Fedora considers "privacy-preserving" telemetry [LWN.net]

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 1:03 UTC (Fri) by geofft (subscriber, #59789)
Parent article: Fedora considers "privacy-preserving" telemetry

I wish they didn't use the name "telemetry" for this; it's going to produce a lot of instinctive reactions from people that don't lend themselves to a productive conversation. (See, for instance, the person objecting that Linux users culturally value their privacy, on a public and archived-forever mailing list, signed with their full name and long-term-persistent email address.)

We've had various forms of "telemetry" in FOSS for a long while. Debian has the "popularity contest," for instance, which is probably wildly inaccurate in this world of public cloud VMs and containers, but is still used when making development decisions. Lots of web services collect visitor logs, and most FOSS web servers default to recording access logs, including IP addresses. Pine (which, admittedly, went through a period where it didn't count as FOSS) prompted users to send an email counting them as a Pine user (https://staff.washington.edu/corey/pine-stats/), which the development team used to measure their impact and justify their continued funding - the same motivation Endless OS cites in their post (https://blogs.gnome.org/wjjt/2023/07/05/endless-oss-priva...). I found the post quite thoughtful, especially about what "privacy-preserving" means.

I suspect there are very few people who are okay with this sort of metrics collection who are going to be motivated to join a forum to argue passionately about how they don't find it objectionable.

to post comments

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 5:04 UTC (Fri) by wjt (subscriber, #56250) [Link] (14 responses)

I'm happy you appreciated that blog post. FWIW I used the term “telemetry”, despite us using the term “metrics” throughout the codebase & in conversation about the stack, almost because it has those connotations and I wanted to address that head-on, rather than using other terms and potentially being accused of hiding behind euphemism.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 5:31 UTC (Fri) by oldtomas (guest, #72579) [Link] (13 responses)

FWIW I prefer calling a spade a spade. Everything else would come across as manipulative.

To the other examples you pose: they are all opt-in. The proposed telemetry is opt-out. To me, this is always a strong smell.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 7:18 UTC (Fri) by taladar (subscriber, #68407) [Link] (12 responses)

Opt-out is also more likely to be a problem legally depending on the information included.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 7:26 UTC (Fri) by eduperez (guest, #11232) [Link]

> Opt-out is also more likely to be a problem legally depending on the information included.

And that is a good thing, because it will force Fedora to ensure that the information included really preserves the privacy of their users.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 7:27 UTC (Fri) by tchernobog (subscriber, #73595) [Link] (10 responses)

Correct. In Europe, this also has quite a bit of repercussions on the way you implement GDPR requirements. Which requires opt-in and not opt-out as soon as data can be used even just for correlation purposes.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 15:13 UTC (Fri) by geofft (subscriber, #59789) [Link]

They address this in the proposal and say that this requires them to do things in a way that is compliant with European law, i.e., any proposals that would be in violation of European law are already off the table. This actually seems like a good constraint - if their devs insist (for good reasons that they set forth in the proposal) on opt-out metrics, their lawyers are going to insist that the data cannot be used for correlation. They can't be tempted to start collecting too much data and defend it with "it's fine because users are consenting."

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 16:59 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (8 responses)

That is not what GDPR says. GDPR says that you must have a "lawful basis" for collecting information. Consent is one such basis, and if you're using consent as your lawful basis, then opt-in is required, but there are other lawful bases as well, and for those, you don't even need to provide an opt-out. However, they all impose some kind of restriction on what data you collect and/or what you use it for. There is no "get out of jail free" card in the law.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 22:27 UTC (Fri) by fraetor (subscriber, #161147) [Link]

Specifically the relevant bit if GDPR is that the lawful basis can come via several things. Consent is one, but the most relevent would be legitimate interest.

“*The legitimate interests of a controller (..) may provide a legal basis for processing, (..) taking into consideration the reasonable expectations of data subjects based on their relationship with the controller.*”

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 13:00 UTC (Sat) by eduperez (guest, #11232) [Link] (4 responses)

GDPR only caes about personal / sensitive information. As long as the information is (really) "privacy-preserving", it does not apply.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:42 UTC (Sat) by NYKevin (subscriber, #129325) [Link] (3 responses)

This is much broader than you think it is. According to GDPR Article 4(1):

> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

In other words: If it is *possible* to figure out which human a given piece of data relates to, then the data is "personal" data. So if I know that somebody has a mouse with three buttons, that's not personal data. But if I know that user #12345 has a mouse with three buttons, that is personal data (assuming that it is possible to look up user #12345 in some database somewhere).

