Homebrew now sends usage information to Google Analytics

https://github.com/Homebrew/brew/blob/master/share/doc/homebrew/Analytics.md

by aorth • 10 years ago

359 301 10 years ago

github.com

hckr1292• 10 years ago

Kudos for at least announcing this. (And I've totally opted out.)

LeoPanthera8• 10 years ago

Set HOMEBREW_NO_ANALYTICS=1 to opt out.

The right thing to do would be to make it opt in, not opt out. (Which would not be without precedent. Debian's popcon is opt-in.)

mikevm• 10 years ago

That's probably true, but then no one would opt-in.

quotha3• 10 years ago

This is software, they can just ask instead!

davesque3• 10 years ago

That's kinda the point.

joosters• 10 years ago

...which is very telling.

cname2• 10 years ago

Although if Homebrew wasn't using Google Analytics, maybe people would. It could just be a "Do you mind sending us anonymous usage data? [y/N]" prompt. Many other apps do something equivalent, and I don't mind giving it to them. The fact that those apps ask in the first place makes me much more amenable to the idea.

duncan_bayne• 10 years ago

... which, if true, tells you something about the value of this 'feature' to the user.

derefr• 10 years ago

Or, even worse, there'd be a selection effect where the distribution of people who opt in is skewed from the total distribution of Homebrew users, ruining the dataset for any analysis one might want to do to it. There's a reason that Nielson Ratings collection isn't opt-in.

jordigh• 10 years ago

At 193,622 submissions, I wouldn't say "nobody" opts in to popcon:

http://popcon.debian.org/

Touche10• 10 years ago

Disagree. Google Analytics is a network of companies that has agreed to privately collection information about users without their permission or even knowledge. It is malware that should not be included in Homebrew. The only ethical decision we can make as developers is not to use it.

fit2rule9• 10 years ago

Yeah, I'll confess that this is a real deal breaker for me personally .. I'll be having a closer look at ports and maybe fink soon. Maybe after all its time to get off OSX and back to Linux, where these sorts of things happen less frequently ..

jldugger• 10 years ago

Would be somehow more ethical if they set up their own piwik instance to collect the same data?

bitmapbrother• 10 years ago

I'm always amused by the way some people try to extend the definition of malware beyond its scope. This isn't malware. It's just anonymous usage tracking. If you don't like it you can turn it off. I hope you don't use a smartphone because the amount of intrinsic "malware" you must be subjected to must be unbearable.

"Malware" is an umbrella term used to refer to a variety of forms of hostile or intrusive software, including computer viruses, worms, trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software.

cpeterso• 10 years ago

Does Homebrew's UUID linked with the user's Google Analytics ID in their browser cookies?

erpellan• 10 years ago

Indeed! Feel free to demand a refund or refer to the contract you signed... Nobody's forcing anyone to use it.

binaryanomaly2• 10 years ago

Totally agree. I don't feel too comfortable bout google knowing everything about me... Should be opt in.

toomuchtodo10• 10 years ago

Did you read the link? Your actions cannot be tied specifically to you.

Confiks2• 10 years ago

What is the mechanism in which Homebrew inserts itself into every shell session anyway? I had expected it to be loaded somewhere in some shell initialization script, such as .bashrc or .bash_profile, but I couldn't find anything.

Sidnicious• 10 years ago

It doesn't — by default, Homebrew lives in /usr/local/bin/, which is already in the default $PATH on OS X.

vemv• 10 years ago

Where's your reasoning? Homebrew gave theirs.

Keep in mind that no personal info is ever sent. Just a random UUID.

oconnore• 10 years ago

no personal info
Just your universally unique id

...

geoelectric2• 10 years ago

One decent reason would be that existing installs arguably shouldn't change their privacy considerations without a hoop to jump through.

LeoPanthera8• 10 years ago

My reasoning? Because it's good to respect the privacy and choices of your users. Homebrew never called home to Google in the past, most people would not reasonably expect it to suddenly start doing so without letting them know.

isomorphic5• 10 years ago

I block Google Analytics in my web browser, too...

isomorphic5• 10 years ago

Or, you could edit /usr/local/Library/Homebrew/utils/analytics.rb to send Google Analytics garbage (from random UUIDs) until Homebrew makes this feature opt-in.

Touche10• 10 years ago

This is a great idea.

Any rubyists want to provide a patch to do this?

