I’m curious how many folks understand that Next.js collects telemetry data (and data collection is opt-out)
How common is this in frameworks? Eleventy definitely doesn’t have anything like this.
Zach Leatherman 6060 replies 6464 likes6363 reposts Original on Mastodon60 replies
@zachleat dotnet does for their SDK and CLI too. I don't consider it to be a horrible thing. They're transparent about it and show that they take steps to make sure it's used for good.
EDIT for URL: https://learn.microsoft.com/en-us/dotnet/core/tools/telemetry
@jakecarpenter yeah, I think transparency is very important—I’m just really curious how many folks understand that it’s happening!
@zachleat it's very common among the large react frameworks iirc. It makes some sense when you have massive amounts of expensive to maintain features and you'd like to know which ones break and which ones aren't used
(I'm not sure that's what they actually use it for though so I won't make any claims there)
((Next.js is also maintained by a profit driven company who is very interested in figuring out how to extract profit from OSS and dev tooling, so...))
@zachleat seems rare and unfortunate to me 😬
@zachleat Fucking hell, are you kidding me?
Wow.
(Why am I surprised? I wrote Auto Encrypt – https://codeberg.org/small-tech/auto-encrypt – because the main Let’s Encrypt library out there for Node.js was doing the same thing.)
*smh*
@lazurski @zachleat As far as the library I was mentioning goes, it was collecting information from everyone who used it. Regarding Vercel’s case: it still normalises surveillance and, more so, in free/open code. Companies get bought, privacy policies are updated.
Also, opt-out is what you do when you don’t respect someone’s privacy. Opt-out says “hi, I’m doing something you might not want. If you want me to stop…”
@janvenetor @lazurski @zachleat Well, we are talking about Big Tech / surveillance capitalism here so, of course, it makes sense that it’s par for the course.
Collecting users (i.e. 3rd party) data is an absolute no-go and IMO should be criminal. But after reading the link from Aral I fail to see much of a problem with the Next.js telemetry. Assuming they are honest about the scope of collected data, it doesn't seem too sensitive. I might be missing something though.
@lazurski @aral @zachleat It's very bad if it comes as a surprise after the fact.
EU GDPR and at least in my understanding e.g. in California, the scope of personally identifiable data collection should be clear when installing, the collection needs to be opt-in, user acceptance needs to be recorded, and be revokable etc...
@janvenetor @aral @zachleat yes, I guess Next.js should at least notify the user (in this case the developer) about their telemetry so we could opt-out. If we have to discover it on their website, it's not nice. Not that I use it anyway 👅
@lazurski @aral @janvenetor @zachleat
"Assuming they are honest" - that is the issue here. I've been burnt enough times that trust has to be earned and not assumed now.
@aral by your reaction I’m guessing you did not know about this 😅
@zachleat What gave it away? :P
(I mean, I wasn’t using it or anything and I know I shouldn’t be surprised given this is Big Tech/surveillance capitalism we’re talking about but, hey…)
@zachleat not for nothing and solely between you and me and no one else since this is totally a closed channel, making an opt-in otel plugin for eleventy is on my 2023 project list.
@papayaga I… can’t tell if you’re joking 😅
@zachleat joking, not really. misspeaking? most likely. as in, "plugin" may be inaccurate?
i slowed my site's build process from 2-3s to 2-3min last month and didn't know how/why. i've also gotten really into grafana in my homelab setup. thought if i could see in grafana by way of otel which network requests were dragging, i could debug future slowdowns.
to me, this is not the same as nextjs' foolishness.
@papayaga just making sure you know about https://www.11ty.dev/docs/debug-performance/ !
@zachleat Nuxt also has telemetry but it's opt-in https://nuxtjs.org/docs/configuration-glossary/configuration-telemetry/
@climatepenguin That’s good to know! Cheers for opt-in!
@zachleat we collect telemetry for ember-cli and have for ~7yrs. It’s never proved all that useful/probably we should remove it or deactivate by default.
@runspired wow! I’d love to read some longer opinions on this (at personal risk of asking you to write a blog post 😅)
@zachleat probably Stef Penner is the person to do so. Might nag him 😅
@zachleat Big "need to show number go up in board meeting/marketing-event" energy.
