cabal user-config update silently enables remote-build-reporting

Created on 27 Aug 2019 · 6Comments · Source: haskell/cabal

As suggested in #5973 I am doing cabal user-config update.
This silently adds a line remote-build-reporting: anonymous to the config file (while
the default setting is none).

This is with

cabal-install version 3.0.0.0
compiled using version 3.0.0.0 of the Cabal library

Source

jwaldmann

Most helpful comment

To clarify: It's irrelevant how long the anonymous default was there. Time have gone past it, we care about our privacy.

phadej on 27 Aug 2019

👍2

All 6 comments

I tried with cabal 1.16 (the oldest version I had locally) to see what the default generated ~/.cabal/config would look like (by invoking it for an empty new user account), and as I suspect it contained

-- build-log:
remote-build-reporting: anonymous
-- one-shot: False

Consequently, the default setting for the ~/.cabal/config file has been this way at least since cabal-install 1.16

hvr on 27 Aug 2019

I think in Europe something like that should require explicit consent nowadays. So better to have remote-building-reporting off by default. Espcially, as I'm quite sure that the data isn't used for anything.

phadej on 27 Aug 2019

👍1

To clarify: It's irrelevant how long the anonymous default was there. Time have gone past it, we care about our privacy.

phadej on 27 Aug 2019

👍2

Yes. If user-config update asked me to enable reporting (and explains what data is used by whom) I might allow it.

remote-build-reporting is not mentioned in the docs? (try https://www.haskell.org/cabal/users-guide/search.html?q=reporting&check_keywords=yes&area=default )

Also, I am a bit confused: anonymous is defined as the default value here? https://github.com/haskell/cabal/blob/7650ce94c4d2b0918f1efa9e7de322a55c57811e/cabal-install/Distribution/Client/Config.hs#L572 But in the auto-generated config file, the line is remote-build-reporting: anonymous, not -- remote-build-reporting: anonymous, so I thought that the value shown is not the default.

jwaldmann on 28 Aug 2019

I think this flag was added optimistically and isn't actually set to do anything at the moment? If we actually add a feature to go with it, we'll need to probably make the opt-in genuinely explicit, even though this flag was auto-set for people.