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:53 UTC (Sat) by wjt (subscriber, #56250) [Link] (2 responses)

In the metrics system that is being proposed here, metrics are associated not with a user ID, but only with an identifier for the originally-installed OS image, which is the same across a large number of devices. (This OS image ID is an Endless OS-specific concept; I don't know if an equivalent channel ID would be used on Fedora but running the current implementation on Fedora would associate all events with the image ID "unknown".)

So, in your example, there would be no database in which to look up user #12345, and no "user #12345" identifier on the three-button-mouse data point.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 23:56 UTC (Sat) by NYKevin (subscriber, #129325) [Link] (1 responses)

That is probably fine, but you still have to be careful. It is very easy to accidentally store personal data without intending to do so.

As an example, let's say that you have some firewall that logs incoming requests for a short time, and captures the source IP address as well as the exact time of the user's submission. Your database stores a timestamp and whatever telemetry metrics are captured. The IP address is an "online identifier," and you can time-correlate the database with the firewall log, so the whole thing is "personal data." The fact that you separate the telemetry metrics from the IP address, and store them in independent systems, is called "pseudonymization":

> ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

Pseudonymous data is still considered personal data, at least until you delete the firewall log, or until you delete enough data that it is no longer possible to associate your telemetry metrics with an IP address (e.g. delete the timestamps from either the database or the firewall log). Pseudonymization is recommended as one possible practice to improve compliance with article 6, but it does not relieve you of any other obligations under GDPR, including the lawful basis requirement.

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 9:21 UTC (Sun) by wjt (subscriber, #56250) [Link]

Each event is stored with a timestamp of when it occured, but not when it was submitted. They are buffered on the client and submitted in batches, and split apart before storing. So the events can't be correlated back to the load balancer logs to link them to an IP address. (I'm not sure what the load balancer logs – thanks for the idea to go and check this!)

It's actually quite annoying to not have the submission time together with each event because it makes it very hard to figure out the event submission latency. (After how many days in July can we expect the data on the server for June to be "mostly complete"?) It would be useful to store a truncated received-at timestamp on the events, but only if it is sufficiently vague to not allow associating events with one another, or with the logs of the upload.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:11 UTC (Sat) by iainn (guest, #64312) [Link] (1 responses)

Article 21 “Right to object” is a reason to provide opt opt, even when consent isn't the lawful basis.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:37 UTC (Sat) by NYKevin (subscriber, #129325) [Link]

That only applies to some situations. If, for example, Amazon.com asks you for your physical mailing address in order to ship a package to you, the law explicitly does not give you the right to object to that (because it would be absurd - how else are they supposed to get the package to you?).

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 9:50 UTC (Fri) by detiste (guest, #96117) [Link] (1 responses)

Also embedded/offline devices can't publish popcon info either.
I manage 1300 servers with python3-zeep while the global PopCon is only at 500.

So popcon is mostly usefull for Desktop/Development package tracking.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 19:26 UTC (Sat) by ballombe (subscriber, #9523) [Link]

Whatever reporting system you use, offline devices will not report telemetry.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 13:18 UTC (Fri) by sionescu (subscriber, #59410) [Link]

> I wish they didn't use the name "telemetry" for this; it's going to produce a lot of instinctive reactions from people that don't lend themselves to a productive conversation. (See, for instance, the person objecting that Linux users culturally value their privacy, on a public and archived-forever mailing list, signed with their full name and long-term-persistent email address.

What better way to exemplify improductive conversations than your nonsensical quip about users that value their privacy ?

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 18:19 UTC (Fri) by clump (subscriber, #27801) [Link]

(See, for instance, the person objecting that Linux users culturally value their privacy, on a public and archived-forever mailing list, signed with their full name and long-term-persistent email address.)

Being concerned about privacy isn't isn't inconsistent with using your real name on a public mailing list. On the contrary, you could argue that if someone truly cared they'd stand up to be counted.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 18:52 UTC (Fri) by gnoutchd (guest, #121472) [Link] (5 responses)

[...] it's going to produce a lot of instinctive reactions from people that don't lend themselves to a productive conversation. (See, for instance, the person objecting that Linux users culturally value their privacy, on a public and archived-forever mailing list, signed with their full name and long-term-persistent email address.)

