The Next.js CLI phones home to Vercel with statistics about how many times e.g. `next dev` is being called, along with details of the developer's OS and CPU, as well as what Next.js plugins they're using in their project.
(And you can opt-out and they display a warning, tough of course that is indeed not an opt-in.)
If the next.js project is collecting ip addresses together with this info they are processing personal data under GDPR. They need to do so under one of the 6 bases for processing, which in their case is either consent or legitimate interest. If consent, opt-in is required and opt-out is a violation. If legitimate interest then opt-out is alright and in fact not even required, but they have a high bar for clearing that standard, especially since opt-out is offered (which somewhat disproves the claim of legitimate interest).
I assume the project is in non-compliance and one complaint to a regulatory authority away from a proceeding that may lead to a fine if they don’t switch to an opt-in model.
That said, I'm not sure if consent or legitimate interest are the only potentially applicable bases. Knowing when the software breaks so you can fix it seems like it might be in the data subject's interest. And if it's not PII (which I'm not sure it's not, given that an IP address can be exposed, even if not logged), those bases aren't even necessary.
Why might it be suprising. Rather than guess, curious what's in mind.
this is a biased framing of the problem. first of all, the telemetry is often more useful for PMs (not developers) to make decisions on what efforts to prioritize vs not, and to assess relative success of launches. less of a convenience thing, but an industry standard way to get some meager signal from all your users, not just the ones that fill out surveys (and i'm sure theres plenty of complaints about surveys being unrepresentative too).
second of all, the work that developers and PMs do with this anonymized data is usually intended to help users.
pitting developer vs user is a false binary.
OK, then it places the developers and PMs convenience ahead of the users privacy and autonomy.
Which speaks volumes.
They do not understand, they just shrug “I guess devs need this”. They expect us to know, to care, because it is our job. We don’t and it’s sad.
That’s why things like public opinion surveys have to be random and why jury duty selection isn’t volunteer.
I disagree with the practice, but it's definitely the way it is.
- which operations were running slowly on real user's computers (and how commonly they ran slowly), so that we could fix these;
- whether users were faced with out of memory errors, or timeouts, etc.;
- whether users had abnormally large database, preferences, etc. files, which suggested that we should optimize for such cases;
- in some cases, whether some features were used at all because if they weren't, it wasn't worth optimizing them.
I'd qualify these as definitely in the interest of the user.
I know that not everybody enjoys having Telemetry collected on their usage, but without this, Firefox would never have been able to catch up with Chrome on user-visible performance.
Terrible conclusion, by that reasoning a drunkard should only seek for his keys under the streetlight
If you do the former, there is a chance you may be missing out. You do the latter, you are certain that you are missing out.
I don’t want browsers or tools to undermine the trust of their users by quietly tracking unknown things. But I agree collecting usage data matters in ways that aren’t always appreciated.
I don’t know how to do it transparently and preserve/establish trust. But I think the instinct to distrust any metric collection probably isn’t the right balance to strike.
Not in the modern software ecosystem it's not. How often is telemetry used to make a product better vs. helping to add more dark patterns to increase "engagement"? No amount of telemetry seems to stop Microsoft from shoving more user hostile garbage into Windows 11.
The only users that developers defending telemetry seem to care about are the ones who are ignorant/silent, e.g., the ones who ignore surveys. For example, if users on HN explicitly state they oppose telemetry, then developers replying on HN will disregard or downplay such statements and instead refer to "the majority of users", "all your users", or some such.
If this majority of users are silent, not stating their views on telemetry as are users on HN, then that does not mean they are on the same side as developers. It would be "biased framing" to assume otherwise. If informed consent was required, would these users agree with developers and consent to telemetry. We do not know.
Look at what happened when Apple introduced App Tracking Transparency in 2020. The change made users choose whether to allow apps to track. Only 3% chose to allow it.
https://arstechnica.com/gadgets/2021/05/96-of-us-users-opt-o...
What would happen if "Telemetry Transparency" was introduced and users were always forced to choose whether to allow telemetry.
If telemetry is enabled by default, then that is not user choice.
Is it disingenuous for developors defending telemetry to pretend that user ignorance and silence equates to informed consent.
If that is so, just ask and explain and be more specific than “this helps improve things”. How hard is it to say how exactly this vague ball of data is helping The Users?
This is why I don't use web apps or web-based services unless I have no other option.
I'm surprised that anyone claiming to be security- or privacy-minded would prefer a native desktop app to a website running in a sandboxed web browser. Even if you build the code yourself, you're probably safer with the web app. At least in the browser, you can monitor and block any connections from the web app. Good luck doing that for a native binary without inspecting the source and build process for underhanded code exfiltrating data from your machine through some unknown number of obfuscation techniques.
Amusingly enough, the article of this submission is about telemetry of frontend tooling that's shipped as native binaries.
That shouldn't be so surprising, really. It's a question of what threats you are the most concerned about. That decision is pretty individual.
> Good luck doing that for a native binary without inspecting the source [...]
I don't have to do all of that. I firewall off all outgoing traffic by default. If a binary is trying to exfiltrate data, it won't get past the firewall. That's hard to do in a web context.
> which does not refer to "web apps," but to "native binaries for building web apps."
Indeed so! I'm not saying that just using native binaries all by themselves is sufficient. I'm saying that I have more tools available to mitigate the problem when it's a native binary.
Just look at the impossibility of effectively stopping browser fingerprinting for an example of the difference between the two things.
At what level? Unless you're running every native binary on its own hardware, or maybe within a VM on an isolated VLAN, how can you be so confident that your firewalling method is less leaky than the battle-tested sandboxing of Chromium or WebKit?
Also, why not both? The most secure option might be running a web app in an isolated Chromium process, with a Chromium extension allowlisting outbound connections, and then also firewalling the Chromium process itself at the operating system level.
> how can you be so confident that your firewalling method is less leaky than the battle-tested sandboxing of Chromium or WebKit?
I can't be 100% certain, of course -- although that's equally true of Chromium and webkit. But I have a monitoring system that checks my firewall logs to catch anything suspicious.
> The most secure option might be running a web app in an isolated Chromium process
Because fingerprinting. I can't think of any way to stop fingerprinting. The best I can do (and I do) is to disallow JS from running, but that still leaves many possible signals.
This is even worse for native apps. webapps do fingerprinting because they don't have access to lowlevel native information. Any native App does not need to do Fingerprinting, they can just read device IDs directly, much more reliable that any method of fingerprinting.
Not if those apps can't phone home.
I in no way claim that my approach is airtight. It's purely a "best effort" sort of thing. But it's far better than nothing. I'm better off for it even if it doesn't stop everything.
Is it though? Putting aside the issue of whether you trust the person collecting telemetry for a second. You can collect telemetry completely anonymized. You don't have store IPs or any sort of personal identifier. I know a certain crowd still won't like it but in practice how does that harm the privacy of the user?
You can't.
You can decide to discard identifying information (although only if you aggregate and don't insert some sort of "anonymous" identifier), sure. But you're still going to collect it.
So it all boils down to trusting not only the developer, but any company or interest that might acquire the developer or product in the future. And I think it has been repeatedly demonstrated that this trust is not well-placed.
Of course you can! Just route telemetry through Tor.
It is true that, in some cases, telemetry can make it faster and easier to improve software, but this is ultimately placing the convenience of the developers ahead of the privacy and autonomy of the users. I believe that software should serve the interests of users, and informed, affirmative consent for phoning home is an absolute baseline for respecting their wishes.