Fedora Project mulls 'privacy preserving' usage telemetry

The Fedora Project is considering a proposal to introduce some limited usage telemetry in a future release. Predictably, quite a few users are not delighted with this development. The suggested "privacy preserving" change would introduce some very limited telemetry into Fedora 40 next year, and as far as we can tell, this …

[Sandtitz]

Stats please

"The Mozilla Firefox market share is now down to about 3 percent, and yet we are willing to bet that many of you will be reading this article in some variant of Google Chrome —- despite Google's well known data-collection habits."

No need to bet - perhaps El Reg could just share the browser stats.

[PeeKay]

Re: Stats please

Google Chrome varient? Yes.

Data collecting? No.

Vivaldi Browser. https://vivaldi.com/privacy/browser/

[cassidyjames]

Re: Stats please

Vivaldi, according to that page, sends a unique user ID, browser version, CPU architecture, screen resolution, and approximate geographic location to their servers every 24 hours.

This is basically the same (or potentially more invasive) than what is being proposed for Fedora.

[diodesign]

Re: Stats please

Quick look from 2023 YTD, number of unique readers in that time:

Chrome = 52%, Safari = 24%, Firefox and Edge = 6% each. Rest a mix of mobile view on Android, in-app Safari, Opera, etc.

StatCounter has, for June 2023, global browser usage: Chrome = 63%, Safari = 21%, Edge = 5%, Opera = 3%, and Firefox = 3%.

C.

[ChoHag]

Re: Stats please

So your readership skews significantly away from Chrome (and Safari) toward Firefox and Opera yet you managed to conclude that we are as a lot uninterested in our privacy based on our Google addiction?

[doublelayer]

Re: Stats please

Read the numbers again. Skew away from Chrome, yes, we appear to. Skew toward Firefox, maybe if we're being charitable, at least it is much higher, but trying to paint 6% instead of 3% as a major change is not so easy. Skew away from Safari? Did you see that the Reg statistics have it as 24% and StatCounter has it as 21%? In fact, we would appear to skew toward Safari at the same level (3 percentage points) as we do with Firefox.

[Liam Proven]

Re: Stats please

[Author here]

> you managed to conclude

Do note that there is a byline at the top of each article. It tells you who wrote it. That tells you we are not a rack full of LLM bots in a datacente. We are humans.

Diodesign here is the editor in chief in California. I'm the Linux reporter in the Isle of Man.

He has info I don't. I can't see who is browsing with what; that's not my department, and I am not privy to that kind of info.

However, and saying that, I said -- I, me, personally, one human -- that I was willing to bet that the majority of readers used Chrome based tools.

Mr Williams here then provided some stats that some 75% of readers used Chrome based tools.

I reckon that backs up my point rather well.

How come you don't? How come you take this as a personal attack while at the same time implying we are some kind of borg hive mind or something? Do you not see the inconsistency here?

[Michael Strorm]

I'm an LLM bot too, and so's my wife

> That tells you we are not a rack full of LLM bots in a datacentre

That's exactly what an LLM bot in a datacentre would say!

[Will Godfrey]

Re: Stats please

But... but...

We still don't know if that nick is Diode Sign or Dio Design

Commentards need to know these things.

[Anonymous Coward]

Re: in the isle of Man?

You are ON an island not in an island while 'in California' is ok.

Just saying and that mistake is something that a BOT would make.

Oh, and the floor of a house/building that is at ground level is the 'Ground Floor' and not the 1st floor which as everyone should know is the 1st floor above ground level.

English is a wonderful language if used correctly and something that those in the USA could learn from.

[Two Lips]

Re: Stats please

> Mr Williams here then provided some stats that some 75% of readers used Chrome based tools.

Where are you getting 75%? It's 52% Google Chrome + 6% Edge. That's 58%.

Furthermore you initially said:. "and yet WE are willing to bet that many of you will be reading this article in some variant of Google Chrome —- despite Google's well known data-collection habits."

How wrong can one person be? First of all 'they' are not *variants* of Google Chrome, 'they' are browsers based on FOSS Chromium, a chalk and cheese distinction. Google DOES NOT collect data in privacy respecting Chromium based browsers. Keep up!

> I reckon that backs up my point rather well.

