Remove Mapbox Telemetry / phone-home code about maplibre-gl-js HOT 11 CLOSED

@snickell (cc @nyurik )

do you happen to know where phone home code(s) currently live in the codebase? Do you have a sense how complex this is? I have no idea if this is a "comment out a line" task, or a big endeavor

As I understand, all (at least most) "phone-home" and, more generally, Mapbox-specific code is encapsulated in the single file. This code is used only for Mapbox tiles. So, at the technical level, there is nothing to remove.

But I think that we have a problem at the legal level. Here is a header of this file:

/***** START WARNING - IF YOU USE THIS CODE WITH MAPBOX MAPPING APIS, REMOVAL OR
* MODIFICATION OF THE FOLLOWING CODE VIOLATES THE MAPBOX TERMS OF SERVICE  ******
* The following code is used to access Mapbox's Mapping APIs. Removal or modification
* of this code when used with Mapbox's Mapping APIs can result in higher fees and/or
* termination of your account with Mapbox.
*
* Under the Mapbox Terms of Service, you may not use this code to access Mapbox
* Mapping APIs other than through Mapbox SDKs.
*
* The Mapping APIs documentation is available at https://docs.mapbox.com/api/maps/#maps
* and the Mapbox Terms of Service are available at https://www.mapbox.com/tos/
******************************************************************************/

As I understand from this text, you are not allowed to

1. Access Mapbox Mapping APIs without this code
2. Use this code without Mapbox SDKs (which is, in this case, Mapbox GL JS).

So, it seems to me that it's legal to use Mapbox Mapping API from any other project/fork, even if you fully copy-pasted this file and use it properly. If it's really so, it's a big problem for the community-driven fork - Mapbox datasets and base maps are pretty popular.

What do you think about it? Should we clarify this situation directly with someone at Mapbox?

from maplibre-gl-js.

Some additional related thoughts. If there is a decision to keep the phone-home code or add additional ones for other map platforms we should also think about how we want to make this available to developers.

With of us coming together to create this fork I'm sure there is plans by many to use different sources of tiles (vector/raster) for the base maps. Looking at other open source projects I have seen different approaches for how to make it easier for developers to pull in the base map tiles they want. Some hard code a list of all services and the user simply says display map X. I have two concerns with this approach;

1. This means that all the details for these services are downloaded by end users when they load a map using this library, even if the developer of that app only exposes a handful of base map options they want to provide.
2. Different services have different authentication options for their tile services. If the service has no authentication or uses a access token or subscription key in a URL, then that's fairly lightweight, but not really secure. Some services offer more secure options, like Azure Active Directory which usually means pulling in a library (i.e https://github.com/AzureAD/microsoft-authentication-library-for-js) which would add extra bulk to the map library and would be a waste for apps who don't need this. There are other approaches I've seen companies make to lock down their tile services as well, which would add yet more complications.

With this in mind, perhaps a modular approach to pulling in providers for base maps makes sense.

Similarly developers also need services such as geocoding in their apps, so we could look at defining a standard schema so any map data provider can create a module can that exposes an API interface that aligns with that standard and developer can easily pull in and swap out different providers easily.

from maplibre-gl-js.

@nyurik do you happen to know where phone home code(s) currently live in the codebase? Do you have a sense how complex this is? I have no idea if this is a "comment out a line" task, or a big endeavor

from maplibre-gl-js.

What's phone-home code ?

from maplibre-gl-js.

A quick 2-pence on this. I'm not a serious developer, so not sure if I can contribute to the codebase, but I make a lot of use of mapbox-gl-js using alternative tile providers and self-hosted tiles.

One thing to bear in mind is what needs to go in the "quick start" documentation to orient new users. Currently, in all the examples on the Mapbox site, it's assumed that you load a Mapbox base "style", which then requires a token. A few possibilities/considerations to think about:

1. Include quick start documentation on how to get a map up and running with token-free raster tile provider, eg. OSM or Stamen (using the vanilla library, without plugins), or with no base tiles at all (eg. if working with geojson sources).
2. Point people to good documentation on how to download or brew their own vector tiles.
3. Consider whether a CDN version of the library should include things like glyphs and sprites, for people who want to get up and running quickly with their OpenMapTiles downloads or their own home-brewed vector tiles.
4. Maintain (or point to) good, concise, documentation for creating vector tile styles that make use of the above (as a new user, I found the OMT documentation on styles pretty opaque, and it wasn't that clear that the only things you need to edit to get started were the tile source, glyphs and sprites).

from maplibre-gl-js.

I noticed src/util/sku_token.js (small file) is also related to Mapbox ToS and could be removed in a future version (in #21?). From the repository history, that warning was added in May 2019.

Among many other things, someone already asked about third-party libraries on the mapbox-gl-js v2.0 ticket. No answers yet.

Depending on how things evolve, it could be better to start fresh based on a more general module/plug-in approach as @rbrundritt mentions, removing this code and creating a new version based on the API docs from Mapbox instead. Note that I couldn't find explicit requirements for the SKU token on that page or in the ToS, but maybe they will be updated later. There is a separate, glossary page for "SKU token" (@exotfboy: this token is the phone-home thing that tracks usage).

from maplibre-gl-js.

Perhaps a useful reference - a search for all instances of "mapbox" in this codebase:
https://github.com/maplibre/maplibre-gl-js/search?q=mapbox

The "phone home" aspect can be identified as a subset of that search result, I think, by isolating URLs that contain mapbox in them, like this

from maplibre-gl-js.

More instances of mapbox in URLs:

That's all I see up to Page 5. One could keep going.

It should be doable to isolate all these URLs with some command line tool and a regular expression...

from maplibre-gl-js.

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days.

from maplibre-gl-js.

This issue was closed because it has been stalled for 30 days with no activity.

from maplibre-gl-js.

Has been implemented with the typescript migration.

from maplibre-gl-js.