Comment by fouric | Hacker News Reader

Comment by fouric | Hacker News Reader

The subject is telemetry, but the article calls it "tracking code". I would be curious to know if the writer actually knows that the telemetry data is enough to track users, or whether they're just exploiting the recent FUD about telemetry.

Edit: To clarify, "tracking" means that you're following a particular user around. "Some user pressed the Audacity record button at 13:04:42 Sunday" is not tracking data (although with sufficiently granular data you could do fingerprinting (which is tracking), the countermeasures for which should be obvious) - "User #1934602 pressed the Audacity record button at 13:04:42 Sunday" is tracking, even if it's anonymized.

There are different levels of privacy that people care about (e.g. some people are ok with anonymized tracking, while others don't want tracking at all). Conflating them is an underhanded tactic used by people to emotionally manipulate others. Furthermore, "non-tracking statistics" is a category of things that few people care about, versus "anonymous tracking", so conflating these two is particularly egregious.

They swear they are implementing telemetry, but their privacy policy implies tracking. You don’t need to worry about minors or handing personal information over unless you’re storing it.

Non-personalized telemetry and crash reports would have been fine to me, but none of their discussions have convinced me that it’s where they would stop (or even really, where they’d start).

I’ve since moved to a paid option, and feel good about the move so far.

> They swear they are implementing telemetry, but their privacy policy implies tracking. You don’t need to worry about minors or handing personal information over unless you’re storing it.

Good point - reminds me of a principle I recently heard someone espouse, "Disregard whatever promises a corporation/individual in power makes, and only pay attention to their legal constraints."

I don't agree with the last statement.

Just because you have the legal right to be an asshole doesn't mean you are an asshole. And conversely, the law can be broken, and clever loopholes can be exploited. There may be consequences, but it doesn't you will get repaid personally.

For me, privacy policies are just indicative. I try to approach the problem considering incentives, risks and benefits. What are the consequences for breaking the promise, for me, and for the company. For the company, imagine yourself as a shareholder, you want to maximize your profit, you know that by breaking your promise customers will be unhappy, will they go to the competition? is your image a valuable asset? is the short term profit worth it? For you, what is leaked? How will it affect your productivity and security? Can you easily switch to a competitor? At what point too much is too much?

If I only cared about legal constraints, I would get into every scam. I mean, advance fee fraud is illegal, so that Nigerian prince cannot take my money, right?

>> Just because you have the legal right to be an asshole doesn't mean you are an asshole

If they're explicitly carving out the legal rights to be an asshole, I think it's fair to assume, regardless of what they say, they are going to quickly become a giant asshole.

I've literally never seen a contract that contained a prohibition on being an asshole. If you are presented with a contract that doesn't contain such a condition it doesn't tell you anything about the intentions of your counter-party

Corporations are obliged to their shareholders, not their consumers. Furthermore, if the service is marketed as free to downstream consumers, those same consumers are more likely in some way the product. Therefore, any action that increases shareholder confidence in the company is liable to be taken. Harming downstream consumers can sometimes be damaging to shareholder confidence, but isn't necessarily.

In essence, companies are incentivized to be "assholes" when it furthers their valuation. Unfortunately, being an "asshole" is very often a lucrative move as long as it's done carefully.

I don't believe everyone who works at a large corporation (example being Amazon) is evil and immoral. However, collective action taken by the company on large scales has shown in many cases to have "asshole" effects. Also, fuck Jeff Bezos.

There's a pretty good write up on the topic [1] over on arstechnica. Author of the above is clearly overreacting or trying to ride some kind of rage-train to more clicks.

Especially the quote from one of the authors of audacity which states "telemetry collection is optional and configurable at any time"

Wether it's opt-in or opt-out is a smaller issue IMO. Like the article on Ars also states, even Firefox telemetry is opt-out, and you don't often see people raging about FF not being privacy sensitive enough....

[1]https://arstechnica.com/gadgets/2021/07/no-open-source-audac...

For once, I disagree with Ars Technica.

Sure, what they're doing right now appears not to be nefarious. But they're putting language into their user agreements that opens the door for them to be nefarious in the future with no warning or recourse.

Without recourse? Audacity is still Foss right? If they screw up bad enough you can just fork em! And I'm sure it will be big news when they actually do mess up, given how big news it became when they didn't even, so you'll probably know about it.

> you don't often see people raging about FF not being privacy sensitive enough....

There are actually a bunch of HN threads about just that.

The article calls it telemetry, and says the fork was created that "removed any current or future tracking code that was implemented upstream." Which is true, even if you don't want to call their telemetry "tracking."

Further, the subject of the article is the CLA, and the entire telemetry part is just to recap recent events.

The subject is their ridiculous new EULA, which includes telemetry. It also bars anyone under 13 from using the software, which is a violation of the actual software license.

People hate the telemetry the most, I think, but it's just one example of a pile of bad ideas baked into their privacy policy.

The IP address is what typically turns "not tracking" into "tracking".

The source IP address is delivered with any IP packet. If there's a dividing line related to the IP address it has to be storing it, not having it available.

The point is that as long as telemetry is delivered over the internet, it is also tracking. There is absolutely no difference whatsoever unless your telemetry is delivered via Tor or some other mathematically proven means of nearly-anonymous transport.

There is no way for a user to tell the difference, and it's very difficult for experts. So for all intents and purposes telemetry and tracking are the same thing.

Reply on news.ycombinator.com