Isn't it? When I opened VS Code on a new computer for the first time today, a message popped up with step by step instructions to opt out

Tracking should always be opt-in, not opt-out. I base this on expected user preference and trying to optimize for user happiness and functionality. I don’t think this is as true for non-OSS software where the purpose is likely more toward revenue generation than community and user functionality.

First, please let's draw a distinction between different kinds of tracking. We're smart enough to appreciate the naunces here. Some information is more valuable than others.

* How many times you clicked Edit -> Paste vs Ctrl/Cmd + V. This is not personal information. It cannot be used in any way to identify you.

* Your location/medical information. Guard this with your life if you must. Share it with literally no one. If it's uploaded somewhere, delete it asap.

All our information falls on a spectrum between these two extremes. Let's please acknowledge that not all information is super sensitive, that it's ok to share information like the paste example.

Second, this information can be useful, and can change the direction of the products we're building. For example, the Office team wanted to re-design the old menu bar interface to surface the features people were using the most. You know what people used the menu bar for the most? EDIT -> PASTE. You'd think everyone knows about Ctrl + V, but apparently not. The vast majority of the world used to click Edit, then click Paste. Knowing that users were doing this allowed the interface to be moulded to suit the needs of the silent, non shortcut using majority instead of HN power users - https://imgur.com/a/WLm4UJd.

Third, if you acknowledge that this information is useful, then it follows that it's only useful when it's opt-out. If it's opt-in and only 0.01% of your users opt-in, you can't make any reasonable conclusion from the data because it wouldn't be representative. If you tried to convince folks that no one uses keyboard shortcuts to paste based on this tiny data set, they'd laugh you out of the room. Collecting opt-in data in this case is almost useless.

Fourth, products that collect this info become better. If you're ok with webapps collecting this but not native apps (like VS Code), then the consequence might be that web apps end up being much better than native apps. Whether you prefer that or not is moot, but personally I like having options. Let's not force native app makers to stop collecting non-identifying information when the downside is minimal/non-existent.

With machine learning they might only need to know your pasting habits and what function names you use most commonly, maybe a bit of information about how fast your type and this will be enough information to identify you based on your behaviour.

Search engines are recording really detailed information as you type, as you browse other websites using their invasive trojan-like analytics. With this data you can probably identify anonymous users from their behaviour (even if the ipv4 address is "encrypted" hah). All it takes is for data from one company to end up at another company and I believe this happens very often.

I think the problem is that you need less and less information to personally identify someone as you have more data. We are not intelligent enough to know what data is identifying or not so therefore the only option we have is to stop giving out our data.

Or you could use differentially private data collection.

This is borderline paranoid IMHO

> With Machine Learning

Tell me, who exactly is running ML on this data? They're going to great lengths to anonymize this data. If they wanted identifying information, they'd just upload your unixname, they wouldn't anonymize and then de-anonymize with ML.

I don't even know how you conflated the metrics on menu clicks with uploading paste data. That's ridiculous. Did you even notice you made that leap?

If the menu click data is detailed enough then it may already be personally identifying information. You could take tracking data from another software that collects similar information and using ML match these together and suddently you can get a full name from just a bunch of seemingly innocent data (if the latter software is associated with a name of course).

I don't know what data they collect now or what they will collect later so I am just speculating. But I am sure the ToS has a section about how they can change the terms however they wish.

Please tell me about the great lengths they go to anonymize this data because I believe it to be very difficult to do, and absolutely not in their interest.

Edit: With pasting habits I meant if you paste with shortcuts or go through the menu, not the actual paste content. Sorry for the confusion.

> Fourth, products that collect this info become better. If you're ok with webapps collecting this but not native apps (like VS Code), then the consequence might be that web apps end up being much better than native apps.

So what? VScode can also be used as web app already, it's not about what others do or don't with their online services. The question is about the expectation and respect to the end user, having telemetry on by default is disingenuous to say the least.

How many times you ctrl + c & ctrl + v, and generally your computer usage, likely could be used to profile you.

One single link to your identity, and you now have user tracking. If course, there's probably easier ways to achieve it.

In theory, it kind of is: as far as I’m aware, which I haven’t delved deeply into it so grain of salt time, but it doesn’t send data until you make that decision. And it isn’t like you have to dig for it: it’s presented to you explicitly. Yeah, it asks if you wish to opt out of “making the product better” or whatever the verbiage, but I don’t think it is going to confuse many. Especially within the target user demographic.

What is the crucial difference between a popup saying "would you like to opt in?" and popup saying "would you like to opt out?"

Opt-in telemetry likely won't serve it's purpose.

Very few users change the defaults. To the point where you don't get enough data for useful insights.

That is exactly right. Almost no one would turn it on if it were off by defauly, which makes data collected by those few users strongly biased against general users and their usage patterns. (Meaning that the data you do collect will be useless.)

This is literally the only reason that telemetry is almost always on by default. There is no illuminati secretly buying developers to learn your secrets via application telemetry, and it's laughable to think that's the case, in my mind.

If people turn it off when they have a choice, and only leave it on when they are unaware it exists then obviously there is a problem. I don't see how it is laughable to be paranoid in this case.

isn't paranoia by definition irrational?

I suppose not when it is rational to be paranoid.

Rational people are cautious, not paranoid.

Opt out is when the tracking is on by default and the user has to take action to stop it. Opt in is off by default and action must be taken to enable it. What happens before the popup decides which one it is. If the user closes or ignores the message about tracking there should be none and there should have been none before the popup.

User perception of a default state.

There’s a good book called Nudge by Richard Thaler (and someone else I can’t remember) where he goes into great detail on the default decision.

Tl;dr; people usually accept the default so your prompts yield very different results.

You can't have your cake and eat it too. Telemetry in this case helps in improvement of the product, it's good for you as end user. If you don't like, please switch to another editor. You paid zero but setting requirements how it should and how it shouldn't. Good luck with utter ugly but no tracking and "free" GNU Emacs with its ancient Lisp and garbage packages.

You are the product. You paid by using it and by giving back on github or by getting your boss to buy support.

If you don't like that switch to a non-open source editor.

When I was using azure data studio the opt out was to visit a link, read the wiki page, open the settings.json file using your file manager and then paste in the tracking opt out key and restart the program. Or you could just close the message and be tracked. This is absolutely unacceptable opting out of tracking should be made exactly the same effort or less effort than opting in.