0x03• 10 years ago

You may also want to "rm ~/.homebrew_analytics_user_uuid"

LeoPanthera8• 10 years ago

You could really screw with their statistics by regularly changing the contents of that file.

gondo• 10 years ago

its better to create am empty ~/.homebrew_analytics_user_uuid and remove write permissions

xutopia• 10 years ago

The fact that they are transparent about this, that we can opt-out if we want and that they're open source makes me feel more than comfortable sharing anonymous usage information with them. Homebrew has been amazing for me!

LeoPanthera8• 10 years ago

Is an alert displayed to the user the first time it tries to send info to Google? If not, that is far from "transparent". It's good that they tell you how to opt out on the website, but I can't remember the last time I went to the website. Probably when I first installed Homebrew on this Mac.

daveguy• 10 years ago

This. Either everyone should be notified before the first google analytics transmission so that they can choose to opt in our out. Or the default should be off and maybe on new installs they can choose to opt in. At the opt in/out dialog (when you give the users a choice) you can make the default to opt-in, but having the default as opt-in without any input from the user is bad form. It is similar to spammers calling your e-mail address "double opt-in" because they got you to open an e-mail and you didn't click the unsubscribe link.

merqurio• 10 years ago

seems like not, yet https://github.com/Homebrew/brew/issues/142

atmosx2• 10 years ago

Get littlesnitch on Mac and you won't need to rely on third parties alerting about outgoing connections, although I recon the when we're talking about something like homebrew it's not easy to vet every single outgoing connection.

Still littlesnitch is really awesome for the privacy conscious users.

Forbo• 10 years ago

I get the following:

  % brew update
  ==> Homebrew has enabled anonymous aggregate user behaviour analytics

joepie91_3• 10 years ago

The fact that it's opt-out rather than opt-in... yeah, well. I don't think I need to finish that sentence.

jbverschoor• 10 years ago

Totally fine with it.

fit2rule9• 10 years ago

Wish there was a way of opt'ing-out without having to set an env var for every session .. is there some brew place to put ENV vars?

LeoPanthera8• 10 years ago

Shove it in your .bashrc, or equivalent for your shell of choice.

atm0sphere• 10 years ago

pls go ahead and read the first response:

http://unix.stackexchange.com/questions/117467/how-to-perman...

fit2rule9• 10 years ago

This is a very single-user-centric view. Some of us have Macs with many hundreds of users.

And so .. It is too invasive of my .bashrc/.profile that I have to use it to disable spy activity. I'd rather brew just have its own flag somewhere that says "Don't ever send analytics, ever, for any user on this system.."

madeofpalk2• 10 years ago

That's what ~/.bashrc or ~/.bash_profile or (whatever it is for your shell) is for.

fit2rule9• 10 years ago

Yeah, I don't want to do that every single time I put home-brew on a machine somewhere, for every single user.

Doesn't it have its own global config? I confess that I'm too miffed by this intrusion in my privacy to be bothered to find out ..

abjorn2• 10 years ago

Couldn't you just put it in your .bashrc?

fit2rule9• 10 years ago

For every user on this machine? On every Mac in the house? Meh.

What I want:

  "brew disable analytics"

There, now I don't have to think about it any more, nor maintain a .profile/.bashrc, nor do it every single time for every user.

SuperKlaus• 10 years ago

Put it in ~/.profile ?

quotha3• 10 years ago

add this to shell profile file: export HOMEBREW_NO_ANALYTICS=1

ccleve• 10 years ago

Google must have eventually hired him.

https://news.ycombinator.com/item?id=9695102

yarou• 10 years ago

No, they didn't.

He works at Apple.

nkozyra• 10 years ago

I'm not sure why Google would care about Google Analytics on brew if they hired him, though.

quotha3• 10 years ago

is it formulae or formula?

andrewjanke• 10 years ago

"formulae" is plural for "formula".

cstrahan5• 10 years ago

Yet another reason to ditch the antiquated Homebrew, and switch to the cross platform Nix:

http://nixos.org/nix

https://github.com/NixOS/nixpkgs

https://blog.errright.com/switching-from-homebrew-to-nix/

astrange2• 10 years ago

Remember when everyone switched to Homebrew because Fink/macports were "antiquated", a.k.a. not written in Ruby?

It was nice back then. Packages didn't install themselves in /usr/local.

