Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Homebrew 4.0.0

brew.sh

Post reply on HN
Print view View original

251–260 of 403 posts

Re: Homebrew 4.0.0

#251

Post by woodruffw »

microtonal wrote: post #246
woodruffw wrote: post #218

Earlier quoted context omitted.

Homebrew doesn't "report" anything to Google, much less anything of yours (implying unique identification). This is an unnecessary editorialization. You can see exactly how Homebrew does analytics here[1], and you can see the sum total of the information collected here[2]. No identifiable information is collected or retained. [1]: https://github.com/Homebrew/brew/blob/master/Library/Homebre... [2]: https://formulae.b…

From the Homebrew documentation: A Homebrew analytics user ID, e.g. 1BAB65CC-FE7F-4D8C-AB45-B7DB5A6BA9CB. This is generated by uuidgen and stored in the repository-specific Git configuration variable homebrew.analyticsuuid within $(brew --repository)/.git/config. This does not allow us to track individual users, but does enable us to accurately measure user counts versus event counts. The ID is specific to the Homebr…

Read your own cite: nothing about the UUID in question is associable with an identified or identifiable natural person, which is what the GDPR concerns.

We do not have the ability to correlate your package installs (again, we do not know what you install) with your browsing history, and we do not store any information that would allow us (or an adversary) to do so.

Re: Homebrew 4.0.0

#252

Post by microtonal »

hardware2win wrote: post #244
mola wrote: post #232

Earlier quoted context omitted.

Ok, so don't do analytics.

Then have worse product for the users?

Homebrew was fine before they started collecting analytics. There are plenty of great package managers outside the macOS ecosystem that don't use analytics.

Re: Homebrew 4.0.0

#253

Post by hungryforcodes »

lamontcg wrote: post #161
ianai wrote: post #75

Earlier quoted context omitted.

Why does a package manager need to track their users at all? If you want usage statistics for packages just track how often individual packages are downloaded on the server side. A maintainer has no need to know who's installing what.

> Why does a package manager need to track their users at all? Do any of you actually work in this industry shipping software products to end users? Without telemetry the problem there is literally one of trying to read the mind of your end users to figure out what they're doing, hoping that your internal CI manages to reflect the configuration in their environment.

Users report issues to GitHub? It's not like Brew users aren't sophisticated in that sense.

In addition to being INCREDIABLY slow, now I have to worry about what it might spy on. If I have a problem I'm more than happy to go to GitHub (or which ever site it's hosted on), and report it.

Re: Homebrew 4.0.0

#255

Post by hardware2win »

microtonal wrote: post #252
hardware2win wrote: post #244

Earlier quoted context omitted.

Then have worse product for the users?

Homebrew was fine before they started collecting analytics. There are plenty of great package managers outside the macOS ecosystem that don't use analytics.

So, just because you werent affected then no one was?

Re: Homebrew 4.0.0

#256

Post by mdaniel »

saghm wrote: post #241
mdaniel wrote: post #220

Earlier quoted context omitted.

> instead of checking out the large (and slow) homebrew/core and homebrew/taps repos I actually wanted to ask why they don't just prune the history of those repos to cut down on their clone size? OT1H, I could actually imagine some software historian being curious what flags were required to build sqlite 3.6.20 from 2009 (872f50ac61d7) but OTOH building a whole new distribution system instead of effectively git-squas…

> OTOH building a whole new distribution system instead of effectively git-squash feels weird Or even just `clone` with `--depth=1`? Just because the history exists doesn't mean you have to fetch it.

I wasn't super sure how subsequent `git pull` works with a shallow clone, but if it works the same, then such an obvious fix makes the invention of that API solution even more painful

Re: Homebrew 4.0.0

#257

Post by sneak »

therealdrag0 wrote: post #233
sneak wrote: post #209

Earlier quoted context omitted.

In retrospect (consoledonottrack operator here) I never should have pushed an opt out standard; it legitimizes opt-out which is indefensible and unethical. Opt-in by advance consent is the only way. Homebrew devs are unethical jerks. Use nixpkgs and don't look back.

What’s unethical about counting errors with no PII?

Errors are the property of the user on the system in which they occurred. Exfiltrating them without consent is unethical and oftentimes illegal, and leaks the user's IP to Google. Homebrew has no claim to them without the consent of the user. It's simple spyware.

Unless you report with Tor, it's not without PII. (Homebrew also includes a unique install UUID supercookie which persists, so every analytics data point includes PII in addition to IP address which allows Google to track that user's physical travel history.)

Re: Homebrew 4.0.0

#258

Post by closewith »

lamontcg wrote: post #161
ianai wrote: post #75

Earlier quoted context omitted.

Why does a package manager need to track their users at all? If you want usage statistics for packages just track how often individual packages are downloaded on the server side. A maintainer has no need to know who's installing what.

> Why does a package manager need to track their users at all? Do any of you actually work in this industry shipping software products to end users? Without telemetry the problem there is literally one of trying to read the mind of your end users to figure out what they're doing, hoping that your internal CI manages to reflect the configuration in their environment.

I imagine many of us work shipping software to end users and also respect their right to privacy, and only track their actions with informed consent.

Re: Homebrew 4.0.0

#259

Post by hardware2win »

closewith wrote: post #254
hardware2win wrote: post #244

Earlier quoted context omitted.

Then have worse product for the users?

Yes, you don't get to decide to violate your users' rights and surveil them because you think it will improve your product.

1 it is their choice what soft they use, isnt it? Its not like chromium on android being pushed on you

2 there is "reasonable" / "good faith" data that in my opinion can be sent e.g crash log, stats like e.g package popularity etc.

You just create drama over nothing.

Ive used data like this to improve my soft countless times and there is nothing shady at all, everything is about what you collect.

Theres difference between keylogger or stealing nudes and tech data

Re: Homebrew 4.0.0

#260

Post by d12bb »

aa-jv wrote: post #12

I wish we could get the industry to understand that when you build-in analytics and make it hard for people to opt out, you're using their resources. Sure, people don't pay for things like Homebrew (can they even?) - but this is no reason to extract resources from end users without their consent or agency. I have to work very hard to get something like Homebrew installed and in-use in my organization - the IT guys de…

> EDIT: Thinking about it, I'm actually not averse to phoning-home, just the automatic/hidden nature of it. If brew asked me, every 5 or so times that I ran it, if I would like to participate in sending anonymized analytics to the brew devs, and showed me what was being sent (instead of obfuscating it), I'd be a lot more inclined to click "[Yes] - this one time" almost every single time ..

I'd take a minute to rip the fckng line of code bugging me every 5 installs out of the code. Thing is, if you make telemetry opt-in, it's the same as just not adding it in the first place. Only a handful of users will opt in, rendering the data pretty much useless, especially as it's install and install-fail counts.

If they included any personal data, it'd be opt-in by law (at least here in EU). As they don't, they don't have to, and I'm fine with it.

Post reply on HN