Opt-in / Opt-Out? A breakout topic for the F40 Change Request on Privacy-preserving telemetry for Fedora Workstation

There are at least two stages of opt-in/out.

  1. collecting telemetry data locally

  2. submitting it to headquarters to be aggregated

It would be helpful to have the data collected locally - with an app to display it various ways. This could be opt-out (to save any collection overhead). Sending the data to HQ is the controversial part - and should be opt-in IMHO. But at least the local data is available for examination to help the cautious but potentially cooperative with their decision.

As many people have stated over and over, they are both controversial, it isn’t only the transmission piece.

It is all a matter of perspective. It might not seem like a big deal to you but that doesn’t mean it isn’t for others.

2 Likes

The whole idea of telemetry is controversial. This is why opt-in only people want nothing installed and talking to anything in the first place, they don’t even want a process to collect it locally without their decision to explicitly allow it. In fact most see the opt-in only as a compromise position and would honestly prefer to see the whole proposal jump in a lake.

1 Like

Thanks, i do see your point.
I was a bit too hasty when writing my comment.
So waiting for a proposal change it is :+1:

1 Like

You know that you can change/edit your posts? (under your comments it should have a pencil)

if you use for example:

the  del tag, to outline <del> I insist on what I said ! </del>

the del tag, to outline I insist on what I said !

This might help to avoid that people block-quote you to early and even can give a other direction to the discussion.

opt-out collection feature WILL NOT sail and go down well with Linux users

I think it’d be useful to take a step back and ask, whether we already have opt-out collection features. And it turns out that we actually do:

  1. Changes/DNF Better Counting - Fedora Project Wiki was already mentioned. This allows Fedora to know if we’re becoming more popular and which variants are being used.

  2. We collect information about crashes and upload some information to a server which collects crash traces. This is how the default gnome-initial-setup screen looks like for this:


    We make a big effort to remove any private information from the uploads, but at least the information about which application was running and when is necessarily available to anyone looking at the reports.

  3. Firefox has opt-out collection of data. This is how the default screen looks like in about:preferences:
    Screenshot from 2023-07-24 13-15-39

  4. Both firefox and gnome do detection of captive portals. This is implemented by querying a well-known page with a fixed text and checking if something substituted the contents. By nature of this request, the server serving the page learns that you’re using Firefox and when, and to some extent where from.

In each of those cases, the implementation preserves privacy to the extent possible. But some data is being uploaded. Each of those cases is “opt-out”. As a user, I’m fine with this, because I understand that this collection is not intended to harm me or track me, but to provide services to me and to make the distribution better. I hope other users think so too.

4 Likes

I think that we should discuss about this collection points as well, and evaluate to change the default to make them opt-in as well, if we end up deciding to make opt-in the new proposed telemetry.

2 Likes

On top of that: whenever DNF (or other high-level package management tools) refresh metadata, the request for mirrorlist information goes to Fedora mirrormanager servers, and to the servers for other repos you may have enabled. By default, DNF does these refreshes in the background without interaction.

This doesn’t allow us to track which packages are installed, but it does give us some information simply intrinsic to the request. We probably have other software that does similar things — I don’t know offhand how Flatpak works in this regard, for example. There are likely other programs which include network activity (possibly to some third party) as part of their normal functions, or which like Firefox have intentional data collection enabled.

I have said earlier somewhere in all of this that Fedora has never tried to really make a privacy-focused distribution. It doesn’t mean that we don’t care about privacy — we absolutely do! We’ve never drawn a really hard line, though. Such a line would come with compromise for users, developers, and our support and quality teams. I don’t think we are likely to take an overall extremist stance. But, we’ve got room to explore — and there is certainly room to make things better. I encourage people who are interested in Fedora taking a more privacy-intentional tack to help work on it.

3 Likes

No, I don’t like it all. Over the years I had to disable telemetry in Firefox on every fresh Firefox installation.

This is how the default gnome-initial-setup screen looks like for this:

This is really bad! Since when it’s default?

2 Likes

You’re in no position to be cheeky about using dark patterns in the prompt design when the community has been overwhelmingly against the telemetry being opt-out for this proposal.

Whether you realize it or not, having the button that shares data be the default choice makes this opt-out, not opt-in. This is what people were referring to when it comes to dark patterns, it’s the mentality of pushing the envelope of what is acceptable for the general user. Joking about it doesn’t make it better, the mentality to reach and grab for more is already evident from the responses I’ve seen.

3 Likes

That’s lame. My 3 Debian installs I’ve done so far migrating from Fedora have all had those Firefox options off and popcorn isn’t even installed. You may be fine with enabling sending data to the internet by default but that doesn’t mean it’s OK. I’m sure Microsoft feels the same way about all the stuff they do. I really wish I hadn’t wasted so much time with Fedora. I think I’m going to tackle my laptop next.

4 Likes

I grew aversion to telemetry, mainly Opt-out ones. BUT! Seeing Fedora pondering this and remembering the way Gnome did theirs, and … gifting us with that “implementation of a tray”, made me think.

Yes. Sure, Opt-out can be done in a good manner… maybe-probably-I-think.

It would be shown at Gnome, Plasma etc First-run/Welcome window and presenting the user with the extreme transparency of what will be collected: why, what for, for how long (in this case I also suggest giving some options to choose for how long the user will allow it).

And also, to make it not a giant trust problem (at least to try to), the program responsible for the data collection would NOT BE INSTALLED, would just be installed after choosing opt-in and finishing the welcome screens (whatever it is) AND would be automatically uninstalled if opt-in after the period which the user chose it to be run. The addition of its icon to the Gnome dash, Plasma panel or a shortcut where the program would have a very visible uninstallation button and the opt-out at any time button.
Finally, the data should be stored at the user’s home folder with an appropriate name/subfolder.

[Edit]
I dare say that it should be as soon as F39 and not just that. Furthermore, even discuss with other distros to consider a joint effort for making it a default thing, so we can, including me, trust it and not vilify it any more. Having the transparency, complete transparency, is the key. I see that telemetry is very import for a much better experience. The data collection being transparent, which is very easy to do, I see no problem.

Absolutely. These should all be defaulted to off with the option to opt-in!

Sorry, I know this is off-topic but this really made my day, I’m still laughing!

I’m glad we can all benefit from this haunting experience years later. :joy:

Yeah, thanks, and I have to admit I have been either the one trying to escape or the one who couldn’t stop talking at different times, so what you wrote sort of struck a chord with me.

At first I thought you mean trying to escape from inside a Vim session and I thought ‘if I was stuck for that long I would just resort to pkill’ :sweat_smile:

Just seeing this a month late – I don’t think fedora needs to collect any data at all from users. This should be something people have to actively turn on after installation is complete and they’re booted up.

Fedora is fine without this. Just because Ubuntu does something poorly doesn’t mean Fedora should. I’d like to see Fedora lead, not follow.

The proposal will probably change into an opt-opt approach, where the user would be forced to make an active decision. To quote:

The proposal owner suggests a compromise “suggested opt-in” design, where the UI encourages the user to opt-in, but the user must explicitly make a decision to do so or not.

From: https://fedoraproject.org/wiki/Changes/Telemetry#Many_users_want_to_require_opt-in_rather_than_opt-out

Hopefully!

opt-opt is better than opt-out I suppose, but really, making it opt-in and moving it from the initial system setup/install process to something the user can find in settings after its running is ideal.

That way it becomes one less product that’s slowly desensitizing users to the idea of sharing data or using software that calls home and still provides the feature for when folks think they don’t mind sharing.