18 ms·

Homebrew now sends usage information to Google Analytics

359 points by aorth 11y ago

hckr1292 11y ago
Kudos for at least announcing this. (And I've totally opted out.)
LeoPanthera 11y ago
Set HOMEBREW_NO_ANALYTICS=1 to opt out. The right thing to do would be to make it opt in, not opt out. (Which would not be without precedent. Debian's popcon is opt-in.)
- mikevm 11y ago
  That's probably true, but then no one would opt-in.
  - quotha 11y ago
    This is software, they can just ask instead!
    - Matt3o12_ 11y ago
      Which might break some scripts that expect home brew not to require user input. The right way to do it would be to ask if a terminal was available but in reality, scripts are not careful enough to tell applications that they are in fact headless. I've seen some scripts break under that assumption.
      - ant6n 11y ago
        Did it print a warning when upgrading on terminal? They could have a prompt with a countdown, you opt in it you don't say 'no' after a minute.
  - davesque 11y ago
    That's kinda the point.
  - joosters 11y ago
    ...which is very telling.
    - toomuchtodo 11y ago
      As in, people want privacy at the expense of volunteer time. Simple solution: Charge people for using Homebrew who don't want to send analytics in, fund Homebrew development with those funds. Otherwise, its an external cost being foisted on the volunteers by developers who want privacy at the cost of additional volunteer time. EDIT: The tone of this thread is the exact problem with open source projects and participation. "I want a say, but I'm not willing to contribute in any way except use your tool you're providing for free." Sad, but expected.
      - cname 11y ago
        I think most people aren't concerned so much about sharing usage data. The problem is specifically the way it's being shared via a third party. Other apps ask if I mind sharing some data (e.g., Firefox), and I don't have a problem with that.
        toomuchtodo 11y ago
        Okay. Is everyone going to pony up for a self-hosted analytics box and the time to manage it? No? Of course not. Everyone wants to complain, no one would contribute resources to do it though. Privacy has a high moral value (its free to want it and complain about it), but small economic value (you use Chrome? It sends everything you do back to Google. You'll still use it, because its better than not).
        Touche 11y ago
        a HN thread is not the appropriate place to ask for resources for a project. There are many OS projects out there with larger needs than an analytics server that have managed to get the support they need. If resources are an ongoing problem you even have the option of applying to join a free software foundation like Apache that has resources.
  - cname 11y ago
    Although if Homebrew wasn't using Google Analytics, maybe people would. It could just be a "Do you mind sending us anonymous usage data? [y/N]" prompt. Many other apps do something equivalent, and I don't mind giving it to them. The fact that those apps ask in the first place makes me much more amenable to the idea.
    - nickfrostatx 11y ago
      "Do you mind" would be counterintuitive. I see analytics and want to respond "n", for no analytics
  - duncan_bayne 11y ago
    ... which, if true, tells you something about the value of this 'feature' to the user.
  - derefr 11y ago
    Or, even worse, there'd be a selection effect where the distribution of people who opt in is skewed from the total distribution of Homebrew users, ruining the dataset for any analysis one might want to do to it. There's a reason that Nielson Ratings collection isn't opt-in.
    - falcolas 11y ago
      Funny, it's been quite a few years, but I remember being a Nielson family for a few months, and it was absolutely opt-in. We had to fill out a little booklet with what we were watching and data about ourselves.
      - maxerickson 11y ago
        You can't opt in to Nielson because they choose who to give the boxes to. Of course it's optional to do it if they do ask you if you want a box.
  - jordigh 11y ago
    At 193,622 submissions, I wouldn't say "nobody" opts in to popcon: http://popcon.debian.org/ http://popcon.debian.org/
- Touche 11y ago
  Disagree. Google Analytics is a network of companies that has agreed to privately collection information about users without their permission or even knowledge. It is malware that should not be included in Homebrew. The only ethical decision we can make as developers is not to use it.
  - fit2rule 11y ago
    Yeah, I'll confess that this is a real deal breaker for me personally .. I'll be having a closer look at ports and maybe fink soon. Maybe after all its time to get off OSX and back to Linux, where these sorts of things happen less frequently ..
    - oh_sigh 11y ago
      Or you could just say HOMEBREW_NO_ANALYTICS=1 and be done with it.
      - 0x0 11y ago
        Until next month when we might need to set HOMEBREW_NO_PIWIK=1337...
        mikeryan 11y ago
        I'd assume "NO_ANALYTICS" would mean "no analytics" not "no google analytics?
        Touche 11y ago
        I'd assume that software that wasn't sending analytics wouldn't start doing so without at least informing me first, but I'd be wrong. I think the parents point is that we can't trust Homebrew to do the right thing, because they've now chosen not to.
        0x0 11y ago
        Who knows!? This marks quite a change in attitude where the end user is suddenly responsible for staying on top of newly silently introduced opt-out settings. I'm pretty disappointed and feel the amount of trust I've had in the maintainers have dropped considerably. Sneakily sending random HTTP requests to third party analytics services and stuffing my dotfiles with unique identifiers for tracking purposes is not what I expected from a friendly open source project. This could have been handled much better with some sort of opt-in prompt like the debian installer does for its popcon usage tracker.
- binaryanomaly 11y ago
  Totally agree. I don't feel too comfortable bout google knowing everything about me... Should be opt in.
  - toomuchtodo 11y ago
    Did you read the link? Your actions cannot be tied specifically to you.
    - binaryanomaly 11y ago
      Says the company that offers the service? There's traces , ips, etc. everywhere, not impossible to correlate...
      - toomuchtodo 11y ago
        Then stop using Homebrew.
      - azag0 11y ago
        1) Homebrew is not a company. 2) It's open source.
        Spivak 11y ago
        1) Google the company. 2) GA is not open source nor does it matter when it's your data on someone else's server.
        toomuchtodo 11y ago
        What makes you trust Homebrew over Google? What makes you trust anyone with your data online?
        drivingmenuts 11y ago
        Well, up until now, Homebrew wasn't specifically collecting any information.
- Confiks 11y ago
  What is the mechanism in which Homebrew inserts itself into every shell session anyway? I had expected it to be loaded somewhere in some shell initialization script, such as .bashrc or .bash_profile, but I couldn't find anything.
  - Sidnicious 11y ago
    It doesn't — by default, Homebrew lives in /usr/local/bin/, which is already in the default $PATH on OS X.
    - Confiks 11y ago
      But then, by which mechanism does Homebrew notify GA that I have opened a terminal tab? There is a curl command executed every time, and I see a connection to GA with Little Snitch. Is there some way to see the caller of a process? htop displays no parent in the tree view.
      - LeoPanthera 11y ago
        You probably have something in your .bashrc, or shell equivalent, that is launching brew.
- vemv 11y ago
  Where's your reasoning? Homebrew gave theirs. Keep in mind that no personal info is ever sent. Just a random UUID.
  - oconnore 11y ago
    > no personal info > Just your universally unique id ...
    - toomuchtodo 11y ago
      "oconnore" is a perfectly valid unique identifier on HackerNews that doesn't tie to anything about you if you don't have your email address in your profile. This is no different.
      - ecesena 11y ago
        he does have the email, though
      - LeoPanthera 11y ago
        The difference is, it's a choice to post on a public website. homebrew is a package management tool, there is no expectation that it will send information about you to Google.
        deleted 11y ago
        [deleted]
        yborg 11y ago
        >is a package management tool This. The reasons they articulate for suddenly deciding on performing this data collection, and for doing it via GA are laughable. I am sufficiently annoyed at this because of the generation of yet another outbound data stream from my system, but the fact that in all likelihood the project will do nothing with this data really annoys me. There is zero need for this in a package system.
    - deleted 11y ago
- isomorphic 11y ago
  Or, you could edit /usr/local/Library/Homebrew/utils/analytics.rb to send Google Analytics garbage (from random UUIDs) until Homebrew makes this feature opt-in.
  - Touche 11y ago
    This is a great idea. Any rubyists want to provide a patch to do this?
    - x0x0 11y ago
      trashing the telemetry data they're using to figure out what OS/ver people are using and bugs they are hitting makes you a real jerk use their opt-out if you want
      - Touche 11y ago
        Fair point, the public shaming that is happening now is probably punishment enough. Frankly I don't trust the opt-out code to be (and remain) bug-free. There are, as far as I can tell from searching, no tests. So I feel more comfortable maintaining a patched version with the calls nooped instead.
        hk__2 11y ago
        You can also submit a pull-request to add tests or fix any bug you can find.
      - isomorphic 11y ago
