Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew now sends usage information to Google Analytics

github.com

Post reply on HN
Print view View original

221–230 of 329 posts

Re: Homebrew now sends usage information to Google Analytics

#221

Post by pessimizer »

developer2 wrote: post #220
couchand wrote: post #211

Earlier quoted context omitted.

That doesn't follow. The fact that many websites do this doesn't prove that it isn't malicious. It may not be (it probably isn't), but that has little to do with the complaints made about the change.

Not even your IP address is recorded. It's physically impossible for this to be malicious. There are no real privacy advocates complaining here, only people who post "it must be opt-in!" as an instant reaction to just reading the term "opt-out". Most of the complaints are probably from people who have never even used homebrew. The submission headline contains the phrase "Google Analytics", which attracts the people w…

I think the phrase you're looking for is "no true privacy advocates."

Re: Homebrew now sends usage information to Google Analytics

#222

Post by pdkl95 »

dudus wrote: post #212
fabulist wrote: post #163

Earlier quoted context omitted.

"We use the information we collect from all of our services to provide, maintain, protect and improve them, to develop new ones, and to protect Google and our users. We also use this information to offer you tailored content – like giving you more relevant search results and ads." https://www.google.com/intl/en/policies/privacy/ "When you visit a website that uses our advertising products (like AdSense), social produ…

Also related: """ Google Analytics protects the confidentiality of Google Analytics data in several ways: Google Analytics data may not be shared without customer consent, except under certain limited circumstances, such as when required by law. Security-dedicated engineering teams at Google guard against external threats to data. Internal access to data (e.g., by employees) is regulated and subject to the Employee A…

> protects the confidentiality

For their definition of "confidential", which they can change at any time.

> certain limited circumstances

If they only intended the "required by law" example, they wouldn't use such a broad - and completely undefined - set of circumstances.

> guard against external threats

Google may have good security practices now, but an continually growing collection of highly-revealing tracking data is a very tempting target for many businesses, governments, etc. If Google (or anybody else) wants to claim that they are protecting your data, they should indemnify the subjects of their spying against any damages those caused by those "external threats".

Re: Homebrew now sends usage information to Google Analytics

#223

Post by pdkl95 »

developer2 wrote: post #220
couchand wrote: post #211

Earlier quoted context omitted.

That doesn't follow. The fact that many websites do this doesn't prove that it isn't malicious. It may not be (it probably isn't), but that has little to do with the complaints made about the change.

Not even your IP address is recorded. It's physically impossible for this to be malicious. There are no real privacy advocates complaining here, only people who post "it must be opt-in!" as an instant reaction to just reading the term "opt-out". Most of the complaints are probably from people who have never even used homebrew. The submission headline contains the phrase "Google Analytics", which attracts the people w…

> It's physically impossible for this to be malicious.

It's "physically impossible for Google to read the IP header addresses if the pack data contains "&aip=1"? The IP is still logged with Google, according to their own documentation[1]:

    When present, the IP address of the sender will be anonymized.
So-called "anonymized" data can be re-correlated with the original values. DJB's gave a great description[2] of this problem, right after he started working for Verizon[3]:

    Hashing is magic crypto pixie-dust, which takes personally identifiable
    information and makes it incomprehensible to the marketing department.
    When a marketing person looks at random letters and numbers they have no
    idea what it means. They can't imagine that anybody could possibly
    understand the information, reverse the hash, correlate the hashes, track
    them, save them, record them.
[1] https://developers.google.com/analytics/devguides/collection...

[2] https://projectbullrun.org/surveillance/2015/video-2015.html...

[3] If you don't believe that DJB works for Verizon, ask the man in the middle... who may have been making an elaborate joke.

Re: Homebrew now sends usage information to Google Analytics

#224

Post by tristor »

alainv wrote: post #165
tristor wrote: post #151

Here's a quick and dirty way to opt out for BASH and ZSH users for easy copy/pasting. BASH: cat > .bashrc # Opt out of Homebrew analytics export HOMEBREW_NO_ANALYTICS=1 if [[ -e "$HOME/.homebrew_analytics_user_uuid" ]]; then rm -f "$HOME/.homebrew_analytics_user_uuid" fi EOF ZSH: cat > .zshrc # Opt out of Homebrew analytics export HOMEBREW_NO_ANALYTICS=1 if [[ -e "$HOME/.homebrew_analytics_user_uuid" ]]; then rm -f "…

`rm -f` ignores nonexistent files so you could omit the `if` to be concise.

Good call. I was mainly using `-f` to suppress the prompt about deleting the file, but you're correct, it's unnecessary to have the if statement in this case.

