www-legal-discuss mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Alex Harui <aha...@adobe.com.INVALID>
Subject Re: What kind of metrics / telemetry is an Apache project allowed to record?
Date Wed, 01 Nov 2017 21:04:49 GMT
The installer uses Adobe AIR.  The Flash usage on that web page is a way of launching an Adobe
AIR app.  It isn't required.  The direct links to the installer were further down on that
page.


  *   Mac OS X Convenience Binary : apache-flex-sdk-installer-3.2.0-bin.dmg<http://www.apache.org/dyn/closer.lua/flex/installer/3.2/binaries/apache-flex-sdk-installer-3.2.0-bin.dmg>
[PGP<https://dist.apache.org/repos/dist/release/flex/installer/3.2/binaries/apache-flex-sdk-installer-3.2.0-bin.dmg.asc>]
[MD5<https://dist.apache.org/repos/dist/release/flex/installer/3.2/binaries/apache-flex-sdk-installer-3.2.0-bin.dmg.md5>]
  *   Windows Convenience Binary : apache-flex-sdk-installer-3.2.0-bin.exe<http://www.apache.org/dyn/closer.lua/flex/installer/3.2/binaries/apache-flex-sdk-installer-3.2.0-bin.exe>
[PGP<https://dist.apache.org/repos/dist/release/flex/installer/3.2/binaries/apache-flex-sdk-installer-3.2.0-bin.exe.asc>]
[MD5<https://dist.apache.org/repos/dist/release/flex/installer/3.2/binaries/apache-flex-sdk-installer-3.2.0-bin.exe.md5>]

Regardless, the idea is that if you can provide some sort of utility to help folks download
and setup your releases, then you have an opportunity to run code that collects data.  And
that seems to be ok as far as we and our mentors understood it back when we first did this
as a podling.

HTH,
-Alex

From: Ted Dunning <ted.dunning@gmail.com<mailto:ted.dunning@gmail.com>>
Reply-To: "legal-discuss@apache.org<mailto:legal-discuss@apache.org>" <legal-discuss@apache.org<mailto:legal-discuss@apache.org>>
Date: Wednesday, November 1, 2017 at 1:50 PM
To: "legal-discuss@apache.org<mailto:legal-discuss@apache.org>" <legal-discuss@apache.org<mailto:legal-discuss@apache.org>>
Subject: Re: What kind of metrics / telemetry is an Apache project allowed to record?

This installer appears to require Adobe flash. A large fraction of people disable flash as
a simple matter of course.

If that limitation does meet your requirements, you may have some issues.

I also have some issue with the assumption that users are clear that the "installer" is party
of the web site. My suggestion would be to explicitly call out the installer both in the privacy
policy and the link to the privacy policy. As in "we collect data about the use of this web
site and the flex installer as described in our privacy policy".



On Oct 31, 2017 2:59 PM, "Alex Harui" <aharui@adobe.com.invalid<mailto:aharui@adobe.com.invalid>>
wrote:
Apache Flex uses Google Analytics.  We worked with the mentors to get
disclaimers in the right place.
Apache Flex also has an installation program to assist users in installing
our releases.  Folks who use it are also warned that the Installer will
hit a URL tracked by GA when the install fails or succeeds.  It gives us
some idea of who is using our product, but doesn't catch anyone who just
grabs the bits off the mirrors.  Again the mentors helped us get the right
disclaimers in the right places.

FWIW, the Apache Flex Installation program can be easily repurposed by
other projects.  It basically runs a subset of Apache Ant in a graphical
UI.  You setup an XML file of releases that contain an xml file of Ant
commands that move files into place and then it hits a URL when done.  It
only works on Mac and Windows though.  Our few Linux users use the same
Ant script to install but don't hit a URL.  But such a thing might be
allowable.