@slightlyoff @zachleat agree, but going up and to the right helps convince some people a project is worth paying attention to / caring about / investing in / adopting
IMO projects shouldn’t collect telemetry like this, but I can see how they’ve justified it
@zachleat can't say that I've ever seen that come up in glancing through the Next docs which is (IMO) a problem. If you're going to collect telemetry data on your tool it should be opt-in and very apparent upfront (that does not mean having to check the logs).
I see from the replies that Nuxt and Ember each collect data (though with different presets). Has anyone checked about Angular though? They would be the other big framework of interest.
@zachleat I just read their guide and terms for the telemetry and it sounds decent enough. It would just be better if it was opt-in.
@bastianallgeier @getkirby oof, good question.
@bastianallgeier @getkirby ah, yes—good distinction.
-
@Marco @zachleat I wonder how different perception is between the US and the EU. GDPR and especially the German version is often so strict that you can seriously get in trouble as a company if you don’t get it right. Even if we would want to collect data this way (we don’t) we’d have to get extensive legal advice to be half-safe. We are pretty conditioned by this already and it feels super risky from this perspective.
@bastianallgeier @Marco @zachleat The GDPR is quite clear on what data and how it applies, and fully anonymous data with no way to back track a specific user is no problem. So as long this telemetry is not collecting full IP addresses or more specific personal data, that can be connected to an individual, that is usually never a GDPR problem at least. That would be quite something new to me.
-
@bastianallgeier @zachleat @getkirby However it could affect GDPR compliance if used in a company. GDPR also protects the privacy of employees.
And in an enterprise environment it could be in conflict with internal compliance.
to follow up, I did go through the Create a Next.js app tutorial https://nextjs.org/learn/basics/create-nextjs-app and it does collect telemetry by default without mention of data collection via the command line or otherwise.
@zachleat It’s included in the next build output, since iirc that’s when they’re submitting the data about the features your app is using. Gatsby does this too, with a notice on installation: https://www.gatsbyjs.com/docs/telemetry/
@zachleat Don’t Ask Don’t Telemetry
@zachleat I absolutely didn't know that Next.js collected telemetry data before I read this post. Thanks for the heads up!
@zachleat there has been some effort to make a cli do not track flag ... But none of them want to commit
@oiyouyeahyou I like that!
@zachleat when I blogged about it way back in the day I had a toonnn of DMs etc about people not knowing this
https://dev.to/netlify/how-to-turn-off-telemetry-in-next-js-17bc
@cassidoo oof yeah, I’m seeing a lot of surprise here too
@zachleat I thought Next.js was a JavaScript framework, not a... panopticon??
@heydon google fonts is a panoptifonticon
*hides*
@heydon I wish I had said panopticonfont instead
@zachleat @heydon I think panoptifonticon has a good memetic ring to it. I can’t quite put my finger on what meme it might be reminding me of. The closest I can think is Dr. Octogonapus (AAAAAHHH), which isn’t quite right. But regardless, the pattern of the sounds feels pleasingly right somehow.
Though panopticonfont is also quite excellent. Spoiled for choice tbh.
@zachleat @heydon This reminds me - keep meaning to ask - is there a really good guide anywhere for self hosting fonts? Particularly interested in the way GF handles variable fonts; i.e., specify the weights one needs and download those instead of whole variable font (which can be huge).
p.s., I looked at Bunny Fonts as alternative to GF, but it uses older API. https://bunny.net/fonts/
Just found this by @elliotjaystocks which looks like just the ticket. Key is to download selection directly from Google Fonts.
https://fonts.google.com/knowledge/using_type/self_hosting_web_fonts
@zachleat @heydon @elliotjaystocks
Actually, I was wrong. I thought the download from Google Fonts would include the precise variable weights I have selected, but the download package includes just the standard weights and the variable files.
Is there a way of downloading static versions of the weights I specify; e.g. in my case today, Alegreya 450?
Is there's a way of exporting a static weight from a variable file locally? Thinking I might have to use something like fontTools in Python?
@zachleat @heydon @elliotjaystocks
Or perhaps better to just include the variable font? In the case of Alegreya, it's 412k for regular and 408k for italic. Nearly a MB. But each static file is ~260k. Yikes.
