It would be helpful to have the data collected locally - with an app to display it various ways. This could be opt-out (to save any collection overhead). Sending the data to HQ is the controversial part - and should be opt-in IMHO. But at least the local data is available for examination to help the cautious but potentially cooperative with their decision.
The whole idea of telemetry is controversial. This is why opt-in only people want nothing installed and talking to anything in the first place, they don’t even want a process to collect it locally without their decision to explicitly allow it. In fact most see the opt-in only as a compromise position and would honestly prefer to see the whole proposal jump in a lake.
We collect information about crashes and upload some information to a server which collects crash traces. This is how the default gnome-initial-setup screen looks like for this:
We make a big effort to remove any private information from the uploads, but at least the information about which application was running and when is necessarily available to anyone looking at the reports.
Firefox has opt-out collection of data. This is how the default screen looks like in about:preferences:
Both firefox and gnome do detection of captive portals. This is implemented by querying a well-known page with a fixed text and checking if something substituted the contents. By nature of this request, the server serving the page learns that you’re using Firefox and when, and to some extent where from.
In each of those cases, the implementation preserves privacy to the extent possible. But some data is being uploaded. Each of those cases is “opt-out”. As a user, I’m fine with this, because I understand that this collection is not intended to harm me or track me, but to provide services to me and to make the distribution better. I hope other users think so too.
I think that we should discuss about this collection points as well, and evaluate to change the default to make them opt-in as well, if we end up deciding to make opt-in the new proposed telemetry.
On top of that: whenever DNF (or other high-level package management tools) refresh metadata, the request for mirrorlist information goes to Fedora mirrormanager servers, and to the servers for other repos you may have enabled. By default, DNF does these refreshes in the background without interaction.
This doesn’t allow us to track which packages are installed, but it does give us some information simply intrinsic to the request. We probably have other software that does similar things — I don’t know offhand how Flatpak works in this regard, for example. There are likely other programs which include network activity (possibly to some third party) as part of their normal functions, or which like Firefox have intentional data collection enabled.
I have said earlier somewhere in all of this that Fedora has never tried to really make a privacy-focused distribution. It doesn’t mean that we don’t care about privacy — we absolutely do! We’ve never drawn a really hard line, though. Such a line would come with compromise for users, developers, and our support and quality teams. I don’t think we are likely to take an overall extremist stance. But, we’ve got room to explore — and there is certainly room to make things better. I encourage people who are interested in Fedora taking a more privacy-intentional tack to help work on it.
You’re in no position to be cheeky about using dark patterns in the prompt design when the community has been overwhelmingly against the telemetry being opt-out for this proposal.
Whether you realize it or not, having the button that shares data be the default choice makes this opt-out, not opt-in. This is what people were referring to when it comes to dark patterns, it’s the mentality of pushing the envelope of what is acceptable for the general user. Joking about it doesn’t make it better, the mentality to reach and grab for more is already evident from the responses I’ve seen.
That’s lame. My 3 Debian installs I’ve done so far migrating from Fedora have all had those Firefox options off and popcorn isn’t even installed. You may be fine with enabling sending data to the internet by default but that doesn’t mean it’s OK. I’m sure Microsoft feels the same way about all the stuff they do. I really wish I hadn’t wasted so much time with Fedora. I think I’m going to tackle my laptop next.
I grew aversion to telemetry, mainly Opt-out ones. BUT! Seeing Fedora pondering this and remembering the way Gnome did theirs, and … gifting us with that “implementation of a tray”, made me think.
Yes. Sure, Opt-out can be done in a good manner… maybe-probably-I-think.
It would be shown at Gnome, Plasma etc First-run/Welcome window and presenting the user with the extreme transparency of what will be collected: why, what for, for how long (in this case I also suggest giving some options to choose for how long the user will allow it).
And also, to make it not a giant trust problem (at least to try to), the program responsible for the data collection would NOT BE INSTALLED, would just be installed after choosing opt-in and finishing the welcome screens (whatever it is) AND would be automatically uninstalled if opt-in after the period which the user chose it to be run. The addition of its icon to the Gnome dash, Plasma panel or a shortcut where the program would have a very visible uninstallation button and the opt-out at any time button.
Finally, the data should be stored at the user’s home folder with an appropriate name/subfolder.
[Edit]
I dare say that it should be as soon as F39 and not just that. Furthermore, even discuss with other distros to consider a joint effort for making it a default thing, so we can, including me, trust it and not vilify it any more. Having the transparency, complete transparency, is the key. I see that telemetry is very import for a much better experience. The data collection being transparent, which is very easy to do, I see no problem.
Yeah, thanks, and I have to admit I have been either the one trying to escape or the one who couldn’t stop talking at different times, so what you wrote sort of struck a chord with me.
Just seeing this a month late – I don’t think fedora needs to collect any data at all from users. This should be something people have to actively turn on after installation is complete and they’re booted up.
Fedora is fine without this. Just because Ubuntu does something poorly doesn’t mean Fedora should. I’d like to see Fedora lead, not follow.
The proposal will probably change into an opt-opt approach, where the user would be forced to make an active decision. To quote:
The proposal owner suggests a compromise “suggested opt-in” design, where the UI encourages the user to opt-in, but the user must explicitly make a decision to do so or not.
opt-opt is better than opt-out I suppose, but really, making it opt-in and moving it from the initial system setup/install process to something the user can find in settings after its running is ideal.
That way it becomes one less product that’s slowly desensitizing users to the idea of sharing data or using software that calls home and still provides the feature for when folks think they don’t mind sharing.