Audacity 3.0 called spyware over data collection changes by new owner

https://appleinsider.com/articles/21/07/04/open-source-audacity-deemed-spyware-over-data-collection-changes

by doener • 5 years ago

105 71 5 years ago

villgax2• 5 years ago

It's not called a spyware, it turned into a spyware after acquisition

alkonaut3• 5 years ago

Who would aquire a piece of pretty niche software to use strategically as a spying platform? Is the information that can be gained really worth that much?

tpxl• 5 years ago

Browser extensions with 10k users are routinely acquired as a "spying platform".

villgax2• 5 years ago

The fact that it was a reliable offline piece of FOSS software key for so many workflows, browser-extension much?

uvesten• 5 years ago

I don't think it's that "niche", actually.

At least from my anecdata, a lot of people who want to do some basic sound editing without buying an audio editor (those are often quite expensive) at least try using Audacity at some point.

htns• 5 years ago

Why would anyone acquire it except to turn it into malware? I can't recall a project that wasn't built for commercial success from the start being bought for any other reason. I guess sourceforge stopping malware bundling could count.

npteljes• 5 years ago

I mean, it's the default audio software in many Linux distros, Tails included.

IshKebab3• 5 years ago

Anyone can call it whatever they like. It doesn't make it true. Is Firefox spyware?

laurowyn2• 5 years ago

I think the argument is that things like Firefox need to share some data with third parties to function correctly. The remote web server needs to know what page you want, your login details etc. That's not to say there's other things that Firefox does that isn't privacy focused, but it's accepted that Firefox has to share some data at some point to function.

Audacity, however, doesn't. It's a standalone application. It works on local files. It has worked perfectly fine like this for decades. And now a new owner has come in and changed that within weeks. That's not okay.

The same complaints are being made about other software doing similar. For example, Microsoft's attempt to make all Windows accounts online. We've had 30+ years of Windows without online accounts. Why should that change? and most importantly, why must it be forced upon unsuspecting users?

I do agree with you, though, that anybody can call it anything they want, and that doesn't make it true. But it's also fair to be suspicious of unnecessary changes that, on their own may seem innocuous, but together lead to something far worse.

chaosite3• 5 years ago

What the GP was saying was that there was no essential technical reason for Firefox to send telemetry data to Mozilla (unless you're connecting to Mozilla).

And yet, Firefox does this: https://support.mozilla.org/en-US/kb/telemetry-clientid

jeroenhd• 5 years ago

Firefox is tracking users pretty aggressively by default, though. Telemetry on by default, experiments on by default, opening a "you've updated Firefox" page with trackers unless you've gone into about:config, the list goes on.

Firefox tries better to anonymize the data collected and is a more reliable company than whoever really owns Audacity these days, but as a Firefox user, I'm pretty annoyed with the amount of settings I need to change to my Firefox installs to keep my data out of the hands of Mozilla of all people, who claim to value my privacy so much.

I can only assume those Mozilla pages telling me I've pressed the update button collect my full IP address for at least logging purposes, as every website does by default. This stuff doesn't need to be on the web, they could easily launch a local HTML file with the same contents.

fsflover• 5 years ago

Discussion: https://news.ycombinator.com/item?id=27727150

And more: https://hn.algolia.com/?dateRange=pastWeek&page=0&prefix=tru...

shmerl• 5 years ago

Fork incoming.

johannes12343212• 5 years ago

Forks there are a few.

What you need is a fork which is sustainable, trustworthy and manages to pulls users towards itself.

On the last point: just a few weeks back I ran into somebody still using OpenOffice instead of LibreOffice. Audacity is referenced from many magazines and targets non-geeks to a large part.

laurent92• 5 years ago

Shouldn’t DARPA or the National Security Agency fund 3-4 developers full-time to fork it and start improvements that will be so sexy that the russian version fades away? If they are so concerned about national security… that seens like a low hanging fruit.

xmprt• 5 years ago

DARPA funding open source projects seems like a pretty decent idea to avoid them being influenced by foreign interests. They already provide a lot of funding to Tor so it's not completely out of the realm of possibility.

sen• 5 years ago

https://github.com/cookiengineer/audacity

MAGZine• 5 years ago

Seems as though crash reporting is now deemed harmful. Strange take by the community.

Ygg23• 5 years ago

Why does crash reporting need my IP address?

0x4d4c• 5 years ago

Consider multiple similar crash reports from one IP address or subnet - that could indicate, that there is something odd ie. with DNS resolution in particular network (corporate or whatever). But that's the case only for apps, that rely on internet connectivity heavily.

lillecarl• 5 years ago

I agree, but how do you plan on submitting the crash report without submitting your IP address?

arp2422• 5 years ago

One possible reason would be to "group" reports: if 95% (or even 100%) of a certain error come from a single computer then there's either a very obscure bug or something wrong with that computer. If all reports come from different computers then it's a much more serious issue.

IP addresses aren't really super-reliable for this (corporate networks, ISP NAT), but many people still are under the misapprehension that they are, and it's probably reliable enough for this purpose.

I don't know if that's the reason; but it could be.

TeMPOraL• 5 years ago

Always has been. That is, crash reporting that happens automatically, without user's consent.

