Fedora considers "privacy-preserving" telemetry [LWN.net]

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 1:03 UTC (Fri) by geofft (subscriber, #59789) [Link] (26 responses)

I wish they didn't use the name "telemetry" for this; it's going to produce a lot of instinctive reactions from people that don't lend themselves to a productive conversation. (See, for instance, the person objecting that Linux users culturally value their privacy, on a public and archived-forever mailing list, signed with their full name and long-term-persistent email address.)

We've had various forms of "telemetry" in FOSS for a long while. Debian has the "popularity contest," for instance, which is probably wildly inaccurate in this world of public cloud VMs and containers, but is still used when making development decisions. Lots of web services collect visitor logs, and most FOSS web servers default to recording access logs, including IP addresses. Pine (which, admittedly, went through a period where it didn't count as FOSS) prompted users to send an email counting them as a Pine user (https://staff.washington.edu/corey/pine-stats/), which the development team used to measure their impact and justify their continued funding - the same motivation Endless OS cites in their post (https://blogs.gnome.org/wjjt/2023/07/05/endless-oss-priva...). I found the post quite thoughtful, especially about what "privacy-preserving" means.

I suspect there are very few people who are okay with this sort of metrics collection who are going to be motivated to join a forum to argue passionately about how they don't find it objectionable.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 5:04 UTC (Fri) by wjt (subscriber, #56250) [Link] (14 responses)

I'm happy you appreciated that blog post. FWIW I used the term “telemetry”, despite us using the term “metrics” throughout the codebase & in conversation about the stack, almost because it has those connotations and I wanted to address that head-on, rather than using other terms and potentially being accused of hiding behind euphemism.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 5:31 UTC (Fri) by oldtomas (guest, #72579) [Link] (13 responses)

FWIW I prefer calling a spade a spade. Everything else would come across as manipulative.

To the other examples you pose: they are all opt-in. The proposed telemetry is opt-out. To me, this is always a strong smell.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 7:18 UTC (Fri) by taladar (subscriber, #68407) [Link] (12 responses)

Opt-out is also more likely to be a problem legally depending on the information included.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 7:26 UTC (Fri) by eduperez (guest, #11232) [Link]

> Opt-out is also more likely to be a problem legally depending on the information included.

And that is a good thing, because it will force Fedora to ensure that the information included really preserves the privacy of their users.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 7:27 UTC (Fri) by tchernobog (guest, #73595) [Link] (10 responses)

Correct. In Europe, this also has quite a bit of repercussions on the way you implement GDPR requirements. Which requires opt-in and not opt-out as soon as data can be used even just for correlation purposes.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 15:13 UTC (Fri) by geofft (subscriber, #59789) [Link]

They address this in the proposal and say that this requires them to do things in a way that is compliant with European law, i.e., any proposals that would be in violation of European law are already off the table. This actually seems like a good constraint - if their devs insist (for good reasons that they set forth in the proposal) on opt-out metrics, their lawyers are going to insist that the data cannot be used for correlation. They can't be tempted to start collecting too much data and defend it with "it's fine because users are consenting."

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 16:59 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (8 responses)

That is not what GDPR says. GDPR says that you must have a "lawful basis" for collecting information. Consent is one such basis, and if you're using consent as your lawful basis, then opt-in is required, but there are other lawful bases as well, and for those, you don't even need to provide an opt-out. However, they all impose some kind of restriction on what data you collect and/or what you use it for. There is no "get out of jail free" card in the law.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 22:27 UTC (Fri) by fraetor (subscriber, #161147) [Link]

Specifically the relevant bit if GDPR is that the lawful basis can come via several things. Consent is one, but the most relevent would be legitimate interest.

“*The legitimate interests of a controller (..) may provide a legal basis for processing, (..) taking into consideration the reasonable expectations of data subjects based on their relationship with the controller.*”

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 13:00 UTC (Sat) by eduperez (guest, #11232) [Link] (4 responses)

GDPR only caes about personal / sensitive information. As long as the information is (really) "privacy-preserving", it does not apply.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:42 UTC (Sat) by NYKevin (subscriber, #129325) [Link] (3 responses)

This is much broader than you think it is. According to GDPR Article 4(1):

> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

In other words: If it is *possible* to figure out which human a given piece of data relates to, then the data is "personal" data. So if I know that somebody has a mouse with three buttons, that's not personal data. But if I know that user #12345 has a mouse with three buttons, that is personal data (assuming that it is possible to look up user #12345 in some database somewhere).

