# Pkg.jl telemetry should be opt-in

**URL:** <https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209>\
**Category:** Internals & Design\
**Created:** [June 28, 2020, 9:11pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209 "2020-06-28T21:11:37Z")\
**Posts on this page:** 20\
**Page:** 12

<div class="post-metadata">

**Author:** ![anon67531922](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@anon67531922](https://discourse.julialang.org/u/anon67531922)\
**Post date:** [July 6, 2020, 8:07am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/223 "2020-07-06T08:07:40Z")

</div>

Agree, but probably best for a separate thread as to not distract from this one 🙂

---

<div class="post-metadata">

**Author:** ![heliosdrm](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/heliosdrm/32/3851_2.png) [@heliosdrm](https://discourse.julialang.org/u/heliosdrm)\
**Post date:** [July 6, 2020, 8:11am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/224 "2020-07-06T08:11:21Z")

</div>

I know; I meant as the reply stands, some might visit the link with serious intention, and felt disappointed and mocked when looking at the contents. I’d had put at least an emoticon or something like that, to avoid unnecessary offence. But yeah, I understand the good intention, so nothing else to add about it.

---

<div class="post-metadata">

**Author:** ![ppalmes](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/ppalmes/32/6838_2.png) [@ppalmes](https://discourse.julialang.org/u/ppalmes)\
**Post date:** [July 6, 2020, 8:12am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/225 "2020-07-06T08:12:19Z")

</div>

I think if we follow the KISS philosophy in Linux, we should create our package that does one thing and does it well. If we install Pkg, we expect that it does Pkg management. Maybe, Telemetry should be a separate package so that people installing it really meant to install it. In this way, we don’t permute the real function of Pkg with that of Telemetry? Of course, relying on the passivity of people or on the ignorance of people on the presence of telemetry doesn’t sound right regardless if it’s harmless. We should always strive for the most transparent way to collect information. The end does not justify the means.

---

<div class="post-metadata">

**Author:** ![anon94023334](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@anon94023334](https://discourse.julialang.org/u/anon94023334)\
**Post date:** [July 6, 2020, 8:15am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/226 "2020-07-06T08:15:23Z")

</div>

You made a joke at the expense of an organization that helps victims of domestic violence.

---

<div class="post-metadata">

**Author:** ![kristoffer.carlsson](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/kristoffer.carlsson/32/22_2.png) [@kristoffer.carlsson](https://discourse.julialang.org/u/kristoffer.carlsson)\
**Post date:** [July 6, 2020, 8:18am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/227 "2020-07-06T08:18:49Z")

</div>

Please stop. You know very well that what you are doing now is disingenuous. In no way was this at the “expense” of them (what expense did they suffer?). Anyway, for the harm, I caused them I also made a donation to their foundation. Message me if you want the receipt.

Edit: Replied to the wrong person.

---

<div class="post-metadata">

**Author:** ![anon94023334](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@anon94023334](https://discourse.julialang.org/u/anon94023334)\
**Post date:** [July 6, 2020, 8:19am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/228 "2020-07-06T08:19:11Z")

</div>

This post was temporarily hidden by the community for possibly being off-topic, unfocused, inappropriate, or spammy.

---

<div class="post-metadata">

**Author:** ![kristoffer.carlsson](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/kristoffer.carlsson/32/22_2.png) [@kristoffer.carlsson](https://discourse.julialang.org/u/kristoffer.carlsson)\
**Post date:** [July 6, 2020, 8:19am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/229 "2020-07-06T08:19:25Z")

</div>

This post was temporarily hidden by the community for possibly being off-topic, unfocused, inappropriate, or spammy.

---

<div class="post-metadata">

**Author:** ![oheil](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/oheil/32/220745_2.png) [@oheil](https://discourse.julialang.org/u/oheil)\
**Post date:** [July 6, 2020, 8:20am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/230 "2020-07-06T08:20:24Z")

</div>

> [@anon67531922](#):
>
> And shame on those who “liked” it, but I’m sadly not surprised.

It’s really getting weird. Instead of reflecting on your own count of likes and than on the validity of your position, you are attacking others because they liked a post? What you show here makes me sad.

Don’t get me wrong: your opinion is fine and it’s ok to bring it in here. But it is an opinion and it’s not you who has to decide whats wrong or right. Respect to your opinion, same to others from you.

In general about this discussion and how it went: those who argue with this highest moral standards claim to have the _right_ position. They aren’t part of the discussion anymore, they want to decide and end the discussion, because it’s clear who is right. This isn’t working, not here, not anywhere. Please, step back, think about the real issue, the real data which is gathered and how it is done. Then think about cameras in public, google, facebook, china and social scoring. Bring everything into relation and think again. You fight at the wrong place!

