I thought I’d give this a shot, but the metrics/data collection flag was turned on by default and when I added a command to my docker-compose to turn them off, it was ignored. Then, I created an account and looked for a way to turn them off in the settings and there was none. You expect people interested in self-hosting OSS to be cool with sending data out of their network every time the server is started, a memo is created, a comment is created, a webhook is dispatched, a resource or a user is created?! Also, the metrics are collected by a 3rd party with their own ToS that could change at any time?
Holy hell, hard pass. I’d rather use a piece of paper.
Saved me the effort, thanks. Although, couldn't you just block the container from talking outside your network? I can't see why I'd need a memo app (server) to have access to the internet.
That’s not good enough in my opinion, it should be opt in, not opt out. They’re marketing it on their site as being more secure because you can self-host. It all just seems really skeevy.
It would appear that blocking app.posthog.com on the host/network resolves this. But I got the parameter to work, too, as per https://www.usememos.com/docs/advanced-settings/metrics use '--metric=false' and bam, no DNS queries!
Yeah, I’d assumed it would respect the —metric=false flag when building with docker run, but docker-compose is ostensibly supported and easier to work with. I was able to successfully change other configuration options (such as setting the db to use MySQL instead of the default SQLite) using the docker-compose ‘command’ block, but the metric flag specifically was ignored. It’s entirely possible that this is a bug and not an intentional attempt to hoover up user data. Either way, data collection should be opt-in by default (by law, imo).
Ah - I actually moved away from Memos (I just wasn't using it and it was taking resources for no benefit) so I can't actually directly help, buuuuuut I want to be optimistic and assume that the 'feature' was removed given the page 404ing.
You could use something like NextDNS (or any other DNS solutions that offer logging, I just use ND on my network), set up as the server's DNS provider, and see if the domain (above) shows up in the logs after a couple days. Though if you're running other software alongside it, then it might not be from Memos, which can lead you down a 'disable, wait, check, repeat' rabbit hole. But that's how I would do it, myself.
Sorry I don't have a quick and easy solution for you :(
17 Comments
Jimbabwe@lemmy.world · 80 pts · 2y
I thought I’d give this a shot, but the metrics/data collection flag was turned on by default and when I added a command to my docker-compose to turn them off, it was ignored. Then, I created an account and looked for a way to turn them off in the settings and there was none. You expect people interested in self-hosting OSS to be cool with sending data out of their network every time the server is started, a memo is created, a comment is created, a webhook is dispatched, a resource or a user is created?! Also, the metrics are collected by a 3rd party with their own ToS that could change at any time?
Holy hell, hard pass. I’d rather use a piece of paper.
DeltaTangoLima@reddrefuge.com · 12 pts · 2y
Saved me the effort, thanks. Although, couldn't you just block the container from talking outside your network? I can't see why I'd need a memo app (server) to have access to the internet.
wreckedcarzz@lemmy.world · 2 pts · 2y
See my adjacent comment
DeltaTangoLima@reddrefuge.com · 1 pts · 2y
Ah, nice one. Still, a bit annoying that it's opt out, rather than opt in.
wreckedcarzz@lemmy.world · 3 pts · 2y
I'd rather it be an initial setup question and/or at least a UI toggle in the settings, yeah
princessnorah@lemmy.blahaj.zone · 4 pts · 2y
That’s not good enough in my opinion, it should be opt in, not opt out. They’re marketing it on their site as being more secure because you can self-host. It all just seems really skeevy.
wreckedcarzz@lemmy.world · 12 pts · 2y
It would appear that blocking
app.posthog.comon the host/network resolves this. But I got the parameter to work, too, as per https://www.usememos.com/docs/advanced-settings/metrics use'--metric=false'and bam, no DNS queries!Jimbabwe@lemmy.world · 4 pts · 2y
Yeah, I’d assumed it would respect the —metric=false flag when building with docker run, but docker-compose is ostensibly supported and easier to work with. I was able to successfully change other configuration options (such as setting the db to use MySQL instead of the default SQLite) using the docker-compose ‘command’ block, but the metric flag specifically was ignored. It’s entirely possible that this is a bug and not an intentional attempt to hoover up user data. Either way, data collection should be opt-in by default (by law, imo).
EVERGREEN@lemmy.one · 2 pts · 2y
wreckedcarzz@lemmy.world · 2 pts · 2y
Ah - I actually moved away from Memos (I just wasn't using it and it was taking resources for no benefit) so I can't actually directly help, buuuuuut I want to be optimistic and assume that the 'feature' was removed given the page 404ing.
You could use something like NextDNS (or any other DNS solutions that offer logging, I just use ND on my network), set up as the server's DNS provider, and see if the domain (above) shows up in the logs after a couple days. Though if you're running other software alongside it, then it might not be from Memos, which can lead you down a 'disable, wait, check, repeat' rabbit hole. But that's how I would do it, myself.
Sorry I don't have a quick and easy solution for you :(
EVERGREEN@lemmy.one · 2 pts · 2y
wreckedcarzz@lemmy.world · 2 pts · 2y
If you remember, reply back - someone else will surely run across this and have the same question!
EVERGREEN@lemmy.one · 2 pts · 2y
RubberElectrons@lemmy.world · 6 pts · 2y
Aww, I love their icon!
Akui@lemmy.ml · 3 pts · 2y
ngl, at first glance I thought it was a ghost boy singing into a headset ^^;
Discover5164@lemm.ee · 3 pts · 2y
how does this compare with silverbullet?
can i link pages? do queries?
KLISHDFSDF@lemmy.ml · 5 pts · 2y
Ooh silverbullet looks nice too, thanks. Link for the lazy: https://silverbullet.md/
jcrabapple@infosec.pub · 1 pts · 2y
So this is like a public notebook?
wreckedcarzz@lemmy.world · 2 pts · 2y
"public" to registered users, it seems (but by default, memos are private; and the ability to set them as publicly can be disabled by the admin)
namelivia@lemmy.world · 1 pts · 2y
Nice! But I'm currently using Obsidian for note taking