New “ Pkg & Storage protocols ” and an accompanying centralized service to host packages have been merged and are present in Julia v1.5.0-rc1. The new Pkg sends telemetry consisting of a user-specific UUID and other information to the server, where it is used to count the number of users and other sta…

Thanks for the productive discussion and suggestions, everyone. We’ve tossed this around a bit among the Julia committers group, and I think it’s clear that all this requires some additional design work, so here’s how we’re going to proceed: For 1.5, we will remove the UUID and all other stateful…

[image] schnetter: Apologies; I removed one “your” from my draft, but missed this one. I meant “the Julia package server database”. I did not mean to attribute any database or technology to a person, rather to the community server and service. Thank you. Also, on re-reading, my message does s…

[image] Oscar_Smith: This would only work if the proposal stored UUID and IP (and time) cross-linked, which we’ve gotten specific confirmation that it won’t happen. Just because they wont store it, doesn’t mean an advanced persistent threat won’t store both UUID and the IP address together as…

[image] chakravala: lazy attacks listening in on plain text requests for Pkg data I was under the impression from Pkg.jl#1377 that Both protocols work over HTTPS, using only GET and HEAD requests

[image] chakravala: Perhaps the transmitted UUID and metadata should be encrypted as it is transferred over the internet, instead of using plain text, to prevent data collection from packet sniffing and so on. Do you just mean HTTPS?

Yea, HTTPS would do it, I wasn’t aware of what kind of data transmission would be used for this. It really should be using that by default for all this.

Pkg refuses to use HTTP unless the host is local, even if you explicitly use an http:// URL as your package server value. This prevents people from accidentally leaving themselves open to snooping or MITM attacks.

[image] anon92994695: I know if I were at Standford, Yale, Harvard, etc, I might think twice about my researchers having their packages being geolocated and curated by such a strong link to MIT professors working in similar areas. I think that this is uncalled for.

The short TL/DR is that no UUIDs are sent in Julia 1.5. Julia 1.5 sends less information and is more protective of the information than Python is — and said information is only sent if and when you download packages from a package server. The package server is easily changed. The slightly longer …

Thanks for clarifying! Not trying to spread FUD - but having worked at universities, in security like roles, and general industrial environments, those are the things that come to mind. I’ll remove my posts, its good to know how you all decided to handle the situation and have really thought about …

There’s a summary post marked as the solution, no?

Pkg.jl telemetry should be opt-in

Internals & Design

kristoffer.carlsson August 3, 2021, 3:39pm 401

No, since the telemetry was removed.

Digression about privacy over OpenTelemetry.jl

Topic		Replies	Views
RFC: Proposal for estimating unique Julia clients without tracking General Usage statistics , pkg , cryptography , rfc	49	1686	July 30, 2026
Digression about privacy over OpenTelemetry.jl Offtopic	9	1090	November 6, 2021
The State of the Julia Ecosystem Community	108	9619	January 31, 2019
Some Julia growth/usage stats Community	42	13733	July 13, 2025
Julia losing popularity among Data Science users (KDnuggets Software Poll) Community	145	21376	June 23, 2018

Pkg.jl telemetry should be opt-in

Related topics