Washuu• 10 years ago

I remember switching from Fink and Macports because most of the time both of them would break or break something important.

santaclaus• 10 years ago

I left MacPorts because the political infighting between package maintainers often left ports hopelessly out of date.

cstrahan5• 10 years ago

Remember when everyone switched to Homebrew because Fink/macports were "antiquated", a.k.a. not written in Ruby?

Yes, I must admit I chose the word "antiquated" quite intentionally, as Homebrew seems to get so much attention (for now) because it's written in Ruby and the website (http://brew.sh/) is shiny, rather than technical merits.

It was nice back then. Packages didn't install themselves in /usr/local.

You might enjoy Nix, then -- for that reason, and the following:

1. Everything is stored in /nix/store -- nothing ever touches /{local,}/{bin,lib,share}

2. Profiles are symlink forests that merge multiple packages into one FSH[1]-like tree -- each link pointing into /nix/store. When you install a package, a new symlink forest is created replacing the one at ~/.nix-profile (your user profile, being the default). If you request that nix rollback to a previous "generation" of your profile, all Nix has to do is replace the ~/.nix-profile link to instead point at the previous generation's symlink forest (you can think of this as bumping HEAD in git -- it's nearly instantaneous). If upgrading a package goes wrong, just rollback.

3. Because Nix knows the entire dependency graph, its trivial to distribute a build plan across multiple machines (you can set this up to happen by default)

4. We have a continuous integration server (Hydra[2]) that builds and signs all of our packages. Of course, there's nothing stopping you from building from source (or you could run your own Hydra instance, if you so wish).

[1] http://www.pathname.com/fhs/ [2]: http://nixos.org/hydra/

SwellJoe2• 10 years ago

Aren't the majority of Homebrew users on Mac OS X? Does Nix work on Mac OS X?

Don't get me wrong: Homebrew is impressive in how many bad ideas it has implemented in a project that is so exceedingly popular; good marketing and ease of use are amazingly powerful. I thoroughly dislike Homebrew, and sincerely hope people choose not to use it, at all (but especially not on servers).

And, also don't get me wrong: I really like Nix, and I believe it has mostly right decisions across the board. If I had my druthers, Nix would be what our near-term package management future looks like.

But, if we're talking about Mac (and gods I hope there aren't a lot of people using Homebrew on other Operating Systems, particularly Linux, where we have an embarrassment of riches in terms of good, even great, package managers), I suspect recommending pkgsrc would be a better near term solution. It is more mature on OS X, and it has more packages than Nix. And, while it is not as modern as Nix, it is an acceptable package manager on most fronts, and doesn't exhibit Homebrew's alarming lack of foresight on security questions.

http://pkgsrc.org

In short: I like Nix a lot. I dislike Homebrew a lot. So, we're agreed on those points. But, for Mac OS X users looking for a better alternative to Homebrew, pkgsrc seems to be the current best choice (Fink is poorly maintained, macports is slightly better maintained, but pkgsrc is a better package manager).

dewski• 10 years ago

Could you provide constructive criticism for why Homebrew is so bad instead of lambast it?

Matt3o12_4• 10 years ago

Could you elaborate what you dislike most about home brew? I only don't like that they refuse to package old versions, although they are still supported by the author and quite popular (I'm looking at you Python). Furthermore, it often leaves deprecated APIs on my computer without offering to upgrade them (because other packages rely on them).

cstrahan5• 10 years ago

Yes, Nix works on Mac OS X. (I packaged X11/XQuartz, MacVim, and a few other things for OS X)

kodablah• 10 years ago

"[...] we do not have the resources to do detailed user studies of Homebrew users to decide on how best to design future features and prioritise current work. Anonymous aggregate user analytics allow us [...]"

Isn't this a false dichotomy? Why can't other measures be used that don't require "resources" to do "detailed user studies" yet don't require on-by-default information capturing? Surely there are many open source projects that persist to make their users happy without this information, correct?

davesque3• 10 years ago

Here's a github issue related to this for those who are interested: https://github.com/Homebrew/brew/issues/142

spicyj• 10 years ago

Isn't this the same info they'd get if they ran their own registry like every other package manager (instead of using GitHub)? In the grand scheme of things, this seems pretty minor to me.

rurban• 10 years ago

See, that's why I am a diehard macports user. /opt/local and not /usr/local. No cross pollution with my own configure && make && make install packages, nicely separated and maintained.

