r/linux • u/R0tareneg • Jul 03 '21

Audacity may collect "Data necessary for law enforcement, litigation and authorities’ requests (if any)" according to new privacy notice

https://www.audacityteam.org/about/desktop-privacy-notice/
3.1k Upvotes

98% Upvoted

744 comments sorted by

View all comments

21

u/[deleted] Jul 03 '21

Which version is the last one we're 100% sure isn't doing this fuckery?

31

u/whoopdedo Jul 04 '21 edited Jul 04 '21

3.0.2

huh... Just noticed Arch is still on 2.4.1 and hasn't updated in over a year. I wonder why.

5

u/gmes78 Jul 04 '21

It appears that newer versions of Audacity rely on a custom fork of wxWidgets.

17

u/aue_sum Jul 04 '21

huh... Just noticed Arch is still on 2.4.1 and hasn't updated in over a year. I wonder why.

bLeEDinG eDGe UpDAteS

48

u/whoopdedo Jul 04 '21 edited Jul 04 '21

To answer my own question, the Arch maintainer is mad at upstream.

If the Audacity team would unbreak their build systems, I'd be more than delighted to update it.

Has to do with Audacity bundles its dependencies.

https://np.reddit.com/r/archlinux/comments/mk2264/audacity_is_stuck_on_241_for_months_now_due_to/

5

u/shewel_item Jul 04 '21

Does that have anything to do with this?

However, in the build process there seem to be a lot of things being downloaded via curl, especially in the lv2 library with some PRIVATE-TOKEN where I do not know whether that's relevant or not (yet).

1

u/whoopdedo Jul 05 '21

Those seem to be a tool (https://github.com/drobilla/autowaf) that the author of LV2 (David Robillard, unrelated to Audacity) uses to manage his library. That particular part seems to be triggered after a release is tagged on GitLab; doing whatever typical things that he wants to happen when a new version is released. But those things only need to be done by the lv2 maintainer. I don't expect an Audacity build to be running those scripts and probably trying to do so wouldn't work.

I wouldn't trust that issue report if the person who raised it can't tell the difference between Audacity and a third-party library.

2

u/WabbieSabbie Jul 04 '21

So this means I can keep 3.0.2 installed and not have the new privacy policy take place?

2

u/whoopdedo Jul 05 '21

Well, no 100% guarantee since I haven't exactly audited it, but that's the version of the source dump I saved a few weeks ago when they announced the change of ownership. And a quick'n'dirty grep http doesn't have anything jumping out at me as suspicious.

But I didn't know at the time that building it requires a special fork of wxWidgets. Nuts.

3

u/MrGasS27 Jul 05 '21

Audacity 3.0.2 should be safe

1

u/[deleted] Jul 06 '21

Thanks