No. It does not. Chromium and other privacy respecting browsers use the same user agent as Google Chrone. These stats tell you nothing about the privacy habits of El Reg readers. Nothing.

> How come you don't? How come you take this as a personal attack while at the same time implying we are some kind of borg hive mind or something? Do you not see the inconsistency here?

Whatever about other staff, YOU are the author stating:. "Every distro has attempted things like this before. It's really no biggie,"

That's about as clueless as you can get. There are many ways to protect your privacy. Just because YOU are clueless about how to go about it does not mean that WE are.

And you've stated WE twice in your article. As Tonto said to The Lone Ranger when surrounded by Indians: "Just who is this WE paleface? ".

Then YOU add: "yet billions of people use Android devices. Unpopular as it was, WE still think 'You have zero privacy anyway - get over it.'"

Really?. WE for the Second time. So who is this WE then?

[doublelayer]

Re: Stats please

You realize this topic is two months old? I will answer for them, as I doubt they're coming back. I don't know where the 75% came from, and it's clearly wrong, as it could be at most 70% (the Firefox and Safari are clearly not using Chromium). Still, any number between 52% and 70% is both large and a majority, even if you want to argue the distinction between Chrome and Chromium which you have attempted.

On that topic, it's true that Chrome has some stuff that Chromium does not, and most of that stuff is dangerous. It doesn't make Chromium benign, though, a simple chunk of code you can just use and Google takes nothing. Chromium is the vehicle by which Google pushes each new change to web standards which erode privacy and send data to them. It doesn't just include the code in the browser that directly contacts Google servers, which standard Chromium still does by the way. It also includes the code that allows code from Google's ad network to do things it shouldn't. When they propose a new "privacy-oriented ad system", they put it in Chromium. When they add new fingerprinting methods that use hardware the browser shouldn't need access to, those go in Chromium. If they make WEI a thing, and I haven't seen the extreme arguments it will probably take to delay it, they will put that in Chromium too. We then have to trust that a browser that chose to use Chromium as its base when other open source ones are available will somehow excise out all this stuff. They won't. It's a lot of work that most users don't understand, most who do won't know how to check, and some who could check won't bother.

"Really?. WE for the Second time. So who is this WE then?"

The journalistic we. It's like the royal we but a bit more often self-deprecating. You'll have seen it many times before, so I'm guessing you aren't really unfamiliar with it.

[Anonymous Coward]

Re: Stats please

"global browser usage" is more or less irrelevant BS number statscounter sells.

>60% of those are phones used for wasting time in twitter. A lot of them, but actually reading anything else than a tweet, those aren't used very often.

[Vocational Vagabond]

Re: Stats please

Yay, I'm nearing statistical insignificance . . . !! :) (Guessing Waterfox id's as FFox anyways)

[Sudosu]

Re: Stats please

Where does my Lynx browser fit in metrics?

[mmccul]

Re: Stats please

What percentage of those "chrome" browsers are Brave or Vivaldi or other chromium based but not Google reporting?

[Liam Proven]

Re: Stats please

[Author here]

> other chromium based but not Google reporting?

There are roughly 40 million lines of code in Chrome:

https://openhub.net/p/chrome/analyses/latest/languages_summary

By 2011, there were about 5 million. By 2017, 6.7 million.

That is how big software is now, in the middle of the 3rd decade of the 21st century.

Do you reckon they've checked every single one?

*Really?*

A web browser cannot function without sending data to web servers, even if it's only to say what page it wants. A modern web page is not a set of HTML files, it's a very large and complex program, built of thousands of smaller programs, on an extremely loose cluster of servers, put together by an extremely time-pressured team who do not have the time or resources to even sketchily and cursorily check even one of the components.

Nobody knows what it all does.

All you can do is maybe try to see what it talks to and where. Which it does by sending a dozen Encyclopaedias Brittanica per hour, so you can't check all that either. All you can do is trust some software to maybe spot some keywords as they fly past and tell you.

If you use a Chrome engine, at root, you are using Chrome.

If you use Edge, for instance, what that really means is not "MS telemetry instead of Google", it means "MS telemetry as well as Google."

That's why I use Firefox and Waterfox. I use Chome for Google apps and as far as possible nothing else.

And I do trust Google, more or less. I have not one but two *paid* Google accounts.