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:53 UTC (Sat) by wjt (subscriber, #56250) [Link] (2 responses)

In the metrics system that is being proposed here, metrics are associated not with a user ID, but only with an identifier for the originally-installed OS image, which is the same across a large number of devices. (This OS image ID is an Endless OS-specific concept; I don't know if an equivalent channel ID would be used on Fedora but running the current implementation on Fedora would associate all events with the image ID "unknown".)

So, in your example, there would be no database in which to look up user #12345, and no "user #12345" identifier on the three-button-mouse data point.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 23:56 UTC (Sat) by NYKevin (subscriber, #129325) [Link] (1 responses)

That is probably fine, but you still have to be careful. It is very easy to accidentally store personal data without intending to do so.

As an example, let's say that you have some firewall that logs incoming requests for a short time, and captures the source IP address as well as the exact time of the user's submission. Your database stores a timestamp and whatever telemetry metrics are captured. The IP address is an "online identifier," and you can time-correlate the database with the firewall log, so the whole thing is "personal data." The fact that you separate the telemetry metrics from the IP address, and store them in independent systems, is called "pseudonymization":

> ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

Pseudonymous data is still considered personal data, at least until you delete the firewall log, or until you delete enough data that it is no longer possible to associate your telemetry metrics with an IP address (e.g. delete the timestamps from either the database or the firewall log). Pseudonymization is recommended as one possible practice to improve compliance with article 6, but it does not relieve you of any other obligations under GDPR, including the lawful basis requirement.

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 9:21 UTC (Sun) by wjt (subscriber, #56250) [Link]

Each event is stored with a timestamp of when it occured, but not when it was submitted. They are buffered on the client and submitted in batches, and split apart before storing. So the events can't be correlated back to the load balancer logs to link them to an IP address. (I'm not sure what the load balancer logs – thanks for the idea to go and check this!)

It's actually quite annoying to not have the submission time together with each event because it makes it very hard to figure out the event submission latency. (After how many days in July can we expect the data on the server for June to be "mostly complete"?) It would be useful to store a truncated received-at timestamp on the events, but only if it is sufficiently vague to not allow associating events with one another, or with the logs of the upload.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:11 UTC (Sat) by iainn (guest, #64312) [Link] (1 responses)

Article 21 “Right to object” is a reason to provide opt opt, even when consent isn't the lawful basis.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:37 UTC (Sat) by NYKevin (subscriber, #129325) [Link]

That only applies to some situations. If, for example, Amazon.com asks you for your physical mailing address in order to ship a package to you, the law explicitly does not give you the right to object to that (because it would be absurd - how else are they supposed to get the package to you?).

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 9:50 UTC (Fri) by detiste (subscriber, #96117) [Link] (1 responses)

Also embedded/offline devices can't publish popcon info either.
I manage 1300 servers with python3-zeep while the global PopCon is only at 500.

So popcon is mostly usefull for Desktop/Development package tracking.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 19:26 UTC (Sat) by ballombe (subscriber, #9523) [Link]

Whatever reporting system you use, offline devices will not report telemetry.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 13:18 UTC (Fri) by sionescu (subscriber, #59410) [Link]

> I wish they didn't use the name "telemetry" for this; it's going to produce a lot of instinctive reactions from people that don't lend themselves to a productive conversation. (See, for instance, the person objecting that Linux users culturally value their privacy, on a public and archived-forever mailing list, signed with their full name and long-term-persistent email address.

What better way to exemplify improductive conversations than your nonsensical quip about users that value their privacy ?

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 18:19 UTC (Fri) by clump (subscriber, #27801) [Link]

(See, for instance, the person objecting that Linux users culturally value their privacy, on a public and archived-forever mailing list, signed with their full name and long-term-persistent email address.)

