Please count me as "one who does not sign up for surveys"

[ccoenen]

As with the State of CSS, I'll not be participating for the sole reason that I will not sign up for an account tied to a survey. This is data collection that is not necessary for this survey. I am wary of data collection in general, and while a survey is fine, it should only collect the data needed for the survey.

In this case, it's claimed that this is used to stop people from answering multiple times, but this is futile for many reasons:

a) there are other means to keep people from answering multiple times, or at least to make it impractical. b) even with email sign up, it's trivial to answer this survey multiple times. I bet that most in the intended audience have a number of mail addresses and/or whole domains to throw at the problem if they wanted to. c) is there any reason to suspect that this is even done on a significant scale to warrant such a step?

So, when the time comes to evaluate the results, please put me on the "cares about their privacy" tab. In this audience, I could imagine this being a non-negligible number of people.

[SachaG]

Thank you for your feedback. This is on our roadmap, but we just haven't had time yet to implement a way to let users fill out the survey anonymously. We do want to include a minimum amount of safeguards such as checking IPs, etc. (which ironically goes against the privacy you're arguing for) to avoid making it trivial for someone to ruin our efforts with a few lines of code.

Until we've done this we're sorry your voice won't be able to be counted in the survey. But since everything we do is open source you can always help us with a privacy-minded PR :)

[ccoenen]

Thank you for considering this.

Personally, I find IPs to be less problematic, where I live they are usually assigned randomly every 24h. I am aware that this is not generally the case.

The problem this brings up is companies (many many people behind the same NAT), IPv6 (where you often get a "small" block that's easily millions of individual IPs) or someone intentionally spamming via cloud servers (which will also each have different IPs). Along with people using TOR or one of the gazillion free VPN services, IPs alone will probably not be enough.

It's not a trivial problem, I agree. I am still thankful that this is something you are looking into.

[ccoenen]

I didn't really suspect this one in my short list of things that could happen, and yet I feel like it should have been on the list.

Sadly, apparently 2022 also has mandatory email signup.

[SachaG]

Yes, this is definitely highlighting the need for a specific auth flow instead of relying on the more traditional email/password combo. We are in the process of porting the whole app to a different stack, which hopefully will make it much easier to implement a custom system.