subject:"Re\: F40 Change\: Privacy\-preserving Telemetry for Fedora Workstation $System\-Wide$"

In hindsight, both of my comments were hastily posted to this discussion.   It 
wasn't very constructive and I apologize for this.

I do believe that this proposed change is being considered with the best 
intentions for both the user and Fedora.  Could we see an example of the 
text/telemetry that would be sent?  Would there be a notification to the user 
when/if this data is sent?   If not, would the user be able to view this on 
their current install in some sort of log?
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-09 Thread Allan via devel

On Sun, 9 Jul 2023 18:54:18 -0400
Demi Marie Obenour  wrote:

> On 7/9/23 18:53, Allan via devel wrote:
> > On Sun, 09 Jul 2023 06:59:11 +
> > Mattia Verga via devel  wrote:
> > 
> >> Il 08/07/23 13:06, Vitaly Zaitsev via devel ha scritto:
> >>> On 06/07/2023 18:10, Aoife Moloney wrote:
>  but the conversation about each change
>  will take place on Fedora Discussion at
>  https://discussion.fedoraproject.org/t/f40-change-request-privacy-preserving-telemetry-for-fedora-workstation-system-wide/85320
> >>> It looks like they've started moving replies they don't like to
> >>> other threads to cover up the flow of resentment that comes
> >>> naturally to them.
> >>>
> >>> That's why switching to Fedora Discussion from the mailing lists
> >>> is a very bad idea: admins or RH staff can easily delete your
> >>> comments or bury them in another threads.
> >>>
> >> Can we please stop implying malevolence every time we don't agree
> >> with something?
> >>
> >> BTW in the spirit of openness, I've set up a poll (UNOFFICIAL) to 
> >> clearly state community sentiment about enabling OPT-OUT metrics to
> >> FESCO:
> >> https://discussion.fedoraproject.org/t/unofficial-poll-about-opt-out-metrics-proposal/85494
> > 
> > How is that going to help anything, when some of us are using
> > browsers from Fedora repos, that just gets this answer:
> 
> Which browser?

Seamonkey, Falkon maybe more...

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-09 Thread Demi Marie Obenour

On 7/9/23 18:53, Allan via devel wrote:
> On Sun, 09 Jul 2023 06:59:11 +
> Mattia Verga via devel  wrote:
> 
>> Il 08/07/23 13:06, Vitaly Zaitsev via devel ha scritto:
>>> On 06/07/2023 18:10, Aoife Moloney wrote:
 but the conversation about each change
 will take place on Fedora Discussion at
 https://discussion.fedoraproject.org/t/f40-change-request-privacy-preserving-telemetry-for-fedora-workstation-system-wide/85320
>>> It looks like they've started moving replies they don't like to
>>> other threads to cover up the flow of resentment that comes
>>> naturally to them.
>>>
>>> That's why switching to Fedora Discussion from the mailing lists is
>>> a very bad idea: admins or RH staff can easily delete your comments
>>> or bury them in another threads.
>>>
>> Can we please stop implying malevolence every time we don't agree
>> with something?
>>
>> BTW in the spirit of openness, I've set up a poll (UNOFFICIAL) to 
>> clearly state community sentiment about enabling OPT-OUT metrics to
>> FESCO:
>> https://discussion.fedoraproject.org/t/unofficial-poll-about-opt-out-metrics-proposal/85494
> 
> How is that going to help anything, when some of us are using browsers
> from Fedora repos, that just gets this answer:

Which browser?
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-09 Thread Allan via devel

On Sun, 09 Jul 2023 06:59:11 +
Mattia Verga via devel  wrote:

> Il 08/07/23 13:06, Vitaly Zaitsev via devel ha scritto:
> > On 06/07/2023 18:10, Aoife Moloney wrote:
> >> but the conversation about each change
> >> will take place on Fedora Discussion at
> >> https://discussion.fedoraproject.org/t/f40-change-request-privacy-preserving-telemetry-for-fedora-workstation-system-wide/85320
> > It looks like they've started moving replies they don't like to
> > other threads to cover up the flow of resentment that comes
> > naturally to them.
> >
> > That's why switching to Fedora Discussion from the mailing lists is
> > a very bad idea: admins or RH staff can easily delete your comments
> > or bury them in another threads.
> >
> Can we please stop implying malevolence every time we don't agree
> with something?
> 
> BTW in the spirit of openness, I've set up a poll (UNOFFICIAL) to 
> clearly state community sentiment about enabling OPT-OUT metrics to
> FESCO:
> https://discussion.fedoraproject.org/t/unofficial-poll-about-opt-out-metrics-proposal/85494

How is that going to help anything, when some of us are using browsers
from Fedora repos, that just gets this answer:

"Unfortunately, your browser is unsupported. Please switch to a
supported browser to view rich content, log in and reply."

Thats why we still wants maillists for this - as clearly said in last
discussion about it.
 
> Just a simple question and a YES/NO reply.

NO

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

> Assuming the goal is to improve fedora, that would be pointless as
> telemetry rarely produces useful results as opt-in. It makes sense to have
> it opt-out, but I'd expect the telemetry output and inputs to be open and
> available for fedora developers.
> 
> Regards,
> Nikos
> 
> 
> On Thu, Jul 6, 2023 at 8:19 PM Vitaly Zaitsev via devel <
> devel(a)lists.fedoraproject.org wrote:
If the telemetry is presented in plain text that's easy to understand and the 
user is prompted if they wish to submit the data, sure that could be a possible 
compromise.
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

> Remember, for avoidance of doubt, we will NEVER enable telemetry upload 
> without the user's consent, which is indicated by either (a) not 
> flipping the telemetry switch in gnome-initial-setup to the off 
> position, or (b) flipping the telemetry switch in gnome-control-center 
> to the on position.

So it's considered consent if you don't know what you're signing up for?  I 
would never consider something consent without it being overtly approved by the 
user, although I don't know how this applies to laws in different 
jurisdictions.   This definition of consent would then have to match up with 
every country where there is a Fedora user, no?
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

> On Thu, Jul 6 2023 at 07:42:47 PM -0400, Demi Marie Obenour 
>  
> The problem is if users are expected to answer, they are going to 
> probably answer No and it's effectively the same as an opt-in. But if 
> we have a default value, users will be inclined to leave the default 
> value.
> 
> My plan is to put this switch in gnome-initial-setup, not the 
> installer. But it will have a default value.
> 
> Remember, for avoidance of doubt, we will NEVER enable telemetry upload 
> without the user's consent, which is indicated by either (a) not 
> flipping the telemetry switch in gnome-initial-setup to the off 
> position, or (b) flipping the telemetry switch in gnome-control-center 
> to the on position. (The telemetry might be enabled *locally only* for 
> users who upgrade from previous versions of Fedora Workstation and who 
> therefore have not seen the consent switch, but the data will never be 
> uploaded to Fedora. And upgraded users will see the switch default to 
> off rather than on, so it really will be opt-in for upgraded users.)
> 
> I'm attaching a screenshot to give an idea of what this would look like 
> in gnome-initial-setup. I don't have a gnome-control-center screenshot 
> handy, but it would be similar, except there it would default to off.
> On Thu, Jul 6 2023 at 07:42:47 PM -0400, Demi Marie Obenour 
>  
> The problem is if users are expected to answer, they are going to 
> probably answer No and it's effectively the same as an opt-in. But if 
> we have a default value, users will be inclined to leave the default 
> value.
> 
> My plan is to put this switch in gnome-initial-setup, not the 
> installer. But it will have a default value.
> 
> Remember, for avoidance of doubt, we will NEVER enable telemetry upload 
> without the user's consent, which is indicated by either (a) not 
> flipping the telemetry switch in gnome-initial-setup to the off 
> position, or (b) flipping the telemetry switch in gnome-control-center 
> to the on position. (The telemetry might be enabled *locally only* for 
> users who upgrade from previous versions of Fedora Workstation and who 
> therefore have not seen the consent switch, but the data will never be 
> uploaded to Fedora. And upgraded users will see the switch default to 
> off rather than on, so it really will be opt-in for upgraded users.)
> 
> I'm attaching a screenshot to give an idea of what this would look like 
> in gnome-initial-setup. I don't have a gnome-control-center screenshot 
> handy, but it would be similar, except there it would default to off.
> On Thu, Jul 6 2023 at 07:42:47 PM -0400, Demi Marie Obenour 
>  
> The problem is if users are expected to answer, they are going to 
> probably answer No and it's effectively the same as an opt-in. But if 
> we have a default value, users will be inclined to leave the default 
> value.

