Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New privacy policy is completely unacceptable! #1213

Closed
Chryseus opened this issue Jul 3, 2021 · 535 comments
Closed

New privacy policy is completely unacceptable! #1213

Chryseus opened this issue Jul 3, 2021 · 535 comments

Comments

@Chryseus
Copy link

Chryseus commented Jul 3, 2021

For anyone not yet aware the official privacy policy was updated on the 2nd of July and contains some very disturbing things, most notably under data collection is "Data necessary for law enforcement, litigation and authorities’ requests (if any)", I want to ask what exactly does this mean ? this is completely vague and tells us nothing about what is actually being collected.

As far as I'm concerned any data collection is unacceptable unless what is collected is exactly stated and opt-out is provided, for an open source project this is doubly so, I urge all users to remove Audacity from their system until this is resolved, in addition if you're a Linux user I would contact the package maintainer for your distribution as such a license may not be permitted.

@NayamAmarshe
Copy link

There's no way Debian package maintainers are letting this pass, their policies regarding privacy are pretty strict.

@ghost
Copy link

ghost commented Jul 3, 2021

"The App we provide [Audacity] is not intended for individuals below the age of 13. If you are under 13 years old, please do not use the App."

why is audacity rated higher than pg-13. I'm pretty sure this directly contradicts the license.

"Who does Audacity share your Personal Data with?
[...]
3. to our auditors, advisors, legal representatives and similar agents [...]"

so, anyone you call a friend

@Chryseus
Copy link
Author

Chryseus commented Jul 3, 2021

"The App we provide [Audacity] is not intended for individuals below the age of 13. If you are under 13 years old, please do not use the App."

why is audacity rated higher than pg-13. I'm pretty sure this directly contradicts the license.

I'm pretty sure this is because the GDPR does not allow for children to give consent, although the age depends upon the member state, for example it's 18 in the UK, it's pretty clear whoever wrote it doesn't understand the GDPR.

@kevinwallace
Copy link

kevinwallace commented Jul 3, 2021

As @floopfloopfloopfloopfloop points out, this is incompatible with the GPL.

Privacy policy:

If you are under 13 years old, please do not use the App.

GPLv2:

The act of running the Program is not restricted

GPLv3:

This License explicitly affirms your unlimited permission to run the unmodified Program.

@shillshocked
Copy link

Fork this or stop using it. There is no need for big brother in a mostly offline audio program.

@rbot-code
Copy link

It looks like a shorter version of Musescore's Privacy Policy. As of recently, they're owned by the same group.

@pizzadude
Copy link

Use firejail --net=none or opensnitch to deny network access.

@theokrueger
Copy link

the audacity to do this....

@AndreiSva
Copy link

The telemetry pull request and now this... They are digging their own grave.

@Routhinator
Copy link

Fork. Fork. Fork. Fork. Fork.

@goodevilgenius
Copy link

Fork me

@GeekyGami
Copy link

"The App we provide [Audacity] is not intended for individuals below the age of 13. If you are under 13 years old, please do not use the App."

why is audacity rated higher than pg-13. I'm pretty sure this directly contradicts the license.

"Who does Audacity share your Personal Data with?
[...]
3. to our auditors, advisors, legal representatives and similar agents [...]"

so, anyone you call a friend

Essentially, if it's restricted to people under 13, that just means that data collection cannot be opted out of.

@ekianjo
Copy link

ekianjo commented Jul 4, 2021

When you can't use the knife, use the fork

@Trung0246
Copy link

Is this will become another The Great Suspender fiasco?

@Blu3wolf
Copy link

Blu3wolf commented Jul 4, 2021

I think its official, Musegroup are intending to kill Audacity. Someone hit me up with a link to the main fork?

@techsin
Copy link

techsin commented Jul 4, 2021

At this point Audacity product can't be trusted even if they revert this change.

@BlueRaccoonTech
Copy link

Keep me in the loop on a fork as well. This update to the privacy policy has lead me to lose what little trust I had left in the owners of this application caring about user privacy.

@Semisol
Copy link

Semisol commented Jul 4, 2021

Fork. Just fork.
Does anyone know if there are any forks that are actively going to be maintained or the commit which this data collection was added?
If anyone is going to fork, I would expect a community managed system where leaders are elected probably.

Or even better, take them to court for the GPL violation.

