'A massive middle finger': Open-source audio fans up in arms after Audacity opts to add telemetry capture
- Reference: 1620395353
- News link: https://www.theregister.co.uk/2021/05/07/audacity_telemetry/
- Source link:
The [2]request turned up in GitHub this week, aimed at providing some telemetry, and the author of the request, Dmitry Vedenko, explained:
Universal Google Analytics is used to track the following events:
Session start and end
Errors, including errors from the sqlite3 engine, as we need to debug corruption issues reported on the Audacity forum
Usage of effects, sound generators, analysis tools, so we can prioritize future improvements.
Usage of file formats for import and export
OS and Audacity versions
A UUID stored on the local machine would be used to identify sessions and web analytics service Yandex Metrica used to estimate daily active users.
"Telemetry collection is optional and configurable at any time," he added.
The change has not gone down well. At time of writing it had attracted over 2,000 "thumbs down" emojis, while a mere 39 users clicked "thumbs up." Hardly a ringing endorsement.
[3]
[4]
[5]
Telemetry collection is an area that causes much gnashing of teeth and twisting of knickers in the open source community. While some see it as a pointless invasion of privacy, others find it invaluable for solving issues or identifying how people use a product.
[6]Audacity 'scared and excited' to be bought and brought under Muse Group's roof, promises to stay free and open source
[7]The Audacity of it all: Version 3.0 of open-source audio fave boasts new file format, 160+ bug fixes
[8]Ardour goes harder: v6.0 brings 'huge engineering changes' to open-source digital audio workstation
[9]Tails OS hits version 3.0, matches Debian's pace but bins 32-bit systems
However, stir third-party services like Google Analytics and Yandex into the mix and the reaction is overwhelmingly negative. There is also the question of opt in vs opt out. Red Hat software engineer Eric Gustavsson had a poke through the code [10]and confirmed it was an opt-in affair, although we can see how a user cheerfully clicking through boxes (because nobody ever does that) might inadvertently opt themselves in.
Telemetry collection is not a new thing for other brands under the Muse Group umbrella. Stablemate notation software firm Musescore defended its use of the technology back in 2019. Adding it to Audacity, however, runs the risk of a fork of the code or some customers looking elsewhere.
As one user [11]delicately put it : "Currently over 99.97 per cent of the reactions to the original commit are negative. Clearly the users are overwhelming[ly] opposed to it. If it gets added, that will be a massive middle finger to people who have used Audacity all these years and will most likely result in a loss of users."
Quite.
[12]
The Register has contacted Audacity and the Muse Group for comment. The latter has yet to respond. The former did, and the original Github PR description was updated in an effort to smooth ruffled feathers.
The Audacity team confirmed that the feature would require a user to opt-in and was purely there to identify issues and get a handle on the size of the user base.
As for those third parties, the team said: "We do not incorporate cross-site tracking, limiting the ability to identify the user by both Google and Yandex," before going on to say: "We will consider replacing Google and Yandex with another service if we find one that fulfills our requirements."
[13]
But as for the telemetry itself: "Just to reiterate, telemetry is completely optional and disabled by default."
The joy of open source means that users can, if they wish, verify Audacity's claims for themselves before deciding that the time has come for a fork. ®
Get our [14]Tech Resources
[1] https://www.theregister.com/2021/05/04/audacity_muse_group/
[2] https://github.com/audacity/audacity/pull/835
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YJVkGUYlaYF8Ghsh5yxbtgAAAME&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJVkGUYlaYF8Ghsh5yxbtgAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJVkGUYlaYF8Ghsh5yxbtgAAAME&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] http://www.theregister.com/2021/05/04/audacity_muse_group/
[7] http://www.theregister.com/2021/03/19/audacity_3/
[8] http://www.theregister.com/2020/05/28/ardour_6_release/
[9] http://www.theregister.com/2017/06/14/tails_os_stretches_its_legs_in_time_with_debian/
[10] https://github.com/audacity/audacity/pull/835#issuecomment-834216720
[11] https://github.com/audacity/audacity/pull/835#issuecomment-834226461
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJVkGUYlaYF8Ghsh5yxbtgAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJVkGUYlaYF8Ghsh5yxbtgAAAME&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
Re: What the GDPR requires
Yes, the rules are not followed by many. Mostly because of ignorance and many just speculate to keep themselves in the shades.
