eh updates

blog.org

@@ -4,6 +4,282 @@
 
 * Meta                                                                :@Meta:
 * Technology                                                    :@Technology:
+** TODO Audacity and the telemetry pull request
+:PROPERTIES:
+:EXPORT_FILE_NAME: audacity-and-the-telemetry-pull-request
+:EXPORT_HUGO_CUSTOM_FRONT_MATTER: :toc true
+:END:
+
+Five days ago at the time of writing, [[https://github.com/crsib][Dmitry Vedenko]] opened a Pull
+Request (PR) in [[https://github.com/audacity/audacity/pull/835][Audacity's GitHub repository]] entitled [[https://github.com/audacity/audacity/pull/835][/Basic telemetry
+for the Audacity/.]] About two days later, all hell broke loose. That PR
+now has over 3.3 thousand downvotes and more than one thousand comments
+from nearly 400 individuals. I started reading the posts shortly after
+they began and kept up with them over the following days, reading every
+single new post. I recognise that few people are going to feel like
+wading through over 1k comments so this is my attempt to provide a
+summary of the PR itself using the community's code reviews along with a
+summary of the various opinions conveyed in the comments.
+
+When I reference comments, I'll provide a footnote that includes a link
+to the comment and a link to a screenshot just in case it's removed or
+edited in the future.
+
+*** Audacity's acquisition
+
+I haven't been able to find /much/ information in this area so forgive me
+if I'm scant on details.
+
+On 30 April, a company called [[https://mu.se/][Muse Group]] acquired [[https://www.audacityteam.org/][Audacity]]. According to
+[[https://mu.se][their website]], Muse is the parent company behind many musical
+applications and tools. It was founded by Eugeny Naidenov just days
+before it acquired Audacity. Before all of this, Eugeny Naidenov founded
+[[https://www.ultimate-guitar.com/][Ultimate Guitar]] (UG) in 1998. The service grew rather quickly and now
+has over 300 million users. UG acquired [[https://deanzelinsky.com/][Dean Zelinsky Guitars]] in 2012,
+[[http://agilepartners.com/][Agile Partners]] in 2013, [[https://musescore.org/][MuseScore]] in 2017, and [[http://trycrescendo.com/][Crescendo]] in 2018. Muse
+Group was established in 2021 and it seems as if all of the services UG
+acquired were (or will be) transferred to Muse Group, as well as UG
+itself. Immediately following its establishment, Muse not only acquired
+Audacity but also [[https://www.staffpad.net/][StaffPad]].
+
+I say 30 April because that's when Muse published their [[https://mu.se/newsroom/tpost/6dhedma301-muse-group-acquires-audacity-expanding-c][press release]]
+and when Martin Keary (Tantacrul) published a video entitled [[https://www.youtube.com/watch?v=RMWNvwLiXIQ][/I’m now in
+charge of Audacity. Seriously./]] According to his comment,[fn:17] Martin
+will help with proposing Audacity's roadmap and many of its future
+features as well as working with the community. This has been his role
+with MuseScore since he joined that project and he will be continuing it
+here.
+
+~-----BEGIN PERSONAL OPINION-----~
+
+Looking at [[https://www.martinkeary.com/][his website,]] I also suspect he will play a large role in
+redesigning Audacity's interface. Considering that he was instrumental
+in designing [[https://www.martinkeary.com/#/ubuntu-touch-os/][the best mobile interface I've ever had the absolute
+pleasure of experiencing,]] I have high hopes that this is the case.
+
+~------END PERSONAL OPINION------~
+
+*** Telemetry implementation
+**** Implementation Basics
+
+A few days after the acquisition, a PR was opened that adds /Basic
+telemetry for the Audacity/. This implementation collects "application
+opened" events and sends those to Yandex to estimate the number of
+Audacity users. It also collects session start and end events, errors
+for debugging, file used for import and export, OS and Audacity
+versions, and the use of effects, generators, and analysis tools so they
+can prioritise future improvements. Sending this data would be optional
+and the user would be presented with a dialogue the first time they
+launch the application after installation or after they update to the
+including release. This description was mostly copied directly from [[https://github.com/audacity/audacity/pull/835#issue-629891447][the
+PR description itself.]]
+
+**** Frontend Implementation
+This is fairly straightforward and a pretty standard UI for prompting
+users to consent to analytics and crash logging. This section is
+included because the community has strong opinions regarding the
+language used and its design, but that will be discussed later. The
+screenshot below is copied directly from the PR.
+
+[[/assets/pngs/audacity-pr/consentdialogue.png]]
+
+**** Backend Implementation
+Many of the code reviews include the reviewer's personal opinion so I
+will summarise the comment, provide the code block in question, and link
+directly to the comment in a footnote.[fn:9]
+
+#+BEGIN_SRC c
+  if (!inputFile.Write (wxString::FromUTF8 (ClientID + "\n")))
+    return false;
+#+END_SRC
