Actually, I don't. I didn't agree to let it phone home. It does it before it tells me anything at all. It's also connecting to the telemetry service endpoint immediately on launch, despite not having selected a telemetry consent setting yet.
How about this one? It phones home when you click "don't phone home".
I respect your privacy views and even share many/most of them (if not so strictly), and appreciate that you are probably just trying to bring this to people's attention. However, you are not the king of open source, and you cannot dictate how other authors must write their projects. It's an open source product written by a for-profit company. There's always going to be trade-offs.
You're saying "Don't use Atom", but what you're implying is "Don't talk about Atom"
I am, however, the king of my own computer, and this software does not respect my sovereignty.
Lots of programs are abusing user trust.
I've never had a problem with people that have extremely strict views of privacy. In fact I usually think they're right. But it's incredibly impractical, and most people don't currently care, which is the real problem. Treating relatively trivial things like this as if it were some conspiracy on behalf of the surveillance state doesn't do anything to get people to listen.
Get people to start dropping Facebook and Google, then we can start tackling the smaller offenses like this. Until then, treating this like you're going up against the NSA is a vanity exercise.
Or he can do one better: Not use it and publicly criticize it.
“Doing one better” would be patching and compiling from source yourself. Better still would be maintaining an up-to-date fork for the benefit of other like-minded people.
Clearly the maintainers of Atom don't place value in their reputation. Just be thankful that the maintainers have conveyed their true colours for all to see.
> "it’s not really in the spirit of open source, where criticism comes in the form of patches and forks."
Everybody has an obligation to refrain from bad behavior whether or not they are an "open source" developer, and everybody has a right to criticize bad behavior whether or not they consume software, and whether or not the software they consume is "open source." That may not be what "open source" means to you, but in that case I want nothing to do with whatever it is that it means to you. I don't subscribe to any ideology that obligates me to hold my tongue when I see somebody doing something I think is morally wrong.
You'll just have to find a way to cope with people criticizing things or people you believe should be immune to criticism. The simple fact of the matter is you have neither the power nor authority to set the bounds for acceptable criticism. People will continue to criticize software they choose to not use, and there is nothing you can do to stop that. You certainly can't stop them by telling them to shut up or by trying to overload the definition of "open source" with your own inane pet philosophy [namely: "All criticism should be formatted as patches or forks."]
For the record—:
• I didn't say (and I don't believe) that developers "should be immune to criticism"
• I didn't describe (and I do reject) an "ideology that obligates [anyone] to hold [their] tongue."
• I never defined any "bounds for acceptable criticism."
• I never said "All criticism should be formatted as patches or forks."
Nobody is obligated to act in accordance with anyone else's opinion of the spirit of a community. People are free to do whatever they wish as long as it's within the bounds of law and license conditions.
I have no problem with any form of criticism, although I do find it more worthy of one's attention when it's constructive. I do have a problem with the attitude of some people who get offended when their criticism is rejected or ignored.
What I reject is the assertion that the copyright holder of an open source software project is obligated to follow a certain mode of behaviour. By contrast, you're saying that "everybody has an obligation to refrain from bad behaviour." So in a surprise twist, it turns out the only person obligating a certain ideology upon others here is you.
If anything is a restriction of open source, it's demanding that the developers of Atom implement a feature the way you want. If you don't like their code or their stewardship, badgering them on this one point doesn't fix the underlying difference in principles.
Open source is a hacker thing. Hackers like open source because it avoids useless duplication of effort, which is toilsome and wasteful. Hackers don't like toil and unnecessary waste.
Forks are nothing but otherwise-unnecessary waste. They become necessary through asshattery like spying on users, but they are a last resort, because everything else about a fork is antithetical to most hackers: it's boring, wasteful, duplicated work, induced solely by an unreasonable upstream.
We try a lot of things before we fork, including naming and shaming.
Badgering the maintainer doesn't fix the fundamental philosophical disagreement.
Forks don't matter if they don't succeed—it only wastes the time of people volunteering to have it wasted. But when they do succeed, sometimes amazing things happen. The history of open source is rife with hugely consequential forks.
Criticism in the form of words is healthy, and this poster is beating a dead horse.
I think most people don't realize. That's why these things do it silently.
