# Pkg.jl telemetry should be opt-in

**URL:** <https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209>\
**Category:** Internals & Design\
**Created:** [June 28, 2020, 9:11pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209 "2020-06-28T21:11:37Z")\
**Posts on this page:** 17\
**Page:** 20

<div class="post-metadata">

**Author:** ![kristoffer.carlsson](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/kristoffer.carlsson/32/22_2.png) [@kristoffer.carlsson](https://discourse.julialang.org/u/kristoffer.carlsson)\
**Post date:** [July 9, 2020, 11:45am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/383 "2020-07-09T11:45:18Z")

</div>

> [@chakravala](#):
>
> Perhaps the transmitted UUID and metadata should be encrypted as it is transferred over the internet, instead of using plain text, to prevent data collection from packet sniffing and so on.

Do you just mean HTTPS?

---

<div class="post-metadata">

**Author:** ![chakravala](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/chakravala/32/6832_2.png) [@chakravala](https://discourse.julialang.org/u/chakravala)\
**Post date:** [July 9, 2020, 11:46am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/384 "2020-07-09T11:46:07Z")

</div>

Yea, HTTPS would do it, I wasn’t aware of what kind of data transmission would be used for this. It really should be using that by default for all this.

---

<div class="post-metadata">

**Author:** ![StefanKarpinski](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/stefankarpinski/32/24_2.png) [@StefanKarpinski](https://discourse.julialang.org/u/StefanKarpinski)\
**Post date:** [July 9, 2020, 12:46pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/385 "2020-07-09T12:46:46Z")

</div>

Pkg refuses to use HTTP unless the host is local, even if you explicitly use an http:// URL as your package server value. This prevents people from accidentally leaving themselves open to snooping or MITM attacks.

---

<div class="post-metadata">

**Author:** ![Tamas\_Papp](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/tamas_papp/32/25949_2.png) [@Tamas\_Papp](https://discourse.julialang.org/u/Tamas_Papp)\
**Post date:** [August 5, 2020, 12:37pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/387 "2020-08-05T12:37:49Z")

</div>

> [@anon92994695](#):
>
> I know if I were at Standford, Yale, Harvard, etc, I might think twice about my researchers having their packages being geolocated and curated by such a strong link to MIT professors working in similar areas.

I think that this is uncalled for.

---

<div class="post-metadata">

**Author:** ![mbauman](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/mbauman/32/31082_2.png) [@mbauman](https://discourse.julialang.org/u/mbauman)\
**Post date:** [August 5, 2020, 1:25pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/389 "2020-08-05T13:25:51Z")

</div>

The short TL/DR is that no UUIDs are sent in Julia 1.5. Julia 1.5 sends less information and is more protective of the information than Python is — and said information is only sent if and when you download packages from a package server. The package server is easily changed. The slightly longer version is the [marked solution](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/374) in this thread.

To be abundantly clear:

- The data collected is not owned or managed by MIT, the Julia Lab, nor Julia Computing. It’s a community resource.
- IP addresses are sent because they’re needed to send the packages. It’s kinda how the internet works.
- IP addresses are only stored to help identify abuse and DDoS attacks (intentional or not) and thus are purged on a regular basis.
- This data is not for targeting ads or emails.
- If your sensitive research topic can be revealed through open source package usage, you may want to re-evaluate your security model.

If you don’t care about this issue, please don’t spread FUD about it.

---

<div class="post-metadata">

**Author:** ![anon92994695](https://avatars.discourse-cdn.com/v4/letter/a/ce7236/32.png) [@anon92994695](https://discourse.julialang.org/u/anon92994695)\
**Post date:** [August 5, 2020, 1:32pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/390 "2020-08-05T13:32:40Z")

</div>

Thanks for clarifying! Not trying to spread FUD - but having worked at universities, in security like roles, and general industrial environments, those are the things that come to mind.

I’ll remove my posts, its good to know how you all decided to handle the situation and have really thought about protecting the end users. Most companies would not have gone as far as this.

Would it be worth making some kind of official post stating the resolution of this thread because it’s huge and full of twists and turns?

---

<div class="post-metadata">

**Author:** ![johnmyleswhite](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/johnmyleswhite/32/31_2.png) [@johnmyleswhite](https://discourse.julialang.org/u/johnmyleswhite)\
**Post date:** [August 5, 2020, 1:34pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/391 "2020-08-05T13:34:12Z")

</div>

There’s a summary post marked as the solution, no?

---

<div class="post-metadata">

**Author:** ![anon92994695](https://avatars.discourse-cdn.com/v4/letter/a/ce7236/32.png) [@anon92994695](https://discourse.julialang.org/u/anon92994695)\
**Post date:** [August 5, 2020, 1:36pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/392 "2020-08-05T13:36:51Z")

</div>

Gotchya - missed that this was marked as solved. All I did was click Summary (which did reduce the thread from 370+ posts to ~80). Basically was trying to install julia 1.5 and remembered some of the discussion, then saw the notice on the website(didn’t coincide?), so I tried to check the thread, missed the solution and saw a huge pile of text with lots of turns. My bad

---

<div class="post-metadata">

**Author:** ![pfitzseb](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/pfitzseb/32/45566_2.png) [@pfitzseb](https://discourse.julialang.org/u/pfitzseb)\
**Post date:** [August 5, 2020, 1:37pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/393 "2020-08-05T13:37:19Z")

</div>

[https://julialang.org/legal/data/](https://julialang.org/legal/data/) should be updated with the new information though (it still mentions UUIDs for example).