+[[https://github.com/crsib/audacity/blob/c9264d2478fe2af82aeb6e2a0295b00b3a27ce53/libraries/lib-telemetry/TelemetryManager.cpp#L199-L200][Lines 199-200 of TelemetryManager.cpp]] save the user's unique client ID
+to a file.[fn:8] This allows the analytics tool (in this case, Google
+Analytics) to aggregate data produced by a single user.
+
+#+BEGIN_SRC c
+  def_vars()
+
+    set( CURL_DIR "${_INTDIR}/libcurl" )
+    set( CURL_TAG "curl-7_76_0")
+#+END_SRC
+[[https://github.com/crsib/audacity/blob/c9264d2478fe2af82aeb6e2a0295b00b3a27ce53/cmake-proxies/libcurl/CMakeLists.txt#L3-L6][Lines 3-6 of CMakeLists.txt]] "vendor in" libcurl.[fn:10] This is when an
+application directly includes sources for a utility rather than making
+use utilities provided by the system itself.
+
+#+BEGIN_SRC c
+  ExternalProject_Add(curl
+     PREFIX "${CURL_DIR}"
+     INSTALL_DIR "${CURL_DIR}"
+     GIT_REPOSITORY https://github.com/curl/curl
+     GIT_TAG ${CURL_TAG}
+     GIT_SHALLOW Yes
+     CMAKE_CACHE_ARGS ${CURL_CMAKE_ARGS}
+  )
+#+END_SRC
+[[https://github.com/crsib/audacity/blob/c9264d2478fe2af82aeb6e2a0295b00b3a27ce53/cmake-proxies/libcurl/CMakeLists.txt#L29-L36][Lines 29-36 of CMakeLists.txt]] add curl as a remote dependency.[fn:11]
+This means that the machine building Audacity from its source code has
+to download curl during that build.
+
+#+BEGIN_SRC c
+  S.Id (wxID_NO).AddButton (rejectButtonTitle);
+  S.Id (wxID_YES).AddButton (acceptButtonTitle)->SetDefault ();
+#+END_SRC
+[[https://github.com/crsib/audacity/blob/c9264d2478fe2af82aeb6e2a0295b00b3a27ce53/src/telemetry/TelemetryDialog.cpp#L93-L94][Lines 93-94 of TelemetryDialog.cpp]] add buttons to the dialogue asking
+the user whether they consent to data collection.[fn:12] ~SetDefault~
+focuses the button indicating that the user does consent. This means
+that if the user doesn't really look at the dialogue and presses
+Spacebar or Enter, or if they do so accidentally by simply bumping the
+key, they unintentionally consent to data collection. If the user
+desires, this can later be changed in the settings menu. However, if
+they weren't aware what they were consenting to /or that they did
+consent/, they won't know to go back and opt out.
+
+There are other problems with the code that include [[https://github.com/audacity/audacity/pull/835#discussion_r628816050][simple mistakes,]]
+[[https://github.https://github.com/audacity/audacity/pull/835#discussion_r628774985][styling that's inconsistent with the rest of the project,]] [[https://github.com/audacity/audacity/pull/835#discussion_r628500849][unhandled
+return values resulting in skewed data,]] [[https://github.com/audacity/audacity/pull/835#discussion_r628792423][use of inappropriate functions,]]
+and [[https://github.com/audacity/audacity/pull/835#discussion_r628818054][spelling errors in the comments.]] I believe these are less important
+that those above so they won't be discussed.
+
+*** Community opinions
+There were many strong opinions regarding both the frontend and backend
+implementations of this PR, from the wording of the dialogue and
+highlighting the consent button to devices running something other than
+Windows and macOS not being able to send telemetry and thus skewing the
+data that /was/ collected.
+
+**** Opinions on the frontend
+
+Really, the only frontend here is the consent dialogue. However, there
+are /many/ comments about it, the most common of which is probably that
+the wording is not only too vague[fn:13] but also inaccurate[fn:14]. The
+assertion that Google Analytics are not anonymous and any data sent can
+be trivially de-anonymised (or de-pseudonymised) is repeated many times
+over. Below are a few links to comments stating such. I searched for the
+term /"anonymous"/, copied relevant links, and stopped when my scrollbar
+reached halfway down the page.
+
+- [[https://github.com/audacity/audacity/pull/835#discussion_r628156527][r628156527]]
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-833969780][833969780]]
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-833969933][833969933]]
+- [[https://github.com/audacity/audacity/pull/835#discussion_r627995927][r627995927]]
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-834358022][834358022]]
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-834377549][834377549]]
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-834382007][834382007]]
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-834385463][834385463]]
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-834405825][834405825]]
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-834531779][834531779]]
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-834546874][834546874]]
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-834638000][834638000]]
+
+The next most pervasive comment is regarding the consent buttons at the
+bottom of the dialogue where users opt in or out.[fn:15] Many individuals call
+this design a /dark pattern/. Harry Brignull, a UX specialist focusing on
+deceptive interface practises, describes dark patterns as [[https://www.darkpatterns.org/][/tricks used
+in websites and apps that make you do things that you didn't mean to/.]]
+The dark pattern in this situation is the opt-in button being
