Telemetry

[reuvenharrison]

Hi oasdiff users,
We would like to learn more about how you are using oasdiff in order to continue improving it, prioritize issues, and make the most useful enhancements.
To do so, we would like to implement a telemetry function that will send us some usage info and error reporting.
The telemetry feature will be enabled by default but can also be disabled by users who prefer not to share anything.
Needless to say, we will publish and respect a privacy policy excluding collection of any identifiable data.
We would like to hear your thoughts about this before going ahead.

• Would you allow such functionality?
• Any specific data you won't allow collecting?
• Other considerations?

Thanks,
The oasdiff team.

[PhilippHeuer]

Hi @reuvenharrison,

i've begun testing oasdiff yesterday and looked through the code a bit. I have a few concerns regarding the current telemetry implementation, particularly with the inclusion of the full command, args and flags.

• oasdiff changelog /home/firstname-lastname/openapi.json /home/firstname-lastname/openapi-v2.json -f json
• oasdiff changelog https://my-api/api-docs?apiKey=secret https://my-api-v2/api-docs?apiKey=secret -f json

If the args or flags include any sensitive file paths / API keys those would be leaked to your telemetry server.

--

I would suggest the following approach:

• exclude the args values (filenames / paths / urls) - could be replaced with the number of args provided.
• for all flags that accept freetext user input (for example --match-path) the values should be omitted, the fact that the flag was provided can stay. Flags that have fixed values (enum), ie. --lang / --format can include the value.

I think that this still provides you with enough information about how oasdiff is used, without users having a chance to expose any kind of sensitive data by accident.

--

Thanks for your work on this project, it is very useful for a use-case i am working on.

[effoeffi]

Thanks @PhilippHeuer for your feedback on the telemetry implementation.
User privacy is our top priority.
We will make a PR with the necessary changes, and we would love for you to review it.
In the meantime, if you have any other feedback, please don't hesitate to let us know.

[effoeffi]

@PhilippHeuer I've added you as a contributor to the oasdiff/telemetry repository, so you can review the PR

[PhilippHeuer]

@effoeffi thanks for taking a look at this issue so quickly.

The changes in the PR address my concerns, i left some additional comments in the PR.

[effoeffi]

@PhilippHeuer this PR should implement your suggestion into oasdiff. Please, review and let me know if you have any other feedback.

[PhilippHeuer]

The PR looks good to me, thanks for working on this issue.

[effoeffi]

Thanks for your insights @PhilippHeuer
I'll be happy to connect, here is my linkedin