        Collecting telemetry data without letting users even know about it (much less opt in) isn't cool, either.
        deleted 11y ago
        [deleted]
        cellularmitosis 11y ago
- 0x0 11y ago
  You may also want to "rm ~/.homebrew_analytics_user_uuid"
  - LeoPanthera 11y ago
    You could really screw with their statistics by regularly changing the contents of that file.
    - hk__2 11y ago
      Homebrew maintainer here. Remember that we didn’t put these analytics in place to get rich or get free beer at the local pub. Screwing up the stats won’t help anyone. We currently don’t have any overview of our userbase; we don’t even know how many people use Homebrew. More importantly, Homebrew currently only bottles the default options but we know some people use some options that cause the formulae to build from source. If tomorrow we see that e.g. `brew install foo --with-bar` is run by hundreds of people everyday we could start bottling it and saving time to everyone. But right now that’s completely dark; the only insights we have about the usage is people opening issues/PRs.
      - azag0 11y ago
        Amazing. I've been using --with-python3 a lot, having a bottled option would be great.
      - jsmeaton 11y ago
        I'll leave analytics turned on, but the blog post says it'll strip arguments. Your example above seems to conflict with what the post says, no?
        hk__2 11y ago
        Yeah it’s not implemented yet. We’re doing it incrementally and actually started shipping the first bits one month ago (but it was opt-in for tests). Bottling the most used options is something we’re really excited both as maintainers and users and is IMO the number 1 reason these analytics will benefit everyone. We’re currently looking how it behaves and will add them soon.
xutopia 11y ago
The fact that they are transparent about this, that we can opt-out if we want and that they're open source makes me feel more than comfortable sharing anonymous usage information with them. Homebrew has been amazing for me!
- LeoPanthera 11y ago
  Is an alert displayed to the user the first time it tries to send info to Google? If not, that is far from "transparent". It's good that they tell you how to opt out on the website, but I can't remember the last time I went to the website. Probably when I first installed Homebrew on this Mac.
  - daveguy 11y ago
    This. Either everyone should be notified before the first google analytics transmission so that they can choose to opt in our out. Or the default should be off and maybe on new installs they can choose to opt in. At the opt in/out dialog (when you give the users a choice) you can make the default to opt-in, but having the default as opt-in without any input from the user is bad form. It is similar to spammers calling your e-mail address "double opt-in" because they got you to open an e-mail and you didn't click the unsubscribe link.
    - khc 11y ago
      How should this be handled if the software in question is a server daemon? I want the users to make an explicit choice but it's not obvious what's the best way to do that.
      - Touche 11y ago
        On install.
        _asummers 11y ago
        I feel like on update would be better. Answering a yes/no/never isn't that much of an ask, I don't think. And that way you get a chance to use the software before you have to make a decision.
jbverschoor 11y ago
Totally fine with it.
fit2rule 11y ago
Wish there was a way of opt'ing-out without having to set an env var for every session .. is there some brew place to put ENV vars?
- LeoPanthera 11y ago
  Shove it in your .bashrc, or equivalent for your shell of choice.
- atm0sphere 11y ago
  pls go ahead and read the first response: http://unix.stackexchange.com/questions/117467/how-to-permanently-set-environmental-variables http://unix.stackexchange.com/questions/117467/how-to-perman...
  - fit2rule 11y ago
    This is a very single-user-centric view. Some of us have Macs with many hundreds of users. And so .. It is too invasive of my .bashrc/.profile that I have to use it to disable spy activity. I'd rather brew just have its own flag somewhere that says "Don't ever send analytics, ever, for any user on this system.."
    - shrikant 11y ago
      Maybe put it in /etc/bashrc ?
      - fit2rule 11y ago
        Maybe not have to pollute files just to not be spied on, hmm.. I'm sure brew has the cleverness to keep this configuration option in its own tree.
- madeofpalk 11y ago
  That's what ~/.bashrc or ~/.bash_profile or (whatever it is for your shell) is for.
ccleve 11y ago
Google must have eventually hired him. https://news.ycombinator.com/item?id=9695102 https://news.ycombinator.com/item?id=9695102
- yarou 11y ago
  No, they didn't. He works at Apple.
- nkozyra 11y ago
  I'm not sure why Google would care about Google Analytics on brew if they hired him, though.
jwilk 11y ago
It's high time for CVE-like identifiers for privacy violations.
- hnhnhn3 11y ago
  This is a great idea. Has there been any prior attempt at this?
petrikapu 11y ago
Tonight I'm going to read about pkgsrc and tomorrow give a try. It has active community last time I used it few years ago. Seems to have also binaries available at http://pkgsrc.joyent.com/install-on-osx/ http://pkgsrc.joyent.com/install-on-osx/
- petrikapu 11y ago
  My quick notes on how to get started with pkgsrc More info: http://pkgsrc.org/ http://wiki.netbsd.org/pkgsrc/pkgsrc_64bit_osx/ # Download pkgsrc curl -O https://ftp.netbsd.org/pub/pkgsrc/stable/pkgsrc.tar.bz2 # validate shasum $ curl -O https://ftp.netbsd.org/pub/pkgsrc/stable/pkgsrc.tar.bz2.SHA1 $ cat pkgsrc.tar.bz2.SHA1 $ shasum pkgsrc.tar.bz2 # extract pkgsrc archive. Mine lives at ~/Work and I also install built packages under Work. $ tar jxvf pkgsrc.tar.bz2 # bootstrap $ cd pkgsrc/bootstrap $ ./bootstrap --abi=64 --prefer-pkgsrc=yes --unprivileged --compiler=clang --prefix="$HOME/Work/pkg" # append prefix/bin to your PATH $ cat ~/.bash_profile export PATH="$PATH:$HOME/Work/pkg/bin" # re-login to make PATH effective # Example build of dos2unix (poor example because lots of dependencies like perl...) $ cd pkgsrc/converters/dos2unix/ $ bmake install ... ===> Installing binary package of dos2unix-7.3.3 $ file ~/Work/pkg/bin/dos2unix /Users/petri/Work/pkg/bin/dos2unix: Mach-O 64-bit executable x86_64
  - petrikapu 11y ago
    You can find homebrew uninstall info from here https://github.com/Homebrew/brew/blob/master/share/doc/homebrew/FAQ.md https://github.com/Homebrew/brew/blob/master/share/doc/homeb... # I did: # remove all packages $ for f in $(brew list); do brew remove "$f"; done # download uninstall script $ curl -O https://raw.githubusercontent.com/Homebrew/install/master/uninstall # review script # run uninstall script $ chmod +x uninstall $ ./uninstall ... # review /usr/local/bin/ /usr/local/etc/ /usr/local/lib/ /usr/local/share/ # I removed $ rm -rf /usr/local/share/ /usr/local/etc/ # Restore permissions $ sudo chmod 0755 /usr/local $ sudo chgrp wheel /usr/local
quotha 11y ago
is it formulae or formula?
- andrewjanke 11y ago
  "formulae" is plural for "formula".
cstrahan 11y ago
Yet another reason to ditch the antiquated Homebrew, and switch to the cross platform Nix: http://nixos.org/nix http://nixos.org/nix https://github.com/NixOS/nixpkgs https://github.com/NixOS/nixpkgs https://blog.errright.com/switching-from-homebrew-to-nix/ https://blog.errright.com/switching-from-homebrew-to-nix/
- astrange 11y ago
  Remember when everyone switched to Homebrew because Fink/macports were "antiquated", a.k.a. not written in Ruby? It was nice back then. Packages didn't install themselves in /usr/local.
  - Washuu 11y ago
    I remember switching from Fink and Macports because most of the time both of them would break or break something important.
  - santaclaus 11y ago
    I left MacPorts because the political infighting between package maintainers often left ports hopelessly out of date.
    - tjl 11y ago
      That's basically the main reason why I left MacPorts. The other was the fact that they'd build their own version of already installed programs. The worst offender for a long time was tetex until they finally added support for looking at an existing tetex installation. I also ran into a number of broken ports. I had used Fink, but I ran into issues with its packaging too. So, when I heard about Homebrew, I decided to try it. It's been pretty decent for me so I've stuck with it. The only major issue I've had has been related to Octave, but that's been a problem for MacPorts too as the OS X version isn't as up to date as the Linux version at times.
  - deleted 11y ago
    [deleted]
  - 11y ago
kodablah 11y ago
"[...] we do not have the resources to do detailed user studies of Homebrew users to decide on how best to design future features and prioritise current work. Anonymous aggregate user analytics allow us [...]" Isn't this a false dichotomy? Why can't other measures be used that don't require "resources" to do "detailed user studies" yet don't require on-by-default information capturing? Surely there are many open source projects that persist to make their users happy without this information, correct?
davesque 11y ago
Here's a github issue related to this for those who are interested: https://github.com/Homebrew/brew/issues/142 https://github.com/Homebrew/brew/issues/142
spicyj 11y ago
Isn't this the same info they'd get if they ran their own registry like every other package manager (instead of using GitHub)? In the grand scheme of things, this seems pretty minor to me.
rurban 11y ago
See, that's why I am a diehard macports user. /opt/local and not /usr/local. No cross pollution with my own configure && make && make install packages, nicely separated and maintained.
- Scarbutt 11y ago
  macports requires all of xcode, homebrew just the CLI tools.
  - jxy 11y ago
