Go 1.23 is out, the first major release since February, and now including telemetry for the Google-sponsored project as well as new features including enhanced for-range loops.

Google distinguished engineer Russ Cox, who is tech lead for the Go programming language, posted in February 2023 about telemetry for open source projects, with the Go language in mind. “Without telemetry, developers rely on bug reports and surveys to find out when their software isn’t working or how it is being used. Both of these techniques are too limited in their effectiveness ,” he wrote.

Cox acknowledged that telemetry evokes negative reactions, because of privacy concerns. Another more nuanced problem is restricting access to telemetry data, which makes an open source project less open. He argued though that the choice between invasive tracking, and doing nothing, “is a false dichotomy, and it’s harming open source.”

Cox proposed collecting anonymous information from the Go toolchain – not from compiled Go applications – and posting the results for public download. Google would strip and protect identity information such as source IP numbers.

An ensuing discussion provoked plenty of objections, including some specifically related to this being Google, known for collecting data for marketing reasons, even though this is not the intent of the Go team. “I have resisted Go for years because it comes from Google … now you guys want to introduce telemetry into your programming language? This is how you drive off any person who even considered giving your project a chance,” said one. Others questioned compatibility with GDPR, the EU’s data protection law, or said that “there is no reason for a development chain to have any kind of telemetry on by default.”

In response Cox changed the proposal to be opt-in. He acknowledged theoretical reidentification risks, where attackers are able to figure out identity information from supposedly anonymized data. He also expressed concern about finding a path that works for many open source projects, not just Go. “If Go’s telemetry were opt-out, that might be used to justify other opt-out systems that are not as careful about what they collect,” he said. In his sights is Microsoft’s .NET telemetry, which is enabled by default and which he said collects more data than is proposed for Go.

Cox proposed a campaign to ask users to opt-in, such as during a graphical install or when VS Code Go is first used. We installed the official Go extension for VS Code and it does pop up a request to turn on telemetry. It also invites developers to view an analysis of the telemetry data on the local machine via the command: go run golang.org/x/telemetry/cmd/gotelemetry@latest view.

Telemetry in Go 1.23 has three modes, of which the default is “local”, meaning data is collected but not uploaded. The other modes are on and off; when on, the data is uploaded to Google. The data can be viewed in summary at https://telemetry.go.dev/ where we learn that only a few submissions are being made currently. There is data, for example, on the operating system used to run the Go command, showing for the last 7 days 21 invocations on Linux, 14 on macOS, 1 on Windows and 1 on FreeBSD – early days so far.

Has the Go team got it right? The problem with opt-in is that many developers will not do so, and those who do may be a non-representative subset. “I fear that this will bias the sample set and ultimately make this design worthless,” argued one developer.

Telemetry aside, Go 1.23 has new features including that “range-over-func”, previously experimental, is now part of the language. This enables for statements with a range clause that can be a function. Cox said in the proposal for this feature, in October 2022, that  “we should converge on a standard way to handle iteration in Go, and one way to incentivize that is to support it directly in range syntax.”

More details about Go 1.23 are in the release notes.