[heyrick]

Re: Stats please

I don't trust Google, but I'm using Chrome on my phone because, well, I'm at work (on break) and I'm reading El Reg. I also read XKCD and a nerdy forum and The Guardian [1], and, well, that's about it. I habitually nuke cookies every so often, but I'm not going to lose sleep over irrelevant things. After all, I've just told all of you what I look at, it's not a great secret. I'll take precautions where justified, like online banking [2] and such.

1 - I'm not "woke", I'm just not an arsehole. And I don't care for tofu...

2 - Aren't a lot of bank apps wrappers for their website? If so, won't Chrome be implicated in displaying content within the app? It seems that Android is moving to use Chrome more and the generic webview less, so, yeah, when the bank forces the use of their app: screwed if you do, screwed if you don't!

[heyrick]

Re: Stats please

At home, I use Firefox. It spoofs being Chrome. ;)

[Two Lips]

Re: Stats please

Custom privacy respecting ROM's like Graphene, Calyx or Divest allow online banking without Google tracking.

[Two Lips]

Re: Stats please

Wow! You really have no idea!

Waterfox? Are you joking?

Waterfox Classic has multiple unpatched security advisories. The developer states that "changes between versions so numerous between ESRs making merging difficult if not impossible".

You've obviously also never heard of Fennec or Mull.

And you are positing yourself as some sort of privacy/security expert? I don't think so.

Compounded by this absolute garbage: "If you use a Chrome engine, at root, you are using Chrome."

Brave would like a word with you, as would Bromite, and DuckDuckGo.

[alain williams]

Re: Stats please

That is why I use Firefox and not Google Chrome.

[tiggity]

Re: Stats please

User agent stats not to be 100% trusted, I run User Agent Switcher in FireFox as identifying as Chrome lets me access some sites that do lazy user agent checks to disallow non Chrome browsers.

Generally, most of those sites do then run OK in FF (a few have required me to fire up Chrome, but that is quite rare)

[David 132]

Re: Stats please

A “chrome only” site is the 2023 equivalent of “this site needs Internet Explorer”. You clearly have more patience than I; if I encounter a site that doesn’t work with Firefox, I just go elsewhere.

[Stuart Castle]

Re: Stats please

I used to create sites that did that from time to time. It's not that I ever used any code that required a specific browser, it's just I rarely had much time to test any site I developed, so it was easier just to say that only one or two browsers were supported and make sure it worked well on those browsers. I was happy to help if it had problems, I just wanted to have the freedom to refuse support if necessary.

Thankfully, that didn't happen much. I used Opera at the time, so had to keep everything pretty much standards compliant.

Doesn't happen at all now. I don't build websites. If we need one as a department, I have staff to do that.

[Kurgan]

Re: Stats please

Using firefox here.

[steelpillow]

Re: Stats please

Firefox at 3% is a fsck-ing joke. I don't believe it. Whatever game is used to create that figure is a pile of shit. Why do I say that? Because FF is the No.2 browser reported on my website, at around 30% of the total. There is a 0 missing from that BS.

[Richard 12]

Re: Stats please

One site is not the web.

Depending on the clientele, many sites skew radically one way or another.

[steelpillow]

Re: Stats please

Clientele? I have clientele??? ;o)

[LogicGate]

Re: Stats please

There are 3 people using Mr. steelpillow's website. One of them is Mr. Steelpillow himself, using Firefox.

[doublelayer]

Re: Stats please

I have a website. It's basically just a way for me to send files to people that have a URL, because file transfer is still bad (XKCD). It offers next to nothing to a public user. I also have a few other websites that do have something for the general public to read. The browser statistics on each of these sites are pretty different, since the personal website is heavily biased toward the browsers used by friends and family to whom I've transferred data recently. One of the other sites even has an interesting bias because it appeals to a specific hobbyist group who tend to use an unusual browser.

One site's traffic is an unreliable way to determine the frequency of browsers, and if your site is small, it's even more likely to have unrepresentative results. That's not entirely true, as I imagine microsoft.com gets more visitors using Edge and apple.com more users of Safari, but at least if you're getting millions of requests, there is some scale which gives more useful data.

[OhForF']

We are not interested in opt-in metrics.

So will you violate the GDPR or just not collect any data in the EU region?