    This statement is false. With only Command Line Tools installed, macports complains, but everything works.
liveoneggs 11y ago
+1 for pkgsrc
atmosx 11y ago
I use MacPorts[1] which is a good alternative to homebrew. It's an older project. Lately though, I've came across many packages that are available for Homebrew but not for macports. [1] http://macports.org/ http://macports.org/
mehta 11y ago
Seems like Homebrew is doing many things right: - Anonimizing IP address. - Explaining what data is collected, and why - A way to optout Something that could be better: - Make this optout for new users and opt-in for existing users? - Notify the user in some manner when the data is sent to GA for the first time? - Change the uuid every X period of time to make things more privacy friendly. [Edit: wording]
nicolas_t 11y ago
I don't mind homebrew collecting anonymous information about me but I do not want Google to get even more information about me (and since the ip address I use with homebrew is the same I use to surf the web, the information is not anonymous for Google).
andreis_ 11y ago
Not on my computer: https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- nathanaldensr 11y ago
  Thanks for the link! I have been using http://winhelp2002.mvps.org/hosts.htm http://winhelp2002.mvps.org/hosts.htm for many years but it looks like StevenBlack's file is more comprehensive and updated more frequently.
- stordoff 11y ago
  Just used this list to set up DNS blocks on my network (DD-WRT/DNSmasq forcibly handles DNS traffic, with a bash script to add IPv6 hosts entries). Seems to work well so far.
joeblau 11y ago
As I see more applications try and hit remote ad servers, I feel even better that I'm blocking all of these ad servers with my /etc/hosts file using https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts. The update will be a no-op from my machine.
jalami 11y ago
Would really prefer it to be opt-in instead of opt-out as others have said. Sharing the info with Homebrew is one thing, the GA borg-malware is another entirely. Something like that should require an explicit request. At least in the browser, I can blacklist all requests with uBlock. Atom does the same thing and I'm not a fan. You have to explicitly remove the analytics 'package'. Soon every piece of software will be reporting, silently.
- dublinben 11y ago
  >Soon every piece of software will be reporting, silently. Not ethically written, free software. You would never see this behavior from a GNU program.
  - HappyTypist 11y ago
    Absolutely. If there were it'd be opt in and not to Google.
FussyZeus 11y ago
I love the knee-jerk hostile reactions to any sort of phoning home by an application. They've provided extensive explanations on what is collected, why they're collecting it, who has access, what it's for, and even the code that does the actual collecting and it still isn't enough for people. While I'm against this type of thing typically, this information is exactly what someone who is concerned about it needs to see, and if they don't want to be involved they include the opt-out on the very same page. I don't see how this could get any better, this could be held up as a gold standard for Microsoft and Google moving forward. This type of data is invaluable to developers, I can't tell you how frustrating it is that so many people now refuse to share it because of overblown privacy concerns. The data is anonymized and no one cares enough about what you're doing to de-anonymize it. There are real threats to your privacy out there and spending time on stuff like this just adds to the noise.
- nathanaldensr 11y ago
  Your arguments are ridiculous. Humans judge; we're good at it. Burn us enough times with false promises of privacy or outright lies and yes, we will learn to become very skeptical and untrusting. You're asking people to continue trusting a system that has proven to be working against users' best interests for a long time. The data is not sufficiently anonymized. Your public IP address is sent to Google and--the burden of proof is on Google to prove this doesn't happen--there is nothing stopping Google from comparing that data to other requests they get from the same IP address (say, from your browser). Maybe Google can't personally identify me from this data, but they can sure target me with ads, which--shock--make them money.
tristor 11y ago
Here's a quick and dirty way to opt out for BASH and ZSH users for easy copy/pasting. BASH: cat <<EOF >> .bashrc # Opt out of Homebrew analytics export HOMEBREW_NO_ANALYTICS=1 if [[ -e "$HOME/.homebrew_analytics_user_uuid" ]]; then rm -f "$HOME/.homebrew_analytics_user_uuid" fi EOF ZSH: cat <<EOF >> .zshrc # Opt out of Homebrew analytics export HOMEBREW_NO_ANALYTICS=1 if [[ -e "$HOME/.homebrew_analytics_user_uuid" ]]; then rm -f "$HOME/.homebrew_analytics_user_uuid" fi EOF Cheers.
- alainv 11y ago
  `rm -f` ignores nonexistent files so you could omit the `if` to be concise.
  - tristor 11y ago
    Good call. I was mainly using `-f` to suppress the prompt about deleting the file, but you're correct, it's unnecessary to have the if statement in this case.
- hk__2 11y ago
  You don’t need to remove that file; the whole point of this env variable is that it stops Homebrew from sending any data. It won’t even be created if that variable is set.
  - tristor 11y ago
    That's only true if the variable is set before the first instance when data would have been sent, otherwise the file will exist (as it did on my system).
aurora72 11y ago
AFAIK, Max Howell was rejected from a position at Google, and now his trademark making use of Google? Let him take a look at GNU.ORG; if he can see any GA code.
rajesht 11y ago
set HOMEBREW_NO_ANALYTICS=1
pdkl95 11y ago
> generated by uuidgen So sending a unique tracking number... > enable us to accurately measure user counts vs. event counts for the specific purpose of associating events from the same user... > This does not allow us to track individual users somehow doesn't accomplish it's stated purpose? The entire point of that UUID is to track individual users. > The Google Analytics anonymous IP setting is enabled Sending Google an additional boolean flag doesn't prevent Google from reading the Source Address from the IP header.
codedokode 11y ago
It looks like everybody today wants to spy on you. Google, Facebook, and Twitter want to look at your browsing history, NSA wants to see your calls, emails, and messages history. Microsoft wants to know about everything you do at your PC and now even package managers want to have their share of data, too. What about asking my opinion first? Well, as homebrew developer have said > The problem with opt-in is that you don’t get representative data. Users do not seem to be enthusiastic about participating when they have a choice so let's go without asking them.
HappyTypist 11y ago
I think it's very reasonable to prompt a message on install saying "Homebrew collects and sends anonymous analytics. Use Homebrew --disable-analytics to opt out" and have that null the analytics identifier. Environment variables aren't that convenient.
dotwtf 11y ago
Made me open an HN account just to say this This is a very bad move and will further erode the already declining trust people put in package managers and software distribution channels. This is not transparency - transparency would be asking for user's explicit consent on the first brew invocation that includes this "feature". If this decision is not publicly reverted I will be removing homebrew altogether as it indicates a severe lapse in judgement, good faith or both on the part of the homebrew team.
mikemcquaid 11y ago
I'm the maintainer who added this. I apologise for the poor communication. I would have responded sooner but I've been on a plane for the last 10 hours. I'd hoped the documentation would have made clear our reasons for doing this but I feel the discomfort so since getting off my flight I've opened and merged three PRs (https://github.com/Homebrew/install/pull/42 https://github.com/Homebrew/install/pull/42 https://github.com/Homebrew/brew/pull/143 https://github.com/Homebrew/brew/pull/143 https://github.com/Homebrew/brew/pull/146 https://github.com/Homebrew/brew/pull/146) to better communicate this to our users on installation and `brew update` before any information is sent and ease the opt-out process.
- javajosh 11y ago
  It should be opt-in, not opt-out.
  - eistrati 11y ago
    I second that. It must be an opt-in feature.
    - shizcakes 11y ago
      I don't see why; you're tracked like this on nearly every website you visit unless you opt out. This isn't malicious.
      - couchand 11y ago
        That doesn't follow. The fact that many websites do this doesn't prove that it isn't malicious. It may not be (it probably isn't), but that has little to do with the complaints made about the change.
        pessimizer 11y ago
        Since more people downvoted you than upvoted you, that proves that when most websites do something, it can't be malicious when an application on your computer does it. I think?
faizanbhat 11y ago
Honest question for people who are opposed to this update and think it should be opt-in: what do you see as the downsides or pitfalls of sending anonymised usage info to Homebrew / Google Analytics?
- cellularmitosis 11y ago
  I really wish people would explain their reasoning here. I guess I just don't understand why handing a list of installed packages to Google is not my interest. Everyone in this thread seems to be just assuming that everyone else is already onboard with this reasoning.
lawnchair_larry 11y ago
Reminder - The NSA/GCHQ systems described their use of Google Analytics piggybacking to fingerprint and target users for exploitation. They also used similar Windows error reporting to monitor what software/hardware users have. Not that anyone should be snooping on what users do without opt-in permission, but even if we believed that Google "anonymize" it, there are still concerns. More simply, there's just no reason for you to know what I do on my own computer. It's none of your business and I don't need a reason.