+highlighted. Many community members assert that users will see the big
+blue button and click it without actually reading the dialogue's
+contents. They just want to record their audio and this window is a
+distraction that prevents them from doing so; it needs to get out of the
+way and the quickest way to dismiss it is clicking that blue button.
+Below is a list of some comments criticising this design.
+
+  - [[https://github.com/audacity/audacity/pull/835#issuecomment-834286641][834286641]]
+  - [[https://github.com/audacity/audacity/pull/835#issuecomment-834358022][834358022]]
+  - [[https://github.com/audacity/audacity/pull/835#issuecomment-834399813][834399813]]
+  - [[https://github.com/audacity/audacity/pull/835#issuecomment-834479968][834479968]]
+  - [[https://github.com/audacity/audacity/pull/835#issuecomment-835250737][835250737]]
+  - [[https://github.com/audacity/audacity/pull/835#issuecomment-835253882][835253882]]
+  - [[https://github.com/audacity/audacity/pull/835#issuecomment-835291066][835291066]]
+  - [[https://github.com/audacity/audacity/pull/835#issuecomment-835445481][835445481]]
+
+Another issue that was brought up by a couple of individuals was the
+lack of a privacy policy.[fn:16] The consent dialogue links to one, but, at the
+time of writing, one does not exist at [[https://www.audacityteam.org/contact/privacy-policy/][the provided URL.]] I have [[https://web.archive.org/web/20210510012924/https://www.audacityteam.org/contact/privacy-policy/][archived
+the state of the page]] in case that changes in the future.
+
+**** Opinions on the backend
+
+#+BEGIN_SRC c
+  if (!inputFile.Write (wxString::FromUTF8 (ClientID + "\n")))
+    return false;
+#+END_SRC
+
+The issue many individuals take with this snippet is saving the
+~ClientID~. Say an individual has an odd file that causes Audacity to
+crash any time they try to open it. Say they attempt to open it a
+hundred times. Without giving the client a unique ID, it could look like
+there are 100 people having an issue opening a file instead of just the
+one. However, by virtue of each installation having an entirely unique
+ID, this telemetry /is not anonymous/. Anonymity would be sending
+statistics in such a way that connecting those failed attempts to a
+single user would be impossible. At best, this implementation is
+/pseudonymous/ because the client is given a random ID, you don't have to
+sign in with an account or something.
+
+#+BEGIN_SRC c
+  def_vars()
+
+    set( CURL_DIR "${_INTDIR}/libcurl" )
+    set( CURL_TAG "curl-7_76_0")
+#+END_SRC
+
+Timothe Litt's comment gives a good description of why "vendoring in"
+libcurl is a bad idea[fn:19] and Tyler True's comment gives a good
+overview of the pros and cons of doing so.[fn:18] Many people take issue
+with this /specifically/ because it's libcurl. Security flaws in it are
+/very/ common and Audacity's copy would need to be /manually/ kept up to
+date with every upstream release to ensure none of its vulnerabilities
+can be leveraged to compromise users. If the Audacity team was going to
+stay on top of all of the security fixes, they would need to release a
+new version every week or so.
+
+#+BEGIN_SRC c
+  ExternalProject_Add(curl
+     PREFIX "${CURL_DIR}"
+     INSTALL_DIR "${CURL_DIR}"
+     GIT_REPOSITORY https://github.com/curl/curl
+     GIT_TAG ${CURL_TAG}
+     GIT_SHALLOW Yes
+     CMAKE_CACHE_ARGS ${CURL_CMAKE_ARGS}
+  )
+#+END_SRC
+The problem with downloading curl at build-time is that it's simply
+disallowed for many Linux- and BSD-based operation systems. When a
+distribution builds an application from source, its build dependencies
+are often downloaded ahead of time and, as a security measure, the build
+machine is cut off from the internet to prevent any interference.
+Because this is disallowed, the build will fail and the application
+won't be available on those operation systems.
+
+Note, however, that these build machines would have the option to
+disable telemetry at build-time. This means the machine wouldn't attempt
+to download curl from GitHub and the build would succeed but, again,
+telemetry would be disabled for anyone not on Windows or macOS. This
+defeats the whole purpose of adding telemetry in the first place.
+
+#+BEGIN_SRC c
+  S.Id (wxID_NO).AddButton (rejectButtonTitle);
+  S.Id (wxID_YES).AddButton (acceptButtonTitle)->SetDefault ();
+#+END_SRC
+
+There was a lot of feedback about the decision to highlight the consent
+button but that was mentioned up in the frontend section; I won't rehash
+it here.
+
+**** Broader and particularly well-structured comments
+These are simply some comments I feel deserve particular attention.
+
+From SndChaser...
+- [[https://github.com/audacity/audacity/pull/835#issuecomment-834037351][834037351]]
+-
+
+*** The Audacity team's response
+
+*** My opinions
+Can't decide whether to include this section or not. If you make it all
+the way down here, let me know what you think.
+
 ** TODO A perfect email setup (for me)
 :PROPERTIES:
 :EXPORT_FILE_NAME: a-perfect-email-setup-for-me
@@ -445,10 +721,11 @@ arguably more important so I don't actually mind that it runs Android.
 
