Squad, please clarify your official stance on the ModStatistics controvery.

[xcorps]

There are a lot of children and even casual players playing KSP.

Meaningless. The data does not identify children or casual players. It doesn't identify any players at all.

It doesn't identify people. That means there is no issue of privacy. All the data says is "game was played in 32x on windows for an hour, didn't crash, and had x mods installed."

That's not an invasion of your privacy people.

[chrt]

Meaningless. The data does not identify children or casual players. It doesn't identify any players at all.

It doesn't identify people. That means there is no issue of privacy. All the data says is "game was played in 32x on windows for an hour, didn't crash, and had x mods installed."

That's not an invasion of your privacy people.

It attaches a unique identifier to a particular install, which means it does identify you and can track individual players. And, just to add insult to injury, all that data is being sent in plaintext.

If doing that without explicitly telling the end-user and without making it explicitly opt-in isn't an invasion of privacy, I don't know what it.

[Temeter]

Meaningless. The data does not identify children or casual players. It doesn't identify any players at all.

It doesn't identify people. That means there is no issue of privacy. All the data says is "game was played in 32x on windows for an hour, didn't crash, and had x mods installed."

That's not an invasion of your privacy people.

That's not even my point, the sentence was ment in the context of the previous one. Children and casual players won't necessarily understand the implications or know what to look out for, easily missing the stuff. Opt-out is relying on that.

Also, your statement about privacy only shows that you don't know how this kind of system works. Logging is easy to do, you don't just send anonymous information into the internet without possibility of tracking. That's why e.g. Squad asks about collecting data, even if it might be anonymous.

Edited July 20, 2014 by Temeter

[Roastduck]

It attaches a unique identifier to a particular install, which means it does identify you and can track individual players

it tracks installs. The identifier wouldn't show up as "User=chrt (address; e-mail address; google search history)" It would show up as "Install #[x]" It doesn't track players, just installs. If you have 3 installs of KSP on your computer, it's still just one player, but ModStatistics would still track 3 installs, because it doesn't track players

[BudgetHedgehog]

It attaches a unique identifier to a particular install, which means it does identify you and can track individual players. And, just to add insult to injury, all that data is being sent in plaintext.

If doing that without explicitly telling the end-user and without making it explicitly opt-in isn't an invasion of privacy, I don't know what it.

No, it identifies the player, not you. It say, to expand on what xcorps said, "player abfj4hf947fkg played KSP x64 for an hour, resulted in a crash with no mods". There's no way to bind that player ID to a specific person e.g. you.

[pxi]

My thoughts are these:

1: The source is available here. I suggest all discussion of the malicious activities, or lack thereof of the plugin be based on what is in the code, unless someone can demonstrate that the plugin that is being distributed in someway differs from the source.

2: If the traffic generated by the plugin was not being sent in the clear, two things would result from that fact:

(a) Encrypting the data would incur overhead, probably trivial, but there would still be an additional hit to the processor.

( You probably couldn't just fire up Wireshark, look at the traffic, and see exactly what it was sending out.

3: Opt-in as the default is probably the most expedient way to defuse the situation as it stands.

[cpast]

On the topic of Squad's official position, stupid_chris said in the ModStatistics thread:

This is the release thread of an addon, which is by all means totally legal and abides to all forum rules.

[The Jedi Master]

"Hey! Someone used your mod!"

That's the extent of it, people.

[Temeter]

Btw: Guys, keep calm. It's pretty obvious Majiir did it to help modders, that server even costs money.

3: Opt-in as the default is probably the most expedient way to defuse the situation as it stands.

Yeah, i'm not really seeing much of a issue behind the system itself. Majiir did a lot of cool stuff for the community (and this tracker could also be helpful), so imo no point in being overly suspicious either.

It's basically just that it potentially tracks data without consent. Including it in your own mod-directory also makes it really hard to find out about the plugin. I might trust Majiir, but everyone else could just hide the thing and don't write about it in the mod thread, fearing people would ignore a mod using a tracker. Not that healthy needing to be suspicious. I'd like to see a requirement to set the config to opt-in when including it into a mod.

