Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew now sends usage information to Google Analytics

github.com

Post reply on HN
Print view View original

251–260 of 329 posts

Re: Homebrew now sends usage information to Google Analytics

#251

Post by TheLogothete »

mortenlarsen wrote: post #133
TheLogothete wrote: post #120

Earlier quoted context omitted.

It does not compromise the user's privacy in any way. GA prohibits PII. Also, the webmaster has to opt-in to share the data with Google in the first place.

Some people disagree. If they didn't, why is this on HN with a lot of comments from people who a unhappy with this change? If software compromises my privacy, I feel that I have been betrayed and lost something that I can not take back. If you don't get to automatically participate in a "anonymous" usage survey, have you lost something you can not undo? That in my opinion, is why software should always err on the sid…

People just LOOVE to be outraged. For example in this thread people rage about google getting hands on their data. When I point out that the webmaster has to explicitly chose to share the data with google, I get downvoted. When I say that GA prohibits the use of PII, I get downvoted. It doesn't matter that I'm right. People WANT to be outraged. Reason, no reason, doesn't matter.

Re: Homebrew now sends usage information to Google Analytics

#254

Post by TheLogothete »

joepie91_ wrote: post #130
TheLogothete wrote: post #92

Earlier quoted context omitted.

Google does not use GA data unless the webmaster chooses to share it with them. I'm not sure if they use it to improve their ad products, but I wouldn't be surprised if the answer is no.

Firstly, this is a decision that should be up to the user , not the webmaster. Secondly, do you have a source for that? I find that a very dubious claim, from a business perspective.

Everyone who has signed up for GA knows it. When you sign up you are asked 2 questions:

Do you want to share data with google to imrpove our products?

Do you want to pool your data for benchmarking purposes?

Both are unchecked by default. But here you go, I will search for "google analytics data sharing" for you.

https://support.google.com/analytics/answer/1011397?hl=en

Re: Homebrew now sends usage information to Google Analytics

#255

Post by Rebelgecko »

tsujamin wrote: post #187
isomorphic wrote: post #43

Earlier quoted context omitted.

I am confirming that Homebrew silently starts talking to Google with no warning after a "brew upgrade".

I was prompted with a warning during my most recent brew update...

I brew updated a few times today and finally got that message. By the time that message showed up, the file ~/.homebrew_analytics_user_uuid was already 4 hours old, which makes me wonder when they actually started doing the analytics

Re: Homebrew now sends usage information to Google Analytics

#256

Post by stephenr »

TheLogothete wrote: post #253

Yeah. So every site and every product on the internet has this dark pattern. Do you use google? Youtube? StackOverflow? Are you outraged by them too?

> So every site and every product on the internet has this dark pattern.

Not every site/product on the internet uses an abusive analytics platform, hell not all of them use analytics at all.

With sites visited in a browser, an extension can be used to block access to abusive services such as GA. There is no Ghostery for the terminal.

I have no issue with them wanting to collect usage information. I opt-in to Debian's package usage tracking.

If I still used Homebrew, I would have a huge issue with them sending information about what packages I install to Google.

Re: Homebrew now sends usage information to Google Analytics

#257

Post by TheLogothete »

stephenr wrote: post #256
TheLogothete wrote: post #253

Yeah. So every site and every product on the internet has this dark pattern. Do you use google? Youtube? StackOverflow? Are you outraged by them too?

> So every site and every product on the internet has this dark pattern. Not every site/product on the internet uses an abusive analytics platform, hell not all of them use analytics at all. With sites visited in a browser, an extension can be used to block access to abusive services such as GA. There is no Ghostery for the terminal. I have no issue with them wanting to collect usage information. I opt-in to Debian's…

How is GA abusive? The webmaster has to explicitly permit data sharing with google. That is, the webmaster is asked if s/he wants to share data with google and the options are unchecked by default.

GA prohibits the use of personally identifiable information.