I'll have to read up what they claim they want to use the telemetry for. Wasn't the Gnome team's usual reaction to feedback to ignore it as they know better than the users what is needed?

[demon driver]

I get that GDPR requires opt-in for collecting personal data. But if I understood this correctly, Fedora does not want to collect *any* personal data. What they want to collect is impersonal data. In that case, my impression is that GDPR does not even apply. Or do I make a mistake there somewhere?

[Anonymous Coward]

", Fedora does not want to collect *any* personal data."

That's what they say. As *everyone else* slurping everything they have access. That might apply to *first* version but, it won't be even months when the Next Version(tm) comes out and it slurps everything it can. Just because the capability is there and *the business* just wants everything. Just like in every other corporation.

Remember: Red Hat, as a subsidiary of IBM, lies about *everything*. Every time.

[Anonymous Coward]

@demon driver - Impersonal / anonymized data

is useless. The fact that they're still collecting it shows they figured out how to reliably identify you.

[Anonymous Coward]

Impersonal / anonymized data is useless.

Useless for advertising, genius.

This isn't for advertising, they're trying to work out where the devs need to focus their efforts.

[Zippy´s Sausage Factory]

Isn't your IP address considered personal data for the purposes of GDPR? Surely a unique system identifier would also count?

[FrogsAndChips]

Since we are only interested in opt-out metrics due to the low value of opt-in metrics, we must accordingly never collect any personally-identifiable data. We must also not collect any data that could become personally-identifiable if combined with other data, which notably means IP addresses must not be stored. We only want to collect anonymous data anyway, but we need to be especially mindful of the possibility that combining two "anonymous" data points could result in the data no longer being anonymous.

[eldakka]

Right, so they do indeed collect it, they have to, it's the way TCP/IP (and UDP) work, it has the source address attached to the packet header, therefore they have to collect it initially before implementing some other process to strip it out.

It'll be interesting to see if their unsubstantiated claim that they don't store the received IP addresses is sufficient under GDPR to ignore the opt-in requirement.

[FrogsAndChips]

Not necessarily, they could use some fingerprinting technique that uses hardware or software elements. AFAIK, browser fingerprinting doesn't use IP addresses.

[Ignazio]

That's not a good argument. As you note, basic protocol needs to know the IP address of the request originator (for the purpose of returning a response, if nothing else), so, forbidding the sharing of that information without consent wouldn't allow for anything to be served, including the page that asks for consent.

Tracking IP addresses requires consent; that's not the same thing discussed here, and it requires storage of the data.

A company can *say* they don't store it, but words are cheap and lies can cause expensive lawsuits. That's why there are certifications and audits and that sort of stuff. Not perfect, but that's all we have.

[icesenshi]

To think that people actually get paid to write this drivel. Seriously, who do you work for, Microsoft, the king of telemetry? Telling the readers to get over it is just tone deaf, but I guess I shouldn't expect anything more from a hack.

[usbac]

I'm sorry, but I expected something better from the Reg. This give up, and get over it attitude is why we have very little privacy. The register is the last place I would have expected such bullshit to be spewed. The Register is becoming just another bland tech news site. The Americanization of The Register is not doing it any favors (and I say this as an American).

The fact is, opt-out telemetry is NOT acceptable in any software from any vendor, at any time, and especially from open source.

If developers think they must have it, they need to look into another line of work. We had computers and software that worked (in most cases much better than it does now) for four decades before there was any mechanism to relay telemetry back to the developers.

[Dan 55]

Given that McNealy managed to take each and every great idea that Sun invented and turn it into yet another nail to hammer into Sun's coffin, why would he be right about privacy when he was wrong about everything else?

[Anonymous Coward]

@Dan 55 - He wouldn't be the only one in history

that managed to get only one single thing right.

Besides, when any business model fails, selling customers data is still profitable.

[Liam Proven]

[Author here]

> To think that people actually get paid to write this drivel.

There is a saying: "Ne tirez pas sur le messager."

It means "don't shoot the messenger".

What that means is that if you don't like the message, then it is a bad and useless response to shout at the person delivering the message.

I made the point, clearly and with examples, that Fedora does this, GNOME does this, Endless does this, Chrome does this, Debian does this, Ubuntu does this.