Most people do care if you ask them. They don't want to be spied on. Given the option, most people will say "no, thank you". That's why these maintainers are so afraid of opt-in. They pay lip service to respecting user consent, but it's just that. They don't actually want to accurately reflect user consent, because they know that if they actually ask to measure it, they don't really have it. It's just like shitty web shops that automatically sign you up for their weekly marketing promo newsletter because you bought something one time. You don't want it, they know you don't want it, but they're still going to rob you of your time deleting them until you finally click Unsubscribe. Same deal.
Did you watch the John Oliver interview with Ed Snowden?[1] The show went out on the street and most people had no idea who he was or what he did or the information he released, but when asked if they knew that the government was logging all of their dick pics (which Ed gracefully confirmed that they are, in fact, doing), they said that they did not know and were not okay with it.
I think the core issue is ignorance, not apathy. I intend to educate people on the matter, and give them actionable steps to take to express their displeasure to the maintainers and their parent organizations. We can solve this issue before it gets any larger.
No, but I can convince other people who don't like their computers being used a spying tools against them to put social pressure on maintainers so that they stop doing this nonsense.
Atom's telemetry used to be on by default; spying silently caused them such a shitstorm that they added a consent dialog. They're almost there! Now they just have to make it functional.
https://github.com/atom/atom/pull/12281
There are precedents. We can push back, especially against open source projects.
> There's always going to be trade-offs.
I don't think that's how software works. I certainly don't take that to mean that I should just accept that it's going to spy on me. I don't want that, and I don't accept that, and I will yell, loudly, at anyone who says I should accept that without a fight.
So how would a user, who hadn't seen this discussion, know that their "we'll ask" reassurance was bullshit?
So if you actually did care, you the user would know because your operating system alerted you.
Nagging everyone to comply with your interpretation of “the right thing” might feel good to you, but it’s actually a very weak and porous form of security theatre.
As I recall, it was a huge upset when Ubuntu app search hit Amazon by default.
And when you install Debian, it asks whether you want to participate in the packages survey. And the default is "no".
Edit: And just to be clear, this isn't about me. I assume that stuff will leak my IP address without warning, so I only connect via nested VPN chains. Or when I really care, that plus Tor.
This is about people who trust stuff that they use.
today i decided i care more about strangers than i thought i did
people brand new to our industry should be able to download a nice gui editor and not get their consent trampled and get spied on even after they click the "dont spy on me" button
it's easy to laugh and be like "oh lol it's software from microsoft what did they expect, noobs" like someone else did in this thread
but that's bullshit and you and i both know it
the software simply shouldn't do that when you say "don't send my data away pls"
i don't want everyone to have to say "oh use homebrew it's great but also add this weird line about analytics to your .bashrc before you install it oh wait you don't know what a bashrc is huh" when they talk to some teenager who just got a $15 rtlsdr and wants to install gnuradio on their mac
that's not a good first-10-minutes-at-the-command-line experience.
i don't think that's fair or good or optimal.
i want the world to be different, and i want these maintainers to realize that they made a mistake, and revert it. i don't think they're bad people, i think they're just misguided, and they're optimizing for vanity metrics like user count, which will effectively go away entirely if i succeed and they only get telemetry from users who said "yes it's ok i don't mind". that's a lot fewer users, and they know it, which is why so many of them are refusing to engage with the ethical argument about silently using a user's own hardware to spy on them without their knowledge or consent.
it shouldn't be a controversial position that our tools should not spy on us.
I don’t understand why some here take your reports on GH personally. The fact that your reports aren’t taken seriously by the Atom team worries me. Your battle is right and presented in the right tones.
Meanwhile, isn't it strange that the default behaviour (on nearly all major consumer computer platforms) that we implicitly trust all applications with near-unfettered access to the internet. And we merely hope they don't betray us.
Why do you need that when you can just not use things that spy on you (by your own logic)
That is a flat wrong summation of sneak's arguments in this discussion. I think you must have misread usernames, because sneak is saying quite the opposite of what you think he's saying.
Note that sneak is not sjwright (the other person in this thread you've responded to and who's argument you seem to have misattributed to sneak.)
(I'm not saying that's the case, by the way. It's just an observation. We can't really know if they're lying or not—and to that extent I agree with your point.)
ISPs, companies and governments can do it for surveillance, censorship and security reasons. We should be able to do it too in order to empower ourselves.
And you're not the king of what people are allowed to voice their views and opinions on in public forums.
Authors can do whatever they want and users can say whatever they want as a result. Doing something does not mean you are free of the consequences, including people voicing their opinions, of those actions.