---

<div class="post-metadata">

**Author:** ![anon92994695](https://avatars.discourse-cdn.com/v4/letter/a/ce7236/32.png) [@anon92994695](https://discourse.julialang.org/u/anon92994695)\
**Post date:** [August 5, 2020, 1:38pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/394 "2020-08-05T13:38:39Z")

</div>

yea thats kinda what I’m saying, theres little tid bits here and there not exactly lining up.  
IE:

```julia
Data sent to pkg.julialang.org is only accessible to a limited subset of core Julia developers and is not made public or shared with any third party.

```

vs

```julia
The data collected is not owned or managed by MIT, the Julia Lab, nor Julia Computing. It’s a community resource.

```

edit - world moves fast I get it, just trying to know what I’m supporting and signing up for hahaha.

---

<div class="post-metadata">

**Author:** ![StefanKarpinski](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/stefankarpinski/32/24_2.png) [@StefanKarpinski](https://discourse.julialang.org/u/StefanKarpinski)\
**Post date:** [August 5, 2020, 2:13pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/395 "2020-08-05T14:13:53Z")

</div>

That page is still linked to if you’re using Julia master, so I’ve left it as-is. It is no longer linked to from Julia 1.5 or anywhere else since the release does not use UUIDs or send any other data that can be used to track or profile users. There is a notice on the Julia downloads page about pkg servers seeing IP address (like all servers). That page will be updated or deleted whenever master changes.

---

<div class="post-metadata">

**Author:** ![ericphanson](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/ericphanson/32/215186_2.png) [@ericphanson](https://discourse.julialang.org/u/ericphanson)\
**Post date:** [August 5, 2020, 2:18pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/396 "2020-08-05T14:18:09Z")

</div>

Those two quotes are consistent in that it’s Julia community project behind the Pkg server, not MIT / the Julia lab or Julia computing, even though the individual people doing a lot of the development etc have various overlapping affiliations with those groups. Discourse says this post has already been linked, but I think it’s worth sharing again: [The Julia Project and Its Entities](https://julialang.org/blog/2019/02/julia-entities/). Even when you say “Most companies would not have gone as far as this” it’s kind of off, because there isn’t a company doing this, it’s the Julia project. If we were downloading packages from Julia Computing it would probably be in the context of Julia Team or one of their products. Here we are downloading open source projects from the Julia community, using Julia community infrastructure.

---

<div class="post-metadata">

**Author:** ![anon92994695](https://avatars.discourse-cdn.com/v4/letter/a/ce7236/32.png) [@anon92994695](https://discourse.julialang.org/u/anon92994695)\
**Post date:** [August 5, 2020, 2:34pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/397 "2020-08-05T14:34:56Z")

</div>

Thanks for explaining this. Eric that link really clarifies most of my concerns about Julia/JuliaComputing/etc. I wish I would have seen this like … 2 years ago. I won’t even share how I thought it was structured because it could be misinterperetted later by a passerby.

So the language itself is more insulated then I thought - which is good

---

<div class="post-metadata">

**Author:** ![bernhard](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/bernhard/32/2619_2.png) [@bernhard](https://discourse.julialang.org/u/bernhard)\
**Post date:** [August 27, 2020, 9:28am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/398 "2020-08-27T09:28:49Z")

</div>

Will any data (number of users (by package?), etc.) be published? Or has this already happened?  
I would be interested to see such statistics.

---

<div class="post-metadata">

**Author:** ![StefanKarpinski](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/stefankarpinski/32/24_2.png) [@StefanKarpinski](https://discourse.julialang.org/u/StefanKarpinski)\
**Post date:** [August 27, 2020, 3:01pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/399 "2020-08-27T15:01:23Z")

</div>

The client uuid was removed from the release because of this discussion, so we don’t know how many users there are. Download statistics are being collected, however, and data about download numbers will be published once the infrastructure is in place to aggregate, process and publish that data.

---

<div class="post-metadata">

**Author:** ![sidpatil](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@sidpatil](https://discourse.julialang.org/u/sidpatil)\
**Post date:** [August 3, 2021, 3:14pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/400 "2021-08-03T15:14:25Z")

</div>

[https://julialang.org/legal/data/](https://julialang.org/legal/data/)

This page is returning a 404. Is there a new location for this page?

---

<div class="post-metadata">

**Author:** ![kristoffer.carlsson](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/kristoffer.carlsson/32/22_2.png) [@kristoffer.carlsson](https://discourse.julialang.org/u/kristoffer.carlsson)\
**Post date:** [August 3, 2021, 3:39pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/401 "2021-08-03T15:39:10Z")

</div>

No, since the telemetry was removed.

[Previous page](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209.md?page=19)