I respect that. I don't agree with the decision, but it was made with understanding and thought.
In ethics, there is no right or wrong answers (mostly), just right and wrong methodologies. If you go the pragmatic way, you'd argue that the benefits of telemetry are greater than the downsides and implement it. If you go Kant's way, you would already have a maxim (either "never invade privacy" or "prioritize technical benefits regardless of the users" in this case) and act according to that maxim regardless of the situation. If you go the intent way, all that matters is whether your intent for the action is good or bad, in contrast if you go the outcome way, all that matters is the outcome regardless of the intent or the methods.
These are all "valid" ways to discuss an ethical dilemma. However, one must always acknowledge the dilemma. This industry, especially big tech, seems to ignore this quite often, mostly because it's very easy to see people as "just numbers" when you don't see them directly. Don't even get me started on lawmakers who are also ignoring this whole issue. Many standard practices in this industry would be straight up illegal in lots of other areas, especially where there is face-to-face contact.
Turns out, my straw man can't read.
Because that's how OP framed it. There is an ethical way to track how your app is used, with user consent.
Furthermore, looking at the asciinema from OctoSQL, users apparently have to edit their profile files on every single machine they intend to use Go on, then remember to verify that the profile applies and has no typos, make sure to never ever accidentally run the program in a context where environment variables aren't respected (would you remember to always use `sudo -E` if you need to use the tool as another user for example?). The danger seems extremely high that the user would, at some point, accidentally run the command without the env var set, even if they were technically proficient and did their best to opt out.
This is not how consent works.
First, making network requests when downloading packages is necessary for the tool to function and unavoidable. People who care about this will be using a VPN of some kind. It's just how the Internet works. But telemetry is something the tool author is choosing to add, not something that's necessary due to the architecture of our computing infrastructure.
Second, the Go telemetry would apparently create a unique, persistent user ID. Normal Internet use doesn't, there's just the IP address which is different from location to location, shared by a bunch of people behind the NAT, and can be masked using common tools.
And yeah, I know this is "anonymised"... but if you have one user ID which uses Go sometimes with an IP address from a particular apartment complex land sometimes from a particular office space, finding out which individual that user ID belongs to is trivial.
It's technically not unavoidable. The Go authors could have made use of the proxy opt-in rather than opt-out, making the tool less usable as a result. A similar argument applies here, I think.
> Second, the Go telemetry would apparently create a unique, persistent user ID
Where did you see this? I scanned through the "Telemetry Design" article reasonably carefully and couldn't find any mention of this concept, and the type definition for the posted JSON (the `Report` type) doesn't seem to include any such user ID.
In the end, ISTM that you're not complaining about something that actually affects your privacy in any way, but just the _idea_ of telemetry. Is that really something worth taking such a hardline stance on?
Frankly, that crap should be expunged from the Go toolchain as well. :(
The distinction is between "What I do with my computer is none of your business unless I choose to make it your business" versus "What I do with my computer is your business unless I choose to not make it your business".
It's insane that we are still having to justify privacy as a default, or that people continue to rationalize away the concerns.
Yeah, maybe if it's opt-in they won't have much telemetry data. Perhaps, in fact, it would not be much better than having no data at all. That will make some things harder. Major bummer. If it was easy to do the right thing, more companies would do it.
Half of the HN is in love with Chrome and nearly all are on Gmail.
The relentless drive towards the erosion of privacy powered by free carrots worked.
There is now a whole generation of people that sees all this as a norm.
The "there shouldn't be any" argument just seems so entitled with there being such demand / reasons to do so. I applaud everyone trying to find ways to satisfy both sides, as done by the original article.
"What I do on my machine is none of your business, unless I decide it's your business" is a strong argument, presented multiple times in multiple places, and I haven't seen any rebuttal by any Go representative.
You can ignore the community and do whatever is good for business, but it's hypocritical to pretend you're a "community-driven" project if you do that.
I disagree, I think it's a very contested topic, with lots of discussion whenever it's raised here, with either side possibly being a vocal minority.