It's not people suddenly objecting a standard practice - it's another episode of the ongoing fight against attempts to normalize this practice.

johannes12343212• 5 years ago

Crash reporting is only a part of that telemetry

tirpen• 5 years ago

No, people are think that them collecting "Data necessary for law enforcement, litigation and authorities’ requests (if any)" harmful.

That has nothing to do with crash reporting, and there is no sane reason for a desktop, offline audio editor to collect such data.

the8472• 5 years ago

Take a look at their privacy policy, that seems quite broad for "crash reporting".

https://archive.fo/d3LBR

ArnoVW• 5 years ago

I believe the issue is that the update to the T's & C's is worded in a very wide and vague way. If I interpret that in a generous way, it's because their lawyers told them to be generic so as to be "always in compliance". The thinking being, no-one ever reads the conditions anyway. I've seen the same thinking in previous companies where I worked.

The problem arrives when people start actually reading these vague and wide conditions. It's a bit like when you tell your son or daughter to take some money to go to the movies, and when you find out they have taken 500$ they say "don't worry, I won't use it all, but at least I'll be sure to have enough".

If they would have explicitly stated what they were logging, and for what purpose, I think reactions would have been much less.

Personally, I would have asked for permission upon crashing, with a button to show what is being sent.

galgalesh• 5 years ago

This is a strawman argument. The policy specifically says the following.

"data necessary for law enforcement, litigation, and authorities' requests (if any),"

This is very different from "crash reporting".

ddtaylor• 5 years ago

You don't need a reverse shell to do crash reporting.

barrkel• 5 years ago

Crash reporting is an obvious vector for leaking of private and personal information.

andyjohnson0• 5 years ago

It shouldn't be necessary, but it's simple to configure Windows firewall to deny it access to the internet. I haven't noticed any adverse effects.

numpad02• 5 years ago

Is it like, Audacity is widely used by whistleblowers, so by tracking down its users, authorities could prevent human rights violation from being uncovered?

What else are these features useful in context of “law enforcement”?

viraptor2• 5 years ago

There's a chance that it's just the wording for CYA situations. They will cooperate with LE either way, so maybe the lawyers decided to put it clearly in the t&c-s.

This really applies to almost every company, since barely anyone will fight LE in your name. It's just rarely spelled out clearly in public.

numpad02• 5 years ago

I will nevertheless move to a fork, but that makes a ton more sense than the conspiracy explanation. Maybe just the word choices are different from typical Western ones as the corporate is in Russia.

bennyp101• 5 years ago

I guess it could be used to cut and crop recordings to sound like a legit thing? Reaching here ...

jokoon• 5 years ago

What do you mean "used by whistleblowers" ?

pieter_mj• 5 years ago

3-letter agencies will explore and exploit any and all available avenues for obtaining information on anyone of interest. you can rest assured it has come to their attention.

elmo2you3• 5 years ago

While there is room for arguments whether these changes to Audacity actually constitutes spying, I believe it's rather their vague wording (and potential reach) that worries people. Rightfully so, I would say. More often than not, developments like these don't end up well. Also the relative little info there is known about this new owner (or backers) appears worrisome.

Anyone knows if there is more known about this new owner, their history and or financial backers?

When this news initially broke, I remember there was a lot of mystery (with some few red flags) surrounding this new owner. I got an uncomfortable feeling that this could even be a front or proxy for a commercial entity that sees Audacity as competition. Not sure how much was payed, but this could be a relatively cheap way of knocking out an open source alternative. On the other hand, abusing an existing install base for any kind of intelligence harvesting also is a popular business model these days (actually criminal in many countries, but sadly hardly ever enforced as such).

Either way, after reading several pages of back and forth on this issue a while ago, I'm convinced that these new owners either don't quite get what they bought (or what it means) or that they do but simply can't really care (and therefore can't be trusted).

Until there's a fork, I'm not toughing this with a ten feet pole.

p49k• 5 years ago

Anyone knows if there is more known about this new owner

They are a known entity (owners of the well-known Ultimate Guitar site), and their previous purchases make it clear what their likely motivation is with Audacity: to make money in a somewhat standard way among startups these days.

They are likely adding trackers so that they can sell ads within audacity and improve their ad targeting on their actual sites. They will likely add premium features to Audacity and sell some kind of subscription service. I wouldn't be surprised to see the same kind of dark patterns/false urgency that you see in the Ultimate Guitar app.

I think that people should be legitimately concerned, but their behavior is no worse than 90% of the startups discussed on HN (not to say that's a good thing, but just to give perspective)

elmo2you3• 5 years ago

Thank you.

It sure sounds plausible, as much as I dislike it. It's one thing to see startups involved in questionable business practices with their own/new products. Quite another seeing existing useful software be destroyed by it. Looks like all that talk about the GPL being too restrictive doesn't mean that much in practice, if stunts like these can still be pulled.

haunter• 5 years ago

Which version is the last one we're 100% sure isn't doing this?

type0• 5 years ago

So far as I know it's 2.4

unicornporn• 5 years ago

If you are under 13 years old, please do not use the App[1].

Is this the future of FOSS? So dystopian.

[1] https://www.audacityteam.org/about/desktop-privacy-notice/

Audacity 3.0 called spyware over data collection changes by new owner

Related Stories