Scarbutt• 10 years ago

macports requires all of xcode, homebrew just the CLI tools.

jxy• 10 years ago

This statement is false. With only Command Line Tools installed, macports complains, but everything works.

liveoneggs• 10 years ago

+1 for pkgsrc

atmosx2• 10 years ago

I use MacPorts[1] which is a good alternative to homebrew. It's an older project.

Lately though, I've came across many packages that are available for Homebrew but not for macports.

[1] http://macports.org/

mehta• 10 years ago

Seems like Homebrew is doing many things right:

- Anonimizing IP address.

- Explaining what data is collected, and why

- A way to optout

Something that could be better:

- Make this optout for new users and opt-in for existing users?

- Notify the user in some manner when the data is sent to GA for the first time?

- Change the uuid every X period of time to make things more privacy friendly.

[Edit: wording]

nicolas_t• 10 years ago

I don't mind homebrew collecting anonymous information about me but I do not want Google to get even more information about me (and since the ip address I use with homebrew is the same I use to surf the web, the information is not anonymous for Google).

andreis_• 10 years ago

Not on my computer: https://github.com/StevenBlack/hosts

nathanaldensr2• 10 years ago

Thanks for the link! I have been using http://winhelp2002.mvps.org/hosts.htm for many years but it looks like StevenBlack's file is more comprehensive and updated more frequently.

stordoff• 10 years ago

Just used this list to set up DNS blocks on my network (DD-WRT/DNSmasq forcibly handles DNS traffic, with a bash script to add IPv6 hosts entries). Seems to work well so far.

joeblau• 10 years ago

As I see more applications try and hit remote ad servers, I feel even better that I'm blocking all of these ad servers with my /etc/hosts file using https://github.com/StevenBlack/hosts. The update will be a no-op from my machine.

jalami• 10 years ago

Would really prefer it to be opt-in instead of opt-out as others have said. Sharing the info with Homebrew is one thing, the GA borg-malware is another entirely. Something like that should require an explicit request. At least in the browser, I can blacklist all requests with uBlock.

Atom does the same thing and I'm not a fan. You have to explicitly remove the analytics 'package'. Soon every piece of software will be reporting, silently.

dublinben• 10 years ago

Soon every piece of software will be reporting, silently.

Not ethically written, free software. You would never see this behavior from a GNU program.

HappyTypist2• 10 years ago

Absolutely. If there were it'd be opt in and not to Google.

petrikapu3• 10 years ago

Tonight I'm going to read about pkgsrc and tomorrow give a try. It has active community last time I used it few years ago. Seems to have also binaries available at http://pkgsrc.joyent.com/install-on-osx/

petrikapu3• 10 years ago

  My quick notes on how to get started with pkgsrc
  
  More info:	http://pkgsrc.org/
  			http://wiki.netbsd.org/pkgsrc/pkgsrc_64bit_osx/
  			
  # Download pkgsrc
  curl -O https://ftp.netbsd.org/pub/pkgsrc/stable/pkgsrc.tar.bz2
  # validate shasum
  $ curl -O https://ftp.netbsd.org/pub/pkgsrc/stable/pkgsrc.tar.bz2.SHA1
  $ cat pkgsrc.tar.bz2.SHA1
  $ shasum pkgsrc.tar.bz2
  # extract pkgsrc archive. Mine lives at ~/Work and I also install built packages under Work.
  $ tar jxvf pkgsrc.tar.bz2
  # bootstrap
  $ cd pkgsrc/bootstrap
  $ ./bootstrap --abi=64 --prefer-pkgsrc=yes --unprivileged --compiler=clang --prefix="$HOME/Work/pkg"
  # append prefix/bin to your PATH
  $ cat ~/.bash_profile
  export PATH="$PATH:$HOME/Work/pkg/bin"
  # re-login to make PATH effective
  # Example build of dos2unix (poor example because lots of dependencies like perl...)
  $ cd pkgsrc/converters/dos2unix/
  $ bmake install
  ...
  ===> Installing binary package of dos2unix-7.3.3
  
  $ file ~/Work/pkg/bin/dos2unix
  /Users/petri/Work/pkg/bin/dos2unix: Mach-O 64-bit executable x86_64

petrikapu3• 10 years ago

You can find homebrew uninstall info from here

https://github.com/Homebrew/brew/blob/master/share/doc/homeb...

  # I did:
  
  # remove all packages
  $ for f in $(brew list); do brew remove "$f"; done
  
  # download uninstall script
  $ curl -O https://raw.githubusercontent.com/Homebrew/install/master/uninstall
  # review script
  # run uninstall script
  $ chmod +x uninstall
  $ ./uninstall
  ...
  