 The only place that Android stands out is in system operations; file
 transfer uses MTP and, when you swipe down from the top of the device, a
-small bar appears as in early Android. This lets you change WiFi
+small bar appears similar to what was in early Android. This lets you
-networks, sync between the companion app on your LAN, the remote
+change WiFi networks, sync with the companion app on your LAN, the
-servers, take a screenshot, search, and access the system settings.
+remote servers, take a screenshot, search, and access the system
-Nothing else about the device really makes me think of Android.
+settings. Nothing else about the device really makes me think of
+Android.
 
 *** Community
 I don't usually browse Reddit but [[https://old.reddit.com/r/Supernote/][the Supernote community]] there is
@@ -531,18 +808,47 @@ Viewing with my naked eye at a comfortable distance, it does look better
 /At the moment,/ I am pretty disappointed with Table of Contents detection
 for ePUBs. A great many of my books seem to use a legacy ToC format that
 the Supernote sees and tries/fails to read before attempting to read the
-more recent
+more up-to-date one. This is easily remedied by editing the ePUB in
+[[https://calibre-ebook.com/][Calibre]], going to Tools → Upgrade Book Internals → Remove the legacy
+Table of Contents in NCX format. You might need to make a small change
+to one of the HTML files and revert it before the save button is
+enabled. After that, just copy it back over to the Supernote and
+everything should work properly.
 
 **** Writing notes
 I write notes as often if not /more/ often than I read and annotate books.
 It's the main reason I purchased the device and I love the experience.
+The Supernote doesn't /really/ feel like paper despite what their
+marketing materials claim, though it doesn't feel /bad/ either. It's hard
+to describe but I would say it's something like writing with a
+rollerball pen on high-quality paper with a marble counter underneath:
+incredibly smooth with but a little bit of texture so it doesn't feel
+like writing on a glass display.
+
+While writing latency[fn:6] is noticeable, I really don't have a huge
+issue with it. I write very quickly but find that the slight latency
+actually makes writing /more/ enjoyable. It sounds weird and I'm not sure
+why, but I /really/ like writing on the Supernote; it's wonderfully
+smooth, pressure-sensitive, the latency makes things interesting, and
+[[https://supernote.com/#/part?id=SP-04][the Heart of Metal pen]] feels good in my hand.
 