The facts:

- no personal data collected
- open source, clear explanation
- early and open discussion before release
- clear goal
- nothing hidden
- absolutely minimal data
- opt-out well documented and relatively easy to do (we are software developers, even the new Julia users should be able to opt-out)

I am sure, that this is the best I have ever seen in collecting data (especially the minimal approach), but it is also the reason, why it is getting so much negative response from those who see their chance to be right. Against the holy inquisition there is no argument.

At last my position: I disagree that opt-in would not give enough data, so I am also on the opt-in side, but I would opt-in for sure. Therefore and regarding the facts I am fine with opt-out. And the handling of the IP adress should be mentioned in the data document.

---

<div class="post-metadata">

**Author:** ![heliosdrm](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/heliosdrm/32/3851_2.png) [@heliosdrm](https://discourse.julialang.org/u/heliosdrm)\
**Post date:** [July 6, 2020, 8:24am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/231 "2020-07-06T08:24:05Z")

</div>

> [@anon67531922](#):
>
> Instead of attacking people who care for not diligently reading every post in this long discussion, why hasn’t anybody made an actual announcement with the link prominently visible instead of buried in a long conversation?

@dlakelan already explained the reasons for missing the link. That being said, I think that comments like “there isn’t yet an official readable document…” and others in the same line, including your question, must be contested.

There are questions that may be debated, but in this conversation there are also many comments implying that the telemetry feature has been dealt with obscurity from the side of developers, and that is really unfair. That document, which is a prominent example of transparency, is (twice) the top link of this conversation, not buried at all. Although everything can be improved, of course, I think that developers have clearly shown that they are very sensitive to the users’ privacy rights and transparency in this issue is one of their top priorities.

---

<div class="post-metadata">

**Author:** ![anon94023334](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@anon94023334](https://discourse.julialang.org/u/anon94023334)\
**Post date:** [July 6, 2020, 8:25am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/232 "2020-07-06T08:25:25Z")

</div>

ok, since I’ve been mentioned twice here, I figure I should chime in on this trainwreck.

I have no issues with respect to user privacy. My objection stems from the fact that code I freely contributed to the Julia language is now going to be used, without any prior discussion, as a way for Julia Computing – an organization that didn’t exist when my first registry PR was merged – to raise revenue. I object to this use of my code, though I realize there’s little I can do about it given its open-source license.

However legal it may be, in my opinion it’s not right to appropriate the work of volunteers who have taken time to learn and promote this language and use it for your own material benefit by changing the terms under which the work was originally submitted.

Had I known that my packages would be used to track individuals for the financial benefit of some group of other people, I never would have submitted my first PR in 2015.

This move, inasmuch as it engenders hostility from developers, is also short-sighted: You can own the painting; but you don’t own the artist.

---

<div class="post-metadata">

**Author:** ![anon67531922](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@anon67531922](https://discourse.julialang.org/u/anon67531922)\
**Post date:** [July 6, 2020, 8:25am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/233 "2020-07-06T08:25:52Z")

</div>

Hi Kristoffer,

I believe you. There was no ill intention. Still, this is a serious foundation that deals with victims of domestic abuse, so, yes, please, I encourage people to make a donation. I just did 🙏

![image](https://global.discourse-cdn.com/julialang/original/3X/7/0/70981fb650f4e85282cf7bcc31e82cbc424909fc.png)

---

<div class="post-metadata">

**Author:** ![Tamas\_Papp](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/tamas_papp/32/25949_2.png) [@Tamas\_Papp](https://discourse.julialang.org/u/Tamas_Papp)\
**Post date:** [July 6, 2020, 8:29am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/234 "2020-07-06T08:29:42Z")

</div>

> [@anon67531922](#):
>
> It makes me wonder, what is the governance of Julia as a language (I don’t really see any to be honest)?

From a practical perspective, I think it is well-defined: people with commit rights to the repo. Like all most open source projects, it is not democratic, but meritocratic: people who do the work get to define where the project goes. Note the intersection between the top contributors and people participating this topic.

Since Julia is under the MIT license, note that it is super-easy to fork, so in this sense every person or group of people gets a “vote”. It just impies a lot of work if they want to make the fork viable.

Personally, I do not to mind the telemetry too much: I am not very enthusiastic about any kind of data collection, but in case there are benefits, it should be well-designed and minimal. But if I happened to disagree with the whole thing vehemently, I still would not dream of asking that I get to “vote” about this as a “member of the community”. Since my contributions to Julia are pretty sporadic, this would be tantamount to me being involved in a decision about a project that _others_ have dreamed up and devoted a significant amount of work to.

---

<div class="post-metadata">

**Author:** ![oheil](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/oheil/32/220745_2.png) [@oheil](https://discourse.julialang.org/u/oheil)\
**Post date:** [July 6, 2020, 8:31am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/235 "2020-07-06T08:31:07Z")

</div>

Because I have to feel ashamed, and because I feel to be pushed to donate somewhere in a complete different context, which makes me even more ashamed, because I can’t compete with this high level of ethics and moral, I am leaving this thread (and because I have articulated my opinion already twice). The only thing I am good enough is to give away this little set of data to the maintainers of Julia and its ecosystems, so I feel, I am not good enough for the people here.