Being concerned about privacy isn't isn't inconsistent with using your real name on a public mailing list. On the contrary, you could argue that if someone truly cared they'd stand up to be counted.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 18:52 UTC (Fri) by gnoutchd (guest, #121472) [Link] (5 responses)

[...] it's going to produce a lot of instinctive reactions from people that don't lend themselves to a productive conversation. (See, for instance, the person objecting that Linux users culturally value their privacy, on a public and archived-forever mailing list, signed with their full name and long-term-persistent email address.)

Putting an opinion on a public record under my real name does not imply I'm OK with surveillance in the (many!) other aspects of my life. I don't want to be told that my privacy concerns will be dismissed and denigrated unless I conspicuously employ every possible defense.

It's true that FOSS projects are very public, perhaps excessively so at times. Given our issues around diversity and inclusion, perhaps we could take contributor privacy more seriously. But the radical transparency of FOSS projects is exactly what makes the software trustworthy and therefore attractive to users worried about privacy. I was drawn to FOSS in great part because I intensely care about my privacy, and I want tools that I can trust.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 18:58 UTC (Fri) by pizza (subscriber, #46) [Link] (4 responses)

One of the problems I see with this is that there's considerable overlap between the folks objecting to telemetry (of any sort) and those that complain that projects are not listening [1] to their users. They simultaneously decry decisions being made without supporting data, and object to attempts to obtain said data.

[1] What comes to mind is ALSA support in Firefox, and extension use in GNOME (and Firefox)

Fedora considers "privacy-preserving" telemetry

Posted Jul 11, 2023 7:37 UTC (Tue) by kilobyte (subscriber, #108024) [Link] (3 responses)

Trying to ransom our data is bad regardless of what excuse you say.

Fedora considers "privacy-preserving" telemetry

Posted Jul 13, 2023 23:03 UTC (Thu) by pizza (subscriber, #46) [Link] (2 responses)

> Trying to ransom our data is bad regardless of what excuse you say.

Who, exactly, is "Trying to ransom our data"? And for what? Those are some pretty strong words....

The thing is, it doesn't matter I or you say here -- What matters is what's in the actual proposal -- the proposal that hardly anyone seems to have actually *read* before expressing opinions about what it says and the "obvious" motivations of its authors and/or the entities that are paying their salaries.

So, going back to what the actual proposal says, no data will be submitted without explicit user consent.

Meanwhile. If you have a problem with "data being gathered" on your local system, I trust you've also disabled (eg) GNOME's search/indexing functionality, which is on by default [1]. Do you also routinely clear (or disable) your browser cache? And then there's everything gathered and stored in ~/.cache or /var/cache -- The system I'm typing this on has over 2.7GB of stuff in ~/.cache (1.2GB of that are browser caches), plus another ~6GB of stuff in /var/cache covering 125 different programs, and while some of that is generic (eg dnf metadata caches) I'd wager the majority of it is stuff unique to my system or even me personally. I actually opted into very little of that, except in the sense that I willingly chose to use a modern Linux desktop system.

[1] Putting aside GNOME, there's also the classic 'locate' database, though I'm not sure if that's installed/enabled by default on Fedora these days. Personally I've always installed/enabled it as I find that functionality invaluable.

Fedora considers "privacy-preserving" telemetry

Posted Jul 14, 2023 8:56 UTC (Fri) by Wol (subscriber, #4433) [Link]

And there's KDE's baloo, which I don't understand. On my current system I can't be bothered to disable it, but on a previous system it (or its predecessor) basically screwed up loads of systems. It extended the login time on my Athlon Thunderbird system to over 36 hours (dunno how long it was - I killed it), which is pretty disastrous on a desktop that gets shut down every night.

It was on by default "to improve your experience with KMail and the like" (which I don't use), so that was a big chunk of the KDE4 disaster ...

Cheers,
Wol

Fedora considers "privacy-preserving" telemetry

Posted Jul 14, 2023 11:25 UTC (Fri) by zuki (subscriber, #41808) [Link]

> there's also the classic 'locate' database, though I'm not sure if that's installed/enabled by default on Fedora these days. Personally I've always installed/enabled it as I find that functionality invaluable.