Gratsby 11y ago
These kinds of "features" are a problem for open source, and I don't know that they are a good idea in general. It's nice to know how and where your software is being used, but in many environments call-home functionality and auto-update functionality are non-starters. Any non-user initiated network activity should be explicitly agreed to and available to be easily stripped. We can and should do a better job with open source software than closed source would-be competition. Even if you aren't a privacy advocate, privacy is a priority of a significant amount of the technical community. It's significant enough that it should be addressed as a forethought to features like this, not an afterthought. Things like this pop up as negative news entries that people gloss over. The guy who makes the snap decision "don't use brew, it phones home" today could be a CTO who never had that opinion changed three years from now.
geggam 11y ago
one more what used to be decent software selling out to marketing.... guess its back to the linux vm when working on a mac...
escot 11y ago
opt-in by default is fine with me. Thanks for the great tool!
corporatemonkey 11y ago
Many large corporations have internal homebrew packages. You can learn company secrets by getting a list of packages that are being installed.
TheLogothete 11y ago
Yeah. So every site and every product on the internet has this dark pattern. Do you use google? Youtube? StackOverflow? Are you outraged by them too?
- stephenr 11y ago
  > So every site and every product on the internet has this dark pattern. Not every site/product on the internet uses an abusive analytics platform, hell not all of them use analytics at all. With sites visited in a browser, an extension can be used to block access to abusive services such as GA. There is no Ghostery for the terminal. I have no issue with them wanting to collect usage information. I opt-in to Debian's package usage tracking. If I still used Homebrew, I would have a huge issue with them sending information about what packages I install to Google.
  - TheLogothete 11y ago
    How is GA abusive? The webmaster has to explicitly permit data sharing with google. That is, the webmaster is asked if s/he wants to share data with google and the options are unchecked by default. GA prohibits the use of personally identifiable information. Additionally the webmaster can tell google to not store IP info, which the webmaster has chosen to this in this case.
    - stephenr 11y ago
      > The webmaster has to explicitly permit data sharing with google. Abusive to users. Google's whole reason for offering free analytics is to build better advertising profiles. > Additionally the webmaster can chose to not send IP info to google, I must have missed the memo where Google invented a way to make HTTP connections with no client IP.
      - TheLogothete 11y ago
        This has gone full circle and honestly is quite irritating at this point. People say that Google uses GA data for advertising, I say that this is not the case and then you just chose to ignore that. So I'm just gonna ask directly - can you show some evidence suggesting Google uses GA data for building advertising profiles or did you pull this opinion out of your ass? Because as someone who analyses marketing and advertising data, I can tell you that I strongly believe they do not use GA data in this way. 1) They have no need to, they have better data; 2) This data is unreliable; 3) GA prohibits the use of personally identifiable information; and most important of all: THE WEBMASTER CAN CHOSE TO NOT SHARE IT WITH THEM. If this webmaster went out of his way to tell google not to store IP information, I think it is pretty safe to assume that they did not opt-in to share the data with google AT ALL. Apart from these technical reasons, using GA data in the way you think they do opens a regulatory risk of EPIC proportions. But if you have some evidence to suggest that they do use it for "advertising profiles", please do share it. But if you can't and you formed this opinion because you are prejudiced, I would like to see you admitting it.
agounaris 11y ago
People have all of their traffic tracked by their ISPs, they use chrome, they have full activated accounts on their phones, they add tag themselves everywhere around facebook and they are mad because someone wants statistics over google analytics... you IT people need to relax... I'm sure someone will find a way to bring up inequality, sexism, racism and being vegan at some point on the thread.
lutoma 11y ago
The tinfoil hats are strong in this thread.
mescalito 11y ago
I normally enjoyed the insight and comments of the thread more than the content of the article and don't comment that much. But my personal opinion on this, only to share it and be heard possibly by the developers of homebrew, is that I honestly do not care about this. It's nice they are open about it, it's a hell of a tool and hey, if they want to track what I do to improve it, have my data. I really don't see the opt-in/opt-out debate being so harsh on this. Because it's open source it should be opt-in? I really don't think so. Analytics are a valuable source of information for the developer and google provides a hell of a service for that. And you probably use several closed source tools that track you, sometimes without even telling you. Yes, you can really of external tools to block this, great for all of us those tools exists, you can use it for homebrew as well. I wonder if all of the opt-in advocates don't use gmail for their email. I am pretty sure they do, and they are not worried about all of the tracking going on there? Or on other apps? Unless you really follow most if not all of stallman's computing principles[1], being furious about this, is, IMHO, disproportionate and a bit ungrateful. So I am more than OK with opt-out. Nice that you wrote about it, nice that you provide a way to do it, and nice that you use your time to create such a great tool! Kudos! [1]: https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html
- tremon 11y ago
  Because it's open source it should be opt-in? Because the sending of data to a third party is not directly related to the functioning of the software. Analytics are a valuable source of information for the developer Yet it's not the developer's data, it's the users' data. you probably use several closed source tools that track you, sometimes without even telling you https://en.wikipedia.org/wiki/Argumentum_ad_populum https://en.wikipedia.org/wiki/Argumentum_ad_populum I wonder if all of the opt-in advocates don't use gmail for their email. I am pretty sure they do https://en.wikipedia.org/wiki/Ad_hominem https://en.wikipedia.org/wiki/Ad_hominem
  - mescalito 11y ago
    Nice links, that's why I like comments. Ok, let's don't state it as an argument, but rather as a question. Do anyone that's so much against opt-in is aware of closed source tools that tracks you and use it anyway? And.. Do you use any third party web service like gmail or any other? Although I hardly think I'll get an answer from most. At some point you have to make assumptions, wether those are fallacies, ok. It's true it's not directly related to the functioning of the software, but it improves it in anyway, then there's a connection with it. I take developer side and I personally look for see the grater good/less harm and compromise. Opt-in will likely give them very little % of adherence and thus rendering all of this useless. Most of the opt-in advocates have technical capabilities to opt-out in any way (homebrew way, network filters, forking ,etc...). So why not simply letting this go? I do think homebrew is a rather technical tool so most users are tech savvy guys, but still. For me, this is pretty similar debate to donating organs. https://en.wikipedia.org/wiki/Organ_donation#Opt-in_versus_opt-out https://en.wikipedia.org/wiki/Organ_donation#Opt-in_versus_o... And I am 100% an opt-out advocate!
izacus 11y ago
So essentially US government is now one data request from Google away from having a full list of software (and vulnerabilities) for any given developer Mac?
socketsAPI 11y ago
You know what homebrew team : you guys are providing a great tool here and you should really charge for it. Take out the analytics stuff, cause no one cares if it helps you or makes it easier for you to improve software that you write for free on your own time. No one cares that it'll take you more time to improve this great tool without the analytics. No one cares that it'll cost you money to use another service besides Google Analytics. We don't want you to spend time or money that you don't have either, just don't bother doing updates or improving it, it's pretty good the way that it is. But honestly, the fact that I can do a clean install of OSX and install my entire dev environment + favorite apps in about 3 minutes VS going to each individual site, having each of them (most likely) collect data about me, have to download them individually, and then install them individually -- is DEFINITELY worth some extra money in your pocket! Charge me a couple bucks, I'll gladly pay you for it. Heck, I'm going to go donate now + wait to get charged. ALSO: Don't let me know TOO much, all the details make me think I can't trust you! And you made the opt-out directions too hard.. you mean I have to do extra work that will take 15 SECONDS OR LESS out of my day to opt-out?.. NO! You do more work, don't make things easy on yourself OR me, that's not cool, you can just start charging me for it. =P. Keep up the good work!

