I find that "upstream" might be at odds with security/privacy, both in terms of funding and data collection (benign reasons being debug/crash data collection as well as "what and how do people use this")