---

<div class="post-metadata">

**Author:** ![pfitzseb](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/pfitzseb/32/45566_2.png) [@pfitzseb](https://discourse.julialang.org/u/pfitzseb)\
**Post date:** [July 6, 2020, 8:31am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/236 "2020-07-06T08:31:09Z")

</div>

> I have no issues with respect to user privacy. My objection stems from the fact that code I freely contributed to the Julia language is now going to be used, without any prior discussion, as a way for Julia Computing – an organization that didn’t exist when my first registry PR was merged – to raise revenue. I object to this use of my code, though I realize there’s little I can do about it given its open-source license.

Wait a minute – the default package server is run by Julia, the open source project, _not_ by Julia Computing.  
The idea is that the open source project may publish package usage statistics, which the package authors in turn could use to apply for funding (see e.g. the JuMP example above).

---

<div class="post-metadata">

**Author:** ![anon94023334](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@anon94023334](https://discourse.julialang.org/u/anon94023334)\
**Post date:** [July 6, 2020, 8:32am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/237 "2020-07-06T08:32:37Z")

</div>

Then `s/Julia Computing/any other organization that is using my package as a way to apply for funding` which logically _includes_ Julia Computing as well.

It certainly does not include me.

---

<div class="post-metadata">

**Author:** ![heliosdrm](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/heliosdrm/32/3851_2.png) [@heliosdrm](https://discourse.julialang.org/u/heliosdrm)\
**Post date:** [July 6, 2020, 8:34am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/238 "2020-07-06T08:34:45Z")

</div>

> [@anon94023334](#):
>
> My objection stems from the fact that code I freely contributed to the Julia language is now going to be used, without any prior discussion, as a way for Julia Computing – an organization that didn’t exist when my first registry PR was merged – to raise revenue

That can help Julia Computing to raise revenue as much as any other company that does business with Julia. Julia Computing does not have special rights with respect to the data that would be collected with Pkg:

> [@Pkg.jl telemetry should be opt-in](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/156):
>
> I think that this needs clarification to avoid noise in the conversation: it’s not Julia Computing who will get the data, but “a limited subset of core Julia developers” (there may be coincidences in the people, but legally this is different). JC may enable other telemetry options in their products (Julia Pro, etc.), which have their own terms of service.

---

<div class="post-metadata">

**Author:** ![pfitzseb](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/pfitzseb/32/45566_2.png) [@pfitzseb](https://discourse.julialang.org/u/pfitzseb)\
**Post date:** [July 6, 2020, 8:35am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/239 "2020-07-06T08:35:22Z")

</div>

I’m not entirely sure what scenario you’re thinking of here – that the author of some third party package would use the popularity of a package they’re not an author of to apply for funding? That seems unlikely to work, no?

In any case: You are opposed to _any_ (public or otherwise) statistics about Julia package downloads then?

---

<div class="post-metadata">

**Author:** ![anon94023334](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@anon94023334](https://discourse.julialang.org/u/anon94023334)\
**Post date:** [July 6, 2020, 8:36am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/240 "2020-07-06T08:36:42Z")

</div>

> It’s not Julia Computing who will get the data, but “a limited subset of core Julia developers”

I missed this. This makes it even worse in my mind. _Cui bono_?

---

<div class="post-metadata">

**Author:** ![anon94023334](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@anon94023334](https://discourse.julialang.org/u/anon94023334)\
**Post date:** [July 6, 2020, 8:40am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/241 "2020-07-06T08:40:02Z")

</div>

> [@pfitzseb](#):
>
> In any case: You are opposed to _any_ (public or otherwise) statistics about Julia package downloads then?

I am opposed to telemetry in principle. I am particularly opposed to this implementation of telemetry: not because users’ privacy is at risk (it is, but for most people it’s not a huge increase), but because the developers whose contributions are being tracked were not consulted, nor given an opportunity to opt out of having their packages participate in this user tracking.

Consider the situation where someone is vehemently opposed to this sort of setup, and then associates the work that I’ve done with the tracking, because s/he sees the tracking request when my package is added. I don’t want the headache of trying to explain that not only am I not a part of this tracking effort, I’m actually against it but there’s nothing I can do about it because the policies under which I originally submitted my code were changed out from under me sometime in mid 2020 and there was no way to withdraw.

---

<div class="post-metadata">

**Author:** ![pfitzseb](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/pfitzseb/32/45566_2.png) [@pfitzseb](https://discourse.julialang.org/u/pfitzseb)\
**Post date:** [July 6, 2020, 8:42am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/242 "2020-07-06T08:42:36Z")

</div>

Fair enough.

Do consider that GitHub already _has_ (probably very comprehensive) stats about Julia package downloads, just by merit of them hosting something like 99% of the package ecosystem.

[Previous page](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209.md?page=11)

[Next page](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209.md?page=13)