New Post: Audacity Telemetry and Why Free Software Means Better Privacy

[FranklyFlawless]

See the followup issue after the PR breakdown:

Actions we propose to take on PR #835 · audacity audacity · Discussion #889

It describes error reports being sent to their self-hosted Sentry servers.

Error reporting

We are currently interested in SQLite errors, application crashes, and non-fatal exceptions. If one of these events is detected, a dialog will appear that explains the nature of the problem and offers to send an error report to us, the Audacity developers. This dialog will contain:

• An option to view the complete error report data before it is sent
• For crashes and errors, it will send the OS used
• For crashes it will send CPU data, like number of cores
• Equally prominent buttons to “send” or “don’t send” this particular error report
• A checkbox (unchecked by default) offering to remember the user’s decision and do the same for future error reports without asking
• The decision for future error reports can be changed in Preferences at any time

Error reports of course take place over the internet, which naturally allows us to see an IP address. The error report is stored in our self-hosted Sentry database on a server located in the EU. No information will be sent to any third parties unless required by law. Sentry stores crash data and system/hardware specifications. Here is a link to their source code: GitHub - getsentry/sentry: Developer-first error tracking and performance monitoring

There is also update checking, but that seems squeaky clean to me. Then, there is this build exception to those two implementations:

Compiling from source and Linux distribution packages

The behaviour described above for error reporting and update checking would only apply to official “release” versions of Audacity available from our website or GitHub page. In other builds, the error reporting and update checking code will be excluded by default via CMake options.

This issue does not address the privacy policy changes or Contributor’s License Agreement mentioned earlier, which deal with the far greater issue of GPL violation. As a result, the Audacity developers’ reputation has severely sunk, even with their 180 telemetry turn.