# Pkg.jl telemetry should be opt-in

**URL:** <https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209>\
**Category:** Internals & Design\
**Created:** [June 28, 2020, 9:11pm UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209 "2020-06-28T21:11:37Z")\
**Posts on this page:** 1\
**Showing post:** 209

<div class="post-metadata">

**Author:** ![c42f](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/c42f/32/52842_2.png) [@c42f](https://discourse.julialang.org/u/c42f)\
**Post date:** [July 6, 2020, 2:06am UTC](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209/209 "2020-07-06T02:06:45Z")

</div>

> [@dlakelan](#):
>
> Particularly if Julia is also tracking IP addresses. It becomes a directory of vulnerable machines and their IP addresses as soon as a vulnerability is discovered that can be exploited.

Ok I think that might be fair; considering the log of UUIDs as a possible toxic data asset which may be used against a wide variety of target servers.

But we should also frame this debate by comparing to the damage that release of a fairly normal server log might do in the _absence of UUID_s. I don’t know what the package server will log currently, but let’s suppose it keeps:

- IP address
- Packages requested by that IP address

Now, suppose you get hold of those logs. You already have the information to attack servers in exactly the way you mention regardless of UUIDs being included or not. As others have mentioned further up the thread, the UUIDs are _less valuable_ to an attacker than data which is already inherently known as part of normal package server operation.

(Side note: I’d point out that any well-developed workflow for server deployment would involve downloading packages to the build machine, not on production servers. So if anything, the UUID and IP would be associated to the build machines, not the public IP of a production server. Naturally some people will update their packages on production servers and we should consider that as an expected use case. But I’d generally discourage this and not expect to see it in a modern deployment scenario.)

---

_[View the full topic](https://discourse.julialang.org/t/pkg-jl-telemetry-should-be-opt-in/42209)._