Opt-out is and always will be incredibly disingenous when it comes to data 
collection.  Now I'm to understand that you're hoping enough users don't 
understand/notice that there's an option to opt-out, so that you recieve enough 
users.  What exactly is the reason this change is being considered?

>One of the main goals of metrics collection is to analyze whether Red
>Hat is achieving its goal to make Fedora Workstation the premier
>developer platform for cloud software development. Accordingly, we
>want to know things like which IDEs are most popular among our users,
>and which runtimes are used to create containers using Toolbx.

Then why not reach out to THESE users instead of casting a global net over all 
users?  There has never been a telemetry inclusion to my knowledge, that has 
been to the benefit of its users.   In understand that Red Hat sells products 
and services, but is it wise to do so at the expense of antagonizing its 
userbase of volunteers and avocates?

At the end of the day, no matter how you word it, telemetry is still data that 
is actively transmitted from the user to a third party.I still have to 
trust that this third-party will not misuse my data and ONLY collect what it 
says it will.Can Red Hat GUARANTEE that it won't collect something else if 
there's a security breach or there's an update pushed to the telemetry app 
containing a bug that collects more than intended?   Once it happens, no matter 
if by acccident or not, it will still have happened and leaked unintended data.
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-09 Thread Tomasz Torcz

On Sun, Jul 09, 2023 at 09:59:08AM +0200, Vitaly Zaitsev via devel wrote:
> On 09/07/2023 08:59, Mattia Verga via devel wrote:
> > BTW in the spirit of openness, I've set up a poll (UNOFFICIAL) to
> > clearly state community sentiment about enabling OPT-OUT metrics to FESCO:
> > https://discussion.fedoraproject.org/t/unofficial-poll-about-opt-out-metrics-proposal/85494
> > 
> > Just a simple question and a YES/NO reply.
> 
> Sorry, but we can't trust **ANONYMOUS** vote on a third-party platform.
> Admins or other people with access to host can easily edit SQL database and
> set 100500 votes for variant YES there.

  Yes they could, but this is ridiculous.

-- 
Tomasz TorczTo co nierealne – tutaj jest normalne.
to...@pipebreaker.pl  Ziomale na życie mają tu patenty specjalne.
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-09 Thread Vitaly Zaitsev via devel


On 09/07/2023 08:59, Mattia Verga via devel wrote:

BTW in the spirit of openness, I've set up a poll (UNOFFICIAL) to
clearly state community sentiment about enabling OPT-OUT metrics to FESCO:
https://discussion.fedoraproject.org/t/unofficial-poll-about-opt-out-metrics-proposal/85494

Just a simple question and a YES/NO reply.


Sorry, but we can't trust **ANONYMOUS** vote on a third-party platform. 
Admins or other people with access to host can easily edit SQL database 
and set 100500 votes for variant YES there.


You have already received a lot of feedback in several threads. FESCO 
can count these replies. Most of them overwhelmingly oppose this change.


--
Sincerely,
  Vitaly Zaitsev (vit...@easycoding.org)
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-09 Thread Vitaly Zaitsev via devel


On 09/07/2023 08:59, Mattia Verga via devel wrote:

Can we please stop implying malevolence every time we don't agree with
something?


What malevolence? All 4 of my replies are gone from the main thread. I 
can treat this as a censoring attempt by the RH staff. This is 
absolutely unacceptable for free projects like Fedora.


--
Sincerely,
  Vitaly Zaitsev (vit...@easycoding.org)
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-09 Thread Mattia Verga via devel

Il 08/07/23 13:06, Vitaly Zaitsev via devel ha scritto:
> On 06/07/2023 18:10, Aoife Moloney wrote:
>> but the conversation about each change
>> will take place on Fedora Discussion at
>> https://discussion.fedoraproject.org/t/f40-change-request-privacy-preserving-telemetry-for-fedora-workstation-system-wide/85320
> It looks like they've started moving replies they don't like to other
> threads to cover up the flow of resentment that comes naturally to them.
>
> That's why switching to Fedora Discussion from the mailing lists is a
> very bad idea: admins or RH staff can easily delete your comments or
> bury them in another threads.
>
Can we please stop implying malevolence every time we don't agree with 
something?

BTW in the spirit of openness, I've set up a poll (UNOFFICIAL) to 
clearly state community sentiment about enabling OPT-OUT metrics to FESCO:
https://discussion.fedoraproject.org/t/unofficial-poll-about-opt-out-metrics-proposal/85494

Just a simple question and a YES/NO reply.

Mattia

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-08 Thread František Šumšal



On 7/8/23 19:48, Dominik 'Rathann' Mierzejewski wrote:

On Saturday, 08 July 2023 at 19:39, Kevin Fenzi wrote:

On Sat, Jul 08, 2023 at 01:06:01PM +0200, Vitaly Zaitsev via devel wrote:

On 06/07/2023 18:10, Aoife Moloney wrote:

but the conversation about each change
will take place on Fedora Discussion at

...

97 posts were merged into an existing topic: Opt-in / Opt-Out? A
breakout topic for the F40 Change Request on Privacy-preserving
telemetry for Fedora Workstation

and the link leads to:

https://discussion.fedoraproject.org/t/opt-in-opt-out-a-breakout-topic-for-the-f40-change-request-on-privacy-preserving-telemetry-for-fedora-workstation/85393

Which, when I visit it, says "This page does not exist or is private".

If that's how it's supposed to work then I'll stay on the mailing list,
thank you very much.


I don't think this is a result of the "evil Red Hat", more like a result of the 
particular
post being moved back and forth, so the link became invalid. If you strip the 
post ID from
the link, it'll work:

https://discussion.fedoraproject.org/t/opt-in-opt-out-a-breakout-topic-for-the-f40-change-request-on-privacy-preserving-telemetry-for-fedora-workstation/

As mentioned in the thread (and also in [0]) - this is the first time we use 
discourse
for such active discussion, so some transient issues are understandable.

[0] 
https://discussion.fedoraproject.org/t/thoughts-about-the-earlier-proposal-to-use-discourse-for-change-discussions/85380

--
PGP Key ID: 0xFB738CE27B634E4B


OpenPGP_signature
Description: OpenPGP digital signature
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-08 Thread Dominik 'Rathann' Mierzejewski

On Saturday, 08 July 2023 at 19:39, Kevin Fenzi wrote:
> On Sat, Jul 08, 2023 at 01:06:01PM +0200, Vitaly Zaitsev via devel wrote:
> > On 06/07/2023 18:10, Aoife Moloney wrote:
> > > but the conversation about each change
> > > will take place on Fedora Discussion at
> > > https://discussion.fedoraproject.org/t/f40-change-request-privacy-preserving-telemetry-for-fedora-workstation-system-wide/85320
> > 
> > It looks like they've started moving replies they don't like to
> > other threads to cover up the flow of resentment that comes
> > naturally to them.
> > 
> > That's why switching to Fedora Discussion from the mailing lists is
> > a very bad idea: admins or RH staff can easily delete your comments
> > or bury them in another threads.
> 
> Well, no. Thats not whats happening. 
> 
> Moving part of the discussion to another thread actually makes it MORE
> visible to other people.

