We support the development of an RFC for controlling telemetry, and we have the following input.
We’d like maintainers to collect new meta information about data privacy concerns, including whether the software calls home, relevant documentation, data processing policies, etc.
It should be the maintainer’s duty to ensure the meta attribute reflects the software’s behavior. If maintainers decide that telemetry is enabled by default, the software should follow ethical data processing guidelines like those defined by GDPR.
That said, we leave the decision to patch out telemetry logic to package maintainers, although we’d like to bias the choice in favor of user interests. In other words, we rather have the ability to disable than no ability to disable, and we rather have the ability to opt-out by configuration than a hard-coded removal of telemetry.
We believe that it is possible to have nuance in the classification and configuration of telemetry.
For instance, it is worth considering
- API calls may be necessary, and they carry some metadata
- The amount and composition of submitted data matters, ranging from package versions to hardware configuration dumps or actual user data
The success of a classification system hinges on minimizing the subjectivity of it.
We also recommend to coordinate with other distributions (e.g. through the freedesktop.org AppStream specification. [No relation to AWS]).
We believe that consent is crucial for telemetry beyond anything trivial.
Projects, including our own can benefit a lot from user data inform maintenance and development, but this can only be done on a basis of trust, by asking for and receiving consent.
It is our responsibility as a community to engage honestly with users and make it easy to opt in, e.g. through the NixOS installer.
As a final word, we find it regrettable that this conversation spilled onto social media, with all that implies. This outcome could have been achieved within the community.
We are optimistic that the community can refine and implement these ideas without further SC involvement.
— SC