Live data from Hacker News

Brew commands send data to Google Analytics

tobiastom.name

71–80 of 342 posts

Re: Brew commands send data to Google Analytics

#71

I was aware, because I run Little Snitch. If you care, you should be too.

You're right, we probably should be using Little Snitch — just know that it's not a golden ticket! There has been some research about bypassing Little Snitch, for example this one from 2016:

https://speakerdeck.com/patrickwardle/defcon-2016-i-got-99-p...

Re: Brew commands send data to Google Analytics

#72
post #31

Data is being sent to Google on probably every page you browse over the internet. And to 50 other data websites as well.

Data isn't being sent when I use most of my developer tooling. When I visit a website, I expect it's going to be inundated with garbage analytics so I use things like ublock and noscript. What I don't expect is a package manager siphoning off data to Google.

It's the new frontier.

Re: Brew commands send data to Google Analytics

#73
post #19

Yes we know. brew tells you that. And you can disable it. Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what? Some of the times it's to make the product better, or better targeted. Some other times it's just for spying on the users. Let's stop complaining about stuff that someone does and tell you they do it. There are many more that do the same th…

If it tells us, then this is a wake up call to me because I don't recall ever becoming informed of that. I must have rushed past the notification.

I probably would have still say OK but I like to at least be aware. Shame on me.

Re: Brew commands send data to Google Analytics

#74

People advocate so fervently for privacy, but can't be bothered to read a prompt...

Privacy-respecting defaults should be there so that you don't have to spend your whole day reading prompts and ToS looking for that one sentence that fucks you over.

Genuine curiosity question: Are all analytics a violation of privacy? If brew simply sent a message that said "brew was used" with no PII, would that matter? At what point is it an issue?

Re: Brew commands send data to Google Analytics

#75
post #19

Yes we know. brew tells you that. And you can disable it. Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what? Some of the times it's to make the product better, or better targeted. Some other times it's just for spying on the users. Let's stop complaining about stuff that someone does and tell you they do it. There are many more that do the same th…

>Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what?

This still doesn't mean we should just shut up and take it for desktop software. What anyone does on its OS shouldn't leave the LAN - same critique stands for recent MS endeavour with Windows 10.

Re: Brew commands send data to Google Analytics

#76
post #67

While factual, the title is a bit misleading. Brew uses Google Analytics and prompts you to inform you that it does so.

What does it send? What does it use it for?

https://github.com/Homebrew/brew/blob/master/docs/Analytics....

(This link is provided in the initial notification)

Re: Brew commands send data to Google Analytics

#77
post #22

Earlier quoted context omitted.

'Stealing' data? Is that like 'stealing' by downloading a movie?

No, it's like stealing personally identifying information and sending it to the world's largest ad company.

The information brew collects I would hardly call personally identifiable. Take a look at what they collect: https://github.com/Homebrew/brew/blob/master/docs/Analytics....

Re: Brew commands send data to Google Analytics

#78
In German we have a word called 'Datensparsamkeit':

http://martinfowler.com/bliki/Datensparsamkeit.html

It's a principle for good software design. This principle is also written down in German law:

https://de.wikipedia.org/wiki/Datenvermeidung_und_Datenspars...

>Damit gilt in Deutschland der Grundsatz, dass die Erhebung, Verarbeitung und Nutzung personenbezogener Daten und die Auswahl und Gestaltung von Datenverarbeitungssystemen an dem Ziel auszurichten sind, so wenig personenbezogene Daten wie möglich zu erheben, zu verarbeiten oder zu nutzen.

Rough translation: Thus in Germany we have there principle, that the collection, processing and using of person related data and the selection and design of data processing systems have to be guided by the aim to collect, process or use as few as possible person related data as possible.

Here, now someone has a list of software installed on various machines and the versions of that software, and whatever else information. It may be enough data to identify me or other users, the computers and the installed software. It may also allow other uses, which I have no idea of.

It's likely that this information spreads to unintended places.

I don't think this is a good idea.

I never liked the idea of using Homebrew, and this makes it even more suspicious.

Re: Brew commands send data to Google Analytics

#79
post #61

Earlier quoted context omitted.

No, it won't make Homebrew a better product. Homebrew was so good without analytics. Now it's worse, because I cannot trust it anymore.

What exactly has brew done to breach your trust? Edit: downvoted for asking a question?

Enabling analytics that send whatever information to Google. Yes, I can opt out, but often times I just don't have the time to verify the privacy policies of each and every piece of software I use.

Re: Brew commands send data to Google Analytics

#80

Earlier quoted context omitted.

We have to start somewhere. Opt in should always be the standard.

Organ donation?

Yes, there are arguments for organ donation to be opt-out. But that's extreme case, when one loses literally nothing - by virtue of being already dead - and another person stands to gain additional years of life[0]. Some other socially beneficial things also have strong arguments for being opt-out (like retirement plans, because opt-out protects people from their own stupidity/short-sightedness).

But that doesn't change the validity of the proposal that opt-in should be the standard - exceptions from which must have solid reasons. Just making it easier for someone to make money off people is not one of those reasons. Neither is vague "making the product better".

--

[0] - INB4 yes, there are also valid arguments that opt-out organ donations will reduce doctors' willingness to fight for patient's life. Human societies are complicated.

Post reply on HN