But, the real question is why an audio application should implement tracking you and your work? The data gathered will surely be monetized at some stage by some shady corp and sell your data and whatnotmore. Let alone the data leaks that will appear, exposing your work directly or indirectly. Then the shady corp disappears and the data is out there, beyond any of GDPR's rules. Most data should not be generated in the first place.
Re: What the GDPR requires
If bug discovery and tracing is the main reason, that's not a bad thing, per-se.
If tracking usage is intended, it begins to get creepy.
But the big thing for me is the involvement of Google Analytics, which I have done my best to expunge from other areas of my computing life. Google simply cannot be trusted to play nicely. What does Google bring to the table that they can't do in-house?
I had an inking something was about to happen as Behringer has been "bundling" Audacity with its cheap kit for some time but has recently substituted something else. Maybe I'll be looking for something else myself, which is a shame as I've been using Audacity for what seems like for ever, but is probably only 20 years or so :-)
M.
Just checked, and Wikipedia reckons the first release was in May 2000, so 20 years is definitely possible.
F**k It
Fork It
Re: F**k It
Or just Pi-Hole it?
Re: F**k It
Dear Vulture friends,
Please tell us when it's forked, so we know what software to replace Audacious with, as many of us would like the heads-up.
Love,
Everyone
Audacity opts to add telemetry capture
and to think that just a couple of days ago I wrote in the forums that the business that bought audacity merely wanted to share their overabundance of funds as a gesture of goodwill and prosperity of all, aka altruistic motive. I'm SO disappointed! :D
Democracy?
The negative reaction will make sod all difference.
An example of ignoring people was Forest Heath District Council (conservative) who a number of years back decided they wanted to put car parking charges in Newmarket. They promissed a referendum. They then said they would ignore the result anyway. Then they didnt tell anyone when or where it was to be held. Still someone in the council leaked to the local newspaper (Cambridge evening news) who put a special edition out. People turned out, voted, 97% + against. The council went ahead. Newmarket is now a ghost town, a few mobile phone shops, a stack of charity shops and a few gambling dens, sod all else, a once thriving town centre buggered and car use increased. Not the councils only cockup, they screwed the local education by swapping from a 3 school to 2 school system (it is cheaper to make primary last longer requiring fewer and less specialst teachers) but the results have suffered. They also spent billions on studies on whether there are enough taxis, on a monument for the town centre (millions) on a new bus station in nearby Mildenhall that fails to provide the shelter the old one did for those commuting to work. Yet the local people apparently still vote the conservatives in every single election - regardless - so maybe people dont actually give a damn how often they are screwed.
Re: Democracy?
We have the same problem here with our Labour Council
Telemetry collection is optional and configurable at any time
optional, as Microsoft OS 'optional'... getting more dis-optional with each next new 'optional' / opt-out / on by default / dig into the last hidden options / registry changeable optional version. All for the benefit of [optionally] fucked users of course. No matter, audacity's dead, but I'm happy to use the last spywareless variant.
Use a random generated ID!
Modify the script used to open Audacity. Ate each new session it would remove the old ID and generate a new one. Let them sort this telemetry...
Error gathering...
Our applications have a button "Send error data" in each error dialog box, next to the "Details" one. Each user can decide to send the error data or not. Many does, as it's their interest to see bug fixed. I'm less interested in how they use the application because we know that not all user use all of the most advanced features, but we know it's those advanced features that makes the applications appealing to many users. And we gather users feedback in other ways - most automatic usage metrics looks pretty dumb and useless - without knowing what they were working on and trying to achieve. That's also when too many applications have removed manuals and usable on-line help system - just throwing you some useless web page.
"Just to reiterate, telemetry is completely optional and disabled by default."
Until an update silently switches it on.
What the GDPR requires
Look at what [1]the GDPR says about this.
Just 2 of the points:
* Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent.
* Explicit consent requires a very clear and specific statement of consent.
Mind you: the majority of web sites & applications do not do what the GDPR requires them to.
[1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/