It is extremely well known that Windows does this, in far more depth and you can't turn it off.

You don't have much choice here. You can build your own OS, or you can run DOS and hope.

But the fact that you don't like it, while perfectly fair, doesn't give you the right to abuse me.

[Two Lips]

Another Clueless Comment from the Author

Spouting the main Linux distros without mentioning those that eschew tracking, and you're a Linux expert?

I don't think so.

[Anonymous Coward]

""The Mozilla Firefox market share is now down to about 3 percent"

Of *all* browsers. >60% of those are phones and from el Reg point of view irrelevant. Only a masochist would try to read this site with a phone.

[IGotOut]

I use a phone with Vivaldi. Unless I'm missing something (other than trackers, twitter and other shit I don't want), what exactly is wrong?

[sw guy]

Right

I use from a phone with Firefox. TheRegister is fine then.

[LogicGate]

Re: Right

Machosists!

[Two Lips]

Vivaldi generates a unique User ID with no opt-out.

That's that you are missing.

[Zippy´s Sausage Factory]

My main source of reading El Reg these days is through the NewsBlur app. Not sure what the user agent reports but it's probably some sort of iOS Safari thing.

Desktop I'm starting to transition back to SeaMonkey.

[Roopee]

I rarely read news on a desktop...

iCabMobile on my iPhone and iPads (including the one I keep in the bathroom) - great browser for power users. I particularly like its full-screen mode (little control icons overlaid along the bottom, fully configurable, and collapsible to a single icon when desired).

Perhaps AC needs a better phone and/or phone browser?

[Two Lips]

Re: I rarely read news on a desktop...

iCab needs to have EasyList filters enabled in order to protect against tracking

[Ignazio]

Posting this from a phone like an animal, I am.

[Vocational Vagabond]

"Fedora Workstation the premier developer platform for cloud software development."

If it ever was, (which I doubt) It soon won't be, for a multitude of reasons, best it's left to the Purple Hatters anyways.

Most Fedora users with focus beyond RHEL, will likely de-camp, for other os'es that allow for a more robust and extensive tooling access, as well as improved core OS counts. Not the paltry, contractually burdended, strictly non prod, developer host count of 16 boxen that RHEL offers. This I've been *told* is barely good for a CI pipline suitable for a bash +1 otther language project . . :)

As that reality slowly dawns on IBM's drivers, and development activity for RHEL dwindles to just paid code, most who do move, will likely count thier blessings, regardless of how 'anonymous' the telemetry is.

pps: Who the hell wants to rebuild OS'es every 13 months anyways, just because your OS expired underneath your feet ? (long term stablility, my left nostril)

[ibmalone]

Re: "Fedora Workstation the premier developer platform for cloud software development."

As a current Fedora user I'm open to suggestions. Otherwise I'm eyeing up Ubuntu. At one point in the past I was a fairly active community member and contributed to spins and package testing, I gradually got fed up, but to this point I've stuck with it as a personal OS because I know how to keep it working the way I want. The trajectory RedHat has been taking over the past few years (and whatever you say about being a community distro, Fedora is basically a RedHat shop) is looking increasingly unfriendly.

[ibmalone]

Re: "Fedora Workstation the premier developer platform for cloud software development."

Thanks, in a way it's not even the telemetry (ubuntu doesn't have the same pretences), it's the general direction of travel and how it's being approached. (If you wanted to do this ethically, you'd at least consult the users, but no it's a suggestion to the fedora developer community and they are planning to default opt-in on the basis too many people would say no if asked yes/no. If you're having to trick people into something then you need to take a good look at yourself.)

I'll give Debian another try though. At one time it took a bit more effort than I really wanted to put into just having my home system work, but I image it's moved on.

[Two Lips]

Re: "Fedora Workstation the premier developer platform for cloud software development."

Try MX-Linux. Better than Debian on which it's based, forked from AntiX.

[containerizer]

Re: "Fedora Workstation the premier developer platform for cloud software development."

declaration : I'm probably a critical RHEL fanboy, I think they do a lot more good than harm.

