Audacity: Clarification of Privacy Policy

https://github.com/audacity/audacity/discussions/1225

by anonymousab • 5 years ago

133 94 5 years ago

tlackemann• 5 years ago

I don't understand the pettiness around this issue.

Audacity needed a maintainer to help with support and development. Developer, who has a pretty active YouTube channel covering design in music software, takes interest and leads the project. Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

Can someone fill me in on what this person could have done better? Honestly, it seems like pearl-clutching from a select group of users who never gave a shit in the first place and just want to whine about something they never contributed to and get to use for free.

system16• 5 years ago

I think if you read the comments in the link, it's pretty clear: changes regarding personal information were dumped on the community along with a bunch of legalese without warning, an announcement, or context. Had the new maintainers given the community a heads up via a simple blog post explaining the reasoning behind this, we wouldn't be where we are. Hopefully they can chalk this off as a learning experience and move forward to gain trust of the community.

kennywinker• 5 years ago

You missed: project purchased by ad-heavy website owner (ultimateguitar).

As for how they could make it better: make it opt-in not opt-out.

This is the kind of toxic behaviour we all tolerate from commercial software, but people get mad when it leaks into open source.

Xc433• 5 years ago

An example of the problem is that in the UK those below 13yo cannot give consent to telemetry. Audacity is used in their public schooling system. Newer versions of Audacity will not be usable by those students anymore.

Roughly.

ronsor• 5 years ago

So they just don't consent to it? The telemetry certainly isn't mandatory; it isn't even enabled by default from what I can tell.

dantondwa• 5 years ago

I think there's a misunderstanding: Tantacrul, the developer with a pretty active Youtube channel, works for the Muse Group, which acquired Audacity. This has nothing to do with him. A company acquired Audacity, not him, and he's not in charge of the Muse Group. Your portraying of the whole thing is inaccurate.

People didn't lose their collective minds.

The Muse Group acquired Audacity, then introduced:

- a CLA (which, between other things, allows them to make closed source versions of Audacity)

- telemetry

- a very controversial privacy policy

People aren't losing their minds. And please, do not spread misinformation.

whateveracct• 5 years ago

a CLA (which, between other things, allows them to make closed source versions of Audacity)

But all previous commits they'd build on are GPL..

zxzax5• 5 years ago

Controversial? This looks extremely similar to most other privacy policies. I would urge you to read the privacy policy on any other web sites that you visit, or for any other services that you use, and compare and contrast. A good starting point might be the privacy policy on your phone's app store.

AnIdiotOnTheNet• 5 years ago

Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

I have never once used software I thought was actually good that was designed based on feedback from telemetry.

arkitaip2• 5 years ago

How would you know though? Telemetry is so common in desktop and web apps alike that you're probably surrounded by it.

techrat• 5 years ago

https://www.independent.co.uk/life-style/gadgets-and-tech/au...

matheusmoreira3• 5 years ago

Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

Their ability to make decisions doesn't matter. It is does not justify putting spyware into previously trusted software.

Also, nobody believes that excuse for a second. They couldn't care less about "improving" anything but their bottom line. They are merely capitalizing on the trustworthiness of an open source project in an attempt to extract maximum value out of its users.

If they wanted to improve the software, they would have hired somebody with good taste to work on it. People with good taste do not tolerate abusive spyware.

Can someone fill me in on what this person could have done better?

They could have not collected any "metrics" in the first place. That way, this ridiculous privacy policy would never have been necessary.

frobozz• 5 years ago

One thing would be not violating the Open Source Definition by forbidding use by under 13s.

McGlockenshire• 5 years ago

Said developer adds telemetry to help make more informed decisions. People lose their collective minds.

I don't understand the reaction either. It's hard to talk about this stuff here because of the anti-analytics groupthink. Everyone seems to jump to the worst possible conclusion whenever it's brought up.

I can't help but wonder if the people screeching about it have ever actually put analytics in their own products. Understanding how your software is used in the real world by real users is absolutely invaluable!

Kim_Bruning5• 5 years ago

The reason people jump to the worst possible conclusion is the same reason that people often do: because abuse is rampant. And sometimes that's why we can't have nice things, because too many people have misbehaved while using them.

Assuming integrity, I think the people complaining about it would indeed do unto others as they would have others do unto themselves. That is to say: not include telemetry.

zelphirkalt• 5 years ago

How about just asking people for their opinion instead of trying to somehow conclude on usage patterns and stuff from telemetry data, which is not opt-in, but opt-out, which is quite sneaky in itself?

