Earlier today I learned that pip includes a bunch of telemetry data in the HTTP User-Agent header for every request it makes, and has for >10 years (with increasing amounts of info): github.com/pypa/pip/blob/545ed…Not only is this not opt-in (as any telemetry should be), but there isn't even an opt-out. I'm still shocked and not sure what conclusions to draw from this, except: This is not okay!
I remember there was quite an uproar when Go tried to add opt-out telemetry a while back, and rightly so. How did I never hear about Python doing this before? Sure, less details, but still sending telemetry without ever asking for consent.
I like #Python, I want to keep using it, but can I if core tooling ignores user consent like this? And what other key development tools (Python or otherwise) have things like that and I just haven't noticed yet?
pip/src/pip/_internal/network/session.py at 545eda389c41478e2f99d23212254d757d8c2cef · pypa/pip
The Python package installer. Contribute to pypa/pip development by creating an account on GitHub.GitHub

Bubu
in reply to Fiona • • •From what I can tell this is parsed here: github.com/pypi/linehaul/blob/… (via github.com/pypi/warehouse/blob…)
Not sure if that's the only place where anything is done with this, but at least in this instance it seems to ignore any of the more privacy invasive and non UA-fitting info anyway. 🤔
(Like a UA saying "I'm pip x.y on python 3.z" seems somewhat reasonable to me, the rest not so much.)
The place to ask for more info/clarification about this would probably be discuss.python.org/t/about-the…?
About the Packaging category
Discussions on Python.orgBubu
in reply to Bubu • • •Fiona
in reply to Bubu • • •Yeah, tool and version should be fine, that's to common expectation of what's in a
User-Agent. Certainly debatable if it was ever a good idea, but it's from times when the internet seemed less dangerous (whether it was… not sure).I've seen some documentation on how to access the data (requires a Google account, though), but the thing that's bothering me is that they collect it without consent in the first place. And there isn't even an opt-out (which I'd still consider problematic, but at least it'd show they considered user privacy).
Analyzing PyPI package downloads - Python Packaging User Guide
packaging.python.orgBubu
in reply to Fiona • • •