The latter though? Somehow the industry got by for decades without intimately knowing what version every single user of the software was running. I think they'll survive without it.

Anyways, how is it "petty" to make a version of the software for which there is clear demand? No one stomped on their birthday cake, they just took an OSS piece of software and modified it, compiled it, and released it. In what world is there any malice in doing the exact thing an open source license exists to allow you to do?

This is the same argument that was used about seatbelts and the internet. You might have survived without it before, but that doesn't mean it isn't going to be better with it in the future.

So far no one in the many replies to my post have given even a single reason why the world is substantially better with data collection on versions. The argument is either this kind of attempt to substitute an Obvious Good Thing and then not explain how this thing is like that, or that "it's just a harmless bit of data collection, as a treat."

I think data collection should probably be held to a higher standard than that. Come up with why it makes my life better first, then pitch me on it. Otherwise you're just pissing in cornflakes and calling it breakfast.

I guess this changed long before Audacity. Today many programs, including open source tools, bundle some sort of telemetry.

I think that instead of opposing Audacity we should talk about other projects in similar situation; we should treat them the same and think about a more general solution. There are already discussions like this, e.g.: https://consoledonottrack.com .

Claw back the privacy on high-profile applications, get an amount of attention that’s significant enough to either lead the application to change or for the other fork to become the go-to. This reminds other companies that people do care and that the cost of tracking is in taking privacy from users who then leave when they can.

Luckily if this bothers you then OSS works as intended, everyone can be happy.

I don’t think it’s clear that there is any demand for a version that doesn’t collect crash reports or version usage. The outrage was about the vagus clause about information necessary for law enforcement or similar.

I’m perfectly happy to see that code (if it exists) being thrown out, but to remove user confirmed crash reporting?

I’d expect every app I use, OSS or not, to have automated crash reporting (a confirmation dialog is a nice touch) and version usage tracking. It’s possible to maintain software without it, just like it’s possible to maintain software without other feedback like a bug reporting system or a profiler.

If it weren't collecting version info what possible reason could it have to have a clause in the EULA about giving info to the police? You have to be phoning home for that to even mean anything.

I can see why the developer wants it, but a person wanting something is not inherent evidence of it being "good". I want lots of things that are bad for me, and even some things that are bad for other people.

Here's the thing: In order to track version numbers, this developer now subjects its users to potential police surveillance. Even if that surveillance is "harmless" on its own, they have still made that bargain. And I feel like we're well past the point of credibly taking any given individual act of surveillance as being isolated and unentwined with more problematic kinds.

Is that bargain really worth it?

I don't think the scale nor the features of modern software is comparable to what we used to have.

Back in the days you didn't have such a diverse numbers of versions/machines combinations, software were much simpler, much less updates, &c.

We also survived just fine without cars, electricity, central heating, processed meat, &c. this isn't a valid argument

https://www.audacityteam.org/about/desktop-privacy-notice/

Count me on Team Crash Report, for sure. Anyone who's worked on any kind of project like this knows how valuable live user telemetry is. These features make software better for all of us. If you really don't like them don't use them and carefully audit the opt-out mechanism to make sure it works. Don't throw poop on the walls.

Software should not collect information in the first place if it may get necessary for law enforcement, litigation and authorities to demand it. If the information is interesting for a third-party then the collection filter is not fine grained.

Live user telemetry does not have to mean Personal Data. If I know that 80% of users who download version 1.2.3 got a crash within 5 minutes, which living person can I identify with it? If I however get download logs of IP addresses, browser identity tags, file names, windows profile names, user directory names (and so on), then that cash report is providing unnecessary personal data.

If I have access to the crash reports, can I do business intelligence gathering? Can I discover information which gives stock market insights? If the answer is yes, then you are collecting too much information.

The only reason to not publish all crash reports openly on the web for anyone to download should be undiscovered security vulnerabilities. The data itself should be inert.

For some reason free (gratis) software attracts the most entitled users ever. If I were in charge of Audacity I'd be inclined to charge a $1 "distribution fee" just to weed these users out.

I think rather it is rather an example of an external company (Muse group) not understanding the community behind the piece of software they have taken over.

They could do the data collection themselves and chose not to store personal identifiable information, in which case they can remove the legal boilerplate since it won't be needed. This suggestion naturally already exist in the GitHub issue.

Leaving the data collection on all the time, makes data-collection part of the terms of use of the software. Which makes data-collection part of the business model. Which makes the software spyware. It is always watching you.

If I followed you around all day, you’d label me a stalker, If I didn’t approach you, didn’t proactively threaten you, didn’t tell anyone else what I knew about you, you could still legally bring sone level of force against me. How is constant telemetry any different?

This - audacity - is supposed to be a bloody offline desktop app.

No connection to ANY online service, including telemetry.

That is what I meant.

Unless you do not collect said information in the first place.

Try to live in a society where everyone, including your closest family members, might collect such information.

https://en.wikipedia.org/wiki/PIDE

Compromising a telemetry server is a one-off operation, would work at scale and is much less risky as the targets have no way to detect it.

Also, since you can fork it, as has been previously mentioned, there seems to be no purpose in objecting to this type of FOSS acquisition. Worst case, the project ends as it was before the acquisition, with no corporate support or funding whatsoever, at which point it seems it won't make any difference whether there was a complaint or not.