"Just ask those people!" Is what I think every single time, when this kind of issue pops up. Ask the people what they find annoying about the product, ask them what they like. There are many questions you can ask and which yield a much more direct result than telemetry data, without upsetting a community and without coming across as sneaky and disrespectful of user privacy.

blooalien2• 5 years ago

Exactly! And if you really need any sort of "telemetry" to get the data that you need, then do what so many other FOSS software I've seen with any sort of "phone home features" does, and simply ask the user during the first run if it's okay to send <such and such data> for development purposes. (Also, a toggle in the preferences is always nice, too, so that I can enable such a feature on days I'm feeling particularly helpful, and still easily disable it on days I'm feeling like there's no need for my software to be sending data anywhere outside my network.)

It's not uncommon for me to approve such features when I'm dealing with software I trust, and when I'm thoroughly informed of exactly what data they're collecting and why. If I see a list of reasonable data points and it's not too intrusive or overreaching (and if I can examine the data before it's sent) then I'm quite often okay with it (again, with software I already trust for other reasons).

kawsper• 5 years ago

What does the OS version string contain (e.g. on Linux specifically)? Some custom kernel version strings could possibly identify someone.

I actually didn't think of this, I compile my own kernels and add my own text to the kernel name.

akersten• 5 years ago

This is now the 2nd "clarification" that Muse group, the new team in charge of Audacity, has recently put out - the first one being here[0]. At this point, it's clear that they are taking the product in an unpopular direction. So why keep pushing an online-first privacy policy and telemetry? Certainly it is not one of the pressing needs of the core product.

Honestly, it will take some convincing to make me think this isn't nefarious at this point. At a minimum, the community is not being listened to, just placated.

[0] https://github.com/audacity/audacity/discussions/880

rStar2• 5 years ago

when this happens the product dies. in my mind it’s as if audacity never existed. hopefully a project emerges from a forked code base that’s useable going forward.

zxzax5• 5 years ago

I'm not sure why the word "fork" is being repeatedly mentioned or why people are thinking this is making the code unusable. At most, I would expect a patched distribution similar to VSCodium to pop up, i.e. not a hard fork. If there was willpower in the community to fork the project and fix all the other long standing issues, that would have happened already, so there is no reason to expect a fork here.

xtracto• 5 years ago

I dont understand all the ruckus around this. Just fork the repo and remove the spying code (I dont want an audio editor to share my CPU and IP with anyone).

It has been done for larger codebases like OpenOffice and MySql.

sneak• 5 years ago

We believe concerns are due largely to unclear phrasing in the Privacy Policy

This is gaslighting. It's not the wording people have an issue with, it's the nonconsensual spyware.

akerl_5• 5 years ago

How could it be nonconsensual? The policy is provided when installing the software. This may certainly be a bad decision for the Audacity team, but nobody is being forced to use their product.

anonymousab2• 5 years ago

It is nonconsensual when the starting premise is "using Audacity".

"Consensual" in that case would mean opt-in telemetry.

elmo2you3• 5 years ago

I don't think it's always that easy. Once people are committed to a certain product, quitting or switching to an alternative isn't always simple or even possible. There can even be substantial financial damage involved. Maybe not in a way that the producer can be held legally liable for, but damage nonetheless.

I believe this argument of "users have a freedom to either take it or leave it" has been repeatedly debunked many times over. It just isn't accurately describing reality.

matheusmoreira3• 5 years ago

Nobody reads much less agrees to these idiotic policy texts. I don't care who made the software or their "conditions" for using it. If it's running on my machine, it answers to me and me alone. This "we put it on the terms and conditions so it's fine" bullshit needs to go away.

elmo2you3• 5 years ago

It certainly looks that way. Though in fairness, gaslighting implies the intent to deceive. I fear that these folk could actually be more of the kind that simply doesn't see anything wrong with their way of "making" money.

While technically legal (although the last about that might not have been said either), I think they are going to find out how their grubby ideas of right-and-wrong might not align at all with a substantial part of the user base of the product they now own.

I believe that they are already doing actual practical harm in some places, which might end up costing them dearly if it would trigger some kind of organized revolt. With their behavior so far, that can/will only end in escalation. I very much doubt that the plans of this new owner will become the financial success they may have imagined.

Sadly, Audacity as a product will no doubt suffer as a consequence. Still makes me wonder if there hasn't been some kind of financial support/injection by a commercial vendor involved, somehow. Of course it doesn't have to, but the idea just does not want to leave me alone.

nxpnsv• 5 years ago

But, why do they need to store IP-address at all? It don't see what good it can do.

deadbunny• 5 years ago

I would assume it's from webserver logs. I could of course be wrong.

noobermin5• 5 years ago

They reference GDPR so that's exactly why they mention it.

anonymousab2• 5 years ago

Logs, maybe abuse protection? For better or worse, the musescore-downloader affair has probably made them a bit pensive and defensive around potential abuse from clients.

