WARNING: Audacity 3.0 is labelled as Spyware

[Hexereticdoom]

Audacity, a popular open-source digital audio editor, has been reported to be storing user's data in the system. In addition, the cross-platform software was called "spyware" which also sends the information to Russian and other firms.

Audacity is Now a Spyware

According to the updated report by Fosspost on July 4, the privacy policy page of the software has received some updates last month including its changes on how it would gather all the users' personal data in the system. For those who are using macOS, your online information might be at risk of being exposed after using Audacity.

In May, Muse Group completed the acquisition of Audacity. The company has imposed changes in data collection in the platform. Moreover, the musician-focused firm is also known for Tonebridge, MuseScore, and the most famous Ultimate Guitar website.

What Are the Personal Data That Are Collected?

Sharing personal details online can put the users' privacy in great harm. For instance, the now-considered spyware, Audacity was reportedly piling up information such as the IP addresses, name of processors, name of OS and its version, as well as some messages.

While this could be considered under a special law that tackles data collection, there was no specification or whatsoever about the particular data that is collected during the process, Apple Insider reported.

According to the company, the IP addresses are kept in storage for a year before being removed. The place called hash is used in storing this information. Given the legal authority and resources, the government entity can detect the user behind the data collection scheme of Audacity.

It was suspected that the main headquarters where the data were stored was in Russia. At the moment, the European Economic Area is said to contain all the information.

It's possible that the personal details have reached the "potential buyers and advisors." There are also third parties and regulators involved in the report. Somehow if the data collection continues without the knowledge of the individuals involved, users would not be able to retrieve the important information.

What the Privacy Policy Tackles?

Before, everyone could use the application regardless of their age. Now with the new privacy policy coming to take effect, the exclusion for those who want to use Audacity covers users who are below 13 years of age. The reminder tells the underage users to refrain from using the app, but more importantly, the GPL license has committed a violation for this.

People over Reddit have been discussing the new implementation of Audacity when it comes to law enforcement. This will involve how to get rid of the license alterations and collection of users' information.

The continuous surge of people who use the application is healthy for a thriving company, but if it would only exploit the users through suspicious data gathering tactics, it would only lose all of them in an instant.

Source: TECHTIMES

I personally should recommend you to uninstall that version (if you have it actually) and switch to an alternative fork. I may suggest you DarkAudacity, for example (for Windows users only).

Sigh, there it goes another good program that gets corrupted by the Dark Side...

[AvzinElkein]

I'm a Linux user; are there any alternatives for that?

[Hexereticdoom]

I'm a Linux user; are there any alternatives for that?

Right now there are some of them, but not exactly like the original Audacity... But anyway, I hope these links may be useful for you:

https://alternativeto.net/software/auda ... form=linux

https://www.linuxadictos.com/en/some-al ... iting.html

Also, there is a lately very active GitHub thread with an Audacity fork, however it is still in construction:

https://github.com/cookiengineer/audacity

I suppose it's a matter of time they release any build...

[Chris]

FWIW, the telemetry and data collection stuff can be turned off at compile-time. This of course won't do anything for the pre-compiled binaries they provide (which will likely have it enabled), but I strongly suspect most Linux distros will have it turned off by default. Still, Muse Group's influence over Audacity has been felt hard these past couple of months (first with the Google telemetry integration, which they pulled back on after public outcry while continuing to look for non-Google alternatives, then introducing a CLA that allows them to relicense any contributed code to any license they want, including to make closed source proprietary versions, and then more recently they've stated they will share data they collect with any law enforcement agencies on request, which they've had to clarify to mean only when compelled by a court while vaguely mentioning what information it is they gather). Needless to say, the trust Audacity had is in the trash, and I don't see it getting better any time soon, if ever. At this point, who can say that a future version won't leave some little treats in even when the unwanted junk is disabled when building.

[KynikossDragonn]

Audacity has been a real mess that I've only continued to use since I have absolutely no alternatives to it, I hate wxWidgets, I hate the fact you need a specific version of wxWidgets. And I'm tired of the fact it doesn't natively support PulseAudio and is prone to just deadlocking for seemingly no reason when starting and stopping playback fast enough (or irregularly enough) and now this telemetry thing.

I'm all for a more competently developed fork of Audacity especially one that eschews that horrible wxWidgets mess for something that actually plays nice with a user's particular desktop theme. All I really need for a audio editor on Linux is something that can make use of LADSPA (and it's successor LV2) and comes with built in effects processing for all the most immediately obvious things you need. (EQ, highpass, lowpass, bandpass, comb, etc)

[AvzinElkein]

...wait, I don't need to edit audio.

[Rachael]

I think the important question is - why isn't anyone just forking it pre-telemetry and continuing the project under a new name? The GPL allows that. In fact, it encourages it.