Do you have any examples for OSS? Because i do not believe that to be true.

> When do we share your information with others? ...When the law requires it. We follow the law whenever we receive requests about you from a government or related to a lawsuit.

However, Audacity is cool and all, but I wonder if it would be better to create a simplified frontend based on Ardour, the way GarageBand is for Logic.

The telemetry has always been opt-in (though they didn't communicate that very well) and their privacy policy is just standard stuff.

Again I haven't followed it. Honestly it looks a bit to me like the playbook you see when a project is sold to a private equity firm.

Even if we assume there is no malicious intent from either the developer nor their infrastructure provider (their initial telemetry attempt was using Google Analytics which is definitely malicious), it can still be coopted by a malicious actor who is able to observe the network traffic or compromise the telemetry infrastructure and put the users at risk.

What's wrong with Windows 10? I think it's great

What's wrong with Google Analytics? As long as the ad retargeting bits aren't enabled ( they aren't by default), it's just a regular anonymous analytics solution.

This assumes you trust Google? Why would you trust an entity that's both got a business incentive to stalk people, is able to hide it (given how many factors go into ad targeting it's impossible to reliable prove from the outside which data was used to target an ad) and is big enough to successfully fob off regulators and get away with it (their current data processing consent flow violates the GDPR for example)?

Muse group, a russian for-profit company that seems to have a shell-headquarters in Cyprus (see https://www.crunchbase.com/organization/muse-group), recently acquired Audacity as part of their expansion into the broader audio-production world.

As a first action, they changed their contributor License Agreement making a future change from a GPL license to a closed-source License possible. (it also allows for dual-licensing a paid version) https://github.com/audacity/audacity/discussions/932

They currently say they're not going to do that, but if they wanted to (and Muse-group is for-profit) they could without the contributor having any recourse. (They have already confirmed a cloud-service for Audacity, which for me already reeks like "we want to have closed-source tools that use our open-source contributors code").

Having a CLA isn't a problem in and off itself, for example, as they correctly state: the FSF requires a CLA because they want to license all their stuff as "GPL 3 or above", which is only possible using some CLA-mechanism. (it's also easier for them to defend GPL related lawsuits if they are the copyright holders)

What MuseGroup forgets to mention, is that they are a for-profit company (https://opencorporates.com/companies/cy/HE411908) while the FSF is a foundation (specifically a 501(c)(3) non-profit organization), which shifts their incentives a lot.

Now, barely a month later, they add the option of collecting data from users and people aren't happy. It is, at the very least, very tone-deaf/stupid from them to add telemetrie only one month after (IMO) showing their hand for what we can expect for the future.

That said, I personally think this fork is a clumsy attempt thus far. If there truly is a rift so wide as the parent comment claims, it probably calls for a total rebrand. The way it's currently positioned makes it look like the author is simply attempting to apply pressure to get Muse to change its behavior, but based on this context I doubt that's going to be a viable long-term strategy.

It's not clear what sort of thing you're referring to, it's generally not possible to make a service where you have accounts and billing, that simultaneously doesn't store your information. The whole point of it is that you want it to store your information.

Yes, they probably also know that I usually connect from an IP address in Chicago. And, while storing that information isn't strictly necessary, I'm also more-or-less 100% confident in saying that anyone who might want to keep tabs on me already knows I live in Chicago, and that would have been true 30 years ago, too. (Well, 30 years ago it was another town, but still.)

I suppose a lot of this is maybe just a halo effect due to all the (quite legitimate) upset about surveillance capitalism? Which is fair. And perhaps we want to say that it's easier to try and shut down all telemetry than it is to distinguish legitimate telemetry from abusive telemetry. Lord knows, if we try to carve out any concept of legitimate telemetry, adtech companies will immediately go about probing it for loopholes.

Also, GitHub is Microsoft and LinkedIn.

If the maintainer had waited out the initial flurry of attention, they probably could have chosen the name they wanted without much drama at all. Instead, they overreacted, deleted the first thread, and then immediately started editing and deleting user comments in the second. Ouch.

That's not what I expect from a software that require no remote server to function.

2. No, off by default or ask on first boot.

3. What data are they collecting that would be shareable to law enforcement? The feds need to know I’m on an outdated version?

I will not use or recommend Audacity anymore. It’s a shame, I really like Audacity and I’ve been using it since high school.

While I do understand the underlying cause and indeed hate things that violate my privacy as much as the next nerd.. you guys know most software phones home for update checks right?

Hell I'll tell you what. Unplug your router from the WAN side and wait a minute. See that popup there on all of your devices telling you you're offline? There's a connectivity check that's been giving out the exact same information the entire time you've had your OS installed

I really do appreciate the vigilance and don't want to discourage the raw energy on display at all but this one might not be the cause to go all in on

On the other side of my own argument it definitely won't hurt to chuck them a GDPR request in a month or two to see what they are gathering :)

I thought it was pretty obvious but yea you got me. Good point, well made.

Their new changes restricted use by individuals under 13. This is probably because they could run into trouble with GDPR with the personal data they are storing on users, which they have no good reason to store except that they can.

Audacity is used in public schools. Forking to keep the project usable by children learning the craft is not petty, it’s a worthwhile thing to do.

Ruining community trust so you can unnecessarily collect private information on your users, that is petty.