sonny,
@sonny@floss.social avatar

💡 portal for anonymous telemetry. Hear me out!

Many developers want to have telemetry so that they can learn about how their app is used and how they perform.

It can lead to better software, but it's also a privacy nightmare 😮‍💨

Currently, apps need to enable full network for it (or more) and users have 0 control over it. This is happening. Right now.

What if there was a way to remove all the negative aspects of telemetry so that we can consider it safe? 🛡️

1/2 🧵

sonny, (edited )
@sonny@floss.social avatar

With a telemetry portal for apps, we could

• Let the user enable or disable telemetry per app
• Be transparent about what is being sent
• batch, throttle and schedule transmissions
• deduplicate efforts to collect generic info

Combined with a trusted server to process and relay, we can

• anonymize
• aggregate
• make public

Worth thinking about, no?

2/2 🧵

grimmy,
@grimmy@mastodon.social avatar

@sonny yes please!! This is something I would prefer to not build if I can avoid it and we need some basic telemetry badly :)

dflxh,

@sonny tbh i'd rather have a functional microphone portal

sonny,
@sonny@floss.social avatar

@dflxh I'd love that too - thankfully it's not one or the other 😄

xerz,
@xerz@fedi.xerz.one avatar

@sonny …wouldn’t devs always be able to just ask for network permissions and keep business as usual?

sonny,
@sonny@floss.social avatar

@xerz the network permission is not considered safe in Flatpak / Flathub

That's why we have leverage.

mks_h,
@mks_h@mstdn.social avatar

@sonny @xerz honesty I don't think neither users nor developers really care for what Flathub considers unsafe, and maybe in part because of such silliness as considering network access unsafe.

I like the idea, but honestly I only care for the ability to turn telemetry on/off, especially if I can make it off by default

sonny,
@sonny@floss.social avatar

@mks_h @xerz

This wouldn't be possible if network was considered safe and had no penalty.

It's not silly, it's honest and forward-looking.

It gives the platform leverage and will let us innovate and do what no other platform does.

But I'm not interested in debating this again tbh :)

j,

@sonny you could even provide users a telemetry id and key per app, so they could access the portal without signing up.

only requiring email sign up if they want an easy way to manage and collate the different apps using it.

sonny,
@sonny@floss.social avatar

@j

By "portal" I meant this https://flatpak.github.io/xdg-desktop-portal/

It's basically standard Linux APIs for apps.

Maybe you understood web portal?

I don't think there should be a signup

wjt,
@wjt@mastodon.me.uk avatar

@sonny Interesting idea!

KDE has a kuserfeedback library that combines anonymous data points sent at a fixed frequency (same approach that Endless OS's metrics system uses to get a distribution of values without having to identify individual devices), a way to prompt users to complete surveys, and a control panel to select the level of data to contribute (but not per-app).

A prototype might be a portal for the same data model – then you'd get all KDE apps in the new system “for free”.

wjt,
@wjt@mastodon.me.uk avatar

@sonny And since the model is so similar (at least superficially) I could well imagine converging this with the Endless OS metrics system.

Anyone pursuing this in earnest should also look at other widely-used telemetry systems on the desktop – e.g. is OpenTelemetry used in desktop apps? Does Electron have a thing, whether built-in or widely used? – and figure out how those can be brought into the same fold.

Sadly I don't have the time/resources to work on this…

wjt,
@wjt@mastodon.me.uk avatar

@sonny but "be transparent about what is sent" is not necessarily a consequence of having a portal. Each data point is a name/event-id and some blob of data - what can be shown to a human without knowledge of the app's particular data points? What stops the app from shoving a machine ID into that blob?

pwithnall,
@pwithnall@mastodon.social avatar

@wjt @sonny More generally, covert channels are basically impossible to eliminate if one party is determined to send something

alatiera,
@alatiera@mastodon.social avatar

deleted_by_author

  • Loading...
  • sonny,
    @sonny@floss.social avatar

    @alatiera @pwithnall @wjt

    No expert but I was hoping the aggregation would make fingerprinting or unique identifiers useless.

    Also, if there is a server, say administrated by Flathub, we can have terms and conditions at least.

    sonny,
    @sonny@floss.social avatar

    @wjt

    That depends on how the system is designed, right?

    From client API to whatever we want to enforce in the terms and conditions.

    about:telemetry in Firefox is a good example of transparency.

    forteller,
    @forteller@tutoteket.no avatar

    @sonny I'm all for anything that can make the Linux community more open to telemetry! It is so needed! Go forth and do it! :)

    doctormo,
    @doctormo@floss.social avatar

    @sonny

    From Inkscape's perspective, I think we would be interested. Stats are very hard. But I'd also like it if it was multi-platform and windows and mac users could submit to the same system.

    It would be useful to have the data and perms be a defined standard. Not just an empty json bucket.

    Though I'd also like telemetry to include one extra field called "owch", text of no more than 200 chars that the user can populate with whatever their single most important demon is.

    sonny,
    @sonny@floss.social avatar

    @doctormo thanks for the feedback!

    Inkscape was an interesting case study when I was researching use cases for the network permission.

    https://github.com/flathub/org.inkscape.Inkscape/blob/3e5cb8a35a113f82a369461fd81e763a47e2db6c/README.md?plain=1#L29

    I wanted to ask about extensions. We have Flatpak extensions but they wouldn't be a good fit I believe.

    I think we should also have a mechanism/portal to let apps fetch assets.

    Perhaps by letting them download from the verified domain? In your case inkscape.org

    doctormo,
    @doctormo@floss.social avatar

    @sonny

    We also download assets from wikimedia, openclipart and github (for some science repos)

    For installable code extensions, I'm not sure how solvable it is. We promote python over anything else and we expect certain workflows, so it should be possible to sandbox. But hard to download that code at a whim.

    Though Inkscape.org for code would be fine. We still check extensions and sign them.

    thibaultamartin,
    @thibaultamartin@mamot.fr avatar

    @sonny it sounds like a lot of effort, and I’m unsure about the benefits.

    Given the tremendous task (not only in terms of build but also of run), user testing with mockups sounds like an install important step.

    It would also be interesting to know how many apps are actively maintained and don't require network access. A biased indicator, but it can help get an order of magnitude of the number of apps concerned.

    sonny,
    @sonny@floss.social avatar

    @thibaultamartin

    I'm told KDE has a telemetry API and server that could be reused, at least to play around with the idea.

    I think we need more network related portals to cover other use cases currently requiring full network access so it would concern more and more apps in the future.

    We can also encourage apps to adopt it regardless because they don't have to build it themselves.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • DreamBathrooms
  • ngwrru68w68
  • cubers
  • magazineikmin
  • thenastyranch
  • rosin
  • khanakhh
  • InstantRegret
  • Youngstown
  • slotface
  • Durango
  • kavyap
  • mdbf
  • tacticalgear
  • JUstTest
  • osvaldo12
  • normalnudes
  • tester
  • cisconetworking
  • everett
  • GTA5RPClips
  • ethstaker
  • anitta
  • Leos
  • provamag3
  • modclub
  • megavids
  • lostlight
  • All magazines