Open source always belongs to the authors. What you can do with it depends on the license.
I made a Pull Request to add Grayjay.
Regarding the open-source question, I would say itâs not open-source. FUTO could also have used the CC-BY-NC 4.0 (Creative
Commons by Non-Commercial).
We should remember that Grayjay is a paid product*, and I see this as the reason why @louis_rossmann doesnât want it under an open license. Because then anyone could fork it and make it free.
But as far as Privacy Guides is concerned, being able to build from source and check the source code, as well as forking it for personal use (to remove parts one doesnât like) â is all that matters.
In the future, it might be worth defining what PG defines as open-source. The Standard Notes license issue is a great starting point.
About Grayjay in itself, I see just one issue : telemetry. Grayjayâs privacy policy states that :
- Information We Collect
[âŚ]
⢠Telemetry Packet: Upon starting the app, Grayjay sends a telemetry packet which contains the following:
- Version of the app youâre using and the OS SDK version
- A randomly generated unique identifier (this does not link back to your identity or specific device)
- Model and make of your phone
- Use of Your Information
⢠Improving Grayjay: The telemetry packet helps us understand our user base, which devices are most commonly used, and ensures that we optimize our app for those devices. The random identifier helps us determine unique app launches without identifying individual users.
This telemetry canât be disabled. I personally donât see it as a big issue, but I know it is for some people, as reflected by the advise to disable daily ping in browsers.
*There is no restriction if you donât pay, but it is still a paid product
1 Like
I think the focus of PrivacyGuides is to find the âbest of the bestâ, itâs just that having a stringent requirement on every recommendation is just not feasible, so the requirements got relaxed somewhat on categories with limited choices. You will notice a trend that the criteria is more strict specifically when there is a lot of choices/competition available (eg. Email, VPN, Cloud Storage), and less strict when the choices are limited (eg. Password Managers, Note taking software).
So itâs less hypocrisy/stupidity and more ânothing will pass our criteria if we donât relax it a bitâ, tagging @jonah for input
Edit 1: Idk why theyâd recommend 1Password though
3 posts were merged into an existing topic: Require Open Source for Password Managers
Not sure why I was down voted - my explanation wasnât meant to say the license was good or bad. It was meant to explain the implications of the license as an end user and somewhat for the user running the code. While I prefer AGPL for interacting with hosted services, in reality Iâm quite content with FUTO at the end of the day as it exposes what is most likely running on a server (my threat model doesnât care about people modifying the code), and actually has (untested) legal agreements if anyone tries to commercialize it.
FUTO doesnât require source code provided over a network, and AGPL like licenses do. This isnât a ideology based consideration, itâs in the license itself. Why people choose some licenses over others without such consideration is definitely and ideology, even FUTO comes with its own take. With that, whether or not such copy left agreements matter to you depends on your threat model.
Regarding the open source vs license issue, I have created the following post to discuss it and define a definition. Following this discussion, we can decide whether being source available like Gray jay is enough for us to consider it open source, and add it to the website without altering the existing criteria.
lol, this is really bad. Unless thereâs absolutely nothing else that is suitable, I wouldnât use nor recommend Grayjay.
5 Likes
Why ?
There is definitely nothing with as many features : simultaneous sources, casting, SponsorBlock support, custom comments system, etc.
Because the data collected can reveal more information about the user than what it might seem at first glance. The fact that this is not even opt-out, but mandatory, is in my opinion not acceptable.
It is still much better than using the stock youtube client or the youtube website, and therefore should be recommended if every other frontend/alternative client is borked or canât keep up with googleâs bs, but that doesnât seem to be the case as of now. NewPipe seems to be working fine.
hmm, I donât know about the other features, but there are forks of NewPipe that include SponsorBlock functionality (Tubular being the actively developed one). NewPipe also supports sources other than YouTube.
3 Likes
Newpipe does not support nearly the same number of platforms as Grayjay does. Grayjay is also built in such a way that you can add any service you want to it via actually Open Source plugins.
If you start using Grayjay, then it sends your Android version, a randomly generated number, and your phone model (Pixel 6a in my case), and it only sends these things once.
I donât see how this is unacceptable. Privacy folks just hear the word âtelemetryâ and completely lose their cool.
3 Likes
Once, or once every time you start the app? The privacy policy seems to point towards the latter, but if that isnât the case then itâs considerably less bad.
If itâs phoning home daily on the other hand, then this information can be used to profile you. That isnât to say that I think they are doing that, but they could, and we cannot verify that they arenât.
(edit: somewhat related)
I personally am not concerned that X will learn that I am using Y app with phone Z.
What I am concerned about though, is my watching history being tracked. And Grayjay (with a VPN ofc) shields me from that threat.
That being said, I would like clarity about the telemetry being on each app start, or one-time only. It may be that device info is sent once, but each app launch is tracked. Hey @louis_rossmann, could you please clarify that point ?