  # review
  /usr/local/bin/
  /usr/local/etc/
  /usr/local/lib/
  /usr/local/share/
  
  # I removed
  $ rm -rf /usr/local/share/ /usr/local/etc/
  
  # Restore permissions
  
  $ sudo chmod 0755 /usr/local
  $ sudo chgrp wheel /usr/local

jwilk• 10 years ago

It's high time for CVE-like identifiers for privacy violations.

hnhnhn32• 10 years ago

This is a great idea. Has there been any prior attempt at this?

FussyZeus• 10 years ago

I love the knee-jerk hostile reactions to any sort of phoning home by an application. They've provided extensive explanations on what is collected, why they're collecting it, who has access, what it's for, and even the code that does the actual collecting and it still isn't enough for people.

While I'm against this type of thing typically, this information is exactly what someone who is concerned about it needs to see, and if they don't want to be involved they include the opt-out on the very same page. I don't see how this could get any better, this could be held up as a gold standard for Microsoft and Google moving forward.

This type of data is invaluable to developers, I can't tell you how frustrating it is that so many people now refuse to share it because of overblown privacy concerns. The data is anonymized and no one cares enough about what you're doing to de-anonymize it.

There are real threats to your privacy out there and spending time on stuff like this just adds to the noise.

nathanaldensr2• 10 years ago

Your arguments are ridiculous. Humans judge; we're good at it. Burn us enough times with false promises of privacy or outright lies and yes, we will learn to become very skeptical and untrusting. You're asking people to continue trusting a system that has proven to be working against users' best interests for a long time.

The data is not sufficiently anonymized. Your public IP address is sent to Google and--the burden of proof is on Google to prove this doesn't happen--there is nothing stopping Google from comparing that data to other requests they get from the same IP address (say, from your browser). Maybe Google can't personally identify me from this data, but they can sure target me with ads, which--shock--make them money.

tristor3• 10 years ago

Here's a quick and dirty way to opt out for BASH and ZSH users for easy copy/pasting.

BASH:

  cat <<EOF >> .bashrc
  # Opt out of Homebrew analytics
  export HOMEBREW_NO_ANALYTICS=1
  if [[ -e "$HOME/.homebrew_analytics_user_uuid" ]]; then
    rm -f "$HOME/.homebrew_analytics_user_uuid"
  fi
  EOF

ZSH:

  cat <<EOF >> .zshrc
  # Opt out of Homebrew analytics
  export HOMEBREW_NO_ANALYTICS=1
  if [[ -e "$HOME/.homebrew_analytics_user_uuid" ]]; then
    rm -f "$HOME/.homebrew_analytics_user_uuid"
  fi
  EOF

Cheers.

alainv• 10 years ago

`rm -f` ignores nonexistent files so you could omit the `if` to be concise.

tristor3• 10 years ago

Good call. I was mainly using `-f` to suppress the prompt about deleting the file, but you're correct, it's unnecessary to have the if statement in this case.

hk__211• 10 years ago

You don’t need to remove that file; the whole point of this env variable is that it stops Homebrew from sending any data. It won’t even be created if that variable is set.

tristor3• 10 years ago

That's only true if the variable is set before the first instance when data would have been sent, otherwise the file will exist (as it did on my system).

aurora72• 10 years ago

AFAIK, Max Howell was rejected from a position at Google, and now his trademark making use of Google? Let him take a look at GNU.ORG; if he can see any GA code.

rajesht• 10 years ago

set HOMEBREW_NO_ANALYTICS=1

pdkl955• 10 years ago

generated by uuidgen

So sending a unique tracking number...

enable us to accurately measure user counts vs. event counts

for the specific purpose of associating events from the same user...

This does not allow us to track individual users

somehow doesn't accomplish it's stated purpose? The entire point of that UUID is to track individual users.

The Google Analytics anonymous IP setting is enabled

Sending Google an additional boolean flag doesn't prevent Google from reading the Source Address from the IP header.

codedokode2• 10 years ago

It looks like everybody today wants to spy on you. Google, Facebook, and Twitter want to look at your browsing history, NSA wants to see your calls, emails, and messages history. Microsoft wants to know about everything you do at your PC and now even package managers want to have their share of data, too. What about asking my opinion first? Well, as homebrew developer have said

The problem with opt-in is that you don’t get representative data.

