Pkg.jl telemetry should be opt-in

No, the worst case is that people who have access to the disaggregated data can figure out that UUID x belongs to you (based on your git commits or whatever), and that you spent an inordinate amount of time doing julia programming with a particular high profile politician from an IP address that happens to be assigned to a particular potentially scandalous location (a strip club, a nonprofit foundation devoted to electing vehemently racist politicians, a meeting room where KKK members congregate, private religious services for satan worshipers, whatever. just insert whatever would be the most damaging thing you could imagine for yourself)

The point is that if the UUID is kept only on a machine that has no access to your IP address then it’s impossible to link your persistent identity to your location and the location of others.

It’s the persistent identity which tracks your install across all locations where your laptop happens to go that’s the issue. The IP should not be collected on the same machine where the UUID is collected.

5 Likes