They may also simply think that it's just plainly required if they're going to run an online service that the app connects to by default.

That's all speculation though, hopefully they'll answer that question on the GitHub discussion.

undfg• 5 years ago

This reminds me of the freenode debacle. The problem is not that audacity was purchased, the problem is that it was sold.

arkitaip2• 5 years ago

I get the feeling that the community has had enough of the corporate shenanigans, that a proper fork is about to go alive any day now.

Andoryuuta• 5 years ago

Alongside the Audacity changes, the Muse group has also performed some highly questionable actions in the context of MuseScore, such as falsely claiming that a downloader script was illegal, and that they owned copyright of all sheet music on their site. Going as far as to state that they will "cooperate with github.com and Chinese government to physically find you and stop the illegal use of licensed content." [0].

Unfortunately, I don't believe the general users of audacity will ever hear about the groups actions, and will continue to use the audacity without knowledge of what has changed.

[0] https://github.com/Xmader/musescore-downloader/issues/5

Xylakant2• 5 years ago

That thread is certainly not a good example of communication, but I cannot find any place where a representative from the Muse group says that they own the copyright to all sheet music on their site. They say (and that's to the best of my knowledge mostly correct at least here in Germany) that the arrangement for music is legally protected and even if someone else typed down the sheet, the rights to this sheet are still protected. And they point to the music industry enforcing restrictions (having worked with the music industry, I find that one entirely credible)

maccard• 5 years ago

There's a thread on an AMA about ultimate guitar from a while back where the founder talks about when they made the decisions to start adding the features people complain about, and the impression he gives is exactly that; the rights holders of the music had them over a barrel and it was a sink or swim decision

alpaca128• 5 years ago

Going as far as to state that they will "cooperate with github.com and Chinese government to physically find you and stop the illegal use of licensed content."

Wow, that's low. It's one thing to send dumb threats, it's another to threaten someone with involvement of a government that frequently disappears people. This is how you turn your products into the PR equivalent of radioactive waste.

throwaaskjdfh• 5 years ago

The tone of the post from the Musescore developer at [0] is so bizarre I wonder if the people who manage the company's policies and communications even know about it.

kzrdude• 5 years ago

In that case, at least there is some separation between the site musescore.com and the musescore open source app.

412092• 5 years ago

Any good alternatives.

It's better to consider the project dead then to argue with them

racl101• 5 years ago

I'd totally get a paid product like Ableton or Pro Tools if they didn't send data about me.

themodelplumber• 5 years ago

It really depends on what you need.

There are lots of non-FOSS but effectively-free alternatives. Ocenaudio is way better than Audacity in gobs of ways, except it's not multi-track. Reaper is pretty great but if you're hoping for commercial use with $20K+ gross/year, you need to pay $200+ USD.

In FOSS land, Zrhythm, Qtractor, LMMS...but these are DAWs so again it depends on what you were using Audacity for. You could even learn sox and maybe benefit from some command line use, like writing scripts for things you need to do all the time.

My advice: List the specific tasks you need to do, and aim to find 2-3 apps that will fill the gap. Then any extras on top of that will be gravy.

Edit: Oh and you can also use FOSS like Blender and render edited sound to mp3, or KDEnlive, or other software that's video or animation related. So if you already know those tools, or like how they work (in some ways they are pretty slick!) then they may fit better than other audio-only software.

412092• 5 years ago

Zrhythm looks great, I think I'll switch to this !

xs• 5 years ago

The thing that isn't addressed. Their terms now say that people 13 and under cannot use their product. Yet this tool is taught in schools. They want to collect this data but do not want to follow COPPA laws.

dehrmann• 5 years ago

Dumb question: Audacity has a GPL license, so it can be forked or built and distributed by a third party, right?

Gaelan• 5 years ago

Yep. In particular, any version of audacity from a Linux distro's package manager is likely already built with telemetry off.

theden3• 5 years ago

Pretty laughable they have to post even more walls of text to convince folks that it's okay for an _offline_ application to spy on you. Frankly, this would have probably been tolerated or largely ignored if there wasn't a long history of Audacity not doing this and for the most part working well.

Time to either move to hard fork (if it happens) or find an alternative IMO, they can choose to die on this hill.