359 points by aorth 11y ago

Kudos for at least announcing this. (And I've totally opted out.)

Set HOMEBREW_NO_ANALYTICS=1 to opt out. The right thing to do would be to make it opt in, not opt out. (Which would not be without precedent. Debian's popcon is opt-in.)

mikevm 11y ago
That's probably true, but then no one would opt-in.
- quotha 11y ago
  This is software, they can just ask instead!
  - Matt3o12_ 11y ago
    Which might break some scripts that expect home brew not to require user input. The right way to do it would be to ask if a terminal was available but in reality, scripts are not careful enough to tell applications that they are in fact headless. I've seen some scripts break under that assumption.
    - ant6n 11y ago
      Did it print a warning when upgrading on terminal? They could have a prompt with a countdown, you opt in it you don't say 'no' after a minute.
- davesque 11y ago
  That's kinda the point.
- joosters 11y ago
  ...which is very telling.
  - toomuchtodo 11y ago
    As in, people want privacy at the expense of volunteer time. Simple solution: Charge people for using Homebrew who don't want to send analytics in, fund Homebrew development with those funds. Otherwise, its an external cost being foisted on the volunteers by developers who want privacy at the cost of additional volunteer time. EDIT: The tone of this thread is the exact problem with open source projects and participation. "I want a say, but I'm not willing to contribute in any way except use your tool you're providing for free." Sad, but expected.
    - cname 11y ago
      I think most people aren't concerned so much about sharing usage data. The problem is specifically the way it's being shared via a third party. Other apps ask if I mind sharing some data (e.g., Firefox), and I don't have a problem with that.
      - toomuchtodo 11y ago
        Okay. Is everyone going to pony up for a self-hosted analytics box and the time to manage it? No? Of course not. Everyone wants to complain, no one would contribute resources to do it though. Privacy has a high moral value (its free to want it and complain about it), but small economic value (you use Chrome? It sends everything you do back to Google. You'll still use it, because its better than not).
        Touche 11y ago
        a HN thread is not the appropriate place to ask for resources for a project. There are many OS projects out there with larger needs than an analytics server that have managed to get the support they need. If resources are an ongoing problem you even have the option of applying to join a free software foundation like Apache that has resources.
- cname 11y ago
  Although if Homebrew wasn't using Google Analytics, maybe people would. It could just be a "Do you mind sending us anonymous usage data? [y/N]" prompt. Many other apps do something equivalent, and I don't mind giving it to them. The fact that those apps ask in the first place makes me much more amenable to the idea.
  - nickfrostatx 11y ago
    "Do you mind" would be counterintuitive. I see analytics and want to respond "n", for no analytics
- duncan_bayne 11y ago
  ... which, if true, tells you something about the value of this 'feature' to the user.
- derefr 11y ago
  Or, even worse, there'd be a selection effect where the distribution of people who opt in is skewed from the total distribution of Homebrew users, ruining the dataset for any analysis one might want to do to it. There's a reason that Nielson Ratings collection isn't opt-in.
  - falcolas 11y ago
    Funny, it's been quite a few years, but I remember being a Nielson family for a few months, and it was absolutely opt-in. We had to fill out a little booklet with what we were watching and data about ourselves.
    - maxerickson 11y ago
      You can't opt in to Nielson because they choose who to give the boxes to. Of course it's optional to do it if they do ask you if you want a box.
- jordigh 11y ago
  At 193,622 submissions, I wouldn't say "nobody" opts in to popcon: http://popcon.debian.org/ http://popcon.debian.org/
Touche 11y ago
Disagree. Google Analytics is a network of companies that has agreed to privately collection information about users without their permission or even knowledge. It is malware that should not be included in Homebrew. The only ethical decision we can make as developers is not to use it.
- fit2rule 11y ago
  Yeah, I'll confess that this is a real deal breaker for me personally .. I'll be having a closer look at ports and maybe fink soon. Maybe after all its time to get off OSX and back to Linux, where these sorts of things happen less frequently ..
  - oh_sigh 11y ago
    Or you could just say HOMEBREW_NO_ANALYTICS=1 and be done with it.
    - 0x0 11y ago
      Until next month when we might need to set HOMEBREW_NO_PIWIK=1337...
      - mikeryan 11y ago
        I'd assume "NO_ANALYTICS" would mean "no analytics" not "no google analytics?
        Touche 11y ago
        I'd assume that software that wasn't sending analytics wouldn't start doing so without at least informing me first, but I'd be wrong. I think the parents point is that we can't trust Homebrew to do the right thing, because they've now chosen not to.
        0x0 11y ago
        Who knows!? This marks quite a change in attitude where the end user is suddenly responsible for staying on top of newly silently introduced opt-out settings. I'm pretty disappointed and feel the amount of trust I've had in the maintainers have dropped considerably. Sneakily sending random HTTP requests to third party analytics services and stuffing my dotfiles with unique identifiers for tracking purposes is not what I expected from a friendly open source project. This could have been handled much better with some sort of opt-in prompt like the debian installer does for its popcon usage tracker.
binaryanomaly 11y ago
Totally agree. I don't feel too comfortable bout google knowing everything about me... Should be opt in.
- toomuchtodo 11y ago
  Did you read the link? Your actions cannot be tied specifically to you.
  - binaryanomaly 11y ago
    Says the company that offers the service? There's traces , ips, etc. everywhere, not impossible to correlate...
    - toomuchtodo 11y ago
      Then stop using Homebrew.
    - azag0 11y ago
      1) Homebrew is not a company. 2) It's open source.
      - Spivak 11y ago
        1) Google the company. 2) GA is not open source nor does it matter when it's your data on someone else's server.
        toomuchtodo 11y ago
        What makes you trust Homebrew over Google? What makes you trust anyone with your data online?
        drivingmenuts 11y ago
        Well, up until now, Homebrew wasn't specifically collecting any information.
Confiks 11y ago
What is the mechanism in which Homebrew inserts itself into every shell session anyway? I had expected it to be loaded somewhere in some shell initialization script, such as .bashrc or .bash_profile, but I couldn't find anything.
- Sidnicious 11y ago
  It doesn't — by default, Homebrew lives in /usr/local/bin/, which is already in the default $PATH on OS X.
  - Confiks 11y ago
    But then, by which mechanism does Homebrew notify GA that I have opened a terminal tab? There is a curl command executed every time, and I see a connection to GA with Little Snitch. Is there some way to see the caller of a process? htop displays no parent in the tree view.
    - LeoPanthera 11y ago
      You probably have something in your .bashrc, or shell equivalent, that is launching brew.
vemv 11y ago
Where's your reasoning? Homebrew gave theirs. Keep in mind that no personal info is ever sent. Just a random UUID.
- oconnore 11y ago
  > no personal info > Just your universally unique id ...
  - toomuchtodo 11y ago
    "oconnore" is a perfectly valid unique identifier on HackerNews that doesn't tie to anything about you if you don't have your email address in your profile. This is no different.
    - ecesena 11y ago
      he does have the email, though
    - LeoPanthera 11y ago
      The difference is, it's a choice to post on a public website. homebrew is a package management tool, there is no expectation that it will send information about you to Google.
      - deleted 11y ago
        [deleted]
      - yborg 11y ago
        >is a package management tool This. The reasons they articulate for suddenly deciding on performing this data collection, and for doing it via GA are laughable. I am sufficiently annoyed at this because of the generation of yet another outbound data stream from my system, but the fact that in all likelihood the project will do nothing with this data really annoys me. There is zero need for this in a package system.
  - deleted 11y ago
isomorphic 11y ago
Or, you could edit /usr/local/Library/Homebrew/utils/analytics.rb to send Google Analytics garbage (from random UUIDs) until Homebrew makes this feature opt-in.
- Touche 11y ago
  This is a great idea. Any rubyists want to provide a patch to do this?
  - x0x0 11y ago
    trashing the telemetry data they're using to figure out what OS/ver people are using and bugs they are hitting makes you a real jerk use their opt-out if you want
    - Touche 11y ago
      Fair point, the public shaming that is happening now is probably punishment enough. Frankly I don't trust the opt-out code to be (and remain) bug-free. There are, as far as I can tell from searching, no tests. So I feel more comfortable maintaining a patched version with the calls nooped instead.
      - hk__2 11y ago
        You can also submit a pull-request to add tests or fix any bug you can find.
    - isomorphic 11y ago
      Collecting telemetry data without letting users even know about it (much less opt in) isn't cool, either.
      - deleted 11y ago
        [deleted]
      - cellularmitosis 11y ago
0x0 11y ago
You may also want to "rm ~/.homebrew_analytics_user_uuid"
- LeoPanthera 11y ago
  You could really screw with their statistics by regularly changing the contents of that file.
  - hk__2 11y ago
    Homebrew maintainer here. Remember that we didn’t put these analytics in place to get rich or get free beer at the local pub. Screwing up the stats won’t help anyone. We currently don’t have any overview of our userbase; we don’t even know how many people use Homebrew. More importantly, Homebrew currently only bottles the default options but we know some people use some options that cause the formulae to build from source. If tomorrow we see that e.g. `brew install foo --with-bar` is run by hundreds of people everyday we could start bottling it and saving time to everyone. But right now that’s completely dark; the only insights we have about the usage is people opening issues/PRs.
    - azag0 11y ago
      Amazing. I've been using --with-python3 a lot, having a bottled option would be great.
    - jsmeaton 11y ago
      I'll leave analytics turned on, but the blog post says it'll strip arguments. Your example above seems to conflict with what the post says, no?
      - hk__2 11y ago
        Yeah it’s not implemented yet. We’re doing it incrementally and actually started shipping the first bits one month ago (but it was opt-in for tests). Bottling the most used options is something we’re really excited both as maintainers and users and is IMO the number 1 reason these analytics will benefit everyone. We’re currently looking how it behaves and will add them soon.

