Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew now sends usage information to Google Analytics

github.com

Post reply on HN
Print view View original

181–190 of 329 posts

Re: Homebrew now sends usage information to Google Analytics

#181

Post by cstrahan »

dewski wrote: post #135
SwellJoe wrote: post #71

Earlier quoted context omitted.

Aren't the majority of Homebrew users on Mac OS X? Does Nix work on Mac OS X? Don't get me wrong: Homebrew is impressive in how many bad ideas it has implemented in a project that is so exceedingly popular; good marketing and ease of use are amazingly powerful. I thoroughly dislike Homebrew, and sincerely hope people choose not to use it, at all (but especially not on servers). And, also don't get me wrong: I really…

Could you provide constructive criticism for why Homebrew is so bad instead of lambast it?

Here's why I don't like Homebrew, and why I believe Nix is (almost) strictly an improvement over it:

1. Updating packages is not safe. If I update openssl and the ABI changes, all of my currently installed packages that depend on it are now broken -- time to rebuild everything. I've burned way too many hours on ABI breakage and rebuilding everything. That problem can't happen with Nix because Nix will ensure that each library is linked precisely to the versions of the libs they need.

2. Nix has a continuous integration server (called Hydra[1]) that builds every package, and caches the binaries. Because Nix knows each packages entire dependency graph, Hydra only needs to build just the packages that have changed. When I want to update some packages, I can count on not having to rebuild everything myself. Each binary package is signed, so I know my stuff is coming from the build server, regardless of whether or not I get the files through a cache or third party. I can also run my own Hydra instance to build my OS X and Linux packages, and I can share the binaries with others should I wish.

3. The lack of determinism. With Nix on OS X, packages are built using OS X's native Sandbox APIs to ensure that the build process can only see the dependencies that were explicitly specified. This guarantees that if the build works on my machine, it will work on yours -- whereas I've seen brew formulas under-specify configure flags and such, resulting in the default of linking to non brew installed libraries, causing quite a bit of confusion when things don't work at run time, or just flat out fail to build.

4. Brew is OS X specific. Nix works on OS X, Linux, and a FreeBSD. As someone who deploys to Linux virtual servers, it's nice that I can use the same versions of packages both in development and production.

It's not all roses, though. We have a smaller community of OS X users at this point, so not everything works (thus my "almost" qualification). Regarding the underlying tech and the outlook for the future, Nix is a superior tool.

Re: Homebrew now sends usage information to Google Analytics

#182

Post by _asummers »

makeitsuckless wrote: post #90
atmosx wrote: post #58

Earlier quoted context omitted.

Get littlesnitch on Mac and you won't need to rely on third parties alerting about outgoing connections, although I recon the when we're talking about something like homebrew it's not easy to vet every single outgoing connection. Still littlesnitch is really awesome for the privacy conscious users.

LittleSnitch also makes you totally paranoid about how almost every piece of software is spying on you without explicit consent. Also, Microsoft really needs to clean up their domain usage, because it takes 999 permission rules to run Office.

In a similar vein, installing uMatrix makes you (rightfully) paranoid about what web pages are collecting from you. "Wait I can disable 28 Javascript scripts and iframes and the page loads OK?"

Re: Homebrew now sends usage information to Google Analytics

#183

Post by Touche »

toomuchtodo wrote: post #122
cname wrote: post #118

Earlier quoted context omitted.

I think most people aren't concerned so much about sharing usage data. The problem is specifically the way it's being shared via a third party. Other apps ask if I mind sharing some data (e.g., Firefox), and I don't have a problem with that.

Okay. Is everyone going to pony up for a self-hosted analytics box and the time to manage it? No? Of course not. Everyone wants to complain, no one would contribute resources to do it though. Privacy has a high moral value (its free to want it and complain about it), but small economic value (you use Chrome? It sends everything you do back to Google. You'll still use it, because its better than not).

a HN thread is not the appropriate place to ask for resources for a project.

There are many OS projects out there with larger needs than an analytics server that have managed to get the support they need. If resources are an ongoing problem you even have the option of applying to join a free software foundation like Apache that has resources.

Re: Homebrew now sends usage information to Google Analytics

#185

Post by stock_toaster »

Touche wrote: post #159
khc wrote: post #124

Earlier quoted context omitted.

How should this be handled if the software in question is a server daemon? I want the users to make an explicit choice but it's not obvious what's the best way to do that.

On install.

Or if you want to cover existing users, just ask during the first interactive invocation, when there is no prior user chosen setting (works for new installs too)...

pseudocode:

  choice = no
  if $brew_prefix/etc/homebrew.yaml:
    choice = read analytics $brew_prefix/etc/homebrew.yaml
  else:
    if interactive-tty and cmd != "--prefix":
      choice = ask-user "enable anonymous analytics (it helps us!)? Y/N: "
      write analytics= $brew_prefix/etc/homebrew.yaml
  if choice == yes:
    enable-analytics

Re: Homebrew now sends usage information to Google Analytics

#186

Post by cstrahan »

astrange wrote: post #51
cstrahan wrote: post #19

Yet another reason to ditch the antiquated Homebrew, and switch to the cross platform Nix: http://nixos.org/nix https://github.com/NixOS/nixpkgs https://blog.errright.com/switching-from-homebrew-to-nix/

Remember when everyone switched to Homebrew because Fink/macports were "antiquated", a.k.a. not written in Ruby? It was nice back then. Packages didn't install themselves in /usr/local.