Edited July 20, 2014 by Temeter

[chrt]

No, it identifies the player, not you. It say, to expand on what xcorps said, "player abfj4hf947fkg played KSP x64 for an hour, resulted in a crash with no mods". There's no way to bind that player ID to a specific person e.g. you.

That doesn't matter - it attaches a unique identifier to my data that remains constant over sessions, therefore, it can not be described as anonymous, but pseudonymous at best.

[Hodo]

I solved this issue, by removing the modstatitics folder all .dlls associated with it, and removing Kethane and any mod created by Majiir till it is removed or created with a better more visable opt-in option. I will not be endorcing anything made by Majiir until this happens.

Pretty simple. I don't like, I don't use it, I wont promote it for use.

[Roastduck]

3: Opt-in as the default is probably the most expedient way to defuse the situation as it stands.

I don't even think that's necessary. Downloading the standalone mod would be an automatic opt-in. A decent compromise would be to have each mod author who bundles ModStatistics inform their users of that fact. It could be as simple as including a line on the thread and in any readme files. Heck, I haven't looked at the license for ModStatistics yet, but there might actually be a clause in there requiring giving credit to the original author upon distribution. IF that's the case, then anyone who bundles it would be obligated to do so.

If it's not the case, Majiir could easily add such a clause, if he wanted to, but I don't think it should be necessary.

EDIT: just read the license, and it just says "Copyright © Majiir 2014 All rights reserved." So disregard what I just said about licenses

Edited July 20, 2014 by Roastduck

[cpast]

I don't even think that's necessary. Downloading the standalone mod would be an automatic opt-in. A decent compromise would be to have each mod author who bundles ModStatistics inform their users of that fact. It could be as simple as including a line on the thread and in any readme files. Heck, I haven't looked at the license for ModStatistics yet, but there might actually be a clause in there requiring giving credit to the original author upon distribution. IF that's the case, then anyone who bundles it would be obligated to do so.

If it's not the case, Majiir could easily add such a clause, if he wanted to, but I don't think it should be necessary.

They already have to do so, per the license (and likely per the forum rules, which say you have to notify people if your addon collects data).

[chrt]

The solution is simple and obvious - anyone who wants their data to be collected should have to download the plugin as a standalone and explicitly allow it. Silently bundling it with other popular mods while only notifying the users through a single changelog line is unacceptable, as is the opt-out policy and the use of the word "anonymous" to describe anything about this mod.

[Roastduck]

Silently bundling it with other popular mods while only notifying the users through a single changelog line is unacceptable

Would you accept loudly bundling it? Large red text surrounding a the download link that announces the mod being downloaded comes bundled with ModStatistics? That way end users can decide for themselves whether or not to extract it.

[KasperVld]

All I can say at this time is that Squad is very much aware of the controversy regarding ModStatistics and is exploring what they want to do about it, if anything. Sorry for being so vague, but I really can't look into their decision making process, we'll have to wait for them to make a statement. But they are very much aware

As things stand currently, ModStatistics doesn't break any of the add-on rules.

[Sandworm]

It may not break rules, but Squad should seriously talk to their legal counsel about this. By allowing mods, by allowing and distributing this specific mod, they may be taking the mod creator on as a partner/subcontractor/Biz associate in regards to PII. Squad may be on the hook for collections by this mod regardless of what is written in tos/eulas. This sort of question can only be answered by actual lawyers in person.

Edited July 20, 2014 by Sandworm

[Trollsama]

Collection of data im ok with. Opt-out instead of opt-in im ok with, it is the lack of information that is my issue. And while the developer of this tool is not solely responsible for making sure every person to distribute it posts it in big red letters on there OP (just as a gun manufacturer isn't responsible for making sure you don't shoot someone).... As the developer of the tool, you are still expected to minimize the chance of it being an issue (like putting a safety on the gun).

IE. just as the opt-out system KSP uses for data collection has a 1 time popup, This mod too should have that popup,

A 1 time window that states the mod is there, what its doing and how to turn it off if you want to, or even just:

"One or more of your mods have been packaged with ModStats.

ModStats is A tool used by Mod developers to better understand how there mod is being used, by collecting non-personal, anonymous data from KSP.

