On Tue, Sep 07, 2021 at 05:54:09PM +1000, Tim Cross wrote:

[...]

> I was thinking of only getting data on 'non-sensitive' variables

Of course, I didn't assume otherwise. What I was aiming at is that
classifying /which/ variables can be considered 'non-sensitive' is
already some non-negligible work, that's all (and leaving the
decision to each single user doesn't seem fair).

>                                                                and
> only aggregate data would be available (i.e. make sure it is not
> possible to say person x submitted values a, b and c).

Of course. Correlations between values might be of interest.

> [...] The possible downside is that this would be
> open to 'gaming' the system, but I'm not sure we need to worry about
> that too much - there is little reward in doing so.

This is why I pointed to Debian's popcon: they just live with that,
and that doesn't seem to be a problem.

> The system would definitely be 'opt in' and the user would be shown
> exactly what is going to be sent (and provided with the ability to
> remove anything they are not comfortable with). 

Also, see popcon.

As a small nit: why JSON and not S-expressions? We're lispies, after
all ;-)

But the latter are just details. I guess who gets to implement gets
to choose. That might be an incentive ;-P

Cheers
 - t