The team behind Linux distro Fedora has proposed the collection of telemetry data to improve services, sparking anger across its user community.
Described as “privacy-preserving Telemetry for Fedora Workstation”, the proposal from the Red Hat Display Systems Team would enable the collection of anonymous Fedora Workstation usage metrics.
While the exact metrics have yet to be determined and the approval of the community is also required, Fedora did give a flavor of the type of data that would be sought, in a post on Thursday.
Examples given include being able to know which IDEs were most popular and which runtimes were used to create containers. Knowing the hardware in use would also be useful - for example, checking if the primary storage was a spinning disk or SSD - as well as collaborating with hardware vendors.
“[The] purpose of all of the above metrics is to inform specific design decisions, not to build tracking profiles,” said the team behind Fedora.
However, the word ‘telemetry’ has sparked anger among many in the Fedora community, with one commenter to the proposal post claiming “there must be an internal contest at Red Hat to see which group can generate the most negative press and/or piss off the most people”.
More were blunter still, with another user stating “the only privacy-preserving way is no telemetry”.
Not all users have been in agreement, with some recognizing the need for collection.
“We need to gather insights over some data,” said one user. “Making it opt-in means that no one will enable it, so it’s best to have it enabled by default, and improve the experience as much as possible”.
Opt-in versus opt-out
The plan would be to deploy the Endless OS metrics system in Fedora, but not the eos-phone-home component. The underlying system would be off by default until the user completes the privacy page.
This is significant because the toggle in gnome-initial-setup will default to being enabled, even though the underlying setting would still be off. Collection of metrics would still occur, but no uploading would happen until the user finishes the privacy page with the toggle still enabled.
“This is to ensure the system is opt-out, not opt-in,” said the Fedora team. “Few users would opt in, and these users would not be representative of Fedora users as a whole. We are not interested in opt-in metrics.”
That said, metrics uploading would be opt-in for upgrading users as there is no mechanism to ask existing users for permission after an upgrade in the same way as for new installations. Local collection would still occur, but not be uploaded.
Fedora is not the first to seek telemetry
The business value of Zscaler Data Protection
Understand how this tool minimizes the risks related to data loss and other security events
Metrics have long been collected by vendors, ostensibly to improve products. However, privacy campaigners and regulators have tended to react negatively to the technology.
Microsoft, for example, has faced allegations of breaches of privacy over what its operating systems and applications send back to the company’s servers.
“This change proposal will likely be compared to the Ubuntu spyware complaints from a decade ago, when Ubuntu desktop users’ search queries were sent to Amazon by default,” the Fedora team added. “Let’s not do that.”
What are the next steps?
The change proposal is currently just that: a proposal. It still requires review and approval by the community-elected Fedora Engineering Steering Committee (FESCo) before implementation. Based on the reaction so far, the proposal will probably require some modification.
“It is very common for developers to wish to know something about how Fedora software is used, and we will finally have a way to answer such questions," the Fedora team said in the post.
“Occasionally, Red Hat might need to collect specific metrics to justify additional time spent on contributing to Fedora or additional investment in Fedora.”