It is. Currently using plocate: https://fedoraproject.org/wiki/Changes/Plocate_as_the_def.... You're welcome ;)

Fedora considers "privacy-preserving" telemetry

Posted Jul 13, 2023 15:47 UTC (Thu) by highvoltage (subscriber, #57465) [Link]

Popcon is opt-in, not opt-out, that makes a world of difference.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 2:31 UTC (Fri) by flussence (guest, #85566) [Link] (3 responses)

> And in contrast to proprietary software operating systems, you can redirect the data collection to your own private metrics server instead of Fedora's to see precisely what data is being collected from you, because the server components are open source too.

That sounds good, but unfortunately they have to be a bit more specific: “client-server tracking software but it's self-hostable and open source” is a spectrum with things like Matomo on one end and Mozilla Weave on the other.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 4:58 UTC (Fri) by wjt (subscriber, #56250) [Link] (2 responses)

It's the metrics stack from Endless OS. The server side is a Python web server that enqueues received events into Redis, and a Python service that pulls events from Redis, parses them, and inserts them into a PostgreSQL database. We publish Docker images of both, which are what we use in production. The most unusual dependency (for a server) is on GLib and GObject-Introspection, which are needed because the wire protocol uses GVariant.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 5:34 UTC (Fri) by kay (subscriber, #1362) [Link]

I always wonder why a big and complicated stack is needed to collect a ping.... and yes I'm old school preferring an apache and a script instead ;-)

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 22:00 UTC (Fri) by flussence (guest, #85566) [Link]

I'm sure people out there have strong opinions about GLib in server software (it's already present on all of mine, because Avahi). But it's not *that* weird - I've seen headless server software that uses Qt for networking.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 7:26 UTC (Fri) by taladar (subscriber, #68407) [Link] (1 responses)

The post talks a lot about graphical settings and settings that differ from the graphical setting under the hood and user consent during installation.

What about installations performed in some automated way (e.g. for all desktops in a company or on a university campus)?

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 10:34 UTC (Fri) by wjt (subscriber, #56250) [Link]

That would be equivalent to the upgrade case described in the proposal. The default is to buffer events locally but not upload them. In a managed environment the organisation can adjust these settings with a text-based config file in /etc.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 8:46 UTC (Fri) by eharris (guest, #144549) [Link] (3 responses)

Given the purpose of the proposed data collection ("how its software is used"), why is the collected data not made anonymous? So....no machine specific data (MAC for example)...no network specific data (IP for example)....no user specific data (user details for paid-for licences for example)....and so on. It's all very well to talk the talk about "privacy"........when anonymity is really what is required.

And another thing.....if the "data upload" was truly anonymous, would that not be useful in persuading users (and law makers) about the propriety of the proposal? And finally, does the "data upload" have a stated lifetime.....or does the Fedora-stored data last forever?

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 9:45 UTC (Fri) by james (subscriber, #1325) [Link] (1 responses)

They cover that in the proposal:

We must also not collect any data that could become personally-identifiable if combined with other data, which notably means IP addresses must not be stored.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 11:26 UTC (Fri) by eduperez (guest, #11232) [Link]

Also:
> We only want to collect anonymous data anyway, but we need to be especially mindful of the possibility that combining two "anonymous" data points could result in the data no longer being anonymous.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 10:48 UTC (Fri) by wjt (subscriber, #56250) [Link]

The proposed data collection is indeed anonymous and does not include any of the data points you mention. The metrics system goes beyond this and is designed to make it impossible to tell whether two separate data points stored on the server came from the same computer or not.

Data lifetime is a great question. Right now there is no automatic retention policy (though the server admin can of course manually remove older data). This would be a great area to improve.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 11:39 UTC (Fri) by adam820 (subscriber, #101353) [Link] (2 responses)

> However, we also want to ensure that the data we collect is meaningful, so gnome-initial-setup will default to displaying the toggle as enabled, even though the underlying setting will initially be disabled. (The underlying setting will not actually be enabled until the user finishes the privacy page, to ensure users have the opportunity to disable the setting before any data is uploaded.)
> Metrics uploading will be opt-in for users who upgrade from previous versions of Fedora Workstation [...] but metrics collection will be opt-out. That is, your upgraded system will collect metrics locally but will never submit them to Fedora.

