The Great Controversy

[blizzy78]

Crashes can already be reported to mod makers on this very forum and you can post surveys or ask users what other mods they're using.

Well, yeah. I don't think this thread is about discussing whether or not "just ask users" on the forums is going to get you reliable statistics - so I won't go into that here.

[Ippo]

Same thing here. I shouldn't have to look through thousands of words.

This is my cue to leave before I answer this and get permabanned. Feel free to infer my opinion of your post.

[diomedea]

I am seeing discussion turrning a bit too harsh at times... time to remind respect for everybody even while your opinion is different?

[Bamse]

Crashes can already be reported to mod makers on this very forum and you can post surveys or ask users what other mods they're using. Crash reporting and relationships between installed mods do not need to - and should not - come at the price of a piece of software which will download whatever is on some random person's private server at any given time without my prior informed consent.

First off, sorry for long post but I've been following this "situation" for quite some time and gotta let out some air (= Nothing personal about this seemingly ranty stuff, it's more of a "people type thing"

So you expect people who don't read the forum threads of said mod, to report crashes, provide logs and everything?

Isn't that fairly contradicting behaviour?

From a modders perspective, I get:

I know that far from everyone on this forum knows about coding or modding, but it is YOUR obligation to read the readme's and instructions of the mods you download, even if you don't understand the source code. When I comment some code I wrote, it's not my responsibility to make sure the end user reads it, but to make sure it's readable and understandable by another coder. If I want to make it understandable for the end user, I can, but that's often a lot of work, seeing as you have to cover all levels of understanding.

But as a tech savy, heavy modded KSP player:

If you download things to your computer, in my opinion, sign off as knowing what you are downloading. You don't bring total strangers into your home without at least doing some kind of assesment on them, same goes for software. If you don't trust the provider, you stay away from it. Seeing as every mod HAVE to give the source, you ALWAYS have the option to see what the plugin does. Whether you do or don't, is your own decission, but crying wolf about the intend and purpose of said mod is just riding the "Big Brother" wave of bad things.

And all this stuff about version checkers had me wonder: Have people ever been riled up about the checker in Kerbal Alarm Clock? Or the Toolbar? Those two have existed for quite some time and I have never seen people complain about that feature of those mods.

In the end, if you're afraid about being monitored on the Internet, I'm sorry to say, but you have been from the first time you plugged your computer in. It's the way the Internet works =)

[blizzy78]

Have people ever been riled up about the checker in ... the Toolbar? Those two have existed for quite some time and I have never seen people complain about that feature of those mods.

Yes, they have, in the process accusing me of producing malware and/or spyware.

[Dodgey]

-snip-

Same thing here. I shouldn't have to look through thousands of words -snip-

This caught my eye. One question how else apart from reading the thread, description or README file would you determine which is in the mod which you are downloading? This is of course forgetting going through the mod folders which should not be required.

[blizzy78]

how else apart from reading the thread, description or README file would you determine which is in the mod which you are downloading?

As I understood his post, it is trust what makes him expect things that mods do (or don't.)

[Dodgey]

As I understood his post, it is trust what makes him expect things that mods do (or don't.)

All I can say to that is welcome to the Internet, the KSP community is good but that doesn't mean you don't check what you are downloading, that's just common sense. As has been said in this very thread what if the mod maker changed the install process, or the now version wasn't compatiable with the old one and you lost your save. Or even required another mod to be installed as a dependancy. If you don't read the information provided to you than it is your fault for not being informed.

[Guest]

All I can say to that is welcome to the Internet, the KSP community is good but that doesn't mean you don't check what you are downloading, that's just common sense. As has been said in this very thread what if the mod maker changed the install process, or the now version wasn't compatiable with the old one and you lost your save. Or even required another mod to be installed as a dependancy. If you don't read the information provided to you than it is your fault for not being informed.

That's a good point but, for a lot of people who are angry, ModStats represents a new era of being careful and vetting every mod. Before ModStats the most that would happen is you getting yelled at for not reading the OP; now you get tracked. In part, I see the bad feelings boil down to the semi-obscure opt-out nature of the software (rather than an in-your-face dialog) and its habit of reappearing after you think you've deleted it. IMO ModStats was poorly executed, despite its intentions and obvious utility.

Whether users are right or wrong for feeling the way they do isn't the point, the fact is they do feel that way and logic (especially delivered in a demeaning manner) has an uphill battle against emotion. It's probably a good thing that this feeling of betrayal, right or wrong, come at virtually no cost at the end of the day.

Edited August 1, 2014 by regex

[DuoDex]

Yes, they have, in the process accusing me of producing malware and/or spyware.

I have looked at the source for that. I look at the source for it every release, because (no offense) I've never met you and don't trust you all that much (I'm a paranoid, I know, I know).

All it's ever been was a simple version check.