If by "MORE visible" you actually mean "unaccessible", then I agree. The
opt-in/opt-out subtopic has been made private:
...
(mattdm) Split this topic 1 day ago

97 posts were merged into an existing topic: Opt-in / Opt-Out? A
breakout topic for the F40 Change Request on Privacy-preserving
telemetry for Fedora Workstation

and the link leads to:

https://discussion.fedoraproject.org/t/opt-in-opt-out-a-breakout-topic-for-the-f40-change-request-on-privacy-preserving-telemetry-for-fedora-workstation/85393

Which, when I visit it, says "This page does not exist or is private".

If that's how it's supposed to work then I'll stay on the mailing list,
thank you very much.

Regards,
Dominik
-- 
Fedora   https://fedoraproject.org
There should be a science of discontent. People need hard times and
oppression to develop psychic muscles.
-- from "Collected Sayings of Muad'Dib" by the Princess Irulan
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-08 Thread Kevin Fenzi

On Sat, Jul 08, 2023 at 01:06:01PM +0200, Vitaly Zaitsev via devel wrote:
> On 06/07/2023 18:10, Aoife Moloney wrote:
> > but the conversation about each change
> > will take place on Fedora Discussion at
> > https://discussion.fedoraproject.org/t/f40-change-request-privacy-preserving-telemetry-for-fedora-workstation-system-wide/85320
> 
> It looks like they've started moving replies they don't like to other
> threads to cover up the flow of resentment that comes naturally to them.
> 
> That's why switching to Fedora Discussion from the mailing lists is a very
> bad idea: admins or RH staff can easily delete your comments or bury them in
> another threads.

Well, no. Thats not whats happening. 

Moving part of the discussion to another thread actually makes it MORE
visible to other people. There's links to it in the first post, and
people who wouldn't want to read through all NNN posts can see a subtopic
they want to discuss.

But if you are consuming via email, it... doesnt matter much.
The entire discussion seems to stay in the same thread anyhow.
(At least in my mail client)

I'm not sure what you mean by "RH staff". Our discourse instance is
managed by Fedora community moderators. (Some of whom work for Red Hat,
but they are part of the community too).

kevin

signature.asc
Description: PGP signature
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-08 Thread Dominik 'Rathann' Mierzejewski

On Friday, 07 July 2023 at 23:45, Björn Persson wrote:
> Michael Catanzaro wrote:
> > The problem is if users are expected to answer, they are going to 
> > probably answer No and it's effectively the same as an opt-in. But if 
> > we have a default value, users will be inclined to leave the default 
> > value.
> [...]
> > Remember, for avoidance of doubt, we will NEVER enable telemetry upload 
> > without the user's consent, which is indicated by either (a) not 
> > flipping the telemetry switch in gnome-initial-setup to the off 
> > position,
> 
> In other words, you expect that many users will click "Next" without
> thinking, and you intend to call that "consent". It's a popular tactic
> to make people "agree" to things without knowing it.

https://en.wikipedia.org/wiki/Dark_pattern#Privacy_Zuckering

So, either explain the issue to users convincingly enough that they do
click to enable the (off-by-default) telemetry (emphasis on benefits)
or scrap the idea altogether. Don't be like Facebook.

Regards,
Dominik
-- 
Fedora   https://fedoraproject.org
There should be a science of discontent. People need hard times and
oppression to develop psychic muscles.
-- from "Collected Sayings of Muad'Dib" by the Princess Irulan
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-08 Thread Demi Marie Obenour

On 7/8/23 06:19, Michal Domonkos wrote:
> On Thu, Jul 06, 2023 at 05:10:24PM +0100, Aoife Moloney wrote:
>> == Summary ==
>>
>> The Red Hat Display Systems Team (which develops the desktop) proposes
>> to enable limited data collection of anonymous Fedora Workstation
>> usage metrics.
> 
> One thing to realize here is that, no matter what collection method will be
> used and how well it will be secured against potential malicious actors, the
> reputation of Fedora *will* be harmed or at least tainted.  And it won't be
> easy to undo that.
> 
> Even if we end up using mathematically sound techniques as per Differential
> Privacy (as I suggested in my other reply), most user won't know/realize that
> and will only see the words "telemetry" and "Fedora" alongside each other in
> all those discussions and articles that will inevitably pop up as a result of
> this change.
> 
> I think the reputation of Fedora as a project shouldn't be taken lightly,
> regardless of the actual implementation, and should be weighted against the
> benefits that it would bring to the project.  I'd say a huge portion of the
> user base in Fedora consists of technical people who actively despise the
> notion of any kind of "phone home" mechanism on their system (me included), 
> and
> for good reason.  It's also evidenced by this thread so far.
> 
> The problem, as noted in this thread multiple times, is that if we make this
> opt-in, the usefulness would decrease to almost it being irrelevant.  If we
> make it opt-out, all the above applies (IMHO).
> 
> Consider that even those big software companies couldn't prevent their 
> products
> from getting the bad reputation, despite some of them reportedly using
> Differential Privacy (!).

I 100% agree with this.  Even if it can be done in a way that preserves
user privacy, the risk to Fedora’s reputation is simply not worth it.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-08 Thread Michael Catanzaro

On Fri, Jul 7 2023 at 09:21:15 PM -0400, Demi Marie Obenour 
 wrote:
For metrics to not be personally identifiable, it is necessary that 
the
set of metrics collected have sufficiently low entropy that on 
average,
_many_ users will send _the exact same metrics_.  It is very hard for 
me

to see any useful set of metrics having such low entropy.

If Fedora has 2 million users (possibly an overestimate) then the
metrics would need to have entropy much less than 2^21, which means
that the entire metrics set would need to be able to be represented
as a 20-bit integer.  In practice, I suspect one would need to fit
the entire set in a 16-bit integer or less, and possibly
_significantly_ less.


We're not going to build creepy user profiles. Particular metrics will 
be stored individually, not correlated together.


Let's say we have two metrics:

Key | Value

User launched GNOME Builder today? | y/n
User has NVIDIA proprietary driver | y/n

We would know how many users launched Builder and how many users have 
NVIDIA graphics, but we wouldn't know how many NVIDIA users launched 
Builder because there's just no need to tie those two data points 
together.


Michael

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-08 Thread Michael Catanzaro

On Sat, Jul 8 2023 at 12:08:09 AM +, Randy Barlow via devel 
 wrote:

I agree.

I think it is important to make it possible for a user to ask for the
data collected from their machine to be deleted in the event they
mistakenly submitted data, or changed their mind.


To be able to delete your data on request, we would have to maintain 
user profiles such that we can tell which user submitted the data. 
That's invasive and would drastically reduce your privacy. We don't 
want to be able to figure out which user submitted particular data. 
That doesn't make sense for Fedora.


___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-08 Thread Vitaly Zaitsev via devel


On 06/07/2023 18:10, Aoife Moloney wrote:

but the conversation about each change
will take place on Fedora Discussion at
https://discussion.fedoraproject.org/t/f40-change-request-privacy-preserving-telemetry-for-fedora-workstation-system-wide/85320


It looks like they've started moving replies they don't like to other 
threads to cover up the flow of resentment that comes naturally to them.


That's why switching to Fedora Discussion from the mailing lists is a 
very bad idea: admins or RH staff can easily delete your comments or 
bury them in another threads.