@caughtquick
Copy link

Yep, the GPL violations is downright disgusting IMO, it's in direct violation to the code that hundreds of people have put in. Seems the best result here is that a fork of audacity comes out that doesn't have all this frankly nonsense in it. That doesn't seem to exist as of yet, most of them are just backup repos of right before the purchase though

@Mek101
Copy link

Mek101 commented Jul 4, 2021

Could you guys not try to sneak in stuff to rip our data FOR 5 MINUTES!

@mnh48
Copy link

mnh48 commented Jul 4, 2021

The age restriction now in the privacy policy is completely going against the licensing of the software, someone should get a lawyer to represent every Audacity users under 13 years old who used to be able to use it under GPL license but are suddenly prohibited by the privacy policy, and take the issue to court.

GPL requires that you allow EVERYONE, including those under 13 years old, to use the software freely.

@Midi-In
Copy link

Midi-In commented Jul 4, 2021

This completely undermines any remnants of trust I might have had for the current Audacity owner, and I'm not going to continue using this software in the current form. Here's hoping for a well maintained fork instead.

@Blu3wolf
Copy link

Blu3wolf commented Jul 4, 2021 via email

@leo60228
Copy link

leo60228 commented Jul 4, 2021

If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term.

Can the age clause even apply?

@Keith-Cancel
Copy link

Keith-Cancel commented Jul 4, 2021

Yep, the GPL violations is downright disgusting IMO, it's in direct violation to the code that hundreds of people have put in. Seems the best result here is that a fork of audacity comes out that doesn't have all this frankly nonsense in it. That doesn't seem to exist as of yet, most of them are just backup repos of right before the purchase though

Problem is muse is not bound by the GPL because the last debaucle regarding the CLA. Muse basically got all the main developers to sign that CLA, and in that thread said they were just rewriting smaller contributions to avoid getting them to sign it.

#932

At this point a fork is the reasonable option, if muse going to be like this.

@caughtquick
Copy link

Yep, the GPL violations is downright disgusting IMO, it's in direct violation to the code that hundreds of people have put in. Seems the best result here is that a fork of audacity comes out that doesn't have all this frankly nonsense in it. That doesn't seem to exist as of yet, most of them are just backup repos of right before the purchase though

Problem is muse is not bound by the GPL because the last debaucle regarding the CLA.

#932

At this point a fork is the reasonable option, if muse going to be like this.

I don't think that all code is yet under the CLA making this a GPL violation if enforced

@Keith-Cancel
Copy link

Keith-Cancel commented Jul 4, 2021

Yep, the GPL violations is downright disgusting IMO, it's in direct violation to the code that hundreds of people have put in. Seems the best result here is that a fork of audacity comes out that doesn't have all this frankly nonsense in it. That doesn't seem to exist as of yet, most of them are just backup repos of right before the purchase though

Problem is muse is not bound by the GPL because the last debaucle regarding the CLA.
#932
At this point a fork is the reasonable option, if muse going to be like this.

I don't think that all code is yet under the CLA making this a GPL violation if enforced

I have not looked closely at the commit history, but they said in the CLA topic they were rewriting all the code from small contributions to avoid having to try and get those people sign the CLA.

@Blu3wolf
Copy link

Blu3wolf commented Jul 4, 2021

Yep, the GPL violations is downright disgusting IMO, it's in direct violation to the code that hundreds of people have put in. Seems the best result here is that a fork of audacity comes out that doesn't have all this frankly nonsense in it. That doesn't seem to exist as of yet, most of them are just backup repos of right before the purchase though

Problem is muse is not bound by the GPL because the last debaucle regarding the CLA. Muse basically got all the main developers to sign that CLA, and in that thread said they were just rewriting smaller contributions to avoid getting them to sign it.

#932

At this point a fork is the reasonable option, if muse going to be like this.

they can say that all they like, rewriting the other contributions does not remove the fact that this work is a derivative work of theirs. GPL remains with the codebase - its a feature, not a bug, and it's designed to prevent exactly this scenario.

@caughtquick
Copy link

Yep, the GPL violations is downright disgusting IMO, it's in direct violation to the code that hundreds of people have put in. Seems the best result here is that a fork of audacity comes out that doesn't have all this frankly nonsense in it. That doesn't seem to exist as of yet, most of them are just backup repos of right before the purchase though

Problem is muse is not bound by the GPL because the last debaucle regarding the CLA.

#932

At this point a fork is the reasonable option, if muse going to be like this.

I don't think that all code is yet under the CLA making this a GPL violation if enforced

I have not looked closely at the commit history, but they said in the CLA topic they were rewriting all the code from small contributions to avoid having to try and get those people sign the CLA.