For More info, including how to opt-out of ModStats: visit [Fourm page link here]"

Its not asking much, a simple window that only pops up once. takes no time to include in the mod, minimal effort on all parties, and solves literally the #1 issue with the mod.

there is no more "I didnt know" Issues. because you as the user had to physically close the window. if you still did not know then it is your own ignorance to blame.

there is no more mistrust caused by the secrecy. Being transparent means what you are doing wont look suspicious and people are much more likely to accept it.

there is no more dependency on 3rd party mod developers to announce the mod.

Aside from the window being added, If a simplified opt out system was implemented (like a button in settings for example) that didn't involved editing files in the game folder. then there would literally be 0 to complain about.

Sidenote:

I just want to note that while i do not support the plugin in its current state, I do still support the developer, and honestly believe that they have good intentions, but just had a few poor decisions in development. and that people need to stop attacking the developer, but rather the issues in the plugin alone. I honestly believe we will see some sort of changes in the future to address the outcry from the community. Everyone just needs to step back and take a few deep breaths

Edited July 20, 2014 by Trollsama
Formatting tweaks / ease of reading

[Temeter]

I'd like an obligatory box on the top of a mod page, saying something like "this mod will analyze and upload game-data to a private server". Maybe just calling the site's name in there, like "stats.majiir.net", so it doesn't look as dubious.

That's delivering content creators a secure guideline how to do things (avoiding accidental blunders), and removes mistrust from us leecher.^^

Edited July 20, 2014 by Temeter

[Master Tao]

IE. just as the opt-out system KSP uses for data collection has a 1 time popup, This mod too should have that popup,

A 1 time window that states the mod is there, what its doing and how to turn it off if you want to.

In the dev thread for ModStatistics, Majiir stated that he's trying to add a button in the main menu to allow easy opt-out, but that's difficult to do as a modder. It would help to not only show what type of information is collected (currently in the dev thread), but also list all the installed mods that use it. That should ease some concerns about what information is used and demonstrate how important it is to modders.

Would that approach work for you?

[xEvilReeperx]

In the dev thread for ModStatistics, Majiir stated that he's trying to add a button in the main menu to allow easy opt-out, but that's difficult to do as a modder.

If it was just a toggle button, it'd take maaaaaaaaaaaybe 25 seconds to add. 2-5 minutes for a nice interface that shows the information you want. 15-45 seconds to just add a popup toggle on start like the autoupdate one, depending on whether you got fancy and added code to wait for the other popup to close before you opened the next.

Let's call it 6 minutes of work on the very outside, including time spent testing

[Master Tao]

If it was just a toggle button, it'd take maaaaaaaaaaaybe 25 seconds to add. 2-5 minutes for a nice interface that shows the information you want. 15-45 seconds to just add a popup toggle on start like the autoupdate one, depending on whether you got fancy and added code to wait for the other popup to close before you opened the next.

Let's call it 6 minutes of work on the very outside, including time spent testing

The difficulty is with adding it to the main menu to make it obvious and available:

I would like to add a prominent button in the main menu screen (and maybe the settings screen too, just to be safe) that allows you to control everything the plugin does. It will also draw extra attention to itself on first run. The reason it doesn't have this currently is that I was planning to use the new App Launcher feature in KSP, but it doesn't support the main menu scene. If that support isn't added very soon, I will simply add my own button. This new UI will also make it more clear what ModStatistics does.

[TheCanadianVendingMachine]

*sigh*. People making something out of nothing. Why must you care about this? It is only sending data about mods. Not where you live, account passwords and the such. So what if a modder wants to include it? They get data about their mod. And see if their mod conflicts with others. It helps you in the end, because your game will be more stable with mods.

[dryer_lint]

I don't see what the big deal is. It just collects data about mods and crash reports, etc.

[Mohax]

LOL i don't even understand the controversy on this subject. Don't mod KSP if you don't understand how mods works xD. Do know that they work inside KSP and not out of it, thus they can't get any information out of the KSP folder (I'm talking about mods, not plugins, totally different). ModStatistics gets information about your OS, specification of your PC. And if a mod crashes it gets the circumstances under which it crashed, it can't get your passwords or hack into your files.