Users do not seem to be enthusiastic about participating when they have a choice so let's go without asking them.

HappyTypist2• 10 years ago

I think it's very reasonable to prompt a message on install saying "Homebrew collects and sends anonymous analytics. Use Homebrew --disable-analytics to opt out" and have that null the analytics identifier. Environment variables aren't that convenient.

dotwtf• 10 years ago

Made me open an HN account just to say this

This is a very bad move and will further erode the already declining trust people put in package managers and software distribution channels. This is not transparency - transparency would be asking for user's explicit consent on the first brew invocation that includes this "feature". If this decision is not publicly reverted I will be removing homebrew altogether as it indicates a severe lapse in judgement, good faith or both on the part of the homebrew team.

mikemcquaid• 10 years ago

I'm the maintainer who added this. I apologise for the poor communication. I would have responded sooner but I've been on a plane for the last 10 hours. I'd hoped the documentation would have made clear our reasons for doing this but I feel the discomfort so since getting off my flight I've opened and merged three PRs (https://github.com/Homebrew/install/pull/42 https://github.com/Homebrew/brew/pull/143 https://github.com/Homebrew/brew/pull/146) to better communicate this to our users on installation and `brew update` before any information is sent and ease the opt-out process.

javajosh• 10 years ago

It should be opt-in, not opt-out.

eistrati• 10 years ago

I second that. It must be an opt-in feature.

developer24• 10 years ago

Man, the privacy critics really come out of the woodwork every single time "opt-out" is mentioned, regardless of the actual facts for a specific situation. The developers explicitly state they set the anonymous IP address flag. There is nothing that links back to you as a person. Are you really concerned that the developers know which packages a random, unknown person has installed?

Crying "opt-in" to every single little thing that has ever tracked you for non-nefarious reasons completely detracts from the cases where tracking is nefarious. Homebrew is not tracking for ads. They are not tracking for anything worth selling to a 3rd party. They're not - and are incapable of - linking this to any other database that does contain personally identifiable information. There's no "profile" worth anything to anybody except the developers, who are trying to get some very basic information completely detached from any identity.

> You will be notified the first time you run brew update or install Homebrew.
> to opt-out of Homebrew's analytics you may set HOMEBREW_NO_ANALYTICS=1 in your environment

They went to the lengths to document this. And to notify you when you run the software. You have the opportunity to opt-out of something that is completely harmless. There is no valid reason to be crying foul over this. Of all the tracking that goes on with our internet connections, this should by far be the least of anyone's concerns.

I have uBlock Origin installed in Chrome. With all the ad networks and analytics scripts blocked. Google Analytics does not run in my browser. And yet, I am not even slightly opposed to homebrew's use of it. It's actually anonymous, unlike how many developers use GA in the browser (tracking IP addresses, custom fields like user ids that link back to the site's database, etc). God speed, homebrew devs.

cat-dev-null4• 10 years ago

Opt-in, like optional security, rarely gets used.

toomuchtodo10• 10 years ago

I'd encourage you to keep the opt-out setting as-is. It clearly brings value to the development team, you're communicating it to users, and Homebrew users who aren't comfortable with opt-out can a) disable analytics or b) not use Homebrew. Switching to opt-in is going to greatly diminish the dataset you'd have for making improvements (selection bias).

The Homebrew developers' time is valuable, versus a subset of users making demands of a free tool. You've been conservative in how clients are identified, as well as the data collected, and people are still suggesting unreasonable alternatives. Can't make everyone happy. Thanks for an awesome tool.

bogomipz2• 10 years ago

Nobody is "making demands"

geoelectric2• 10 years ago

Thanks for the changes!

lawnchair_larry3• 10 years ago

Change it to opt-in, please.

bogomipz2• 10 years ago

But why not make it "opt out" by default and then ease the ability to "opt in?"

cat-dev-null4• 10 years ago

Please leave it like countries with good organ donation opt-out policies.

Speaking of which, become an organ donor if you live in an opt-in country.

speeder• 10 years ago

Like in Brazil, where there are real cases of people convicted of murdering donors to sell their organs to rich people?

sneak2• 10 years ago

Why are you even collecting this information? Homebrew isn't some for-profit product trying to optimize its funnel.

Keep doing what you were doing. You were doing a great job. There is no benefit to you or us to silently spy on us.