Yeah but I don't think that, at this current time, is completed yet

@benrob0329
Copy link

Unfortunate, as Audacity is a big name amongst hobbyist software for being some of the best in it's class. I suppose it's not the first time major projects have undergone a "rebranding" when the parent tries to pull some corporate crap, but it's always unfortunate whenever it's needed.

@BitesizedLion
Copy link

While not directly related to the topic of Audacity's privacy policy, apparently Muse Group are comfortable blackmailing people with threats to their life: https://twitter.com/marcan42/status/1417085393762099200

Well, the new Audacity owners seem nice! /sarcasm

@Pxartist
Copy link

comment

What's the source for that image? I want to look more into this incident.

@Semisol
Copy link

Semisol commented Jul 20, 2021

comment

What's the source for that image? I want to look more into this incident.

Xmader/musescore-downloader#5 (comment),
click on the edited, then click on the second entry from the top.

@cadadr
Copy link

cadadr commented Jul 21, 2021

This issue is also relevant Xmader/musescore-downloader#130 MuseGroup seems to confirm that threats are company policy and not some rogue, over-eager employees.

@Pxartist
Copy link

Pxartist commented Jul 21, 2021

comment

What's the source for that image? I want to look more into this incident.

Xmader/musescore-downloader#5 (comment),
click on the edited, then click on the second entry from the top.

Damn. I've been using MuseScore all this time and just discovered that stuff like this was going on in the background. People should really be made more aware on how MuseGroup behaves.
Can't believe this happened an year ago and only now is this getting coverage: https://www.theregister.com/2021/07/20/muse_group_deportation_threat/

@Semisol
Copy link

Semisol commented Jul 21, 2021

Can't believe this happened an year ago and only now is this getting coverage: theregister.com/2021/07/20/muse_group_deportation_threat

Wait, that is ONE YEAR OLD??? What?!
This is actually BS

@Pxartist
Copy link

Can't believe this happened an year ago and only now is this getting coverage: theregister.com/2021/07/20/muse_group_deportation_threat

Wait, that is ONE YEAR OLD??? What?!
This is actually BS

The article is pretty new, but the github thread here: Xmader/musescore-downloader#5 was opened on February 8, 2020. The fellow who threatened him, workedintheory, is the same guy who wrote this: #1225. The original threat post has since been removed but has been archived on waybackmachine https://web.archive.org/web/*/https://github.com/Xmader/musescore-downloader/issues/5.

Like Audacity, MuseScore is also currently having discussions on having forks - Just that the fork should have occurred ages ago given how MuseGroup actually behaves behind the scenes. Who knows, there may be even more incidents, just that they weren't publicized enough. If anything, I think that this proves that MuseGroup is not an organization that should be trusted and we should've started forking the moment they announced their acquisition of Audacity.

@Semisol
Copy link

Semisol commented Jul 21, 2021

The article is pretty new, but the github thread here: Xmader/musescore-downloader#5 was opened on February 8, 2020. The fellow who threatened him, workedintheory, is the same guy who wrote this: #1225. The original threat post has since been removed but has been archived on waybackmachine web.archive.org/web/*/https://github.com/Xmader/musescore-downloader/issues/5.

Like Audacity, MuseScore is also currently having discussions on having forks - Just that the fork should have occurred ages ago given how MuseGroup actually behaves behind the scenes. Who knows, there may be even more incidents, just that they weren't publicized enough. If anything, I think that this proves that MuseGroup is not an organization that should be trusted and we should've started forking the moment they announced their acquisition of Audacity.

Yep the thread I am talking about.

@strazto
Copy link

strazto commented Jul 21, 2021

Marginally off-topic, but MustGroup is evil, and perhaps should consider not threatening people who they think may violated their license with death threats.

The good news is that at least the name "Audacity" has another layer of meaning to it

@petersampsonaudacity
Copy link

The final revised Privacy Policy was release with 3.0.3
a) the age restriction has been removed
b) no personal information is gathered
c) users can opt out
c) for folks who build Audacity (e.g. distros) networking has to be positively enabled

@DC7IA
Copy link

DC7IA commented Aug 4, 2021

b) no personal information is gathered
c) users can opt out

Please clarify. Why would I need to opt out if no personal information is gathered?

@petersampsonaudacity
Copy link

petersampsonaudacity commented Aug 4, 2021

On first launch of 3.0.3 (or later) you will get this dialog
image
If you turn that off in preferences before clicking the OK button no data at will be sent.
If you do not turn it off then your IP address is sent but not stored.

If you get database errors you may see a message like this:
image
If you click the "Don't Send" button then no data will be sent - your choice if you want to help the dev and QA team to fix the bug or not.
If you click "send" then your IP address is sent but not stored.