I think this is a reasonable compromise to the opt-out/opt-in situation, and an important one for anyone who skips reading the posting. I personally don't mind this kind of data collection for real-world use, but making it a checkable box available in the installer is a good move, instead of something that happens automatically and you have to go off and find in the settings later to remember to turn off if you don't want it. Slap it in as a kickstart option as well and I'm a happy camper.

I think if people really want to see Desktop Linux become more cohesive, user-friendly, and accessible in this age of Steam Decks and increased interest from non-Linux-y types, this is a good opportunity to tackle some of those fronts. I've always had a great experience in Desktop Linux for years, even with relatively recent hardware, but my friend gave Fedora a shot as a daily driver for a week and ran into a bunch of issues with his mixed set of 60Hz/144Hz displays, gaming peripherals, etc. which ultimately resulted in switching back to Windows (for a variety of those and other issues). Getting access to the real-world usage info to improve this experience is going to be - hopefully - a good thing, and I'm hoping Fedora can do this in a really user-privacy protected manner.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 18:11 UTC (Fri) by brunowolff (guest, #71160) [Link] (1 responses)

> I think if people really want to see Desktop Linux become more cohesive, user-friendly, and accessible in this age of Steam Decks and increased interest from non-Linux-y types, this is a good opportunity to tackle some of those fronts.

I'd like to see more attention to privacy in the free software echo system. I don't know that I have too much in common with the kind of person that wants to use Steam Decks. Gog is a much better compromise for using proprietary games in my opinion.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 21:44 UTC (Fri) by adam820 (subscriber, #101353) [Link]

> I don't know that I have too much in common with the kind of person that wants to use Steam Decks.

That's fine, but there's lot of people who do, and see it as a way forward for Linux, much like Android phones and every other mass market device. It's getting a lot of people (read: kids) with their hands on a device that runs a full Linux desktop. This is how you get the next generation of people interested in this: the tinkerers, the curious, the gamers, etc. This isn't some computer you have to make an effort to install Linux on, it's already there, by default.

The entire point of the post was "we want to collect data but do it in the most privacy-preserving anonymous way possible, complete with opt-out, full control, and community transparency" and somehow that fails to meet the bar for "attention to privacy".

Be concerned about privacy, sure. It's important. But walk and chew gum; some of us would like a more usable/consistent Desktop experience.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 20:09 UTC (Fri) by tilt12345678 (subscriber, #126336) [Link] (1 responses)

Announcing something like this without key information such as
- What is going to be collected
- How (technically) it is being collected
- How (technically) the information is going to be transmitted
- Where to (territory and legal entity) the information is going to be transmitted
- Where to (territory and legal entities) the information is going to be copied after it has been transmitted
- What the retention policy will be
- What the privacy policy will be
is making this announcement something that can neither be agreed upon nor rejected, so i choose to ignore it. At the time when it will be rolled out, please remind me again, so i can patch it out of our images. Thank you in advance.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 10:56 UTC (Sat) by pwithnall (guest, #97459) [Link]

It’s a proposal, not an announcement. This is the period in which you can voice your specific concerns and proposed solutions about those things to influence the direction the proposal takes.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 21:32 UTC (Fri) by fraetor (subscriber, #161147) [Link]

Something like Go's proposed transparent telemetry could be good. I personally favour informed opt-out though something like a pre-ticked checkbox in the installer, as telemetry is really useful for making informed decisions.

Go Transparent Telemetry: https://research.swtch.com/telemetry

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 14:48 UTC (Sat) by Subsentient (subscriber, #142918) [Link] (10 responses)

My argument against telemetry:

IBM has bought Red Hat, IBM is demonstrably evil, and look at what's happened at Red Hat since then. Fedora may be a "community project", but it's funded by Red Hat and many Red Hat employees are involved.

Even if the initial telemetry respects privacy, there is no ironclad guarantee that IBM will not exert pressure at a point in the near future to change that. I oppose this because Red Hat, and IBM especially, have exhausted all trust from me, and I've already been considering switching to a different distribution before they find ways to limit, corrupt, destroy, or otherwise molest Fedora.

If telemetry is enabled by default, even if it's easy to turn off, that could quite possibly be the last straw that pushes me to another distro.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 15:41 UTC (Sat) by Wol (subscriber, #4433) [Link] (8 responses)

> If telemetry is enabled by default, even if it's easy to turn off, that could quite possibly be the last straw that pushes me to another distro.

