Feature: Opt out of Sentry reporting

[BLACK4585]

What feature or improvement do you think would benefit Files?

I've recently discovered that Files is making ~2 DNS requests/minute to your Sentry domain. As this is an open source app, I would like to have the option to opt out of this, even better, only need to explicitly need to opt in for error reporting. In the current state, the only way is to block the DNS requests, which is not easy for inexperienced users.
Also, what I discovered when creating this issue, that every user has its own user ID. Which obviously makes sense when using Sentry. But I don't want to get tracked, even though you say it's “anonymous”.

Requirements

• This proposal will accomplish higher privacy

Files Version

3.9.0.0

Windows Version

10.0.22631.4751

Comments

No response

[yaira2]

We currently do not plan to offer an official method to disable crash reporting, as we depend on these metrics to identify and resolve issues. However, you can review the specifics of what data is collected by looking for Sentry references within our codebase. We've also done everything to make sure that no identifiable data is collected.

Also, what I discovered when creating this issue, that every user has its own user ID. Which obviously makes sense when using Sentry. But I don't want to get tracked, even though you say it's “anonymous”.

The ID is randomly generated and securely stored in the settings file. This was implemented to protect user anonymity while enabling us to access the corresponding crash reports in Sentry for technical support.

For those with privacy concerns, you have two options:

• Build the application from the source code where you can remove Sentry.
• Block Sentry through your firewall.

Please be aware that by choosing either of these options, you will waive your eligibility for technical support as we will not be able to retrieve crash reports necessary for troubleshooting.

[BLACK4585]

Hello @yaira2 ,
of course, you do not offer such an option right now. That's why I created this issue.
Sorry, but I have another opinion on this topic. Since you are an open source project, you don't rely on “anonymous” user data, collected by saying “If you use the product, you automatically agree to my policy”. For this, GitHub issues exist, which big companies with their proprietary software don't have. Thus, they “need” crash reports etc. (I often doubt this, but this is another topic) to be actively able to monitor their app since no one can report it anywhere, besides some shady Subreddits. But you absolutely don't, also by considering the fact that I am using your btw really well-designed and working file explorer just because I don't want any Microsoft trackers, regardless of what I do. If you ask Microsoft, they will also just say that they require the data to “improve their app”, which is BS in my opinion. (sorry for saying it in this way)
Users just have the possibility to write on the Discord Server or here on GitHub what is going wrong and have a conversation with real people to fix their issue. If nothing helps, you can still ask for logs or ask them to turn on error reporting.
But as I said, having an error reporting tool is not something I would not approve of, also since I am a developer myself. But the way you implement this is wrong in my opinion. Users should always and easily have the option to opt out of this, even better need to manually opt in for this feature. And saying that users can “just” build the app by themselves or use a blocker like me is hilarious. Most users don't even know how a firewall works, or even how to set it up properly.
I wouldn't expect an open source app to track me all times, and I was pretty surprised this morning that the top-blocked domain, which was torpedoing my DNS blocker with requests, is coming from Files.
Also, since I am a European citizen, I see it from a different point of view. I nowhere see a notice about anonymous data collection in your GH README nor your website, besides this little “Privacy” button in the bottom right-hand corner. Also, when using the app I don't see a “privacy policy” popup, so I can agree or disagree on this.
And I think every user should have the free choice if he wants to upload his “anonymous” data to a random server on the internet or not.

Long story short: I request a re-open of this issue and a reconsideration to add this in the future in Files, since every user needs to have the choice if they want to contribute to your error reporting.

Thank you!

[yaira2]

I've read your response and respect your view. I don't have much to add to what I already said, but I'll address your main points:

• Manual bug reports are valuable, but they are only one part of the puzzle. Many problems remain unreported, and even for ones that are reported, Sentry offers both alerts and detailed insights into how many users are impacted. Additionally, there are cases where exceptions are managed, yet the underlying issues still need to be resolved. We also use these metrics to ensure exceptions don't return, something that would be hard to rely on just by user reports.
• The privacy policy is linked to on our website, on the about page in Files, and on the Microsoft Store page. I'm not against adding it to the GitHub readme but it's easy enough to find if someone is looking for it.

[yaira2]

I'd also like to emphasize that no personal data is reported to Sentry. We've enabled all the privacy options on Sentry and all that's currently being tracked is the number of users, number of sessions, and exception reporting.

[BLACK4585]

We cannot be sure what you really enable and what not, without insinuating anything. Sentry is a really powerful tool and can track everything, not just pseudo-anonymous data.
I understand your point, but what is stopping you from adding an opt-out feature? The user should at least be able to disagree sending data to some cloud provider, if you don't want an opt-in.

[BLACK4585]

Also by reading your last paragraph from before:

Please be aware that by choosing either of these options, you will waive your eligibility for technical support as we will not be able to retrieve crash reports necessary for troubleshooting.

you indirectly say that you can definitely track certain users. In the case of a technical issue, you would maybe ask for my userID to find my case in the Sentry DB directly. And boom, you instantly have a connection between the user and the “anonymous” data. This is exactly what I'm concerned about.

[0x5bfa]

Providing opt out switch for this would break the original and the only purpose to gather error info including crash exception stack traces and app version, etc. If some or a few of exception metrics lack, we might be unlikely to prioritize to fix that crash or issue because the number of report might be lowered. This means enabling such option affect on people who don't opt out, and the number of which should be much larger than that of who opted out.

Also, even if your user ID is compromised, no one except Yair can access metrics data using it, and should it also be compromised, again, no one can identify your personal information because our Sentry report doesn't collect it in the first place. This is phrased out in our Privacy Policy as any other companies do.

[yaira2]

And boom, you instantly have a connection between the user and the “anonymous” data.

Technically that's correct, however the reports do not include any personal data. For what it's worth, users can technically remove the user id from the settings file.

[Smackdab69]

A few comments:

• Your anonymization of telemetry requires a user trust you don't erroneously (or nefariously) include identifiable data in your telemetry
• For Zero Trust users and organizations, we cannot accept an application that sends telemetry data of any kind, for any reason. This is why enterprise applications offer an option to disable this and include it in their contracts.
• You've outsourced the collection and anonymization of telemetry to a 3rd party closed-source service (Sentry) that I/we have no visibility into nor do we have any agreements with.

As others have said, you really ought to at least provide the option to not send telemetry.