FilterSweep2• 10 years ago

From the GitHub doc[0]:

Homebrew is provided free of charge and run entirely by volunteers in their spare time. As a result, we do not have the resources to do detailed user studies of Homebrew users to decide on how best to design future features and prioritise current work. Anonymous aggregate user analytics allow us to prioritise fixes and features based on how, where and when people use Homebrew.

I read this as: "Google Business Development contacted us and offered us a sum of money for high-privilege-level analytic data on developers."

I would have rather homebrew extended the donation coffer cup on line 0 every time "brew update" or "brew install foo" was called. Much like how Wikipedia ends up getting me to donate each year. Part of me wonders if this was my fault for not donating.

[0] https://github.com/Homebrew/brew/blob/master/share/doc/homeb...

username2232• 10 years ago

I apologise for the poor communication.

Try apologizing for your poor behavior. You didn't "communicate poorly;" you offended people who used your software, and betrayed their trust. You can either make this thing opt-in, or "ease the opt-out process" and continue being a jerk.

ctvo• 10 years ago

Feeling this betrayed and entitled over anonymous analytics in an open source project?

KenoFischer• 10 years ago

Since there is a lot of negative comments here, let me add the counterpoint here that I am totally fine with this. For me, any time saved by enabling you guys to build better software is well worth it. Thanks!

faizanbhat• 10 years ago

Honest question for people who are opposed to this update and think it should be opt-in: what do you see as the downsides or pitfalls of sending anonymised usage info to Homebrew / Google Analytics?

cellularmitosis2• 10 years ago

I really wish people would explain their reasoning here. I guess I just don't understand why handing a list of installed packages to Google is not my interest. Everyone in this thread seems to be just assuming that everyone else is already onboard with this reasoning.

lawnchair_larry3• 10 years ago

Reminder - The NSA/GCHQ systems described their use of Google Analytics piggybacking to fingerprint and target users for exploitation.

They also used similar Windows error reporting to monitor what software/hardware users have.

Not that anyone should be snooping on what users do without opt-in permission, but even if we believed that Google "anonymize" it, there are still concerns.

More simply, there's just no reason for you to know what I do on my own computer. It's none of your business and I don't need a reason.

Gratsby• 10 years ago

These kinds of "features" are a problem for open source, and I don't know that they are a good idea in general.

It's nice to know how and where your software is being used, but in many environments call-home functionality and auto-update functionality are non-starters.

Any non-user initiated network activity should be explicitly agreed to and available to be easily stripped.

We can and should do a better job with open source software than closed source would-be competition. Even if you aren't a privacy advocate, privacy is a priority of a significant amount of the technical community. It's significant enough that it should be addressed as a forethought to features like this, not an afterthought.

Things like this pop up as negative news entries that people gloss over. The guy who makes the snap decision "don't use brew, it phones home" today could be a CTO who never had that opinion changed three years from now.

geggam• 10 years ago

one more what used to be decent software selling out to marketing....

guess its back to the linux vm when working on a mac...

escot• 10 years ago

opt-in by default is fine with me. Thanks for the great tool!

corporatemonkey• 10 years ago

Many large corporations have internal homebrew packages. You can learn company secrets by getting a list of packages that are being installed.

TheLogothete10• 10 years ago

Yeah. So every site and every product on the internet has this dark pattern. Do you use google? Youtube? StackOverflow? Are you outraged by them too?

stephenr2• 10 years ago

So every site and every product on the internet has this dark pattern.

Not every site/product on the internet uses an abusive analytics platform, hell not all of them use analytics at all.

With sites visited in a browser, an extension can be used to block access to abusive services such as GA. There is no Ghostery for the terminal.

I have no issue with them wanting to collect usage information. I opt-in to Debian's package usage tracking.

If I still used Homebrew, I would have a huge issue with them sending information about what packages I install to Google.

TheLogothete10• 10 years ago

How is GA abusive? The webmaster has to explicitly permit data sharing with google. That is, the webmaster is asked if s/he wants to share data with google and the options are unchecked by default.

GA prohibits the use of personally identifiable information.

Additionally the webmaster can tell google to not store IP info, which the webmaster has chosen to this in this case.

mortenlarsen6• 10 years ago

I have come to expect some tracking of stuff that happens in my browser. I try to block as much of it as I can with noscript, ublock, etc.