We're already tracked by so many apps (and at the OS-level for many) I think a lot of people are pushing back hard (maybe unfairly) because it's something they can control since it's FOSS.

Audacity has been around for over 20 years! It's takes some serious ego to drop in CLAs and telemetry on the community months after acquiring it.

jitl• 5 years ago

Telemetry and error reporting are opt-in. Error reporting uses industry-standard Sentry (also an OSS), which is not a nefarious data seller. Auto-update checked are opt-count and send a very basic user-agent with less data than an average web browser HTTP request. There is no spying here.

theden3• 5 years ago

Yeah maybe by modern software which doesn't respect the user's privacy and resource usage it's nothing to worry about.

I'd say this is a regression, and adding all that networking code makes it easier for them to push it further down the line, and adds more vectors for attacks.

At best it's bloat. Developers were able to write good software without pulling in user's data before, it says more about the devs if they think it's so necessary.

Okay say it's not spying—you now have another app on your system pinging hosts, and depending on how much you trust Muse, you have to check the changelog every time to ensure they haven't added more bloat or juiced up the telemetry.

I'd posit that spying has been normalised we don't even recognise it anymore. Opt-in isn't a get out of jail free card, since your avg user will just click whatever.

yoyomamamama• 5 years ago

Audacity is over as soon as a fork gets some momentum.

Barrin92• 5 years ago

depends on someone actually paying the developers because I don't think development is community driven but done by Muse.

People need to keep in mind that open source software doesn't automatically develop itself just because you can fork the code. Audacity is a pretty big, complicated piece of software.

reikonomusha• 5 years ago

I’m not sure the developer who manages to remove telemetry is also ready to start maintaining fast Fourier transforms…

thayne• 5 years ago

As a linux user, I have absolutely no need for an auto-update feature. Hopefully that is something that can be disabled at both build time and run time.

miles• 5 years ago

CoasterGhost has uploaded[1] 31 versions of Audacity and Github source code for 18 versions to archive.org[2] for posterity.

[1] https://old.reddit.com/r/DataHoarder/comments/oe2opu/due_to_...

[2] https://archive.org/details/AudacityArchive

dang• 5 years ago

Recent and related:

Audacity 3.0 called spyware over data collection changes by new owner - https://news.ycombinator.com/item?id=27736151 - July 2021 (70 comments)

Audacity may collect “Data necessary for law enforcement, litigation” and more - https://news.ycombinator.com/item?id=27727150 - July 2021 (254 comments)

New [July 2, 2021] Audacity Data Collection Policy - https://news.ycombinator.com/item?id=27724389 - July 2021 (34 comments)

gigatexal• 5 years ago

Too much ill-will generated with this sudden takeover of audacity. Best to move on to alternatives and forks and forget about Audacity's new owners.

https://ardour.org/

Xylakant2• 5 years ago

ardour may have worded that better than the audacity folks, but make no mistake, as per it's privacy policy ardour will phone home (to check for new versions), store information about bugs and comply with requests from law enforcement.

    If you download and use a ready-to-run version of Ardour from ardour.org, the program will attempt to contact ardour.org at startup to determine if you should be notified about a new release of the software. If the computer where you use Ardour is connected to the internet, this process will store the computer's internet address and an identifier for its operating system.
    
    If you report a bug to our bug tracker, we will store whatever information you provide as part of the bug report.
    
    When Do We Privately Share Personal Data?
    
    Never, unless required to by law.

userbinator• 5 years ago

Microsoft popularised telemetry in otherwise-offline applications with Windows 10. Now every other trendchasing company thinks they should do it too.

They always claim it improves software, but all that seems to happen is it just gets dumbed down and features removed, making it worse for experienced/power users.

noobermin5• 5 years ago

This isn't telemetry though.

noobermin5• 5 years ago

It looks like just info you pick up if you visit the site for download. May be the initial communication was an issue but this doesn't make it spyware necessarily. They also say it has nothing to do with "offline use."

May be the story is as I said the initial communication now, not with the privacy policy changes, no? I'm starting to feel had, there is literally no telemetry here, that's just internet hype and rumors.

EDIT: there is telemetry for bug reporting...okay that's optional so I'm still seeing no fire.

BugWatch• 5 years ago

Fork name suggestion:

Gaudacity.

As in Ye Olde "G(ood) Audacity". Intentional misspelling of "gouda" (but sounds the same), has original name as a substring, and should come with appropriately cheesy wedge located between the headphones. Bonus points: reference to plugging one's ears with cheese.

...what? My dad humor is showing?

But in all frankness, I'm serious.

Audacity: Clarification of Privacy Policy

Related Stories