xutopia 11y ago

The fact that they are transparent about this, that we can opt-out if we want and that they're open source makes me feel more than comfortable sharing anonymous usage information with them. Homebrew has been amazing for me!

LeoPanthera 11y ago
Is an alert displayed to the user the first time it tries to send info to Google? If not, that is far from "transparent". It's good that they tell you how to opt out on the website, but I can't remember the last time I went to the website. Probably when I first installed Homebrew on this Mac.
- daveguy 11y ago
  This. Either everyone should be notified before the first google analytics transmission so that they can choose to opt in our out. Or the default should be off and maybe on new installs they can choose to opt in. At the opt in/out dialog (when you give the users a choice) you can make the default to opt-in, but having the default as opt-in without any input from the user is bad form. It is similar to spammers calling your e-mail address "double opt-in" because they got you to open an e-mail and you didn't click the unsubscribe link.
  - khc 11y ago
    How should this be handled if the software in question is a server daemon? I want the users to make an explicit choice but it's not obvious what's the best way to do that.
    - Touche 11y ago
      On install.
      - _asummers 11y ago
        I feel like on update would be better. Answering a yes/no/never isn't that much of an ask, I don't think. And that way you get a chance to use the software before you have to make a decision.

jbverschoor 11y ago

Totally fine with it.

fit2rule 11y ago

Wish there was a way of opt'ing-out without having to set an env var for every session .. is there some brew place to put ENV vars?

LeoPanthera 11y ago
Shove it in your .bashrc, or equivalent for your shell of choice.
atm0sphere 11y ago
pls go ahead and read the first response: http://unix.stackexchange.com/questions/117467/how-to-permanently-set-environmental-variables http://unix.stackexchange.com/questions/117467/how-to-perman...
- fit2rule 11y ago
  This is a very single-user-centric view. Some of us have Macs with many hundreds of users. And so .. It is too invasive of my .bashrc/.profile that I have to use it to disable spy activity. I'd rather brew just have its own flag somewhere that says "Don't ever send analytics, ever, for any user on this system.."
  - shrikant 11y ago
    Maybe put it in /etc/bashrc ?
    - fit2rule 11y ago
      Maybe not have to pollute files just to not be spied on, hmm.. I'm sure brew has the cleverness to keep this configuration option in its own tree.
madeofpalk 11y ago
That's what ~/.bashrc or ~/.bash_profile or (whatever it is for your shell) is for.

ccleve 11y ago

Google must have eventually hired him. https://news.ycombinator.com/item?id=9695102 https://news.ycombinator.com/item?id=9695102

yarou 11y ago
No, they didn't. He works at Apple.
nkozyra 11y ago
I'm not sure why Google would care about Google Analytics on brew if they hired him, though.

jwilk 11y ago

It's high time for CVE-like identifiers for privacy violations.

hnhnhn3 11y ago
This is a great idea. Has there been any prior attempt at this?

petrikapu 11y ago

Tonight I'm going to read about pkgsrc and tomorrow give a try. It has active community last time I used it few years ago. Seems to have also binaries available at http://pkgsrc.joyent.com/install-on-osx/ http://pkgsrc.joyent.com/install-on-osx/

petrikapu 11y ago
My quick notes on how to get started with pkgsrc More info: http://pkgsrc.org/ http://wiki.netbsd.org/pkgsrc/pkgsrc_64bit_osx/ # Download pkgsrc curl -O https://ftp.netbsd.org/pub/pkgsrc/stable/pkgsrc.tar.bz2 # validate shasum $ curl -O https://ftp.netbsd.org/pub/pkgsrc/stable/pkgsrc.tar.bz2.SHA1 $ cat pkgsrc.tar.bz2.SHA1 $ shasum pkgsrc.tar.bz2 # extract pkgsrc archive. Mine lives at ~/Work and I also install built packages under Work. $ tar jxvf pkgsrc.tar.bz2 # bootstrap $ cd pkgsrc/bootstrap $ ./bootstrap --abi=64 --prefer-pkgsrc=yes --unprivileged --compiler=clang --prefix="$HOME/Work/pkg" # append prefix/bin to your PATH $ cat ~/.bash_profile export PATH="$PATH:$HOME/Work/pkg/bin" # re-login to make PATH effective # Example build of dos2unix (poor example because lots of dependencies like perl...) $ cd pkgsrc/converters/dos2unix/ $ bmake install ... ===> Installing binary package of dos2unix-7.3.3 $ file ~/Work/pkg/bin/dos2unix /Users/petri/Work/pkg/bin/dos2unix: Mach-O 64-bit executable x86_64
- petrikapu 11y ago
  You can find homebrew uninstall info from here https://github.com/Homebrew/brew/blob/master/share/doc/homebrew/FAQ.md https://github.com/Homebrew/brew/blob/master/share/doc/homeb... # I did: # remove all packages $ for f in $(brew list); do brew remove "$f"; done # download uninstall script $ curl -O https://raw.githubusercontent.com/Homebrew/install/master/uninstall # review script # run uninstall script $ chmod +x uninstall $ ./uninstall ... # review /usr/local/bin/ /usr/local/etc/ /usr/local/lib/ /usr/local/share/ # I removed $ rm -rf /usr/local/share/ /usr/local/etc/ # Restore permissions $ sudo chmod 0755 /usr/local $ sudo chgrp wheel /usr/local

quotha 11y ago

is it formulae or formula?

andrewjanke 11y ago
"formulae" is plural for "formula".

cstrahan 11y ago

Yet another reason to ditch the antiquated Homebrew, and switch to the cross platform Nix: http://nixos.org/nix http://nixos.org/nix https://github.com/NixOS/nixpkgs https://github.com/NixOS/nixpkgs https://blog.errright.com/switching-from-homebrew-to-nix/ https://blog.errright.com/switching-from-homebrew-to-nix/

astrange 11y ago
Remember when everyone switched to Homebrew because Fink/macports were "antiquated", a.k.a. not written in Ruby? It was nice back then. Packages didn't install themselves in /usr/local.
- Washuu 11y ago
  I remember switching from Fink and Macports because most of the time both of them would break or break something important.
- santaclaus 11y ago
  I left MacPorts because the political infighting between package maintainers often left ports hopelessly out of date.
  - tjl 11y ago
    That's basically the main reason why I left MacPorts. The other was the fact that they'd build their own version of already installed programs. The worst offender for a long time was tetex until they finally added support for looking at an existing tetex installation. I also ran into a number of broken ports. I had used Fink, but I ran into issues with its packaging too. So, when I heard about Homebrew, I decided to try it. It's been pretty decent for me so I've stuck with it. The only major issue I've had has been related to Octave, but that's been a problem for MacPorts too as the OS X version isn't as up to date as the Linux version at times.
- deleted 11y ago
  [deleted]
- 11y ago

kodablah 11y ago

"[...] we do not have the resources to do detailed user studies of Homebrew users to decide on how best to design future features and prioritise current work. Anonymous aggregate user analytics allow us [...]" Isn't this a false dichotomy? Why can't other measures be used that don't require "resources" to do "detailed user studies" yet don't require on-by-default information capturing? Surely there are many open source projects that persist to make their users happy without this information, correct?

davesque 11y ago

Here's a github issue related to this for those who are interested: https://github.com/Homebrew/brew/issues/142 https://github.com/Homebrew/brew/issues/142

spicyj 11y ago

Isn't this the same info they'd get if they ran their own registry like every other package manager (instead of using GitHub)? In the grand scheme of things, this seems pretty minor to me.

rurban 11y ago

See, that's why I am a diehard macports user. /opt/local and not /usr/local. No cross pollution with my own configure && make && make install packages, nicely separated and maintained.