--
Sincerely,
  Vitaly Zaitsev (vit...@easycoding.org)
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-08 Thread Michal Domonkos

On Thu, Jul 06, 2023 at 05:10:24PM +0100, Aoife Moloney wrote:
> == Summary ==
> 
> The Red Hat Display Systems Team (which develops the desktop) proposes
> to enable limited data collection of anonymous Fedora Workstation
> usage metrics.

One thing to realize here is that, no matter what collection method will be
used and how well it will be secured against potential malicious actors, the
reputation of Fedora *will* be harmed or at least tainted.  And it won't be
easy to undo that.

Even if we end up using mathematically sound techniques as per Differential
Privacy (as I suggested in my other reply), most user won't know/realize that
and will only see the words "telemetry" and "Fedora" alongside each other in
all those discussions and articles that will inevitably pop up as a result of
this change.

I think the reputation of Fedora as a project shouldn't be taken lightly,
regardless of the actual implementation, and should be weighted against the
benefits that it would bring to the project.  I'd say a huge portion of the
user base in Fedora consists of technical people who actively despise the
notion of any kind of "phone home" mechanism on their system (me included), and
for good reason.  It's also evidenced by this thread so far.

The problem, as noted in this thread multiple times, is that if we make this
opt-in, the usefulness would decrease to almost it being irrelevant.  If we
make it opt-out, all the above applies (IMHO).

Consider that even those big software companies couldn't prevent their products
from getting the bad reputation, despite some of them reportedly using
Differential Privacy (!).

-- 
Michal Domonkos / RPM dev team / Red Hat, Inc.
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-08 Thread Fabio Alessandro Locati

On Sat, Jul 8, 2023, at 03:21, Demi Marie Obenour wrote:
> If Fedora has 2 million users (possibly an overestimate) then the
> metrics would need to have entropy much less than 2^21, which means
> that the entire metrics set would need to be able to be represented
> as a 20-bit integer.  In practice, I suspect one would need to fit
> the entire set in a 16-bit integer or less, and possibly
> _significantly_ less.

I see this numbers as over-optimistic, since:
* The change will only apply to Fedora Workstation users, not all Fedora users
* Many pro users (probably a big percentage of the total Fedora users, due to 
the nature of Fedora) will disble the telemetry

Overall, my pov is: this change is acceptable only if it is 100% opt-in.
Opt-out is not a valid way of saying "user consent", and can also be considered 
a dark pattern (illegal in many places, immoral everywhere).

Best,
Fale
-- 
Fabio Alessandro "Fale" Locati
fale.io
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Demi Marie Obenour

On 7/6/23 12:10, Aoife Moloney wrote:
> That said, Fedora Legal has determined that if we collect any
> personally-identifiable data, the entire metrics system must be
> opt-in. Since we are only interested in opt-out metrics due to the low
> value of opt-in metrics, we must accordingly never collect any
> personally-identifiable data.


I oppose any telemetry that is not opt-in, but I also do not think that
what this proposal is suggesting is possible to implement.

For metrics to not be personally identifiable, it is necessary that the
set of metrics collected have sufficiently low entropy that on average,
_many_ users will send _the exact same metrics_.  It is very hard for me
to see any useful set of metrics having such low entropy.

If Fedora has 2 million users (possibly an overestimate) then the
metrics would need to have entropy much less than 2^21, which means
that the entire metrics set would need to be able to be represented
as a 20-bit integer.  In practice, I suspect one would need to fit
the entire set in a 16-bit integer or less, and possibly
_significantly_ less.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Demi Marie Obenour

On 7/7/23 21:14, Naheem Zaffar wrote:
> On Sat, 8 Jul 2023, 01:08 Randy Barlow via devel, <
> devel@lists.fedoraproject.org> wrote:
> 
>> On 7/7/23 19:59, Demi Marie Obenour wrote:
>>> That is not consent.  The GDPR explicitly states that consent must
>>> be opt-IN.
>>
>> I agree.
>>
>> I think it is important to make it possible for a user to ask for the
>> data collected from their machine to be deleted in the event they
>> mistakenly submitted data, or changed their mind.
>>
> 
> Wouldnt that require the data to be individually identifiable?

Yup!  The set of all Fedora users is small enough that trying to use
cryptographic approaches to mask it won’t work, as a brute-force
attack is feasible.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Naheem Zaffar

On Sat, 8 Jul 2023, 01:08 Randy Barlow via devel, <
devel@lists.fedoraproject.org> wrote:

> On 7/7/23 19:59, Demi Marie Obenour wrote:
> > That is not consent.  The GDPR explicitly states that consent must
> > be opt-IN.
>
> I agree.
>
> I think it is important to make it possible for a user to ask for the
> data collected from their machine to be deleted in the event they
> mistakenly submitted data, or changed their mind.
>

Wouldnt that require the data to be individually identifiable?

___
> devel mailing list -- devel@lists.fedoraproject.org
> To unsubscribe send an email to devel-le...@lists.fedoraproject.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Randy Barlow via devel


On 7/7/23 19:59, Demi Marie Obenour wrote:

That is not consent.  The GDPR explicitly states that consent must
be opt-IN.


I agree.

I think it is important to make it possible for a user to ask for the 
data collected from their machine to be deleted in the event they 
mistakenly submitted data, or changed their mind.

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Demi Marie Obenour

On 7/6/23 21:17, Michael Catanzaro wrote:
> On Thu, Jul 6 2023 at 07:42:47 PM -0400, Demi Marie Obenour 
>  wrote:
>> Then make the metrics be neither opt-in nor opt-out.  Have
>> “Enable telemetry (y/n)?” be a mandatory question in the 
>> installer,
>> which the user must answer.
> 
> The problem is if users are expected to answer, they are going to 
> probably answer No and it's effectively the same as an opt-in. But if 
> we have a default value, users will be inclined to leave the default 
> value.
> 
> My plan is to put this switch in gnome-initial-setup, not the 
> installer. But it will have a default value.
> 
> Remember, for avoidance of doubt, we will NEVER enable telemetry upload 
> without the user's consent, which is indicated by either (a) not 
> flipping the telemetry switch in gnome-initial-setup to the off 
> position, or (b) flipping the telemetry switch in gnome-control-center 
> to the on position.

That is not consent.  The GDPR explicitly states that consent must
be opt-IN.

The way to get more data is not to trick users, but to explain _exactly_
what that data is in a way that non-technical people can actually
understand.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Michal Domonkos

On Thu, Jul 06, 2023 at 08:08:05PM -0500, Michael Catanzaro wrote:
> ... that would be sad since it would mean more work for me, but
> we're still at the point where that's possible. (I'd *much* rather make
> changes to the existing system to adapt it to our needs, though. :)

Oh, and I didn't mean to suggest adding more work or reworking your existing
plans, don't get me wrong :)

And absolutely, using an *existing* (and tried) system and adapting that to our
needs sounds like a much better idea than scratching all your plans and looking
for something else, especially if that *something* isn't even that obvious.

-- 
Michal Domonkos / RPM dev team / Red Hat, Inc.
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)


On Fri, Jul 07, 2023 at 16:15:14 -0500,
 Michael Catanzaro  wrote:


The local collection is a bit of a hole, but I like your suggestion to 
put a short time limit on that. Perhaps we can collect for something 
like one hour locally, then delete if the user has not consented to 
upload before then. Something like that.


I think that would be an improvement.
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Michal Domonkos

On Thu, Jul 06, 2023 at 08:08:05PM -0500, Michael Catanzaro wrote:
> But remember we do not want to keep information about individuals in the
> data set in the first place. It's easier to dodge privacy concerns if we
> just don't store such associations at all.

Sure, but the data still needs to leave a user's system at some point and
that's where you have to trust the aggregator (the Fedora project in this case,
I suppose) that it's not stored verbatim.

Or, apply a DP technique locally, before it leaves the system.  Randomized
response, which you mentioned, is actually one such technique.

