Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HomeBrew Analytics – top 1000 packages installed over last year

brew.sh

Post reply on HN
Print view View original

101–110 of 168 posts

Re: HomeBrew Analytics – top 1000 packages installed over last year

#101

Post by mikemcquaid »

zakk wrote: post #92
woodruffw wrote: post #11

Earlier quoted context omitted.

Homebrew maintainer here. That language could probably be more precise - only current maintainers have access to detailed analytics (the details being specified on that same page). I wasn't part of the creation of that particular page, but one thing we (the maintainers) commonly find ourselves doing is publicly referencing install statistics as justification for removing an unused formula or taking extra care during…

Mildly unrelated question. Why is telemetry collected through Google? I suppose that’s because they have some particularly convenient APIs, however please consider that many user are concerned by the amount of information Google has about their lifes. (I know, it’s possible to opt out, but good choices should be the default!)

> Why is telemetry collected through Google?

No-one else provides anywhere near the same scale for free. We have over a million monthly active users and every other solution we tried (including FOSS ones) either fell over at that load or we couldn't find anyone willing to provide hosting for us.

We don't send any personally identifiable information to Google. You are tracked by a randomly generated UUID (which you can regenerate at any time) and we tell Google to not store IP addresses.

Re: HomeBrew Analytics – top 1000 packages installed over last year

#102

Post by mikemcquaid »

falcolas wrote: post #34
woodruffw wrote: post #11

Earlier quoted context omitted.

Homebrew maintainer here. That language could probably be more precise - only current maintainers have access to detailed analytics (the details being specified on that same page). I wasn't part of the creation of that particular page, but one thing we (the maintainers) commonly find ourselves doing is publicly referencing install statistics as justification for removing an unused formula or taking extra care during…

> as justification for removing an unused formula This does not, in my mind, help the case at all. This culture of deletion makes no real sense to me; something not being used for a month or a year doesn't mean it's not being used at all. What's the real cost of just leaving those formula around? A slight problem with it not working immediately when it is used? At least then it can be fixed, instead of seeing the "No…

> At least then it can be fixed, instead of seeing the "No formula found" text.

You don't see that text but instead text indicating the formula has been deleted.

> The culture of deletion surrounding the long tail of digital artifacts just doesn't make any sense.

They will be preserved in the Git history for as long as we continue to use Git.

Both the above comments make it seem like you've not really done any research into your own objections, here.

Re: HomeBrew Analytics – top 1000 packages installed over last year

#103

Post by mikemcquaid »

falcolas wrote: post #30
slagfart wrote: post #18

Earlier quoted context omitted.

There's significant value, when developing a product, in knowing which other products your customers are likely to have, so that you can prioritise your different integrations. Similar data could probably be compiled from Google Trends, but this clean and authoritative view is something that can be trusted, and I think the result makes the open-source ecosystem stronger.

That only sets up the value proposition for the maintainers - not for making it public. What value do any of us, not on the Homebrew maintenance team, derive from this list (other than fuel for "X is better than Y" arguments)?

> What value do any of us, not on the Homebrew maintenance team, derive from this list

This list was added specifically because a bunch of people expressed concerns about this data not being public. You can please some of the people all of the time, etc.

Re: HomeBrew Analytics – top 1000 packages installed over last year

#104

Post by mikemcquaid »

peteretep wrote: post #78

Who the hell uses homebrew to install Perl? OS X ships with it, and perlbrew is a much more natural way to install it if you care about not using the system Perl. Maybe it's a dep for another package?

> Maybe it's a dep for another package?

Random pedantry: the list on that page is the stuff where people have typed `brew install perl` (or `brew upgrade perl`) and it hasn't been pulled in as a dependency. As to why: I have no idea :D

Re: HomeBrew Analytics – top 1000 packages installed over last year

#106

Post by zakk »

mikemcquaid wrote: post #101
zakk wrote: post #92

Earlier quoted context omitted.

Mildly unrelated question. Why is telemetry collected through Google? I suppose that’s because they have some particularly convenient APIs, however please consider that many user are concerned by the amount of information Google has about their lifes. (I know, it’s possible to opt out, but good choices should be the default!)

> Why is telemetry collected through Google? No-one else provides anywhere near the same scale for free. We have over a million monthly active users and every other solution we tried (including FOSS ones) either fell over at that load or we couldn't find anyone willing to provide hosting for us. We don't send any personally identifiable information to Google. You are tracked by a randomly generated UUID (which you ca…

First of all, let me say I appreciate your response and your work on Homebrew, a great piece of software, and quite a blessing for Mac users.