About sources, NewPipe does support a few one, but it lacks Odysee/LBRY. More importantly, Grayjay displays sources simultaneously, side-by-side.
It sends an anonymous piece of info which is
- version of app
- release build
- type of phone
- stable or unstable phone
Itâs sent every boot and helps us figure out what phones it crashes on, what we fkd up. A lot of people will say it doesnât work on their phone but it works on another, but never submit a bug report or email. The anonymized stuff above was used to make bugfixing the app on a quick release cycle easier.
Citation for telemetry: grayjay-android/app/src/main/java/com/futo/platformplayer/states/StateTelemetry.kt at ec19ea44ad6f95fd445e1d343240bf8451ac1f9b ¡ futo-org/grayjay-android ¡ GitHub I donât expect anyone to trust what I said above without a citation. It shows where the telemetry packet goes.
This is done out in the open, so if you want to block it, logs.grayjay.app 0.0.0.0 in your firewall/hosts⌠or just re-build the app without it. As you can see from the source code above, this is in no way designed to allow us to figure out anything about you other than what we fucked up when programming this app, what devices it is working on, & what devices it is not working on.
With regards to licensing, licenses are up to the maintainer of the project, not me! I donât decide them. Different projects are under different licenses here.
With regards to the idea, if some phone maker says we want to bundle our app and have the âi already paidâ button be hit on all of them, weâd like the ability to sell a mass-license to them rather than just have them provide it for free. Itâs already essentially honor-system/trust-me-bro software with regards to payment as it is, so I see this as reasonable.
On one hand, I can see how people in the open source community think that this license is unreasonable; even though it allows you to modify & view source code & change for your own use, it doesnât allow commercial redistribution without an agreement with FUTO. A limit on freedom!
On the other hand, if I were the billionaire spending tens of millions of dollars on all of these applications with DRM of âI already paidâ and someone walked into my office to tell me that what I was doing was wrong⌠I would likely reply back with my trademark youtube catchphrase: âgargle my balls.â
7 Likes
Thanks for the link.
I understand why telemetry is helpful to the project but even if I do trust you to not misuse this data, thereâs no way for the users to audit your servers and ensure that it is being properly anonymized and isnât being used for anything other than what is claimed.
Please consider adding the option to enable telemetry in the popups when you first open the app and not have it on by default. Iâm sure many would be willing to enable it to help with development, for the same reason why people are willing to pay for the product if itâs good. But when you start collecting data without saying anything, itâs not exactly the best look.
I donât think that people think the license is unreasonable, they just think it is not open source, which is true. The response to FUTOâs âsource firstâ has been largely positive, at least in this community and other tech communities Iâm in. People agree with what youâre doing.
4 Likes
Thanks for popping on the forum and clarifying.
I agree with you that telemetry isnât a hard blocker to sensible privacy, and I get confused when others are ride or die on it. Without basic metrics, the only way to improve the software is to rely on user reports and a strong community. Even then, the quality of reports matters, and diagnosing issues becomes difficult.
Regarding the license, my main beef with source first licenses is not with the license itself, but companies doing a bait and switch. Prime recent example is Redis. This is especially jarring in the example as it went from a weak BSD license to an AGPL like SSPL - a smack in the face of how itâs used everywhere, and makes me distrust Redis the company. Luckily forks were made under new owners as the previous BSD license permitted that.
However, I greatly respect FUTO coming out of the gates with it, and I suspect no foul play. The intention is definitely not to bait, gain popularity, then switch the license over us. It has a clear defined goal set out.
I hear where youâre coming from, but the anonymous nature of the data is right there in the code that is publicly viewable.
With regards to collecting data âwithout saying anythingâ, it is in the 2nd paragraph of our plain English privacy policy which is less than two pages long. Privacy Policy that privacy policy is the opposite of the wall of legalese nonsense I find everywhere else.
I would like to see a button to disable telemetry myself. At the same time, I want to make sure that theyâre not being misrepresented as EULA roofing users when they are not
1 Like
Thanks for the reply.
IP addresses are personal data. We cannot verify that youâre not storing and/or associating it with the rest of the data that is being collected.
Thatâs another reason to display it to the user when they first open the app. Itâs not an incomprehensible gigantic wall of text that any sane human being would refuse to read.
In regards to transparency, I think Ubuntu does or at least used to get this very right: they have a button where you can view in plaintext the exact data that will be sent if you hit agree. Since Grayjay doesnât collect a lot of data, it should be readable even from a tiny phone screen.
1 Like
Every website you visit has access to a general IP address of yours. You have to send your IP so the server knows how to send data back to you. This is why VPNs are a hot commodity for this - you route traffic through another server to conceal this. But the VPN knows your IP at that point.
If their privacy policy says they donât collect, we can try to trust that. If you donât, then that threat model applies to every other website you visit, and not just this one in particular.
4 Likes