In a way, you already trust the distribution by the very nature of it, e.g.
the signatures in packages you install.  DP just provides a framework in which
you can formally quantify the risk of de-masking an individual user from a
given data set, and concrete strategies to employ to minimize that risk.

Actually this exact problem is discussed in the blog post series I shared,
specifically in this part:

https://desfontain.es/privacy/local-global-differential-privacy.html

> As for differential privacy, I'm quite unfamiliar with this topic so I don't
> know to what extent it could be useful, but Endless is interested in adding
> randomized response [1], where say 50% of the data sent is fake and the
> other half is accurate. This only works for boolean and possibly integer
> data, but it would make it even harder to deanonymize reporterd data. But
> that is not supported yet.

Indeed, randomized response is one of the DP-aware techniques (it's also
mentioned in that blog series) :)  And RAPPOR is basically just randomized
response but generalized to arbitrary strings (using this fancy thing called
Bloom filters [1]).

> I will add that to my reading list. Certainly it seems a lot less
> intimidating than the Wikipedia article. ;)

Yup, the Wikipedia article isn't very helpful.  There are much better
resources, including a bunch of talks on YouTube from the researchers
themselves (e.g. Cynthia Dwork).

> Wow. I'll add this to my reading list too, although remains to be seen
> whether I'll be able to understand it. :D

Yeah, the RAPPOR paper is an interesting read but pretty dense and math-heavy
(although not as much as it might seem at first glance).  I did *try* to read
it at some point and actually managed to understand the key concepts which
aren't *that* complicated.  But I can't blame anybody for not wanting to go
down that path after they skim through it and see those formulas and charts,
really :D

I went into this DP rabbit hole myself when I was working on the DNF Countme
[2] implementation a few years back, and even if it wasn't directly applicable
in the end, it did inspire me to add a form of "randomized response" there, to
spread the countme events from a single system randomly across a week's time
window so that no usage patterns of that particular system (e.g. the typical
uptime hours) could emerge if someone were to inspect the HTTP requests with
the countme flag coming from the same system aggregated over a long period of
time.  Pretty theoretical and, in retrospect, rather unlikely and paranoid, but
it was easy to add that logic so I did, just for the peace of mind :)

I haven't kept up with the latest developments in DP since then, though, and
have blissfully forgotten most of it, too.  But it sparked my interest back
then and I certainly thought that if Fedora ever decides that it wants some
kind of "telemetry", *this* is the (only acceptable) way to do it.

Which doesn't mean there aren't other ways, or that the approach taken by
Endless (which you'd like to adopt) is wrong, of course.  These were just my 2
cents :)

FWIW, it seems like various tech companies and software project make use of DP
(at least that's what the Wikipedia article claims).  Google Chrome and MS
Windows are among those, amusingly, despite their reputation.

[1] https://en.wikipedia.org/wiki/Bloom_filter
[2] https://fedoraproject.org/wiki/Changes/DNF_Better_Counting

-- 
Michal Domonkos / RPM dev team / Red Hat, Inc.
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Björn Persson

Looking at the screenshot, I wonder what percentage of users will read
"Privacy", see that all the switches are on, and click "Next" in the
belief that all the privacy features are on.

Björn Persson


pgp2ZQzLUmMNa.pgp
Description: OpenPGP digital signatur
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Björn Persson

Michael Catanzaro wrote:
> The problem is if users are expected to answer, they are going to 
> probably answer No and it's effectively the same as an opt-in. But if 
> we have a default value, users will be inclined to leave the default 
> value.
[...]
> Remember, for avoidance of doubt, we will NEVER enable telemetry upload 
> without the user's consent, which is indicated by either (a) not 
> flipping the telemetry switch in gnome-initial-setup to the off 
> position,

In other words, you expect that many users will click "Next" without
thinking, and you intend to call that "consent". It's a popular tactic
to make people "agree" to things without knowing it.

Björn Persson


pgpRT0A1SqC4E.pgp
Description: OpenPGP digital signatur
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Björn Persson

Michael Catanzaro wrote:
> I would envision installing 
> eos-event-recorder-daemon via a Recommends: from the 
> gnome-control-center and gnome-initial-setup packages (and probably 
> also by adding it to the workstation-product comps group), so if you 
> don't have gnome-initial-setup or gnome-control-center installed, you 
> wouldn't get in on upgrade.

I don't seem to have a package named gnome-initial-setup installed.
gnome-control-center is installed, but fortunately it looks like I can
remove it without losing anything important. I don't know what pulled in
gnome-control-center or when, but I used XFCE for many years (until it
became unusable on my laptop and drove me over to LXQT), and XFCE had
ties to various gnomy things.

> Certainly the metrics 
> components should not be installed for non-GNOME users as part of this 
> change proposal.

Having some package installed is not the same thing as using a
particular desktop environment. There are many possible reasons why
packages get installed, and they won't always get removed when they're
no longer needed. Among more than 4000 installed packages, there are
surely several I'm not actually using, but examining them all to
determine which ones can be removed would take a lot of work.

> I think eos-event-recorder-daemon uses some sort of ring buffer to 
> eventually discard old events, so that storage space does not increase 
> forever and should not become an issue?

That should make it somewhat less of a problem if it is so. It should of
course be verified before data gathering is turned on.

> (BTW, the GNOME 3 era concluded with the release of GNOME 40 in Fedora 
> 34, so I wouldn't except Fedora users to still be using GNOME 3. :)

I need some way to distinguish between the Gnome that once was and the
very different thing that took over the name "Gnome".

Björn Persson

pgpdVGkitXcGu.pgp
Description: OpenPGP digital signatur
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Michael Catanzaro

On Fri, Jul 7 2023 at 12:25:12 PM -0500, Bruno Wolff III 
 wrote:
Is there going to be a recommended way to not accidentally install 
this stuff? I'm guessing the least work (for Fedora) would be to 
black list the key packages in the repo files. Making available a 
package that conflicts with them could be done, but it could 
accidentally get removed during and --allowerasing change. But this 
might be easier when doing installs.


Well I wouldn't necessarily expect it to be easy to install by mistake, 
but I do want to make sure it's not harmful if that happens somehow. So 
even if the packages are installed, they're still not going to upload 
metrics to Fedora without further user consent.


The local collection is a bit of a hole, but I like your suggestion to 
put a short time limit on that. Perhaps we can collect for something 
like one hour locally, then delete if the user has not consented to 
upload before then. Something like that.


Michael

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Michael Catanzaro

On Fri, Jul 7 2023 at 12:03:14 PM -0500, Bruno Wolff III 
 wrote:
Note that collecting the data by default increases the harm if 
someone accidentally enables telemetry and then notices the issue 
after data is reported.


Is there going to be some time limit on the data that is stored and 
not uploaded yet?


We can implement a time limit. The main purpose of this is so that we 
have the ability to collect data between first boot and the privacy 
panel in gnome-initial-setup. I'll add this to the feedback section of 
the change proposal.


___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Ewoud Kohl van Wijngaarden


On Thu, Jul 06, 2023 at 08:17:27PM -0500, Michael Catanzaro wrote:
On Thu, Jul 6 2023 at 07:42:47 PM -0400, Demi Marie Obenour 
 wrote:

Then make the metrics be neither opt-in nor opt-out.  Have
“Enable telemetry (y/n)?” be a mandatory question in the installer,
which the user must answer.


The problem is if users are expected to answer, they are going to 
probably answer No and it's effectively the same as an opt-in. But if 
we have a default value, users will be inclined to leave the default 
value.


So you do not trust users to answer the way you want? So much for 
respecting your users.