> No-one else provides anywhere near the same scale for free.

That's a bit naive. Google is not a charity and provides that service by making a profit out of user data.

> We don't send any personally identifiable information to Google. You are tracked by a randomly generated UUID (which you can regenerate at any time) and we tell Google to not store IP addresses.

Even with no IP, Google can easily cross-references searches and the random UUID, since a typical use case is that a user installs something through Homebrew after Googling it.

Please rethink this bad default choice. And sorry if my reply sounds harsh, but I think that Google tracking by default is an extremely bad choice for your users.

Re: HomeBrew Analytics – top 1000 packages installed over last year

#107

Post by tomsmeding »

deathanatos wrote: post #93
jrimbault wrote: post #89

Earlier quoted context omitted.

How often do you handle files large enough to observe a difference between grep, ack, ag and rg ? I'm willing to bet (and happy to lose) that most people, even in the subset who use grep "a lot" (defining "a lot"...), wouldn't see a significant improvement. They are people (I'm betting fewer) who need speed above all other concerns, and those people already make it to the top 1000.

> How often do you handle files large enough to observe a difference between grep, ack, ag and rg ? > I'm willing to bet that most people, even in the subset who use grep "a lot" (defining "a lot"...), wouldn't see a significant improvement. Daily, but not for the reasons that I think you're thinking. I work in Python a lot, which means there is typically a virtualenv in the tree somewhere, sometimes more than one. T…

Possibly redundant information, but still: ag has those same features. I see lots of reasons to choose rg/ag over grep, but none yet to choose rg over ag.

Re: HomeBrew Analytics – top 1000 packages installed over last year

#108

Post by njharman »

alexashka wrote: post #12

Can someone explain the popularity of imagemagick on there? As in, are that many people tinkering with graphics via the command-line?

I do resize on the command line all the time. Format conversion occasionally. Other things few times a year.

Re: HomeBrew Analytics – top 1000 packages installed over last year

#109

Post by pdkl95 »

mikemcquaid wrote: post #101
zakk wrote: post #92

Earlier quoted context omitted.

Mildly unrelated question. Why is telemetry collected through Google? I suppose that’s because they have some particularly convenient APIs, however please consider that many user are concerned by the amount of information Google has about their lifes. (I know, it’s possible to opt out, but good choices should be the default!)

> Why is telemetry collected through Google? No-one else provides anywhere near the same scale for free. We have over a million monthly active users and every other solution we tried (including FOSS ones) either fell over at that load or we couldn't find anyone willing to provide hosting for us. We don't send any personally identifiable information to Google. You are tracked by a randomly generated UUID (which you ca…

> We don't send any personally identifiable information to Google.

Yes, you do. While you use[1] the "Anonymize IP" option, a packet is still sent from the user's IP. Google's business model includes gathering as much data as possible so it's foolish to think that they are throwing data away in this situation. You may disagree and trust Google to honor the "Anonymize IP" option, but trust is not transitive so you shouldn't ever assume users agree (use opt-in in every situation).

However, claiming you don't send pii to Google makes me wonder if you have actually read the documentation for GA? The "Anonymize IP" (aid=1) option is blatant doublespeak. From their own documentation[2]:

> The IP anonymization feature in Analytics sets the last octet of IPv4 user IP addresses ...

They are only masking out the last 8 bits of the address, which are the least interesting bits. You can still discover the ASN from the remaining data. At worst all that option did is add a 1-in-256 guess when correlating your analytics data to the rest of Google's tracking data. That is trivial to overcome Google's massive databases of tracking data.

You even provide a unique additional per-install tracking number that lets Google track users when they move to a different IP address. Once a correlation exists between your analytics data and everything else at Google, your analytics events provide a reliable report about that can allows other tracking data to be correlated to the new IP address.

Why does that option exist? It's possible that it was designed to mislead developers into sending Google tracking information, but their own documentation[2] suggests a different hypothesis:

> This feature is designed to help site owners comply with their own privacy policies or, in some countries, recommendations from local data protection authorities

This is a feature designed to check boxes on compliance requirements, not to provide any provide actual anonymity to users.

[1] https://github.com/Homebrew/brew/blob/fd4fe3b80cab9902437016...

[2] https://support.google.com/analytics/answer/2763052?hl=en

Post reply on HN