Telemetry

[petiepooo]

Devs, I wish to head off a firestorm and open a discussion here about telemetry before 2.4.70 is released. I suspect this will be a bigger issue than any of you anticipate.

I understand that Security Onion is no longer released under an OSS license. The Elastic License v2 is (IMHO) a good compromise in accessibility vs control, and I had no problem signing your CLA. Additionally, I recognize that this is your product, and you can take it in whatever direction you wish to take it. Trying to make a business out of a product you give away for free is tough, as many others have learned.

However, the first time that people learn about your request for telemetry should not be when soup returns a prompt of:

--------------- SOC Telemetry ---------------

The Security Onion development team could use your help! Enabling SOC
Telemetry will help the team understand which UI features are being
used and enables informed prioritization of future development.

Adjust this setting at anytime via the SOC Configuration screen.

Documentation: https://docs.securityonion.net/en/2.4/telemetry.html

Continue the upgrade with SOC Telemetry enabled [Y/n]?

(as pulled from:)

securityonion/salt/manager/tools/sbin/soup

Line 614 in ca49943

--------------- SOC Telemetry ---------------

Please activate the link early and give yourself a chance to reassure your users well before they stumble across the above prompt. We will want to know what telemetry you collect, how it is anonymized, how much bandwidth it will take, how you plan to use it, and likely a few other things that an active discussion here will turn out. Be prepared for many to not like it regardless; us security folk are a suspicious lot...

That said, it looks like it will be optional and simple to decline. Thank you for that; it should squash most of the backlash. Prior notice and a chance for input is likely to give you a higher success rate in enabled systems, as users will have time to research and gain assurance that they are not being unduly exploited. Users hate surprises.

[dougburks]

We are aware of all of this and already spent a lot of time thinking through and discussing this.

Please see the Telemetry section of the blog post:
https://blog.securityonion.net/2024/05/security-onion-2470-now-available.html

Also see the Telemetry section of the documentation:
https://docs.securityonion.net/en/2.4/telemetry.html

[petiepooo]

Discussing with whom? I don't recall seeing anything here on the discussions app in github.

For those reading this later, the telemetry section of the docs only went live on release.

Also note that closing this discussion here in github prevents it from showing up on default searches. It's something I would expect to see if one does not want an active and interesting discussion. Is that your intent? It feels like you're trying to shut me down.

[dougburks]

Discussing with whom? I don't recall seeing anything here on the discussions app in github.

I'm referring to live discussions with key stakeholders.

For those reading this later, the telemetry section of the docs only went live on release.

You were looking at unreleased code in the 2.4/dev branch. Perhaps if you had looked at the dev branch of the documentation, you would have seen the telemetry documentation that we had already written and you would have been less surprised.

Also note that closing this discussion here in github prevents it from showing up on default searches. It's something I would expect to see if one does not want an active and interesting discussion. Is that your intent? It feels like you're trying to shut me down.

You asked for documentation and I provided a link to it, so I closed the discussion.

[petiepooo]

I think you misunderstood me, Doug. Documentation, being the dissemination of information from author to user, was just one part of what I was asking for. What I actually asked for was a discussion, which implies bidirectional communication.

However, the response where you mention live discussions with key stakeholders tells me everything I need to know. I've been around long enough to know "key stakeholders" is corpo-speak for "paying customers." And since this forum is not where paying customers hang out, we here were excluded from providing feedback.

As I mentioned in the original post, Security Onion Solutions is not the first company to forsake their original base in pursuit of profits. I don't blame you; after all your about page shows there are 20+ families depending on the success of Security Onion Solutions. It just makes me sad to see I'm not considered a stakeholder despite nearly a decade of PRs going back to Snorby, ELSA, and pf_ring.

Thanks for the tip about checking the doc's dev branch. You'll see less from me as we phase out systems running Security Onion. I wish you all the best.