 **** Surfacing Content
+While organisation is done using a regular filesystem hierarchy, the
+Supernote does have other ways to search for and surface your notes. As
+you're writing, you can use the lasso select tool and encircle a word. A
+little dialogue pops up and gives you a few buttons for things you can
+do with that selection: copy, move to another page, cut, add it to the
+Table of Contents, or mark it as a key word. If you select the key word
+icon, the Supernote does some incredible OCR[fn:7] on it and displays a
+dialogue where you can add it to the note file as a tag. This dialogue
+allows you to edit the word before adding it just in case the OCR was
+wonky. Even with my terrible handwriting, I've found that it works very
+well and I rarely have to make edits.
 
 *** TODO Pong Isi and Volpeon when finished
 
 ** TODO Setting LXC up for local "cloud" development
-* Education                                                      :@Education:
+* Education                                                  :@Education:
 ** TODO Homeschooling
 * Music                                                              :@Music:
 * Pipe Smoking                                               :@Pipe__Smoking:
@@ -550,15 +856,45 @@ It's the main reason I purchased the device and I love the experience.
 
 * Footnotes
 
+[fn:19] [[https://github.com/audacity/audacity/pull/835#issuecomment-834451187][Link to the comment]] and [[/assets/pngs/audacity-pr/privatelibcurl.png][link to the screenshot]]
+
+[fn:18] [[https://github.com/audacity/audacity/pull/835#issuecomment-834010117][Link to the comment]] and [[/assets/pngs/audacity-pr/vendorproscons.png][link to the screenshot]]
+
+[fn:17] [[https://github.com/audacity/audacity/pull/835#issuecomment-836069326][Link to the comment]] and [[/assets/pngs/audacity-pr/tantacrulrole.png][link to the screenshot]]
+
+[fn:16] [[https://github.com/audacity/audacity/pull/835#discussion_r627762185][Link to the comment]] and [[/assets/pngs/audacity-pr/missingprivacypolicy.png][link to the screenshot]]
+
+[fn:15] [[https://github.com/audacity/audacity/pull/835#issuecomment-834286641][Link to the comment]] and [[/assets/pngs/audacity-pr/darkpattern.png][link to the screenshot]]
+
+[fn:14] [[https://github.com/audacity/audacity/pull/835#discussion_r627764300][Link to the comment]] and the screenshot is the same as previous
+
+[fn:13] [[https://github.com/audacity/audacity/pull/835#discussion_r627756976][Link to the comment]] and [[/assets/pngs/audacity-pr/vaguedialogue.png][link to the screenshot]]
+
+[fn:12] [[https://github.com/audacity/audacity/pull/835#discussion_r628124998][Link to the review]] and [[/assets/pngs/audacity-pr/defaultconsentbutton.png][link to the screenshot]]
+
+[fn:11] [[https://github.com/audacity/audacity/pull/835#discussion_r628008821][Link to the review]] and [[/assets/pngs/audacity-pr/externaldependency.png][link to the screenshot]]
+
+[fn:10] [[https://github.com/audacity/audacity/pull/835#discussion_r628005925][Link to the review]] and [[/assets/pngs/audacity-pr/vendorcurl.png][link to the screenshot]]
+
+[fn:9] Note that because I am not a C programmer, these reviews might
+not be entirely accurate and I wouldn't be able to catch the reviewer's
+error. I am relying on other community members to catch issues and
+comment on them; none of the reviews I link to have such comments so I'm
+assuming they are correct.
+
+[fn:8] [[https://github.com/audacity/audacity/pull/835#discussion_r627993755][Link to the review]] and [[/assets/pngs/audacity-pr/writeanalyticsid.png][link to the screenshot]]
+
+[fn:7] /Optical Character Recognition/: the program looks at your
+handwriting and tries to turn it into text.
+
+[fn:6] In this situation, latency refers to how long it takes for "ink"
+to show up on the "page" after writing something.
+
 [fn:5] It's not really a fountain pen even though that's what they call
 it; it's just pressure-sensitive.
 
-[fn:4] While this would be absolutely awesome, it would also be
+[fn:4] There does seem to be a group of people interested in just such a
-prohibitively expensive and difficult to write software for. E-ink
+thing: /[[https://alexsoto.dev/challenges-building-an-open-source-eink-laptop.html][Challenges Building an Open-Source E Ink Laptop]]/
-displays are /far/ from cheap and the incredibly low refresh rate would
-render usual computing habits ... odd. For example, words wouldn't show
-up right as you type them; the delay there would be significant and the
-same goes for a mouse. The idea is nonetheless compelling.
 
 [fn:3]Taken from their [[https://support.remarkable.com/hc/en-us/articles/360006699537-About-reMarkable-2-][support page about the reMarkable 2]]; search the
 page for /operating system/ and it should show up.