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Leslie Satenstein via devel

>From what I read, the metrics accumulation has an option to turn off the 
>collection, as well as the transmission

Sent from Yahoo Mail on Android 

  On Thu, Jul 6, 2023 at 8:53 p.m., Michael Catanzaro 
wrote:   

On Thu, Jul 6 2023 at 11:08:15 PM +0200, Björn Persson 
 wrote:
> As a non-user of Gnome 3 who normally never runs any Gnome 3 settings
> programs, I get the impression that Fedora 40 will begin accumulating
> unused metrics somewhere in the filesystem. To prevent a constantly
> growing waste of storage space, I'll have to run one of two Gnome 3
> settings programs – which may or may not require starting a Gnome 3
> desktop session – and find the right switch to either turn on 
> uploading
> or turn off collection. I'll have to remember to do that after
> upgrading around a year from now, and also on any new installations in
> the distant future.
> 
> If my impression is wrong, then the change proposal needs to be 
> amended.

Well this change proposal is for Fedora Workstation specifically. 
That's in the title. :) I would envision installing 
eos-event-recorder-daemon via a Recommends: from the 
gnome-control-center and gnome-initial-setup packages (and probably 
also by adding it to the workstation-product comps group), so if you 
don't have gnome-initial-setup or gnome-control-center installed, you 
wouldn't get in on upgrade. I'm not sure whether I want to amend this 
level of detail into the change proposal in case we might want to 
change the specifics of how it gets installed, but that's just to give 
you an idea of what I'm thinking currently. Certainly the metrics 
components should not be installed for non-GNOME users as part of this 
change proposal.

However, I've heard that Fedora KDE might also be interested in adding 
metrics once we have this working in Workstation. But that would be up 
to the people contributing to Fedora KDE and would need to be proposed 
separately.

I think eos-event-recorder-daemon uses some sort of ring buffer to 
eventually discard old events, so that storage space does not increase 
forever and should not become an issue? But please don't quote me on 
this; I have a lot of comments to respond to, and I'm not super 
familiar with the code, and I don't want to dive in to look at how it 
works right now. If there's really an issue with space growing without 
bound, then that's a bug we should fix, but I don't think it's so.

(BTW, the GNOME 3 era concluded with the release of GNOME 40 in Fedora 
34, so I wouldn't except Fedora users to still be using GNOME 3. :)

Michael
> 

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)


On Thu, Jul 06, 2023 at 19:53:12 -0500,
 Michael Catanzaro  wrote:


Well this change proposal is for Fedora Workstation specifically. 
That's in the title. :) I would envision installing 
eos-event-recorder-daemon via a Recommends: from the 
gnome-control-center and gnome-initial-setup packages (and probably 
also by adding it to the workstation-product comps group), so if you 
don't have gnome-initial-setup or gnome-control-center installed, you 
wouldn't get in on upgrade. I'm not sure whether I want to amend this 
level of detail into the change proposal in case we might want to 
change the specifics of how it gets installed, but that's just to give 
you an idea of what I'm thinking currently. Certainly the metrics 
components should not be installed for non-GNOME users as part of this 
change proposal.


Is there going to be a recommended way to not accidentally install this 
stuff? I'm guessing the least work (for Fedora) would be to black list the 
key packages in the repo files. Making available a package that conflicts 
with them could be done, but it could accidentally get removed during 
and --allowerasing change. But this might be easier when doing installs.

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)


On Thu, Jul 06, 2023 at 14:32:04 -0500,
 Michael Catanzaro  wrote:


On Thu, Jul 6 2023 at 08:19:07 PM +0200, Vitaly Zaitsev via devel 
 wrote:

All telemetry collection MUST be an opt-in feature (disabled by
default). I'm strongly against enabling it by default.


As explained in the proposal document, we know that opt-in metrics are 
not very useful because few users would opt in, and these users would 
not be representative of Fedora users as a whole. We are not 
interested in opt-in metrics.


This strongly suggests that most people would prefer not to provide 
metrics. But what is hoped that they won't mind it enough to turn things 
off. I'm not a fan of doing this, but people can reasonably argue it is 
for the greater good or that most people are misevaluating the trade offs 
of their data being used to improve things for them.

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)


On Thu, Jul 06, 2023 at 20:17:27 -0500,
 Michael Catanzaro  wrote:


Remember, for avoidance of doubt, we will NEVER enable telemetry 
upload without the user's consent, which is indicated by either (a) 
not flipping the telemetry switch in gnome-initial-setup to the off 
position, or (b) flipping the telemetry switch in gnome-control-center 
to the on position. (The telemetry might be enabled *locally only* for 
users who upgrade from previous versions of Fedora Workstation and who 
therefore have not seen the consent switch, but the data will never be 
uploaded to Fedora. And upgraded users will see the switch default to 
off rather than on, so it really will be opt-in for upgraded users.)


Note that collecting the data by default increases the harm if someone 
accidentally enables telemetry and then notices the issue after data 
is reported.


Is there going to be some time limit on the data that is stored and not 
uploaded yet?

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Christoph Karl


+1

Am 07.07.23 um 13:05 schrieb Kevin Kofler via devel:

"Privacy-preserving Telemetry" is an oxymoron. No such thing exists.
Telemetry is always an invasion of privacy, and as such, completely
unacceptable in a Free Software operating system. All the more if it is
mandatory or opt-out rather than opt-in (but I also consider all those
obnoxious "please opt-in to sharing your personal data with us" prompts a
major annoyance).

I do not see why Fedora (or any other Free Software project, including
GNOME, KDE, Endless OS, etc. – I am also complaining about other projects'
telemetry efforts) has a need to spy on its users.

 Kevin Kofler
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Michael Catanzaro

On Thu, Jul 6 2023 at 09:27:47 PM +0200, Florian Weimer 
 wrote:

What about packages which already collect metrics and report them
somewhere (not necessarily to Red Hat)?  Would these packages need to
change under this proposal?  If not, how do we explain this to our
users?


No, packages that are already collecting their own metrics separately 
would not be affected.


___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Kevin Kofler via devel

"Privacy-preserving Telemetry" is an oxymoron. No such thing exists. 
Telemetry is always an invasion of privacy, and as such, completely 
unacceptable in a Free Software operating system. All the more if it is 
mandatory or opt-out rather than opt-in (but I also consider all those 
obnoxious "please opt-in to sharing your personal data with us" prompts a 
major annoyance).

I do not see why Fedora (or any other Free Software project, including 
GNOME, KDE, Endless OS, etc. – I am also complaining about other projects' 
telemetry efforts) has a need to spy on its users.

Kevin Kofler
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Daniel P . Berrangé

On Fri, Jul 07, 2023 at 12:41:00PM +0200, Leon Fauster via devel wrote:
> Am 07.07.23 um 12:19 schrieb Richard W.M. Jones:
> > On Thu, Jul 06, 2023 at 05:10:24PM +0100, Aoife Moloney wrote:
> > > Important process note: we are experimenting with using Fedora
> > > Discussion as part of the Changes process. Change announcements (like
> > > the one you are reading right now) will still be sent to the
> > > devel-announce mailing list, but the conversation about each change
> > > will take place on Fedora Discussion at
> > > https://discussion.fedoraproject.org/t/f40-change-request-privacy-preserving-telemetry-for-fedora-workstation-system-wide/85320
> > 
> > Why?  This was discussed a while back and the number problems with
> > discourse were covered, and to my knowledge none of them have been
> > fixed.
> > 
> > > == Summary ==
> > > 
> > > The Red Hat Display Systems Team (which develops the desktop) proposes
> > > to enable limited data collection of anonymous Fedora Workstation
> > > usage metrics.
> > > 
> > > Fedora is an open source community project, and nobody is interested
> > > in violating user privacy. We do not want to collect data about
> > > individual users. We want to collect only aggregate usage metrics that
> > > are actually needed to achieve specific Fedora improvement objectives,
> > > and no more. We understand that if we violate our users' trust, then
> > > we won't have many users left, so if metrics collection is approved,
> > > we will need to be very careful to roll this out in a way that
> > > respects our users at all times. (For example, we should not collect
> > > users' search queries, because that would be creepy.)
> > 
> > This also keeps coming up and the answer is again, no!  There's no
> > such thing as anonymous data collection, people don't want it, it must
> > not be enabled by default (making it useless to you), it's probably
> > illegal in the Europe, so stop asking for it.
> 
> +1
> 
> General Data Protection Regulation in EU law.
> 
> "... consent can't be implied and must always be given through an opt-in
> ..."