People who accuse you (Blizzy) of spyware are {insert massive rant here}. And, they accuse you of these things without actually checking to see if their accusations are even somewhat valid. A version check is not spyware. My browser does it. My Steam does it. My network admin software does it. My frickin' OS does it! No one's accused Firefox of being spyware, have they?

Edited August 1, 2014 by DuoDex

[Dodgey]

Well I think that a lot of those problems would be due to the fact that ModStats was in very much uncharted territory. If it was done over, and I hope it is, I think that it would be made a lot better.

Edit

Anyway this isn't the right place for that conversation.

Edited August 1, 2014 by Dodgey

[ragzilla]

All I can say to that is welcome to the Internet, the KSP community is good but that doesn't mean you don't check what you are downloading, that's just common sense. As has been said in this very thread what if the mod maker changed the install process, or the now version wasn't compatiable with the old one and you lost your save. Or even required another mod to be installed as a dependancy. If you don't read the information provided to you than it is your fault for not being informed.

RoverDude's comments on being right vs. being effective seem appropriate here, a lot of capital and trust has been burned during this whole event, and for little to no gain.

The whole thing was a violation of the principle of least astonishment for me. I've always used FAR and trusted that the code didn't do anything malicious or unethical. So when I suddenly get a popup about modstatistics (which I had no interest in running) wanting to update itself, after I updated FAR for 0.24, I was annoyed to say the least. You can take the righteous stand all you want (FAR has a disclaimer on the forum page, why didn't you read what you were installing?) but now you've thrown away the trust you've cultivated with that set of users for years just to get a statistics mod of questionable utility installed on your users PC.

[Laie]

This caught my eye. One question how else apart from reading the thread, description or README file would you determine which is in the mod which you are downloading? This is of course forgetting going through the mod folders which should not be required.

As I understood his post, it is trust what makes him expect things that mods do (or don't.)

Sounds like you're talking about me. Look at the Scansat download page: https://github.com/S-C-A-N/SCANsat/releases/tag/v6.1. It does mention ModStatistics, but somehow fails to point out that this is something people might want to opt out of. I downloaded the file, looked at the readme: not a word. In the changlog, nothing. In the modstatistcs folder: only dll files.

Yet that name, "ModStatistics", piqued my interested (I hadn't even heard about it before). So I asked google. Then I got angry. Then I had another good look at the forum page and found that yes, there is a line about modstatistics, hidden in plain sight. So I cannot claim that he's totally silent about it. But somehow, that only makes it worse.

Have another look at the ScanSat forum page: http://forum.kerbalspaceprogram.com/threads/80369

• [OPTIONAL] If you want to use the toolbar (you do!), download and install blizzy's Toolbar.
  
• [OPTIONAL] If you want to IVA w/ SCANsat (you do!) , downoad and install RasterPropMonitor.
  

Yet in the case of modstatitics, he's not suggesting, recommending or asking his users to install it. He just includes it in the bundle. Why does he feel the need to do it like this? I have a few ideas as to why, and even the benign ones aren't especially charming.

[Padishar]

The whole thing was a violation of the principle of least astonishment for me. I've always used FAR and trusted that the code didn't do anything malicious or unethical. So when I suddenly get a popup about modstatistics (which I had no interest in running) wanting to update itself, after I updated FAR for 0.24, I was annoyed to say the least. You can take the righteous stand all you want (FAR has a disclaimer on the forum page, why didn't you read what you were installing?) but now you've thrown away the trust you've cultivated with that set of users for years just to get a statistics mod of questionable utility installed on your users PC.

Well, if you didn't trust that Ferram4 (or any other modder) wouldn't bundle something with his mod unless he was happy that it was safe, then there wasn't a lot of trust to lose and you should never have installed his mod in the first place...

[Master Tao]

Yet in the case of modstatitics, he's not suggesting, recommending or asking his users to install it. He just includes it in the bundle. Why does he feel the need to do it like this?

I'm coming to this discussion as a former researcher – I've conducted research where the participants were all 4-6 years old and assisted in research with adults with aphasia. In each study, part of my role was to obtain informed consent*, so I'm familiar with the legal and ethical issues in the U.S.. Most research with human participants is opt-in because the risks, although usually very small, require that approach. That said, methodology research (yes, that's research on how to conduct research) has shown that opt-out approaches give more reliable data. When it's legal and ethical to use an opt-out approach, researchers try to do that to get more meaningful results. You still need to provide sufficient information that declining to opt-out can be considered informed consent. Here's a good discussion of a case of opt-out research that didn't provide enough information – if it were up to me, I would not have approved that study as it was.

I believe SQUAD's decision is the only one they could make because the legal issues vary too much around the world.

*And verbal assent from the kids – you can't consent to research until you're an adult. Parents consent, kids assent.

[Dodgey]

@laie I just don't want to quote your entire post.

Anyway, is there anyway to go straight to the download of the mod without first going through the forum page? I honestly don't think that the line about ModStats is hidden in any rational sense of the word. It's the second sentence on the page, second sentence. How is that hidden? And most of all how does it make it worse?