Putting an opinion on a public record under my real name does not imply I'm OK with surveillance in the (many!) other aspects of my life. I don't want to be told that my privacy concerns will be dismissed and denigrated unless I conspicuously employ every possible defense.

It's true that FOSS projects are very public, perhaps excessively so at times. Given our issues around diversity and inclusion, perhaps we could take contributor privacy more seriously. But the radical transparency of FOSS projects is exactly what makes the software trustworthy and therefore attractive to users worried about privacy. I was drawn to FOSS in great part because I intensely care about my privacy, and I want tools that I can trust.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 18:58 UTC (Fri) by pizza (subscriber, #46) [Link] (4 responses)

One of the problems I see with this is that there's considerable overlap between the folks objecting to telemetry (of any sort) and those that complain that projects are not listening [1] to their users. They simultaneously decry decisions being made without supporting data, and object to attempts to obtain said data.

[1] What comes to mind is ALSA support in Firefox, and extension use in GNOME (and Firefox)

Fedora considers "privacy-preserving" telemetry

Posted Jul 11, 2023 7:37 UTC (Tue) by kilobyte (subscriber, #108024) [Link] (3 responses)

Trying to ransom our data is bad regardless of what excuse you say.

Fedora considers "privacy-preserving" telemetry

Posted Jul 13, 2023 23:03 UTC (Thu) by pizza (subscriber, #46) [Link] (2 responses)

> Trying to ransom our data is bad regardless of what excuse you say.

Who, exactly, is "Trying to ransom our data"? And for what? Those are some pretty strong words....

The thing is, it doesn't matter I or you say here -- What matters is what's in the actual proposal -- the proposal that hardly anyone seems to have actually *read* before expressing opinions about what it says and the "obvious" motivations of its authors and/or the entities that are paying their salaries.

So, going back to what the actual proposal says, no data will be submitted without explicit user consent.

Meanwhile. If you have a problem with "data being gathered" on your local system, I trust you've also disabled (eg) GNOME's search/indexing functionality, which is on by default [1]. Do you also routinely clear (or disable) your browser cache? And then there's everything gathered and stored in ~/.cache or /var/cache -- The system I'm typing this on has over 2.7GB of stuff in ~/.cache (1.2GB of that are browser caches), plus another ~6GB of stuff in /var/cache covering 125 different programs, and while some of that is generic (eg dnf metadata caches) I'd wager the majority of it is stuff unique to my system or even me personally. I actually opted into very little of that, except in the sense that I willingly chose to use a modern Linux desktop system.

[1] Putting aside GNOME, there's also the classic 'locate' database, though I'm not sure if that's installed/enabled by default on Fedora these days. Personally I've always installed/enabled it as I find that functionality invaluable.

Fedora considers "privacy-preserving" telemetry

Posted Jul 14, 2023 8:56 UTC (Fri) by Wol (subscriber, #4433) [Link]

And there's KDE's baloo, which I don't understand. On my current system I can't be bothered to disable it, but on a previous system it (or its predecessor) basically screwed up loads of systems. It extended the login time on my Athlon Thunderbird system to over 36 hours (dunno how long it was - I killed it), which is pretty disastrous on a desktop that gets shut down every night.

It was on by default "to improve your experience with KMail and the like" (which I don't use), so that was a big chunk of the KDE4 disaster ...

Cheers,
Wol

Fedora considers "privacy-preserving" telemetry

Posted Jul 14, 2023 11:25 UTC (Fri) by zuki (subscriber, #41808) [Link]

> there's also the classic 'locate' database, though I'm not sure if that's installed/enabled by default on Fedora these days. Personally I've always installed/enabled it as I find that functionality invaluable.

It is. Currently using plocate: https://fedoraproject.org/wiki/Changes/Plocate_as_the_def.... You're welcome ;)

Fedora considers "privacy-preserving" telemetry

Posted Jul 13, 2023 15:47 UTC (Thu) by highvoltage (subscriber, #57465) [Link]

Popcon is opt-in, not opt-out, that makes a world of difference.