Note the proposal at the top of the thread directly addresses this
opt-in vs opt-out Q wrt GDPR compliance:

[quote]
Fedora Legal has determined that if we collect any
personally-identifiable data, the entire metrics system must be
opt-in. Since we are only interested in opt-out metrics due to the low
value of opt-in metrics, we must accordingly never collect any
personally-identifiable data. We must also not collect any data that
could become personally-identifiable if combined with other data,
which notably means IP addresses must not be stored. We only want to
collect anonymous data anyway, but we need to be especially mindful of
the possibility that combining two "anonymous" data points could
result in the data no longer being anonymous.
[/quote]

IOW, the intention is to avoid triggering GDPR obligations by not
collecting (potentially) personally identifiable data.

The last sentance though hints at how tricky this can be to put into
practice in reality though.

Combining anonymous data sets can be surprisingly effective at producing
metrics that could uniquely identify users - it is the heart of online
advertizment targetting techniques after all.

With regards,
Daniel
-- 
|: https://berrange.com  -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Leon Fauster via devel

Am 07.07.23 um 12:19 schrieb Richard W.M. Jones:

On Thu, Jul 06, 2023 at 05:10:24PM +0100, Aoife Moloney wrote:

Important process note: we are experimenting with using Fedora
Discussion as part of the Changes process. Change announcements (like
the one you are reading right now) will still be sent to the
devel-announce mailing list, but the conversation about each change
will take place on Fedora Discussion at
https://discussion.fedoraproject.org/t/f40-change-request-privacy-preserving-telemetry-for-fedora-workstation-system-wide/85320

Why? This was discussed a while back and the number problems with
discourse were covered, and to my knowledge none of them have been
fixed.

== Summary ==

The Red Hat Display Systems Team (which develops the desktop) proposes
to enable limited data collection of anonymous Fedora Workstation
usage metrics.

Fedora is an open source community project, and nobody is interested
in violating user privacy. We do not want to collect data about
individual users. We want to collect only aggregate usage metrics that
are actually needed to achieve specific Fedora improvement objectives,
and no more. We understand that if we violate our users' trust, then
we won't have many users left, so if metrics collection is approved,
we will need to be very careful to roll this out in a way that
respects our users at all times. (For example, we should not collect
users' search queries, because that would be creepy.)

This also keeps coming up and the answer is again, no! There's no
such thing as anonymous data collection, people don't want it, it must
not be enabled by default (making it useless to you), it's probably
illegal in the Europe, so stop asking for it.

General Data Protection Regulation in EU law.

"... consent can't be implied and must always be given through an opt-in
..."

--
Leon
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Richard W.M. Jones

On Thu, Jul 06, 2023 at 10:26:17PM +0200, Frantisek Zatloukal wrote:
> 
> 
> On Thu, Jul 6, 2023 at 9:58 PM Vitaly Zaitsev via devel <
> devel@lists.fedoraproject.org> wrote:
> 
> On 06/07/2023 21:32, Michael Catanzaro wrote:
> > As explained in the proposal document, we know that opt-in metrics are
> > not very useful because few users would opt in, and these users would
> > not be representative of Fedora users as a whole.
> 
> Because Linux users care about their privacy.
> 
>
> In that case, the users can opt-out, if the aggregated telemetry
> doesn't fit in their privacy framework.

This is not legal.

Rich.

> --
> 
> Best regards / S pozdravem,
> 
> František Zatloukal
> Senior Quality Engineer
> Red Hat

> ___
> devel mailing list -- devel@lists.fedoraproject.org
> To unsubscribe send an email to devel-le...@lists.fedoraproject.org
> Fedora Code of Conduct: 
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: 
> https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
> Do not reply to spam, report it: 
> https://pagure.io/fedora-infrastructure/new_issue


-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Richard W.M. Jones

On Thu, Jul 06, 2023 at 05:10:24PM +0100, Aoife Moloney wrote:
> Important process note: we are experimenting with using Fedora
> Discussion as part of the Changes process. Change announcements (like
> the one you are reading right now) will still be sent to the
> devel-announce mailing list, but the conversation about each change
> will take place on Fedora Discussion at
> https://discussion.fedoraproject.org/t/f40-change-request-privacy-preserving-telemetry-for-fedora-workstation-system-wide/85320

Why?  This was discussed a while back and the number problems with
discourse were covered, and to my knowledge none of them have been
fixed.

> == Summary ==
> 
> The Red Hat Display Systems Team (which develops the desktop) proposes
> to enable limited data collection of anonymous Fedora Workstation
> usage metrics.
>
> Fedora is an open source community project, and nobody is interested
> in violating user privacy. We do not want to collect data about
> individual users. We want to collect only aggregate usage metrics that
> are actually needed to achieve specific Fedora improvement objectives,
> and no more. We understand that if we violate our users' trust, then
> we won't have many users left, so if metrics collection is approved,
> we will need to be very careful to roll this out in a way that
> respects our users at all times. (For example, we should not collect
> users' search queries, because that would be creepy.)

This also keeps coming up and the answer is again, no!  There's no
such thing as anonymous data collection, people don't want it, it must
not be enabled by default (making it useless to you), it's probably
illegal in the Europe, so stop asking for it.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Nikos Mavrogiannopoulos

Assuming the goal is to improve fedora, that would be pointless as
telemetry rarely produces useful results as opt-in. It makes sense to have
it opt-out, but I'd expect the telemetry output and inputs to be open and
available for fedora developers.

Regards,
Nikos


On Thu, Jul 6, 2023 at 8:19 PM Vitaly Zaitsev via devel <
devel@lists.fedoraproject.org> wrote:

> On 06/07/2023 18:10, Aoife Moloney wrote:
> > The Red Hat Display Systems Team (which develops the desktop) proposes
> > to enable limited data collection of anonymous Fedora Workstation
> > usage metrics.
>
> All telemetry collection MUST be an opt-in feature (disabled by
> default). I'm strongly against enabling it by default.
>
> Please add the ability to completely get rid of it by removing the
> telemetry collector package.
>
> --
> Sincerely,
>Vitaly Zaitsev (vit...@easycoding.org)
> ___
> devel mailing list -- devel@lists.fedoraproject.org
> To unsubscribe send an email to devel-le...@lists.fedoraproject.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-07 Thread Florian Weimer

* Aoife Moloney:

> == Dependencies ==
>
> Any package that wishes to collect a metric would need to depend on
> eos-metrics. For example, if we were to collect statistics on which
> system settings panels are used most frequently, then the
> gnome-control-center package would need to depend on eos-metrics in
> order to send a metric to eos-event-recorder-daemon.

What about packages which already collect metrics and report them
somewhere (not necessarily to Red Hat)?  Would these packages need to
change under this proposal?  If not, how do we explain this to our
users?

Thanks,
Florian
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

On Thu, Jul 6 2023 at 09:40:59 PM -0400, Demi Marie Obenour 
 wrote:

It needs to be off by default.  See KDE’s telemetry policy


Again, if it's off by default then the data will be garbage. There is 
no point in doing opt-in telemetry. I would withdraw the proposal 
entirely if we cannot do it opt-out.