Both are commonplace across most apps, websites and operating systems.

@DC7IA
Copy link

DC7IA commented Aug 4, 2021

If you turn that off in preferences before clicking the OK button no data at will be sent

I'd never guess that. Not very intuitive. How about opt-in or a large button that says "opt-out" that is at least easy to spot?

@AverageHelper
Copy link

It's not the most intuitive interface, but at least the dialog, when read, is clear. Thanks for that, @AudacityTeam

@DC7IA
Copy link

DC7IA commented Aug 5, 2021

but at least the dialog, when read, is clear.

The dialog is clear, but you still don't know that you have to open the settings before clicking "OK" if you don't want to send data.

@trumad
Copy link

trumad commented Aug 5, 2021

but at least the dialog, when read, is clear.

The dialog is clear, but you still don't know that you have to open the settings before clicking "OK" if you don't want to send data.

Yeah, that's pretty sneaky.

@BenBE
Copy link

BenBE commented Aug 5, 2021

The way disabling the update check is implemented in the app update dialog is a clear anti-pattern: Just offe the user the option to "check for updates", "never check for updates" (disables data transmission) and "ask me later" (postpones the decision, does not send any data).

@SteveDaulton
Copy link
Member

Based on 14 years of user feedback, I expect that the majority of Audacity users will want update checking enabled. For those users that do NOT want update checking, there's a pop up message on first run that tells you how to disable it.
That's good enough for me.

@DC7IA
Copy link

DC7IA commented Aug 5, 2021

"check for updates", "never check for updates"

I have a package manager for a reason, don't want all my software to complain. I run dialy updates anyway.

@DC7IA
Copy link

DC7IA commented Aug 5, 2021

That's good enough for me.

"Works for me."

No, really. It's not obvious that you can open the dialog BEFORE clicking "OK", just put two buttons there.

No need for dark patterns in this software.

@SteveDaulton
Copy link
Member

No need for dark patterns in this software.

Oh for goodness sake. When did plain English become a "dark pattern"?
Don't you have something better to do. I'm out of this nonsense. Find someone else to play with.

@BitesizedLion
Copy link

That's good enough for me.

"Works for me."

No, really. It's not obvious that you can open the dialog BEFORE clicking "OK", just put two buttons there.

No need for dark patterns in this software.

How's it a dark pattern?

@DC7IA
Copy link

DC7IA commented Aug 5, 2021

How's it a dark pattern?

It tricks users into accepting something they don't want.

https://en.wikipedia.org/wiki/Dark_pattern

https://www.darkpatterns.org/

@trumad
Copy link

trumad commented Aug 5, 2021

Oh for goodness sake. When did plain English become a "dark pattern"?

This is a disingenuous statement. Small "unsubscribe" links at the bottom of emails, styled so as not to appear as a hyperlink, follows the letter of the law, but is obviously a dark pattern. Despite "unsubscribe" being right there as "plain English".

It's clear from looking at the screenshot that Audacity Team doesn't want users to turn off automatic updates, and it resorts to using a dark pattern to achieve this. Why not tell users in plain English: "Update checking is really important to Audacity. We'd prefer if you didn't turn it off", followed by 3 buttons: "check for updates", "never check for updates", "ask me later" .

@AverageHelper
Copy link

Does Audacity accept pull requests? Perhaps someone might add those buttons in themselves and fix this problem for everybody.

@BenBE
Copy link

BenBE commented Aug 5, 2021

Does Audacity accept pull requests? Perhaps someone might add those buttons in themselves and fix this problem for everybody.

Sure, as if people didn't have other things to do too, instead of fixing the fallout from people who obviously ignore every user feedback they don't like.

@SteveDaulton Why so hostile? What's so complicated to understand in "avoid dark patterns"? Especially when two people already described a solution that is easy to understand for the user AND neutral in it's implementation. Looking at how members of the Audacity org on twitter have reacted in the past months to criticism it looks like you got a bet to win how fast you can lose every last user of audacity. FWIW: I've blacklisted audacity for my systems, thus have no incentive to support this hostile and toxic environment.

Apart from this: I'll NOT sign the CLA for Audacity. And since you require this for any contributions I'm afraid you'll have to look for someone else to write the patch for this UI change.

@ghost
Copy link

ghost commented Aug 19, 2021

The email doesn't threaten the guy. Anyone here, please seek some credibility we all ought to.

@audacity audacity locked and limited conversation to collaborators Aug 19, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests