what's up with the hard coded heartbeat URL https://api.tinyauth.app/?

[11notes]

https://github.com/steveiliop56/tinyauth/blob/32539b0ae9346f0a238331aca38d8d0d3237ad75/internal/bootstrap/app_bootstrap.go#L319

what's the purpose of this "call home" function that is hard coded?

[steveiliop56]

Not really a call home function. It's just a way for me to get an insight on active instances and most used versions. A detailed explanation is available here. If you like you can disable it with DISABLE_ANALYTICS=true (arguably not a great config name since it is not analytics).

[11notes]

It is a call home function, doesn’t matter what it transmits, so far. It’s also enabled by default and not opt-in. I don’t see the benefit on shipping your app with a default call home function when this has no benefit to or for the end user of the app. This type of data collection is simply not needed.

[steveiliop56]

Source: You can read the code which is available here licensed under MIT. I also added a feature that displays a warning if the server owner uses trace or debug which exposes the IP address. Now yes, I can of course compile the code myself and do whatever I want so yes you will have to trust me, but if you don't that's fine, you can use DISABLE_ANALYTICS=true and you are done, the routine will never run.

[11notes]

Such an endpoint is simply not needed and should be opt-in by default (not opt-out as it is currently).

[sergi0g]

+1 on this, if someone wants to help you with whatever you're trying to do, it should be their own choice. If the whole point of developing open source software for you is having a user count to brag about, you may as well just make it closed source. Otherwise, respect your users. Also, there's no reason to know what version your users are using. You have the right to decide how to develop your project and they have the right to update when they feel like it.

[steveiliop56]

I find the version count a useful metric in order to understand how versions are distributed, as mentioned countless times above. I am not harming the users in any way since I collect non-PPI information. If you don't trust me that's completely fine, just use DISABLE_ANALYTICS=true and Tinyauth will never "phone home". If you don't trust this either, you are free to fork my software and maintain it yourself without the heartbeat. In the end of the day every developer decides how to maintain their software and that's how I want to maintain my software, if you don't like it you can fork it or simply don't use it. Now if you don't have anything else to add to this discussion, let's end it here.

[11notes]

@sergi0g you can always opt to use 11notes/tinyauth which disables the telemetry in code before compiling.