Scarbutt 11y ago
macports requires all of xcode, homebrew just the CLI tools.
- jxy 11y ago
  This statement is false. With only Command Line Tools installed, macports complains, but everything works.

liveoneggs 11y ago

+1 for pkgsrc

atmosx 11y ago

I use MacPorts[1] which is a good alternative to homebrew. It's an older project. Lately though, I've came across many packages that are available for Homebrew but not for macports. [1] http://macports.org/ http://macports.org/

mehta 11y ago

Seems like Homebrew is doing many things right: - Anonimizing IP address. - Explaining what data is collected, and why - A way to optout Something that could be better: - Make this optout for new users and opt-in for existing users? - Notify the user in some manner when the data is sent to GA for the first time? - Change the uuid every X period of time to make things more privacy friendly. [Edit: wording]

nicolas_t 11y ago

I don't mind homebrew collecting anonymous information about me but I do not want Google to get even more information about me (and since the ip address I use with homebrew is the same I use to surf the web, the information is not anonymous for Google).

andreis_ 11y ago

Not on my computer: https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts

nathanaldensr 11y ago
Thanks for the link! I have been using http://winhelp2002.mvps.org/hosts.htm http://winhelp2002.mvps.org/hosts.htm for many years but it looks like StevenBlack's file is more comprehensive and updated more frequently.
stordoff 11y ago
Just used this list to set up DNS blocks on my network (DD-WRT/DNSmasq forcibly handles DNS traffic, with a bash script to add IPv6 hosts entries). Seems to work well so far.

joeblau 11y ago

As I see more applications try and hit remote ad servers, I feel even better that I'm blocking all of these ad servers with my /etc/hosts file using https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts. The update will be a no-op from my machine.

jalami 11y ago

Would really prefer it to be opt-in instead of opt-out as others have said. Sharing the info with Homebrew is one thing, the GA borg-malware is another entirely. Something like that should require an explicit request. At least in the browser, I can blacklist all requests with uBlock. Atom does the same thing and I'm not a fan. You have to explicitly remove the analytics 'package'. Soon every piece of software will be reporting, silently.

dublinben 11y ago
>Soon every piece of software will be reporting, silently. Not ethically written, free software. You would never see this behavior from a GNU program.
- HappyTypist 11y ago
  Absolutely. If there were it'd be opt in and not to Google.

FussyZeus 11y ago

I love the knee-jerk hostile reactions to any sort of phoning home by an application. They've provided extensive explanations on what is collected, why they're collecting it, who has access, what it's for, and even the code that does the actual collecting and it still isn't enough for people. While I'm against this type of thing typically, this information is exactly what someone who is concerned about it needs to see, and if they don't want to be involved they include the opt-out on the very same page. I don't see how this could get any better, this could be held up as a gold standard for Microsoft and Google moving forward. This type of data is invaluable to developers, I can't tell you how frustrating it is that so many people now refuse to share it because of overblown privacy concerns. The data is anonymized and no one cares enough about what you're doing to de-anonymize it. There are real threats to your privacy out there and spending time on stuff like this just adds to the noise.

nathanaldensr 11y ago
Your arguments are ridiculous. Humans judge; we're good at it. Burn us enough times with false promises of privacy or outright lies and yes, we will learn to become very skeptical and untrusting. You're asking people to continue trusting a system that has proven to be working against users' best interests for a long time. The data is not sufficiently anonymized. Your public IP address is sent to Google and--the burden of proof is on Google to prove this doesn't happen--there is nothing stopping Google from comparing that data to other requests they get from the same IP address (say, from your browser). Maybe Google can't personally identify me from this data, but they can sure target me with ads, which--shock--make them money.

tristor 11y ago

Here's a quick and dirty way to opt out for BASH and ZSH users for easy copy/pasting. BASH: cat <<EOF >> .bashrc # Opt out of Homebrew analytics export HOMEBREW_NO_ANALYTICS=1 if [[ -e "$HOME/.homebrew_analytics_user_uuid" ]]; then rm -f "$HOME/.homebrew_analytics_user_uuid" fi EOF ZSH: cat <<EOF >> .zshrc # Opt out of Homebrew analytics export HOMEBREW_NO_ANALYTICS=1 if [[ -e "$HOME/.homebrew_analytics_user_uuid" ]]; then rm -f "$HOME/.homebrew_analytics_user_uuid" fi EOF Cheers.

alainv 11y ago
`rm -f` ignores nonexistent files so you could omit the `if` to be concise.
- tristor 11y ago
  Good call. I was mainly using `-f` to suppress the prompt about deleting the file, but you're correct, it's unnecessary to have the if statement in this case.
hk__2 11y ago
You don’t need to remove that file; the whole point of this env variable is that it stops Homebrew from sending any data. It won’t even be created if that variable is set.
- tristor 11y ago
  That's only true if the variable is set before the first instance when data would have been sent, otherwise the file will exist (as it did on my system).

aurora72 11y ago

AFAIK, Max Howell was rejected from a position at Google, and now his trademark making use of Google? Let him take a look at GNU.ORG; if he can see any GA code.

rajesht 11y ago

set HOMEBREW_NO_ANALYTICS=1

pdkl95 11y ago

> generated by uuidgen So sending a unique tracking number... > enable us to accurately measure user counts vs. event counts for the specific purpose of associating events from the same user... > This does not allow us to track individual users somehow doesn't accomplish it's stated purpose? The entire point of that UUID is to track individual users. > The Google Analytics anonymous IP setting is enabled Sending Google an additional boolean flag doesn't prevent Google from reading the Source Address from the IP header.

codedokode 11y ago

It looks like everybody today wants to spy on you. Google, Facebook, and Twitter want to look at your browsing history, NSA wants to see your calls, emails, and messages history. Microsoft wants to know about everything you do at your PC and now even package managers want to have their share of data, too. What about asking my opinion first? Well, as homebrew developer have said > The problem with opt-in is that you don’t get representative data. Users do not seem to be enthusiastic about participating when they have a choice so let's go without asking them.

HappyTypist 11y ago

I think it's very reasonable to prompt a message on install saying "Homebrew collects and sends anonymous analytics. Use Homebrew --disable-analytics to opt out" and have that null the analytics identifier. Environment variables aren't that convenient.

dotwtf 11y ago

Made me open an HN account just to say this This is a very bad move and will further erode the already declining trust people put in package managers and software distribution channels. This is not transparency - transparency would be asking for user's explicit consent on the first brew invocation that includes this "feature". If this decision is not publicly reverted I will be removing homebrew altogether as it indicates a severe lapse in judgement, good faith or both on the part of the homebrew team.

mikemcquaid 11y ago

I'm the maintainer who added this. I apologise for the poor communication. I would have responded sooner but I've been on a plane for the last 10 hours. I'd hoped the documentation would have made clear our reasons for doing this but I feel the discomfort so since getting off my flight I've opened and merged three PRs (https://github.com/Homebrew/install/pull/42 https://github.com/Homebrew/install/pull/42 https://github.com/Homebrew/brew/pull/143 https://github.com/Homebrew/brew/pull/143 https://github.com/Homebrew/brew/pull/146 https://github.com/Homebrew/brew/pull/146) to better communicate this to our users on installation and `brew update` before any information is sent and ease the opt-out process.

javajosh 11y ago
It should be opt-in, not opt-out.
- eistrati 11y ago
  I second that. It must be an opt-in feature.
  - shizcakes 11y ago
    I don't see why; you're tracked like this on nearly every website you visit unless you opt out. This isn't malicious.
    - couchand 11y ago
      That doesn't follow. The fact that many websites do this doesn't prove that it isn't malicious. It may not be (it probably isn't), but that has little to do with the complaints made about the change.
      - pessimizer 11y ago
        Since more people downvoted you than upvoted you, that proves that when most websites do something, it can't be malicious when an application on your computer does it. I think?

faizanbhat 11y ago

Honest question for people who are opposed to this update and think it should be opt-in: what do you see as the downsides or pitfalls of sending anonymised usage info to Homebrew / Google Analytics?

cellularmitosis 11y ago
I really wish people would explain their reasoning here. I guess I just don't understand why handing a list of installed packages to Google is not my interest. Everyone in this thread seems to be just assuming that everyone else is already onboard with this reasoning.

lawnchair_larry 11y ago

Reminder - The NSA/GCHQ systems described their use of Google Analytics piggybacking to fingerprint and target users for exploitation. They also used similar Windows error reporting to monitor what software/hardware users have. Not that anyone should be snooping on what users do without opt-in permission, but even if we believed that Google "anonymize" it, there are still concerns. More simply, there's just no reason for you to know what I do on my own computer. It's none of your business and I don't need a reason.