Blaming tone is too easy - at this point the Atom team is representing Microsoft, so I'd say the burden is on them to soak up a little snark; especially coming from a user who maybe expects them to behave a bit more like the GitHub of old. Even if they were a small open-source team I would still expect them to directly confront the issue instead of beating around the bush. It's about privacy, and splitting hairs to deny the reporter's reality is a bad look.
It's an insult. They're comparing people with legitimate concerns backed by evidence and precedent to paranoid schizophrenics. They are implicitly saying that people who value privacy are delusional and mentally ill.
This is just picking on an open-source team which already has shown themselves to take user feedback about privacy seriously. If you are so suspect of third parties that any device or application sending any network traffic without previous authorization is of serious concern to you, there's a lot more important and impactful products to voice concern about. Like pretty much any other part of Microsoft.
But I'm sympathetic to Github here. Having users on unpatched software is a bigger risk to them than not having 100% perfect insulation from sending their IP address to Microsoft.
That's not a decision for Github to make. Let the user decide. Perhaps by even presenting them with a dialog on first run that informs them then asks them ti decide.
Somewhere out there (prog21 ?) is an article stating that the one in desperate need of electricity (the computing device) is subject to the one in a position to provide it (the user), and I agree with that sentiment.
I'd even like an IETF-standard-like T-shirt that says 'The user's will MUST be obeyed as faithfully as possible unless prevented by unrecoverable circumstances' or something like that.
Click-through EULAs and dialog boxes are another symptom of the 'elite-developer-itis' our industry can sometimes exude.
One typically gets packages from the distro's repository. And traffic with modern repositories uses HTTPS. So third parties don't see what packages are being used. And unless one configures a developer repository, there's never any traffic to the developer.
Also, IP addresses are considered PII under GDPR.
Edit: Still, if one cares that much about ones IP address, it's prudent to use a VPN service or Tor.
I'm like 99% sure that datasets are available that link IP addresses to all sorts of PII. And then there are third-party cookies and other trackers.
Not true. They’re only PII if they can be used to connect something to a person. It’s a minor distinction, but it is one nonetheless.
a dht/blockchain mashup comes to mind, but really it just pushes the IP knowledge to knwoledge of some other intrinsic variable that can be used for fingerprinting.
the issuer of public information (an update) doesn't necessarily need to know who collects the information, it's just architected like that for most internet things.
Then the only useful logs would be held by Wikipedia. And more broadly, requests to that page would be utterly lost in the noise.
Ideally the article would contain (in a comment or some hidden field) a signature from the PGP key of the app's developer, covering both the version number and the date of release (to stop replay/rollback attacks).
Alternatively, the app could look at the article history and find the latest edit made by the developer's Wikipedia account, so that malicious edits would be ignored. This assumes the threat model doesn't include rogue Wikipedia admins rewriting history or hijacking accounts.
At the expense of a smaller anonymity set, it might make more sense for the app to query Wikidata instead of Wikipedia: https://www.wikidata.org/wiki/Q16766305
In my imagining, the content of the Wikipedia article does nothing more than trigger a notification to the user; it would be the user's choice whether to initiate a network connection with the vendor's server for the "real" check and binary download.
I was a little unclear about what I meant by "replay/rollback attacks", though. My concern was that someone editing the Wikipedia page could vandalise it to remove the reference to a newly released app version, meaning the app never checked the vendor's server. They would be rolling back the article to a previous edit, or "replaying" a previous edit that was no longer truthful.
Moreover, an attacker could add a spurious reference to a version that hasn't been released, in order to trigger an app to make unnecessary requests against the vendor's server.
Fortunately, both of these types of vandalism would be ignored by a system which checked the revision history and knew the user name associated with the vendor.
That said I suggested Wikipedia mostly as a joke—though I do like the principles of indirection and hiding private material within the most noise.
--
Actually, it occurs to me that an appropriate place for software update notifications could be DNS. Something like a cryptographically signed TXT value with a long TTL. It does have the downside of being a cleartext protocol at the moment, but once that changes, you've got a great distributed, fast and resilient key-value store right there...
The paranoid, accusatory tone in the issue does nothing to help your argument, and I believe makes it harder for maintainers to take you seriously. Your argument is well thought out, and I don't necessarily disagree with it in principle, but you're making mountains out of molehills here. If you'd simply pointed out the issue and asked that the auto-update check be performed after the consent check - especially if it came with a PR implementing that - you'd go a lot further.