Well why not jump now and quit moaning.

> there is no ironclad guarantee that IBM will not exert pressure at a point in the near future to change that.

Last time IBM picked a fight with the Europeans, they came off a VERY poor second. What makes you think it'll be any different next time round?

Cheers,
Wol

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:10 UTC (Sat) by mikebenden (guest, #74702) [Link] (7 responses)

> > If telemetry is enabled by default, [...] that could quite possibly be the last straw that pushes me to another distro.
>
> Well why not jump now and quit moaning.

Are *you* a Fedora user, or just taking pot shots ? (admittedly, he *did* line that one right up for you, tbh) :D

All joking aside, up until a few years ago I would have *never* comtemplated using anything *but* Fedora. Have been using the original RedHat (before RHEL), then Fedora, since the late 90s. In the last few years, I've been getting an unsettling feeling that a faction within Fedora's "leadership" is taking the distro into annoying and unhelpful (to me personally) directions, and have started thinking I need to emotionally prepare for the day Fedora decides to leave *me*.

It is useful information (again, to me) that I'm not the only one feeling that way.

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 8:21 UTC (Sun) by Wol (subscriber, #4433) [Link] (6 responses)

> > Well why not jump now and quit moaning.

> Are *you* a Fedora user, or just taking pot shots ? (admittedly, he *did* line that one right up for you, tbh) :D

I think at the moment we have an invasion of the moaners ... all complaints about what other people are(n't) doing, and all armchair warriors themselves ...

I failed to join the Red Hat eco-system back when it was Red Hat, not RHEL and all that.

Just like I failed to join the Debian eco-system. I tried both, and just couldn't get on with them.

My first linux was Universe Linux, kernel 1.3, and then SuSE. Then when some important (to me) software refused to install on latest SuSE, I went to gentoo, where I've been ever since.

Gentoo for me, SUSE for other people I support, and Slack as my emergency disks ...

Cheers,
Wol

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 11:11 UTC (Sun) by mikebenden (guest, #74702) [Link] (5 responses)

> all complaints about what other people are(n't) doing, and all armchair warriors themselves ...

As mentioned earlier, I used pre-RHEL RedHat and then Fedora since forever. Used, sysadmin-ed for a 500-ish user department, and maintained a few software packages of interest to my community. So I don't consider myself an armchair warrior. I'm also *clearly* not one of the charismatic "organizer" or "leadership" types ("not officer material", as they say in the military :) ).

So I tend to quietly work around the annoyances, and mostly quietly worry about the charismatic workstation types pushing "secure boot", "flatpaks", and now, most recently, "telemetry".

I think secure boot is nice in theory, but in practice mostly ends up having a vendor or corporate entity lord it over the user in physical possession of the device (a kind of "control collar" of sorts, so I hate it instinctively). Secondly, if we're going to treat the distro as simply a host organism for a bunch of third-party flatpaks, why the $#%@ even bother anymore. Lastly, telemetry is actually the least "evil" or scary thing, but the optics are bad, particularly when put in context with all the other stuff.

As long as I can install from the "everything" repositories, and customize my kickstart scripts to get the exact install I want, and disable or ignore the annoying bits, I should be fine. But I wonder for how long I can get away with that, given the overall direction of the "prevailing winds"...

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 14:52 UTC (Sun) by jzb (editor, #7867) [Link] (1 responses)

I think you'd find more interest and sympathy by solely identifying and voicing your technological issues and avoiding the digs at people who're doing the work.

The armchair quarterback analogy is somewhat apt here. Producing an open source project can be a spectator sport if you're content to watch and accept what comes out of it. Otherwise, suit up and play or coach, or carry water buckets, whatever, if you want a voice. If you want ultimate control, buy a team. Of course buying a team is out of reach for most people, but so is providing all the infrastructure and people time to produce Fedora.

I could go on at length with this analogy, but suffice to say that Fedora is ultimately at the intersection of commercial and community interests and is always going to be driven in part by changing commercial requirements.

Like choosing to follow a pro sports team, there's always going to be the possibility that the owners or players will do something to disappoint you - and I don't just mean losing games or championships. I say this as someone who is originally from near St. Louis, which has lost not just one but *two* professional NFL teams to other cities in my lifetime. One hopes St. Louis has learned its lesson by now.