But I do not expect applications outside of my browser to behave like web sites do.

dang• 10 years ago

We detached this subthread from https://news.ycombinator.com/item?id=11567580 and marked it off-topic.

agounaris• 10 years ago

People have all of their traffic tracked by their ISPs, they use chrome, they have full activated accounts on their phones, they add tag themselves everywhere around facebook and they are mad because someone wants statistics over google analytics... you IT people need to relax... I'm sure someone will find a way to bring up inequality, sexism, racism and being vegan at some point on the thread.

lutoma• 10 years ago

The tinfoil hats are strong in this thread.

mescalito2• 10 years ago

I normally enjoyed the insight and comments of the thread more than the content of the article and don't comment that much.

But my personal opinion on this, only to share it and be heard possibly by the developers of homebrew, is that I honestly do not care about this. It's nice they are open about it, it's a hell of a tool and hey, if they want to track what I do to improve it, have my data.

I really don't see the opt-in/opt-out debate being so harsh on this. Because it's open source it should be opt-in? I really don't think so. Analytics are a valuable source of information for the developer and google provides a hell of a service for that. And you probably use several closed source tools that track you, sometimes without even telling you. Yes, you can really of external tools to block this, great for all of us those tools exists, you can use it for homebrew as well.

I wonder if all of the opt-in advocates don't use gmail for their email. I am pretty sure they do, and they are not worried about all of the tracking going on there? Or on other apps? Unless you really follow most if not all of stallman's computing principles[1], being furious about this, is, IMHO, disproportionate and a bit ungrateful.

So I am more than OK with opt-out. Nice that you wrote about it, nice that you provide a way to do it, and nice that you use your time to create such a great tool!

Kudos!

[1] https://stallman.org/stallman-computing.html

tremon5• 10 years ago

Because it's open source it should be opt-in?

Because the sending of data to a third party is not directly related to the functioning of the software.

Analytics are a valuable source of information for the developer

Yet it's not the developer's data, it's the users' data.

you probably use several closed source tools that track you, sometimes without even telling you

https://en.wikipedia.org/wiki/Argumentum_ad_populum

I wonder if all of the opt-in advocates don't use gmail for their email. I am pretty sure they do

https://en.wikipedia.org/wiki/Ad_hominem

mescalito2• 10 years ago

Nice links, that's why I like comments.

Ok, let's don't state it as an argument, but rather as a question.

Do anyone that's so much against opt-in is aware of closed source tools that tracks you and use it anyway?

And..

Do you use any third party web service like gmail or any other?

Although I hardly think I'll get an answer from most. At some point you have to make assumptions, wether those are fallacies, ok.

It's true it's not directly related to the functioning of the software, but it improves it in anyway, then there's a connection with it.

I take developer side and I personally look for see the grater good/less harm and compromise.

Opt-in will likely give them very little % of adherence and thus rendering all of this useless. Most of the opt-in advocates have technical capabilities to opt-out in any way (homebrew way, network filters, forking ,etc...). So why not simply letting this go?

I do think homebrew is a rather technical tool so most users are tech savvy guys, but still.

For me, this is pretty similar debate to donating organs.

https://en.wikipedia.org/wiki/Organ_donation#Opt-in_versus_o...

And I am 100% an opt-out advocate!

izacus• 10 years ago

So essentially US government is now one data request from Google away from having a full list of software (and vulnerabilities) for any given developer Mac?

socketsAPI• 10 years ago

You know what homebrew team : you guys are providing a great tool here and you should really charge for it. Take out the analytics stuff, cause no one cares if it helps you or makes it easier for you to improve software that you write for free on your own time. No one cares that it'll take you more time to improve this great tool without the analytics. No one cares that it'll cost you money to use another service besides Google Analytics. We don't want you to spend time or money that you don't have either, just don't bother doing updates or improving it, it's pretty good the way that it is. But honestly, the fact that I can do a clean install of OSX and install my entire dev environment + favorite apps in about 3 minutes VS going to each individual site, having each of them (most likely) collect data about me, have to download them individually, and then install them individually -- is DEFINITELY worth some extra money in your pocket! Charge me a couple bucks, I'll gladly pay you for it. Heck, I'm going to go donate now + wait to get charged. ALSO: Don't let me know TOO much, all the details make me think I can't trust you! And you made the opt-out directions too hard.. you mean I have to do extra work that will take 15 SECONDS OR LESS out of my day to opt-out?.. NO! You do more work, don't make things easy on yourself OR me, that's not cool, you can just start charging me for it. =P. Keep up the good work!

Homebrew now sends usage information to Google Analytics

Related Stories