As for your last point both of those mods change the gameplay or visual astectics of the game in ways which are unneeded for scan sat to work, ModStats does not affect the game in anyway, it sits there quietly and does its job. Hence why it could be included. That's my hypothesis anyway, you would have to ask the mod author why if you really wanted to know.

As to your points about the lack of information in the download it's self, personally I think it shouldn't be needed to include information in the download, README, and I did say that it shouldn't be required to go through the mod folders, which it isn't.

So the "disclaimer" about ModStats isn't hidden away on the forum post, I agree that there should be a README for ModStats for redundancy sake, though shouldn't be needed for first hand information, and there is a possible explanation for why ModStats would be included in the download where as the other two mods weren't.

[blizzy78]

Yet in the case of modstatitics, he's not suggesting, recommending or asking his users to install it. He just includes it in the bundle.

You are wrong:

NOTE: This mod includes ModStatistics, an anonymous mod usage statistics plugin. See the ModStatistics thread for more information and opt-out instructions.

It says that very clearly near the top of the post. Also, it says so in the change log, which you should read every time you get a new version.

Edit: Okay, technically, just in case you might insist on your exact wording - yes, he does not suggest, recommend, nor ask for installation of ModStats. I was going more after the point where it had been suggested that he did not mention ModStats at all, which is not true. That said, it's his right to just bundle it without asking.

Edited August 1, 2014 by blizzy78

[ragzilla]

Edit: Okay, technically, just in case you might insist on your exact wording - yes, he does not suggest, recommend, nor ask for installation of ModStats. I was going more after the point where it had been suggested that he did not mention ModStats at all, which is not true. That said, it's his right to just bundle it without asking.

I think we can all agree that it is the modder's right to bundle whatever they want with their plugin (license permitting), but don't be surprised when there's a backlash from your users. Right vs effective etc.

Personally I feel that only hard dependencies providing essential functionality (jsonfx, firespitter, kae, etc) should be bundled, but I don't think we're likely to get community consensus on that point. And I don't think Squad wants to make a rule on that point.

[blizzy78]

I think we can all agree that it is the modder's right to bundle whatever they want with their plugin (license permitting), but don't be surprised when there's a backlash from your users. Right vs effective etc.

True that

[Justin Kerbice]

@Laie and some others: Scansat mod doesn't include a requirement/dependency/optional word about modstatistics BECAUSE it doesn't add any user's feature but an author's feature (to get stats about his/her mod), that's explain why. The bad thing is the author didn't pay enough attention to talk about it in the readme, miscommunication again maybe.

@many people who complaint: it's good to look at the source to check if everything is clear but... why complaining about this situation and some small stats, whereas you don't compile each single plug-in you use from it's source (provided according to rules) ? Are you 110% sure the plug-in you use (compiled code) comes from the provided source code ?

There is no checksums (bad habits or lack of good habit) so it is always possible the compiled version is the best-of spyware/malware ever made, and was not compiled from the source code provided. But you don't care about it, do you ?

And when you don't have any source code to check, you don't complain ? (MS OS and utils, Google apps, etc)

This controversy is just a black-hole that's suck a lot of time here, is there any redirect/shut-down black-hole mission ? contract maybe ? Jeb please come to help us !

[Borklund]

Nobody has yet to come up with a reason why a mod for a video game should dump the contents of some random person's private server onto my computer without my prior express consent, and that tells it all really.

[blizzy78]

I believe that is part of ModStats' auto updater? You should ask Majiir that question, really.

[Ippo]

It is not "the contents of someone's server", it is an auto-update feature for a modding API.

You are also asked if you want to consent to the automatic update.

[blizzy78]

Personally I feel that only hard dependencies providing essential functionality (jsonfx, firespitter, kae, etc) should be bundled, but I don't think we're likely to get community consensus on that point. And I don't think Squad wants to make a rule on that point.

(Forgot that in my previous post replying to yours.)

I don't think it is any of Squad's business to make rules on that.

[ragzilla]

Nobody has yet to come up with a reason why a mod for a video game should dump the contents of some random person's private server onto my computer without my prior express consent, and that tells it all really.

The auto-updater in Modstatistics is opt-in (don't remember if it's default checked or not), but it's implemented with absolutely no regard to security and is trivially exploited through DNS poisoning, HTTP interception, or a hack of Majiir's server.

(Forgot that in my previous post replying to yours.)

I don't think it is any of Squad's business to make rules on that.

If it helps avoid situations like this I'd be surprised if they hadn't at least considered it. The difficult part is the enforcement since it's so subjective w/r/t definition of a functionally necessary dependency. A possible compromise here would be that bundled plugins must be in their own gamedata folder (e.g. how firespitter and modmanager are distributed), and not bundled in with the mod you're downloading's gamedata folder.

Edited August 1, 2014 by ragzilla