I think we need a way to differentiate between “good telemetry” where the package maintainer can just disable it by default and the package remains installable (eg. golang ) and “bad telemetry” where you’d need to effectively patch the software to remove it (eg. devenv ).
Also I think there is a question of how this will work together with the module system. For example, the matrix-synapse module turns telemetry off by default. Is the way then to have the package flagged but whitelisted via the modules setup ?