Additionally the webmaster can tell google to not store IP info, which the webmaster has chosen to this in this case.

Re: Homebrew now sends usage information to Google Analytics

#258

Post by stephenr »

TheLogothete wrote: post #257
stephenr wrote: post #256

Earlier quoted context omitted.

> So every site and every product on the internet has this dark pattern. Not every site/product on the internet uses an abusive analytics platform, hell not all of them use analytics at all. With sites visited in a browser, an extension can be used to block access to abusive services such as GA. There is no Ghostery for the terminal. I have no issue with them wanting to collect usage information. I opt-in to Debian's…

How is GA abusive? The webmaster has to explicitly permit data sharing with google. That is, the webmaster is asked if s/he wants to share data with google and the options are unchecked by default. GA prohibits the use of personally identifiable information. Additionally the webmaster can tell google to not store IP info, which the webmaster has chosen to this in this case.

> The webmaster has to explicitly permit data sharing with google.

Abusive to users. Google's whole reason for offering free analytics is to build better advertising profiles.

> Additionally the webmaster can chose to not send IP info to google,

I must have missed the memo where Google invented a way to make HTTP connections with no client IP.

Re: Homebrew now sends usage information to Google Analytics

#259

Post by mortenlarsen »

TheLogothete wrote: post #253

Yeah. So every site and every product on the internet has this dark pattern. Do you use google? Youtube? StackOverflow? Are you outraged by them too?

I have come to expect some tracking of stuff that happens in my browser. I try to block as much of it as I can with noscript, ublock, etc.

But I do not expect applications outside of my browser to behave like web sites do.

Re: Homebrew now sends usage information to Google Analytics

#260

Post by pdkl95 »

developer2 wrote: post #226
pdkl95 wrote: post #223

Earlier quoted context omitted.

> It's physically impossible for this to be malicious. It's "physically impossible for Google to read the IP header addresses if the pack data contains "&aip=1"? The IP is still logged with Google, according to their own documentation[1]: When present, the IP address of the sender will be anonymized. So-called "anonymized" data can be re-correlated with the original values. DJB's gave a great description[2] of this p…

>> The IP is still logged with Google, according to their own documentation Not quite[1]. The full IP never makes it to disk. It's true that "anonymous IP" isn't as anonymous as I'd have expected. Only the last octet of an IPv4 address is removed. Considering homebrew's use specifically , not just looking at GA in general, I think this is acceptable. [1] https://support.google.com/analytics/answer/2763052?hl=en

> The full IP never makes it to disk.

The full IP makes it to Google. We don't know what Google actually does with the packets they receive; we only know what they say.

> Only the last octet of an IPv4 address is removed.

Really? Wow. They aren't even pretending to anonymize addresses with a hash. Given that there is certainly more than 8-bits of identifying data in the other data sent to GA, a unique identifier can easily be recovered. Also, the bits they mask are the least interesting part of the address. They are preserving the network part of the address, which probably gives them the AS number.

> Considering homebrew's use specifically, not just looking at GA in general

That's the point - homebrew is choosing to add data to GA, which cannot be considered in isolation. The problem with GA isn't that they collect data from any particular site. Knowing that you occasionally visit ${website} might be interesting, but it's of limited value and relevancy. A list of people that visit ${political_opponent}'s website might be very interesting, but most of the time nobody is going to care. Knowing that you installed some software isn't interesting in most cases.

All of those situations change when someone can aggregate the data. Consider all those data points combined with the other websites that send data to GA, gmail, when you loaded the Javascript, fonts, etc hosted by Google. Add in all the data that is sent to Google from Android devices, Chrome, Nest, and every other product that Google (err, "Alphabet") is involved in. In aggregate, just the timestamps and partial address information will produce surprisingly accurate profile of your life. This gets scary when you start to do an actual pattern-of-life analysis and correlate "anonymized" data back to real names.

Post reply on HN