Should commercial actors ship telemetry in nixpkgs?

If my understanding of the code is correct, the table is pretty irrelevant.

In the context of collecting telemetry IMHO it is relevant to give users an understanding of what is transmitted and collected vs discarded.

E.g. I’m fine if my IP is transmitted (because that’s how networks work), less so if it’s collected.

This said;

The feature will tar up whatever it can find in your git repository with source code and all and upload it to Domens server. Opting out will only add a flag to the url stating you don’t want all that tarball to be used as telemetry, but the upload happens none the less.

Thanks for the pointer. My understanding is that that the method grabs all non-binary tracked files in a git repo (git ls-files -z), filters paths based on an exclude list and adds what’s left to a tarball via tokio_tar. The doc of tokio_tar::Builder::append_path suggests it will add content, not just the file name, to the archive.

With the caveat that I have not looked into what goes in the exclude list, this behavior seems pretty aggressive and goes beyond just logging prompts (that’s expected by a GenAI tool). My assumption (to be validated) would be that the exclude list would contain all non devenv managed files. But even if that’s the case, the approach would still be a liability.

Again, I assume good intentions, but this behavior was not clear to me just by reading the documentation at devenv 1.4: Generating Nix Developer Environments Using AI - devenv.

Anyway, I think this is going a bit off-topic. Happy to discuss elsewhere if we can keep the convo constructive :).

My takeaway is that maybe what constitutes “telemetry” is a bit of gray area, and this reinforces my preference for opt-out by default.

12 Likes