Gratsby 11y ago

These kinds of "features" are a problem for open source, and I don't know that they are a good idea in general. It's nice to know how and where your software is being used, but in many environments call-home functionality and auto-update functionality are non-starters. Any non-user initiated network activity should be explicitly agreed to and available to be easily stripped. We can and should do a better job with open source software than closed source would-be competition. Even if you aren't a privacy advocate, privacy is a priority of a significant amount of the technical community. It's significant enough that it should be addressed as a forethought to features like this, not an afterthought. Things like this pop up as negative news entries that people gloss over. The guy who makes the snap decision "don't use brew, it phones home" today could be a CTO who never had that opinion changed three years from now.

geggam 11y ago

one more what used to be decent software selling out to marketing.... guess its back to the linux vm when working on a mac...

escot 11y ago

opt-in by default is fine with me. Thanks for the great tool!

corporatemonkey 11y ago

Many large corporations have internal homebrew packages. You can learn company secrets by getting a list of packages that are being installed.

TheLogothete 11y ago

Yeah. So every site and every product on the internet has this dark pattern. Do you use google? Youtube? StackOverflow? Are you outraged by them too?

stephenr 11y ago
> So every site and every product on the internet has this dark pattern. Not every site/product on the internet uses an abusive analytics platform, hell not all of them use analytics at all. With sites visited in a browser, an extension can be used to block access to abusive services such as GA. There is no Ghostery for the terminal. I have no issue with them wanting to collect usage information. I opt-in to Debian's package usage tracking. If I still used Homebrew, I would have a huge issue with them sending information about what packages I install to Google.
- TheLogothete 11y ago
  How is GA abusive? The webmaster has to explicitly permit data sharing with google. That is, the webmaster is asked if s/he wants to share data with google and the options are unchecked by default. GA prohibits the use of personally identifiable information. Additionally the webmaster can tell google to not store IP info, which the webmaster has chosen to this in this case.
  - stephenr 11y ago
    > The webmaster has to explicitly permit data sharing with google. Abusive to users. Google's whole reason for offering free analytics is to build better advertising profiles. > Additionally the webmaster can chose to not send IP info to google, I must have missed the memo where Google invented a way to make HTTP connections with no client IP.
    - TheLogothete 11y ago
      This has gone full circle and honestly is quite irritating at this point. People say that Google uses GA data for advertising, I say that this is not the case and then you just chose to ignore that. So I'm just gonna ask directly - can you show some evidence suggesting Google uses GA data for building advertising profiles or did you pull this opinion out of your ass? Because as someone who analyses marketing and advertising data, I can tell you that I strongly believe they do not use GA data in this way. 1) They have no need to, they have better data; 2) This data is unreliable; 3) GA prohibits the use of personally identifiable information; and most important of all: THE WEBMASTER CAN CHOSE TO NOT SHARE IT WITH THEM. If this webmaster went out of his way to tell google not to store IP information, I think it is pretty safe to assume that they did not opt-in to share the data with google AT ALL. Apart from these technical reasons, using GA data in the way you think they do opens a regulatory risk of EPIC proportions. But if you have some evidence to suggest that they do use it for "advertising profiles", please do share it. But if you can't and you formed this opinion because you are prejudiced, I would like to see you admitting it.

agounaris 11y ago

People have all of their traffic tracked by their ISPs, they use chrome, they have full activated accounts on their phones, they add tag themselves everywhere around facebook and they are mad because someone wants statistics over google analytics... you IT people need to relax... I'm sure someone will find a way to bring up inequality, sexism, racism and being vegan at some point on the thread.

lutoma 11y ago

The tinfoil hats are strong in this thread.

mescalito 11y ago

I normally enjoyed the insight and comments of the thread more than the content of the article and don't comment that much. But my personal opinion on this, only to share it and be heard possibly by the developers of homebrew, is that I honestly do not care about this. It's nice they are open about it, it's a hell of a tool and hey, if they want to track what I do to improve it, have my data. I really don't see the opt-in/opt-out debate being so harsh on this. Because it's open source it should be opt-in? I really don't think so. Analytics are a valuable source of information for the developer and google provides a hell of a service for that. And you probably use several closed source tools that track you, sometimes without even telling you. Yes, you can really of external tools to block this, great for all of us those tools exists, you can use it for homebrew as well. I wonder if all of the opt-in advocates don't use gmail for their email. I am pretty sure they do, and they are not worried about all of the tracking going on there? Or on other apps? Unless you really follow most if not all of stallman's computing principles[1], being furious about this, is, IMHO, disproportionate and a bit ungrateful. So I am more than OK with opt-out. Nice that you wrote about it, nice that you provide a way to do it, and nice that you use your time to create such a great tool! Kudos! [1]: https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html

tremon 11y ago
Because it's open source it should be opt-in? Because the sending of data to a third party is not directly related to the functioning of the software. Analytics are a valuable source of information for the developer Yet it's not the developer's data, it's the users' data. you probably use several closed source tools that track you, sometimes without even telling you https://en.wikipedia.org/wiki/Argumentum_ad_populum https://en.wikipedia.org/wiki/Argumentum_ad_populum I wonder if all of the opt-in advocates don't use gmail for their email. I am pretty sure they do https://en.wikipedia.org/wiki/Ad_hominem https://en.wikipedia.org/wiki/Ad_hominem
- mescalito 11y ago
  Nice links, that's why I like comments. Ok, let's don't state it as an argument, but rather as a question. Do anyone that's so much against opt-in is aware of closed source tools that tracks you and use it anyway? And.. Do you use any third party web service like gmail or any other? Although I hardly think I'll get an answer from most. At some point you have to make assumptions, wether those are fallacies, ok. It's true it's not directly related to the functioning of the software, but it improves it in anyway, then there's a connection with it. I take developer side and I personally look for see the grater good/less harm and compromise. Opt-in will likely give them very little % of adherence and thus rendering all of this useless. Most of the opt-in advocates have technical capabilities to opt-out in any way (homebrew way, network filters, forking ,etc...). So why not simply letting this go? I do think homebrew is a rather technical tool so most users are tech savvy guys, but still. For me, this is pretty similar debate to donating organs. https://en.wikipedia.org/wiki/Organ_donation#Opt-in_versus_opt-out https://en.wikipedia.org/wiki/Organ_donation#Opt-in_versus_o... And I am 100% an opt-out advocate!

izacus 11y ago

So essentially US government is now one data request from Google away from having a full list of software (and vulnerabilities) for any given developer Mac?

socketsAPI 11y ago

You know what homebrew team : you guys are providing a great tool here and you should really charge for it. Take out the analytics stuff, cause no one cares if it helps you or makes it easier for you to improve software that you write for free on your own time. No one cares that it'll take you more time to improve this great tool without the analytics. No one cares that it'll cost you money to use another service besides Google Analytics. We don't want you to spend time or money that you don't have either, just don't bother doing updates or improving it, it's pretty good the way that it is. But honestly, the fact that I can do a clean install of OSX and install my entire dev environment + favorite apps in about 3 minutes VS going to each individual site, having each of them (most likely) collect data about me, have to download them individually, and then install them individually -- is DEFINITELY worth some extra money in your pocket! Charge me a couple bucks, I'll gladly pay you for it. Heck, I'm going to go donate now + wait to get charged. ALSO: Don't let me know TOO much, all the details make me think I can't trust you! And you made the opt-out directions too hard.. you mean I have to do extra work that will take 15 SECONDS OR LESS out of my day to opt-out?.. NO! You do more work, don't make things easy on yourself OR me, that's not cool, you can just start charging me for it. =P. Keep up the good work!