Re: Homebrew now sends usage information to Google Analytics

#225

Post by tristor »

hk__2 wrote: post #166
tristor wrote: post #151

Here's a quick and dirty way to opt out for BASH and ZSH users for easy copy/pasting. BASH: cat > .bashrc # Opt out of Homebrew analytics export HOMEBREW_NO_ANALYTICS=1 if [[ -e "$HOME/.homebrew_analytics_user_uuid" ]]; then rm -f "$HOME/.homebrew_analytics_user_uuid" fi EOF ZSH: cat > .zshrc # Opt out of Homebrew analytics export HOMEBREW_NO_ANALYTICS=1 if [[ -e "$HOME/.homebrew_analytics_user_uuid" ]]; then rm -f "…

You don’t need to remove that file; the whole point of this env variable is that it stops Homebrew from sending any data. It won’t even be created if that variable is set.

That's only true if the variable is set before the first instance when data would have been sent, otherwise the file will exist (as it did on my system).

Re: Homebrew now sends usage information to Google Analytics

#226

Post by developer2 »

pdkl95 wrote: post #223
developer2 wrote: post #220

Earlier quoted context omitted.

Not even your IP address is recorded. It's physically impossible for this to be malicious. There are no real privacy advocates complaining here, only people who post "it must be opt-in!" as an instant reaction to just reading the term "opt-out". Most of the complaints are probably from people who have never even used homebrew. The submission headline contains the phrase "Google Analytics", which attracts the people w…

> It's physically impossible for this to be malicious. It's "physically impossible for Google to read the IP header addresses if the pack data contains "&aip=1"? The IP is still logged with Google, according to their own documentation[1]: When present, the IP address of the sender will be anonymized. So-called "anonymized" data can be re-correlated with the original values. DJB's gave a great description[2] of this p…

>> The IP is still logged with Google, according to their own documentation

Not quite[1]. The full IP never makes it to disk. It's true that "anonymous IP" isn't as anonymous as I'd have expected. Only the last octet of an IPv4 address is removed. Considering homebrew's use specifically, not just looking at GA in general, I think this is acceptable.

[1] https://support.google.com/analytics/answer/2763052?hl=en

Re: Homebrew now sends usage information to Google Analytics

#227

Post by vorg »

Touche wrote: post #183
toomuchtodo wrote: post #122

Earlier quoted context omitted.

Okay. Is everyone going to pony up for a self-hosted analytics box and the time to manage it? No? Of course not. Everyone wants to complain, no one would contribute resources to do it though. Privacy has a high moral value (its free to want it and complain about it), but small economic value (you use Chrome? It sends everything you do back to Google. You'll still use it, because its better than not).

a HN thread is not the appropriate place to ask for resources for a project. There are many OS projects out there with larger needs than an analytics server that have managed to get the support they need. If resources are an ongoing problem you even have the option of applying to join a free software foundation like Apache that has resources.

> join a free software foundation like Apache that has resources

There's a reciprocal arrangement here. One of the requirements of joining the Apache Software Foundation is using "Apache" when refering to the name of the software product for the first time in a new context, e.g. first mention on a webpage. Apache Groovy was promoted from Apache's incubator last November (2015), so I've been doing just that ever since. Unfortunately, many of the developers who work on Groovy don't bother, availing themselves of those resources but not giving back to the foundation the small amount asked.

Re: Homebrew now sends usage information to Google Analytics

#228

Post by cat-dev-null »

javajosh wrote: post #195
mikemcquaid wrote: post #193

I'm the maintainer who added this. I apologise for the poor communication. I would have responded sooner but I've been on a plane for the last 10 hours. I'd hoped the documentation would have made clear our reasons for doing this but I feel the discomfort so since getting off my flight I've opened and merged three PRs ( https://github.com/Homebrew/install/pull/42 https://github.com/Homebrew/brew/pull/143 https://gith…

It should be opt-in, not opt-out.

Opt-in, like optional security, rarely gets used.

Re: Homebrew now sends usage information to Google Analytics

#230

Post by cat-dev-null »

mikemcquaid wrote: post #193

I'm the maintainer who added this. I apologise for the poor communication. I would have responded sooner but I've been on a plane for the last 10 hours. I'd hoped the documentation would have made clear our reasons for doing this but I feel the discomfort so since getting off my flight I've opened and merged three PRs ( https://github.com/Homebrew/install/pull/42 https://github.com/Homebrew/brew/pull/143 https://gith…

Please leave it like countries with good organ donation opt-out policies.

Speaking of which, become an organ donor if you live in an opt-in country.

Post reply on HN