HTH,
-Alex

On 10/31/17, 11:27 AM, "Konstantin Boudnik" <cos@apache.org<mailto:cos@apache.org>>
wrote:

>We are in a very similar situation with Apache Ignite, where we'd like
>to track the usage stats of the project. But we really don't want
>anything fancy, but to know the number of the installations and their
>geo-spread. Incidentally, we don't even want to keep the info once the
>stats were derived and clearly aren't interested in users IP address
>beyond the general vicinity of it (e.g. UK, Russia, US, and so on).
>
>IANAL, but recording OS info or plugins might require an explicit
>consent of the users. You might find [1] to be useful for the
>background information.
>--
>  With regards,
>Konstantin (Cos) Boudnik
>2CAC 8312 4870 D885 8616  6115 220F 6980 1F27 E622
>
>Disclaimer: Opinions expressed in this email are those of the author,
>and do not necessarily represent the views of any company the author
>might be affiliated with at the moment of writing.
>
>
>On Mon, Oct 30, 2017 at 2:56 PM, Emilian Bold <emilian.bold@gmail.com<mailto:emilian.bold@gmail.com>>
>wrote:
>> Hello,
>>
>> We have very little metrics from ASF for Apache JMeter and the best
>> source seems to be a 3rd party site that has a popular plugin portal
>> and records more information.
>>
>> This is a pretty sad state of affairs:
>>
>> * downloads are not counted very accurately. I discovered there are
>> some text logs on
>>https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww-us.ap
>>ache.org<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fache.org&data=02%7C01%7C%7Cde7b223cf2c44d761b8108d5216a2588%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C636451662140981443&sdata=cjfeSuaV4LgUx4oJUobv%2BFF9G3%2Bg5Z5jp%2FhnJtTcdzo%3D&reserved=0>%2Fdyn%2Fstats%2F&data=02%7C01%7C%7C2f3fbb2a870e4fb01f7108d5208d1
>>712%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C636450712715729336&sdata
>>=vyzVBc03mnuLwQHWlaQjZQR2Dxziaez%2BnI9yVlzldFQ%3D&reserved=0 but these
>>are
>> very approximate and the mirrors send no logs back to Apache for
>> centralisation or such.
>>
>> * website logs are on-demand only. I see the ASF does use Google
>> Analytics as per
>>
>>https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.apac
>>he.org<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhe.org&data=02%7C01%7C%7Cde7b223cf2c44d761b8108d5216a2588%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C636451662140981443&sdata=ngDaRffhcgXYFHC8naQnm4f%2FYPm0PVl3eRdT2RC9XM4%3D&reserved=0>%2Ffoundation%2Fpolicies%2Fprivacy.html&data=02%7C01%7C%7C2f3fbb2a8
>>70e4fb01f7108d5208d1712%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C6364
>>50712715729336&sdata=4M%2FHlnH9ujWeNOdVA4O%2FrDawh0w50A6QTCUYOlYxdo0%3D&r
>>eserved=0 but individual
>> projects don't (can't?) so we only have server logs(?)
>>
>> It would be interesting to
>>
>> * record version information, operating system, popular plugins
>>ourselves
>>
>> * allow users to send an error "to us" when it happens (error
>>reporting).
>>
>> So, what kind of privacy policy must we follow for such a feature and
>> how can INFRA help us with a server to receive these messages?
>>
>> Having more info about the current state and the trend of our user
>> base would allow some better planning since everybody is
>> time-constrained.
>>
>> Having this info under our control would allow us to actually follow a
>> given privacy policy instead of relying on a 3rd party site that does
>> not even *have* a privacy policy.
>>
>> Some of these questions apply to Apache NetBeans too, as we have a
>> very nice error reporting mechanism there with a custom server backend
>> for detecting duplicates, statistics and such.
>>
>> --emi
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org<mailto:legal-discuss-unsubscribe@apache.org>
>> For additional commands, e-mail: legal-discuss-help@apache.org<mailto:legal-discuss-help@apache.org>
>>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org<mailto:legal-discuss-unsubscribe@apache.org>
>For additional commands, e-mail: legal-discuss-help@apache.org<mailto:legal-discuss-help@apache.org>
>

Mime
View raw message