Michael

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

On Fri, Jul 7 2023 at 01:39:24 AM +, Maxwell G  
wrote:

I don't see an attachment.


Trying again.

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-06 Thread Neal Gompa

On Thu, Jul 6, 2023 at 8:53 PM Michael Catanzaro  wrote:
>
>
>
> On Thu, Jul 6 2023 at 11:08:15 PM +0200, Björn Persson
>  wrote:
> > As a non-user of Gnome 3 who normally never runs any Gnome 3 settings
> > programs, I get the impression that Fedora 40 will begin accumulating
> > unused metrics somewhere in the filesystem. To prevent a constantly
> > growing waste of storage space, I'll have to run one of two Gnome 3
> > settings programs – which may or may not require starting a Gnome 3
> > desktop session – and find the right switch to either turn on
> > uploading
> > or turn off collection. I'll have to remember to do that after
> > upgrading around a year from now, and also on any new installations in
> > the distant future.
> >
> > If my impression is wrong, then the change proposal needs to be
> > amended.
>
> Well this change proposal is for Fedora Workstation specifically.
> That's in the title. :) I would envision installing
> eos-event-recorder-daemon via a Recommends: from the
> gnome-control-center and gnome-initial-setup packages (and probably
> also by adding it to the workstation-product comps group), so if you
> don't have gnome-initial-setup or gnome-control-center installed, you
> wouldn't get in on upgrade. I'm not sure whether I want to amend this
> level of detail into the change proposal in case we might want to
> change the specifics of how it gets installed, but that's just to give
> you an idea of what I'm thinking currently. Certainly the metrics
> components should not be installed for non-GNOME users as part of this
> change proposal.
>
> However, I've heard that Fedora KDE might also be interested in adding
> metrics once we have this working in Workstation. But that would be up
> to the people contributing to Fedora KDE and would need to be proposed
> separately.
>

I'm interested from the Fedora KDE side, but I don't want to implement
it until we have our own equivalent of GNOME Initial Setup working
that would let us present all the knobs on first boot. Without that,
it feels pretty sketchy to me.

I also don't have a good handle on what this thing records, and what
metrics I would *want* to enable for it to record. I would also be
generally interested in what this can do from a holistic Fedora point
of view and how accessible the data will be to the project.

Since Workstation presents the configuration knob for this at first
boot with GNOME Initial Setup, I feel that is a good place to ensure
people get an informed (non)consent of metrics gathering so they can
make a decision of whether to leave it enabled.

> I think eos-event-recorder-daemon uses some sort of ring buffer to
> eventually discard old events, so that storage space does not increase
> forever and should not become an issue? But please don't quote me on
> this; I have a lot of comments to respond to, and I'm not super
> familiar with the code, and I don't want to dive in to look at how it
> works right now. If there's really an issue with space growing without
> bound, then that's a bug we should fix, but I don't think it's so.
>
> (BTW, the GNOME 3 era concluded with the release of GNOME 40 in Fedora
> 34, so I wouldn't except Fedora users to still be using GNOME 3. :)
>

From my perspective, it's still the GNOME 3 era, as there hasn't been
a significant redesign of the UX to warrant distinguishing it.



-- 
真実はいつも一つ！/ Always, there's only one truth!
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-06 Thread Demi Marie Obenour

On 7/6/23 21:17, Michael Catanzaro wrote:
> On Thu, Jul 6 2023 at 07:42:47 PM -0400, Demi Marie Obenour 
>  wrote:
>> Then make the metrics be neither opt-in nor opt-out.  Have
>> “Enable telemetry (y/n)?” be a mandatory question in the 
>> installer,
>> which the user must answer.
> 
> The problem is if users are expected to answer, they are going to 
> probably answer No and it's effectively the same as an opt-in. But if 
> we have a default value, users will be inclined to leave the default 
> value.
> 
> My plan is to put this switch in gnome-initial-setup, not the 
> installer. But it will have a default value.

It needs to be off by default.  See KDE’s telemetry policy.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

2023-07-06 Thread Maxwell G

On Thu Jul 6, 2023 at 20:17 CDT, Michael Catanzaro wrote:
> I'm attaching a screenshot to give an idea of what this would look like 
> in gnome-initial-setup. I don't have a gnome-control-center screenshot 
> handy, but it would be similar, except there it would default to off.

I don't see an attachment.

-- 
Maxwell G (@gotmax23)
Pronouns: He/They
___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)

On Thu, Jul 6 2023 at 07:42:47 PM -0400, Demi Marie Obenour 
 wrote:

Then make the metrics be neither opt-in nor opt-out.  Have
“Enable telemetry (y/n)?” be a mandatory question in the 
installer,

which the user must answer.


The problem is if users are expected to answer, they are going to 
probably answer No and it's effectively the same as an opt-in. But if 
we have a default value, users will be inclined to leave the default 
value.


My plan is to put this switch in gnome-initial-setup, not the 
installer. But it will have a default value.


Remember, for avoidance of doubt, we will NEVER enable telemetry upload 
without the user's consent, which is indicated by either (a) not 
flipping the telemetry switch in gnome-initial-setup to the off 
position, or (b) flipping the telemetry switch in gnome-control-center 
to the on position. (The telemetry might be enabled *locally only* for 
users who upgrade from previous versions of Fedora Workstation and who 
therefore have not seen the consent switch, but the data will never be 
uploaded to Fedora. And upgraded users will see the switch default to 
off rather than on, so it really will be opt-in for upgraded users.)


I'm attaching a screenshot to give an idea of what this would look like 
in gnome-initial-setup. I don't have a gnome-control-center screenshot 
handy, but it would be similar, except there it would default to off.


___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)




On Thu, Jul 6 2023 at 11:33:03 PM +0200, Michal Domonkos 
 wrote:
Given the detailed proposal, it's probably too late now for any 
fundamental
changes, but there's a formal research area called Differential 
Privacy [1]
that deals with the collection of user data in such a way that it 
preserves the

privacy of each participating individual.


No, it's not too late for fundamental changes. Big changes would make 
this harder and take longer, but we're still very early on here. If the 
Fedora community wants to completely throw out the Endless system and 
use something else instead, that would be sad since it would mean more 
work for me, but we're still at the point where that's possible. (I'd 
*much* rather make changes to the existing system to adapt it to our 
needs, though. :)


But remember we do not want to keep information about individuals in 
the data set in the first place. It's easier to dodge privacy concerns 
if we just don't store such associations at all.


As for differential privacy, I'm quite unfamiliar with this topic so I 
don't know to what extent it could be useful, but Endless is interested 
in adding randomized response [1], where say 50% of the data sent is 
fake and the other half is accurate. This only works for boolean and 
possibly integer data, but it would make it even harder to deanonymize 
reporterd data. But that is not supported yet.


[1] 
https://blogs.gnome.org/wjjt/2023/07/05/endless-oss-privacy-preserving-metrics-system/



Have you guys, by any chance, considered looking into that for some
inspiration?

Either way, if anyone is curious, there's a nice and easy-to-read 
write up on

the key concepts:
https://desfontain.es/privacy/differential-privacy-awesomeness.html


I will add that to my reading list. Certainly it seems a lot less 
intimidating than the Wikipedia article. ;)


A specific set of algorithms (RAPPOR) for collecting arbitrary user 
strings
that preserves Differential Privacy has been proposed (and 
implemented) by

Google a while back, too:
http://arxiv.org/abs/1407.6981
https://github.com/google/rappor


Wow. I'll add this to my reading list too, although remains to be seen 
whether I'll be able to understand it. :D


Michael

___
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Re: F40 Change: Privacy-preserving Telemetry for Fedora Workstation (System-Wide)