Earlier today I learned that pip includes a bunch of telemetry data in the HTTP User-Agent header for every request it makes, and has for >10 years (with increasing amounts of info): github.com/pypa/pip/blob/545ed…Not only is this not opt-in (as any telemetry should be), but there isn't even an opt-out. I'm still shocked and not sure what conclusions to draw from this, except: This is not okay!
I remember there was quite an uproar when Go tried to add opt-out telemetry a while back, and rightly so. How did I never hear about Python doing this before? Sure, less details, but still sending telemetry without ever asking for consent.
I like #Python, I want to keep using it, but can I if core tooling ignores user consent like this? And what other key development tools (Python or otherwise) have things like that and I just haven't noticed yet?
pip/src/pip/_internal/network/session.py at 545eda389c41478e2f99d23212254d757d8c2cef · pypa/pip
The Python package installer. Contribute to pypa/pip development by creating an account on GitHub.GitHub

Bubu
in reply to Fiona • • •From what I can tell this is parsed here: github.com/pypi/linehaul/blob/… (via github.com/pypi/warehouse/blob…)
Not sure if that's the only place where anything is done with this, but at least in this instance it seems to ignore any of the more privacy invasive and non UA-fitting info anyway. 🤔
(Like a UA saying "I'm pip x.y on python 3.z" seems somewhat reasonable to me, the rest not so much.)
The place to ask for more info/clarification about this would probably be discuss.python.org/t/about-the…?
About the Packaging category
Discussions on Python.orgBubu
in reply to Bubu • • •