOW, you collect data for the reasonable operation of your business, and you provide access to that data to authorities when given a warrant. You don't just say you'll collect whatever is requested of you.
> It sends very specific telemetry data home, and I think that's what this document covers.
No, that's part of what the document covers. Specifically, it's what the first row of the table in the privacy policy covers.
But the problem is not the first row; it's the second.
What really irks here is saying that such a policy is normal now and therefore ok, when it's obviously a large new overreach.
The response that it's OK if they say they'll behave like spyware because there's little chance they'll succeed also irks.
But worse are the multiple people saying that people can't recognize a standard policy boilerplate when it obviously is not.
If we're being really generous, it's possible that the current wording was not intended to mean what it says, but that also doesn't make it ok.
I've never seen a privacy policy be as vague and overreaching as Audacity's.
https://news.ycombinator.com/item?id=27741910 [Audacity fork without any sentry telemetry or crash reporting]