> Remember when everyone switched to Homebrew because Fink/macports were "antiquated", a.k.a. not written in Ruby?

Yes, I must admit I chose the word "antiquated" quite intentionally, as Homebrew seems to get so much attention (for now) because it's written in Ruby and the website (http://brew.sh/) is shiny, rather than technical merits.

> It was nice back then. Packages didn't install themselves in /usr/local.

You might enjoy Nix, then -- for that reason, and the following:

1. Everything is stored in /nix/store -- nothing ever touches /{local,}/{bin,lib,share}

2. Profiles are symlink forests that merge multiple packages into one FSH[1]-like tree -- each link pointing into /nix/store. When you install a package, a new symlink forest is created replacing the one at ~/.nix-profile (your user profile, being the default). If you request that nix rollback to a previous "generation" of your profile, all Nix has to do is replace the ~/.nix-profile link to instead point at the previous generation's symlink forest (you can think of this as bumping HEAD in git -- it's nearly instantaneous). If upgrading a package goes wrong, just rollback.

3. Because Nix knows the entire dependency graph, its trivial to distribute a build plan across multiple machines (you can set this up to happen by default)

4. We have a continuous integration server (Hydra[2]) that builds and signs all of our packages. Of course, there's nothing stopping you from building from source (or you could run your own Hydra instance, if you so wish).

[1]: http://www.pathname.com/fhs/ [2]: http://nixos.org/hydra/

Re: Homebrew now sends usage information to Google Analytics

#187

Post by tsujamin »

isomorphic wrote: post #43
merqurio wrote: post #32

Earlier quoted context omitted.

seems like not, yet https://github.com/Homebrew/brew/issues/142

I am confirming that Homebrew silently starts talking to Google with no warning after a "brew upgrade".

I was prompted with a warning during my most recent brew update...

Re: Homebrew now sends usage information to Google Analytics

#188

Post by fabulist »

estel wrote: post #74
fabulist wrote: post #37

Earlier quoted context omitted.

Collecting telemetry is reasonably, but it seems inappropriate for Google to get a copy and to be able to identify which of their users installed a particular piece of software from the IP address. So yes. Running their own server would be much preferable.

For Homebrew: > The Google Analytics anonymous IP setting is enabled i.e. 1 ( https://developers.google.com/analytics/devguides/collection... )

While I feel we should all treat Google with skepticism here, I didn't realize they (and so failed to acknowledge) that Homebrew was attempting to remedy that, so I apologize for speaking out of turn.

Re: Homebrew now sends usage information to Google Analytics

#189

Post by stordoff »

andreis_ wrote: post #78

Not on my computer: https://github.com/StevenBlack/hosts

Just used this list to set up DNS blocks on my network (DD-WRT/DNSmasq forcibly handles DNS traffic, with a bash script to add IPv6 hosts entries). Seems to work well so far.

Re: Homebrew now sends usage information to Google Analytics

#190

Post by SwellJoe »

dewski wrote: post #135
SwellJoe wrote: post #71

Earlier quoted context omitted.

Aren't the majority of Homebrew users on Mac OS X? Does Nix work on Mac OS X? Don't get me wrong: Homebrew is impressive in how many bad ideas it has implemented in a project that is so exceedingly popular; good marketing and ease of use are amazingly powerful. I thoroughly dislike Homebrew, and sincerely hope people choose not to use it, at all (but especially not on servers). And, also don't get me wrong: I really…

Could you provide constructive criticism for why Homebrew is so bad instead of lambast it?

I wrote a blog post a while back about my experiments with Homebrew, which covers most of the major security concerns I have with it. I hope it's clear from the post (linked below) that I went into the process with an open mind, and even positive expectations, because so many people really like Homebrew. But, I was alarmed at the implications of some of the decisions they've made; I understand why they made the design choices they made, but I don't think the trade off is even close to worth it. It is, as noted, particularly scary for server use, but I would be hesitant to use it for any purpose.

http://inthebox.webmin.com/homebrew-package-installation-for...

After that post was written, I continued to tinker with Homebrew (because it is so popular, it was really hard to completely toss it aside), but found a number of other problems. While it has lots of packages and they are often very up to date, updating over time and upgrading/downgrading versions, both proved fragile.

In a world with so many really good package managers, I find it unfortunate that the one that captured so many people's imagination and enthusiasm is broken by design, and in ways that have been understood for decades (even before good package managers, it was understood that you don't run all your servers as the same user). Or, at the very least, cannot ever be a general purpose package manager for operating systems; if you understand the limitations and know you can never safely deploy to servers using Homebrew, and only ever use it on private development laptop/desktop systems, then I won't judge. I understand it is easy to use, has a lot of packages, and has a lot of good documentation. Those are good things.

Anyway, I'm a packaging nerd. It's a thing I'm weirdly passionate about (I've contributed patches to yum in the distant past, have been a maintainer of packages for all sorts of operating systems and OSS and commercial projects, and I maintain the package repositories for my company's products and projects). I have strong opinions, but they are based on much (much!) more than average experience; over the past two decades I've spent a lot of time building packages (for Linux, Windows, Mac OS X, Solaris, FreeBSD, etc.). It may even be the technical area I have spent the most time on, since it's been consistent across nearly every company and project I've ever worked for/on. Homebrew strikes me as a huge step backward.

Post reply on HN