Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: legal-discuss@apache.org
MIME-Version: 1.0
In-Reply-To: 
 <CAGc_3jHaDNyxvQ5x4Aa8jSQ0pgtFMwcD=cw=zFO4Xbwf0pHQfA@mail.gmail.com>
References: 
 <CAGc_3jHaDNyxvQ5x4Aa8jSQ0pgtFMwcD=cw=zFO4Xbwf0pHQfA@mail.gmail.com>
Date: Wed, 12 Jun 2013 13:52:42 -0400
Message-ID: 
 <CAP-ksohBFnrnvADW=4WLvS-17QPXho3hVPV6i4sY7N1=aKHnZg@mail.gmail.com>
Subject: Re: Error collecting infrastructure for Openmeetings
From: Rob Weir <robweir@apache.org>
To: legal-discuss@apache.org
Cc: dev <dev@openmeetings.apache.org>,
	ASF Infrastructure <infrastructure@apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Thu, Jun 6, 2013 at 5:30 AM, Alexei Fedotov <alexei.fedotov@gmail.com> w=
rote:
> Hello, Infra and Legal folks,
>
> We ask you for advice on the automated error collection
> infrastructure. Any helpful ideas are appreciated.
>

A perspective from someone who has set up and used Google Analytics on
an Apache project website and researched some of the issues.

> 1. Our users are tainted with iphones and other reliable and fancy
> staff. They start wanting openmeetings to work reliably. This makes us
> think of a global error collecting infrastructure to plan important
> bug fixes. Here is an example by Firefox [1].
>
> We believe collecting user errors is generally ok if proper
> preparations are made. Is it generally possible to implement error
> collecting infrastructure as a part of Apache project? If not, we can
> try to do it as a commercial company, yet Firefox example shows a
> non-commercial org can be behind that error collection.
>
> 2. Could we use Google Analytics to store collected errors? The
> general Apache practice is to use Apache infrastructure. Google
> Analytics allows us storing 50 mln. events for free. The comparable
> thing won't be free for Apache for sure.
>
> Once can use JIRA, or Confluence via API, this will be a heavy load.
> Are you ok with using third party for storing error & environment
> messages and associated risks?
>

If the weight of the tracking infrastructure is a concern, have you
thought of using an open source web analytics tool like Piwik? Would
that give you what you need?

http://piwik.org/


> The code we are talking about is below:
>        try {
>                _gaq =3D _gaq || [];
>                _gaq.push(['_setAccount', 'UA-13024987-1']); // PMC id
>                _gaq.push(['_trackPageview']);
>                _gaq.push(['_trackEvent', 'Openmeetings client error',
> message, '', 0, true]);
>        } catch (exception) {
>                alert(exception);
>        }
>

You should be aware of two legal/regulatory concerns:

1) Read the terms of service for Google Analytics carefully.  You
will, for example, be required to disclose its use in a posted privacy
policy.

2) There have been some concerns raised in Germany about the IP
address storage that Google Analytics, and whether that contravenes
local data privacy laws.  I have no opinion on whether this concern is
legitimate, but it does exist.  Google has added an API to help
anonymize the IP and you might want to add that to your code, if your
community and users share this concern:

https://developers.google.com/analytics/devguides/collection/gajs/methods/g=
aJSApi_gat#_gat._anonymizeIp

> 3. Is it ok for PMC to share Google Analytics id? Should we use some
> Apache Id instead?
>

Two things:  the ID, which is just a string, and the password to the
Google Analytics account that gives you access to the results of the
tracking.  I don't see any problems with the ID.  That is public
information, and anyone can see it in the code.  It is not a secret.
But for access to the reports Google does allow you to assign access
to multiple users, at various control levels.  What we did with
OpenOffice is give access to interested PMC members.


Regards,

-Rob

> 4. Which preparations should be done to start this error collection
> service in the next release?
>
> 4.1. Is it ok just to semi-silently mention in release notes, that
> errors are automatically sent to the (Google) server right now?
> 4.2. Or should we explicitly notify each new user that the errors are
> now to be collected?
> 4.3. If 4.2. holds, can we ask once per user at the beginning of his
> session and remember if he agreed sharing error reports? Or should we
> allow a user to review each error report each time the error is sent
> (I expect 5-10 errors per standard openmeetings session)? Can we have
> a checkbox "Remember my choice" or a button "Send error reports
> always" for those, who are tied of error messages?
>
> [1] https://crash-stats.mozilla.com/report/index/050f1aab-1507-4c8f-a166-=
9b3322130422
>
> --
> With best regards / =D1=81 =D0=BD=D0=B0=D0=B8=D0=BB=D1=83=D1=87=D1=88=D0=
=B8=D0=BC=D0=B8 =D0=BF=D0=BE=D0=B6=D0=B5=D0=BB=D0=B0=D0=BD=D0=B8=D1=8F=D0=
=BC=D0=B8,
> Alexei Fedotov / =D0=90=D0=BB=D0=B5=D0=BA=D1=81=D0=B5=D0=B9 =D0=A4=D0=B5=
=D0=B4=D0=BE=D1=82=D0=BE=D0=B2,
> http://dataved.ru/
> +7 916 562 8095
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
> For additional commands, e-mail: legal-discuss-help@apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org