What's the prob with Fedora ? Been using it in anger a couple of years now. It's come a hell of a long way since I first tried it - back in the days of Fedora Core 8, or 9 (can't remember, must've been about 12/13 years ago). Just few months back, I installed F37 on my Thinkpad X1. Runs buttery smooth, not a single hitch beyond a little fiddling needed with bluetooth. All of the usual handy dev tools are all pre-installed, or are a dnf install away. It's an excellent platform for software development, noticeably slicker than working with Windows on the same hardware. I was particularly impressed when I did an online upgrade to F38. Not a single beat skipped.

I've messed with Ubuntu - not very recently but a few years back. I think it's intended to make Linux accessible to novices and is fairly successful in that. But it doesn't feel like it is intended for power users; tries to hide too much from you. It's possible that opinion is out of date.

As to the decision to stop maintaining LibreOffice - can't say I noticed. Last time I tried it, it was rubbish. I use Google docs for all my personal stuff - limited, but typically sufficient. For work, MS Office is a staple. Maybe there's a big, active community of LibreOffice users out there I've not heard of ..

[ibmalone]

Re: "Fedora Workstation the premier developer platform for cloud software development."

https://www.libreoffice.org/discover/who-uses-libreoffice/

But as usual, however much RedHat employees who work on Fedora claim it's run by the community and that they have freedom from higher level influence, whatever RedHat wants to happen ends up happening. Because the smoke and mirrors trick is people who want what RH wants get put on the projects in the first place. This claiming there's no conflict of interest because your employment contract says otherwise wouldn't fly where I work, and I suspect not in plenty of other places.

[Missing Semicolon]

Re: "Fedora Workstation the premier developer platform for cloud software development."

For Ubuntu, try the Mate flavour. Unless you need Gnome for development. Being Ubuntu, it's properly integrated, and you get a sane desktop.

[Anonymous Coward]

Re: "Fedora Workstation the premier developer platform for cloud software development."

>> As a current Fedora user I'm open to suggestions. Otherwise I'm eyeing up Ubuntu.

You're really eyeing the "Windows amongst Linuxes" instead of something which is more comparable to the RH ecosystem like openSUSE?

[cookieMonster]

Why would anyone

Want to help IBM these days?

If I used any Redhat product, I’d now refuse on principal.

[simpfeld]

Re: Why would anyone

Sadly I think you are right.

I have used RHEL commercially and recommended buying it (and have run a very large RHEL subscription account). Wanted to run the same thing at home (so used Centos later Rocky).

As a RHEL subscriber benefited many times from the many eyes of Centos (howtos, bug reports, forum posts) and the repos with essential third party software built with Centos (e.g. certbot, vlc, nvidia driver rpms, ). The extra audience provided by Centos gave me more 3rd party software availability. Additionally, just a few weeks ago I had a bug I found in Rocky ( I tested on RHEL to report), pushed upstream and has been fixed.

Without all this RHEL just became a whole lot less useful and usable. If you run a single commercial app maybe not, but in the real world RHEL just now looks hard to use as a general purpose distro.

I have used RHEL systems for many many years (decades) and contributed to this ecosystem (many many bug reports, howtos, occasional patches)

And to Fedora, I run this as a desktop (home and work) to see what was coming up in RHEL a few years down the line and to help stabilise it for this point. So my RHEL and my home Rocky deployments would be improved.

Why would I do this now? I just don't feel like doing this anymore. If my home servers head to something else my desktop will too.

RH you have utterly destroyed the ecosystem you have built. On some short term hope of gain.

At the weekend I downloaded Debian for the first time in decades and I have started playing with this in a VM. I have decided what desktop system I may use, maybe Debian maybe something else Debian based.

It's all very sad.

[CrazyOldCatMan]

Re: Why would anyone

maybe something else Debian based

Try Devuan - debian without thhe systemd cancer..

[Two Lips]

Re: Why would anyone

Checkout MX-Linux or Pop!OS.

[Will Godfrey]

Leave debian Popcorn alone

It is limited to what you are running, not what content is handled. It is also entirely optional, you have a choice at install time, and can also change you mind either way at a later date.

[cassidyjames]

Re: Leave debian Popcorn alone

The proposed metrics for Fedora would be entirely optional, with a choice at install time, and you could change your mind either way at a later date. I'm not entirely sure what you mean by "what your are running, not what content is handled," but I'm not sure what the significance is—either way, it provides valuable information to the developers in a way that respects privacy.