With the momentum Audacity has right now and with the massive outcry over the recent changes, adapting to the new fork will not be difficult, and people will be quick to switch to the new fork. There will be very few staying behind on the original Audacity program. Then after that happens and the new fork gains the bulk of the users the original once had, the investment will fail, and hopefully it will serve as a cautionary tale against any other investment firms hoping to make a buck off of OSS software.

[Blzut3]

I think the important question is - why isn't anyone just forking it pre-telemetry and continuing the project under a new name? The GPL allows that. In fact, it encourages it.

They are, it just takes more than a few hours to get that all setup.

That said, I personally think this is all people getting freaked out over boilerplate legalese. As far as I've been able to tell the telemetry they want to implement isn't that much more invasive than what we've done for GZDoom, even in the original PR. It just sounds scary since they actually have legal resources to write an actual privacy policy.

That isn't to say that Muse Group's communication hasn't been leaving much to be desired though.

[Rachael]

This has been going on for quite a bit more than a few hours. I'm not expecting a fork to just miraculously appear overnight, but this issue has been going on for at least a month now, going on 2.

Also, there is a lately very active GitHub thread with an Audacity fork, however it is still in construction:

https://github.com/cookiengineer/audacity

Well - I didn't see this. I take back what I said.

[Graf Zahl]

The main question for their success will be how widespread Audacity is among people who lack the knowledge or desire to avoid this.

[leileilol]

I don't use Audacity (I main CoolEdit 96) but this is rather troubling when there's a lot of 'advice' and tutorials of just format conversion with 'just get audacity to save mp3' when they could use a small standalone encoder that will have drag-n-drop (lame, oggenc, flac, even ffmpeg). That's what many install Audacity for, frankly.

I could've sworn there was once a sox frontend that worked like an alternative to the point it was on debian

[Caligari87]

The reality is that Audacity is quite a competent audio editor which is also simple enough to easily learn. It's basically like having a nice option between MSPaint and Photoshop, and in terms of cross-platform audio editors I haven't really found much else that fills quite the same niche. I don't see that changing anytime soon, as a fork is going to have a tough time achieving the same mindshare. That said, competition is a good thing and while Audacity fills a niche pretty well, it's also never really been challenged in that niche. I do think that this whole kerfluffle will probably blow over soon except among diehard privacy zealouts (especially if the new management team actually starts improving it Audacity at something more than a pace glacial pace, and/or if distro maintainers start compiling it with the telemetry disabled) but I'm also very interested to see what (if any) ecosystem changes result from this.

[Caligari87]

Double-posting, but it's important. Here's a breakdown of all the telemetry currently in Audacity and why it's basically identical to many standard desktop applications like browsers, even open-source ones.

Personally, I see nothing to be concerned about here.

[Chris]

Double-posting, but it's important. Here's a breakdown of all the telemetry currently in Audacity and why it's basically identical to many standard desktop applications like browsers, even open-source ones.

Personally, I see nothing to be concerned about here.

Aside from the CLA, a lot of it is really bad communication. There was some initial excitement that Tentacrool was being put in charge, who apparently did really good stuff with MuseScore, but first impressions are hard to shake and Muse made a really bad one.

The initial work for telemetry, for instance, came out of nowhere, used Google's telemetry services, and was on by default without being clear it could be turned off at compile-time. The thread where that blew up had many voices saying telemetry in itself was fine, so long as it avoided Google's over-reaching data collection and storage (there are other more privacy-minded options available), they were clear with what was being collected (which should be restricted to only what's necessary to improve the program), and it would be opt-in. They pulled back saying it was meant to be off by default, and they'd look for other non-Google options. Some people expressed the good points that such telemetry data could be used to massively improve the UI (it's currently worst aspect), though others have expressed concern it could be used to justify removing useful features because it wasn't reported as being used enough (or that the majority of people who do use it have data collection off; so features will stay only for people that allow Muse to collect their data). So there's potentially good stuff here, and potentially bad, depending on how they utilize it.

Then came the Contributor License Agreement, which gives them carte-blanche to change any contributed code to any license they wish at their discretion. For a GPL-based project like Audacity, one would assume the source and any contributions would remain open source since that's the entire point of the GPL, but the CLA explicitly allows them to make closed proprietary versions using any code you give them. So they're not honoring the intent behind the project license, even if they can legally do it. This is not good.

Then came the law enforcement policy, which was badly worded to make it sound like they would readily hand data over to law enforcement when asked, and also not being clear with what data they would have to give. They had to clarify that data would only be handed over when compelled by a court (i.e. a subpoena that they're legally obligated to honor), and what data they'll have and for how long (which they've given some detail on, but it's left wanting). And since for many (most?) people, Audacity is a tool to simply record, manipulate, convert, and save audio locally, there's the question of what data than can/should have to give in the first place. So this may be more of less normal, but lacking clarity.

[Nash]

And now, for something very, very wild.



Yes, this is apparently real...

https://github.com/tenacityteam/tenacity/issues/99

https://github.com/Sneeds-Feed-and-Seed/sneedacity