We are where we are with the state of open source today because the vast majority of people have been content to sit on the sidelines and hope that shouting at the owners, coaches, and players would be sufficient to influence things forever.

As you say, how long can "the community" get away with that? If you're a Cardinals or Rams football fan, only so long as you don't care what city they're playing in. If you're a vendor-sponsored project user, only so long as there's not a huge disconnect between the vendor's needs and your wants.

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 15:56 UTC (Sun) by mikebenden (guest, #74702) [Link]

> I think you'd find more interest and sympathy

Not looking for sympathy, but thanks anyway :)

> The armchair quarterback analogy is somewhat apt here. Producing an open source project can be a spectator sport if you're content to watch and accept what comes out of it.

Well, maintaining Fedora for people in my care, and maintaining Fedora RPM packages for software I (and those people) care about is, IMHO, dead-center in the "community member" territory. Not part of the "intelligentsia", like what *you* may be used to.

> content to sit on the sidelines and hope that shouting at the owners, coaches, and players would be sufficient to influence things forever.

I think (re. OP's suggestion he might switch away from fedora, which propmpted the whole "moaner" thing I then felt compelled to reply to) it's useful for us "peasants" to make our voices heard. The "high rollers" will do what they will do, and we will vote with our feet. I'd rather not have to, but I'm perfectly qualified to do so (with great deals of annoyance and unnecessary extra work, but qualified and able to nonetheless).

Your thing about buying a team or learning to play NFL-class football as an alternative to yelling at the owners and players from the sidelines does read a lot like "try eating cake when the bread runs out", whether you intended it that way or not.

I'll stop here, since I already said what I had to say, and see no further point in having an actual *argument* :) Cheers!

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 18:27 UTC (Sun) by Wol (subscriber, #4433) [Link] (2 responses)

> I think secure boot is nice in theory, but in practice mostly ends up having a vendor or corporate entity lord it over the user in physical possession of the device (a kind of "control collar" of sorts, so I hate it instinctively)

And here - although you do word it correctly - you piss off a load of people who MIGHT be on your side.

You get annoyed by people who don't let you do what you like with stuff in your possession - well if you found a £50 note in someone else's handbag and spent it the police might like a word with you - it's called theft. But it was in your possession! ...

If, on the other hand, you'd said "lord it over the OWNER of the device", I'd agree with you.

My company laptop is locked up down the wazoo, and I see nothing wrong with that. It is THEIR device, after all. If I can't do my work as a result, I get paid for doing nothing ... brilliant !!!

Those people who think possession is nine tenths of law piss of the one tenth who actually own the device ...

Cheers,
Wol

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 20:24 UTC (Sun) by mikebenden (guest, #74702) [Link] (1 responses)

> And here - although you do word it correctly - you piss off a load of people who MIGHT be on your side.

I chose my words carefully, thanks for noticing!

> If, on the other hand, you'd said "lord it over the OWNER of the device", I'd agree with you.

Happy to agree on our disapproval of vendors/manufacturers retaining "de facto" ownership on devices they sell to us and which we own "de jure". I hold my fruity-phone at arms length, with two fingers, with disgust (metaphorically speaking), knowing it would thrown me under the bus in a New York minute the moment my interests diverged from those of its manufacturer.

> My company laptop is locked up down the wazoo, and I see nothing wrong with that.
> It is THEIR device, after all. If I can't do my work as a result, I get paid for doing nothing ... brilliant !!!

Agree on the use case being a perfectly legal one. However, anyone wishing to employ me who would refuse to trust me to self-manage a machine they bought for me (and therefore legally own themselves) to our mutual benefit can fuck right off. This may mean that I'm privileged (in that I can afford to turn down work when my principles conflict with those of a potential employer), but I really really hate the concept of a "control collar", and would consider it insulting and humiliating to be subjected to it. As such, I feel that a community valuing freedom should not obsequiously aid such corporate oppression. Which is another reason I feel the "prevailing winds" of Fedora may be blowing in a direction in which I don't wish to go.

You should obviously feel free to do *you*, of course... :)

With all that out of the way, I'm done, and going back into anonymous lurking mode -- Cheers!

