[mistrial9]

what is the constant phone-home activity on that opaque container they send as SourceGraph.. It is occassionally the case that devs have too-fast machines, so their code isn't seen on ordinary equipment. With SourceGraph and other inner-network-devs tools, the amount of chatty traffic and build dependancies seems seriously off-putting, trending to useless with ordinary network.

[voz_]

This seems like a bad attitude. Perhaps you could constructively ask for a sourcegraph-lite that does less, in return for less deps / networking complexity?

[slimsag]

I am a dev at Sourcegraph, I'd be very open to any feedback.

You can firewall off Sourcegraph 100% for complete confidence, and aside from the first admin's email address (so we can notify them of any security updates) we only send back aggregated anonymous usage statistics which we are extremely transparent about: https://docs.sourcegraph.com/admin/pings

We sell developer tools, not user data.

[jsjddbbwj]

Maybe the problem is that to disable telemetry you have to contact support and pray they like you, instead of giving a configuration option.

[slimsag]

Ah, yeah, that's fair. I'll forward this feedback onto the team.

The option is documented in our config docs, though, and also appears in the config editor's autocomplete in the app if you type `telemetry`, though, so it's not really a secret https://docs.sourcegraph.com/admin/config/site_config#disabl...

[prepend]

The property is “disableNonCriticalTelemetry“ [0] that seems curiously named to me.

What kind of telemetry is critical? How do I disable that?

[0] https://docs.sourcegraph.com/admin/config/site_config#disabl...

[emidoots]

You are 100% correct, I really messed up here by suggesting that option. I misread our own docs. It would only disable event counts from being sent (e.g. instead of "how many jump-to-definitions were performed in a day?" we would just send a boolean "did one or more jump-to-definition occur in a day?" based on my reading of the code[1]) -- not what I thought it did. Will send a PR to clarify the docs on this so I don't mess up like this again..

I'm human and screw up, frequently; this instance just happened to be on the ridiculously important topic of privacy -- hopefully you will forgive me for that, I wasn't trying to be malicious but certainly in retrospect I can see this being interpreted as such.. :/

The right option to turn it all off is just this one, since we only send ping data as part of the version update check you disable that and it's all off. And you can confirm this in the code as I just did here[2][3]: https://docs.sourcegraph.com/admin/config/site_config#update... And as I mentioned previously you can always firewall off Sourcegraph 100%.

As an aside, I can promise you that I wouldn't have continued to work at Sourcegraph for the last 5 years if I thought our business was selling or collecting identifiable user data in ANY form. We only collect just enough information to help prioritize what features we improve and (aside from the first admin's email as I noted already above) it is all 100% anonymous and aggregated numbers that we are extremely transparent about[4]. Our person running analytics is also constantly trying to make this more transparent[5] because we all are very security and privacy aware and know the #1 way to convince people to not run software is to make them think you are spying on them or using their data in ways they would not want.

It's obvious to me this should be more clear in our docs, I'm going to forward all of this conversation onto the rest of our team to make sure we improve our docs here.

[1] https://sourcegraph.com/search?q=repo:%5Egithub%5C.com/sourc...

[2] https://sourcegraph.com/github.com/sourcegraph/sourcegraph@f...

[3] https://sourcegraph.com/github.com/sourcegraph/sourcegraph@f...

[4] https://docs.sourcegraph.com/admin/pings

[5] https://github.com/sourcegraph/sourcegraph/pull/8930#issueco...