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 22:34 UTC (Sun) by Wol (subscriber, #4433) [Link]

> Agree on the use case being a perfectly legal one. However, anyone wishing to employ me who would refuse to trust me to self-manage a machine they bought for me (and therefore legally own themselves) to our mutual benefit can fuck right off

Well, you're a sys-admin. I'm a NoSQL database guy. One of the main reasons our systems are locked down is the increasing threat from crackers. I'm happy to leave all that security stuff to others.

It is frustrating, though, that I can't do what I want. But most of that is actually getting permission to run the software I want, which I'm hoping to get. And seeing as the software I want - if I succeed - is likely to replace Excel and require support from elsewhere, then the company has every right not to let me run riot introducing stuff that nobody else has a clue how to support. Bus factor and all that ...

Cheers,
Wol

Fedora considers "privacy-preserving" telemetry

Posted Jul 10, 2023 18:00 UTC (Mon) by brunowolff (guest, #71160) [Link]

> IBM has bought Red Hat, IBM is demonstrably evil, and look at what's happened at Red Hat since then.

IBM is a big company and different parts do do things that may be good or bad for the free software community.

One of the good things they do is support ozlabs (it looks like for over 20 years), which has done some good work for openpower (which I care about), along with a number of other things.

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 8:58 UTC (Sun) by mips (guest, #105013) [Link] (4 responses)

Leaving aside individual privacy, is there a security issue?

If the telemetry includes enough information to construct a fingerprint that could be correlated by an external scan, then an attacker with access to the telemetry could conceivably learn a lot given the telemetry is privileged information gathered from inside any defences, e.g. whether critical patches have been applied.

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 15:35 UTC (Sun) by drago01 (subscriber, #50715) [Link] (3 responses)

Security by obscurity doesn't work.

The solution to uninstalled security patches is to actually install them.

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 18:38 UTC (Sun) by Wol (subscriber, #4433) [Link] (2 responses)

> Security by obscurity doesn't work.

But security by obscurity IS another line of defence.

I wouldn't rely on it, but if it's available I'll use it!

Cheers,
Wol

Fedora considers "privacy-preserving" telemetry

Posted Jul 10, 2023 7:14 UTC (Mon) by drago01 (subscriber, #50715) [Link] (1 responses)

No it really isn't.

Exploits are simply tried out, if you are vulnerable you will get attacked.

If there are known security vulnerabilities with available patches, the patches must be applied ASAP.

Fedora considers "privacy-preserving" telemetry

Posted Jul 10, 2023 8:53 UTC (Mon) by Wol (subscriber, #4433) [Link]

Which is why I left out the line about "unpatched vulnerabilities".

I'm a database guy. But I don't worry about Bobby Tables because the SELECT verb behaves in a completely unexpected (to the naive attacker) way.

I just have to worry about other things instead :-)

Cheers,
Wol

Fedora considers "privacy-preserving" telemetry

Posted Jul 10, 2023 14:09 UTC (Mon) by nixfu (guest, #165829) [Link] (2 responses)

$100 says this is IBM wanting to track who is using Fedora, so they can build a list of IP's of corporations they can then go try and sell RHEL to.

Fedora considers "privacy-preserving" telemetry

Posted Jul 10, 2023 14:51 UTC (Mon) by pizza (subscriber, #46) [Link]

> $100 says this is IBM wanting to track who is using Fedora, so they can build a list of IP's of corporations they can then go try and sell RHEL to.

IP addresses are explicitly *not* collected as part of this proposal. Indeed, there are no per-device/user identifiers collected at all, which you would have known if you'd bothered to *read* the proposal instead of just mouthing off against it.

Meanwhile, you do understand that IP address information has _always_ been obtainable/available through the download mirror infrastructure?

LOL

Posted Jul 11, 2023 3:55 UTC (Tue) by mattdm (subscriber, #18) [Link]

I've heard a lot of silly, over-the-top reactions to this proposal, but I do think you're the overall winner so far (although close call runner-ups for the person who called this "equivalent to slavery", and the guy who said that we are "the devil").

You can donate your $100 to Outreachy, EFF, or to LWN. (The latter I think not tax deducible.)