5 ms·

The fact that they are transparent about this, that we can opt-out if we want and that they're open source makes me feel more than comfortable sharing anonymous

by xutopia 11y ago

The fact that they are transparent about this, that we can opt-out if we want and that they're open source makes me feel more than comfortable sharing anonymous usage information with them. Homebrew has been amazing for me!

LeoPanthera 11y ago
Is an alert displayed to the user the first time it tries to send info to Google? If not, that is far from "transparent". It's good that they tell you how to opt out on the website, but I can't remember the last time I went to the website. Probably when I first installed Homebrew on this Mac.
- daveguy 11y ago
  This. Either everyone should be notified before the first google analytics transmission so that they can choose to opt in our out. Or the default should be off and maybe on new installs they can choose to opt in. At the opt in/out dialog (when you give the users a choice) you can make the default to opt-in, but having the default as opt-in without any input from the user is bad form. It is similar to spammers calling your e-mail address "double opt-in" because they got you to open an e-mail and you didn't click the unsubscribe link.
  - khc 11y ago
    How should this be handled if the software in question is a server daemon? I want the users to make an explicit choice but it's not obvious what's the best way to do that.
    - Touche 11y ago
      On install.
      - _asummers 11y ago
        I feel like on update would be better. Answering a yes/no/never isn't that much of an ask, I don't think. And that way you get a chance to use the software before you have to make a decision.
      - stock_toaster 11y ago
        Or if you want to cover existing users, just ask during the first interactive invocation, when there is no prior user chosen setting (works for new installs too)... pseudocode: choice = no if $brew_prefix/etc/homebrew.yaml: choice = read analytics $brew_prefix/etc/homebrew.yaml else: if interactive-tty and cmd != "--prefix": choice = ask-user "enable anonymous analytics (it helps us!)? Y/N: " write analytics=<choice> $brew_prefix/etc/homebrew.yaml if choice == yes: enable-analytics
- merqurio 11y ago
  seems like not, yet https://github.com/Homebrew/brew/issues/142 https://github.com/Homebrew/brew/issues/142
  - isomorphic 11y ago
    I am confirming that Homebrew silently starts talking to Google with no warning after a "brew upgrade".
    - tsujamin 11y ago
      I was prompted with a warning during my most recent brew update...
      - Rebelgecko 11y ago
        I brew updated a few times today and finally got that message. By the time that message showed up, the file ~/.homebrew_analytics_user_uuid was already 4 hours old, which makes me wonder when they actually started doing the analytics
        sirn 11y ago
        I updated Homebrew almost daily and my .homebrew_analytics_user_uuid shown that it was created on Apr 24[1], which means I have been sending the analytics data without knowing for two days already (UTC+7) :-\ [1]: https://files.grid.in.th/plBnTi.png https://files.grid.in.th/plBnTi.png
- atmosx 11y ago
  Get littlesnitch on Mac and you won't need to rely on third parties alerting about outgoing connections, although I recon the when we're talking about something like homebrew it's not easy to vet every single outgoing connection. Still littlesnitch is really awesome for the privacy conscious users.
  - isomorphic 11y ago
    For posterity, Homebrew is using curl to talk to Google Analytics. You will have to selectively block curl by destination in Little Snitch (or only allow the various other hosts Homebrew uses).
  - makeitsuckless 11y ago
    LittleSnitch also makes you totally paranoid about how almost every piece of software is spying on you without explicit consent. Also, Microsoft really needs to clean up their domain usage, because it takes 999 permission rules to run Office.
    - _asummers 11y ago
      In a similar vein, installing uMatrix makes you (rightfully) paranoid about what web pages are collecting from you. "Wait I can disable 28 Javascript scripts and iframes and the page loads OK?"
    - K-Wall 11y ago
      Skype is even more fun to watch in Little Snitch with all of its p2p connections. I regularly have 2k+ connections being opened to sync online state.
  - andrei_says_ 11y ago
    I have little snitch and can verify that everything talks to the Internet all of the time :(
    - Matt3o12_ 11y ago
      Only if you let them. I have installed little snitch and the only applications that have unlimited access to the Internet (all servers on port 80/443) are my web browsers. The other applications barely have access to their on servers (only if I find it necessary for them to auto-check for updates) let alone google analytics. To achieve the best security, you should disable most bultin rules or customize them yourself.
- trollingineeer 11y ago
  Then don't use their product if you're going to whine so much.
- Forbo 11y ago
  I get the following: % brew update ==> Homebrew has enabled anonymous aggregate user behaviour analytics
joepie91_ 11y ago
The fact that it's opt-out rather than opt-in... yeah, well. I don't think I need to finish that sentence.

by xutopia 11y ago

LeoPanthera 11y ago

Is an alert displayed to the user the first time it tries to send info to Google? If not, that is far from "transparent". It's good that they tell you how to opt out on the website, but I can't remember the last time I went to the website. Probably when I first installed Homebrew on this Mac.

daveguy 11y ago
This. Either everyone should be notified before the first google analytics transmission so that they can choose to opt in our out. Or the default should be off and maybe on new installs they can choose to opt in. At the opt in/out dialog (when you give the users a choice) you can make the default to opt-in, but having the default as opt-in without any input from the user is bad form. It is similar to spammers calling your e-mail address "double opt-in" because they got you to open an e-mail and you didn't click the unsubscribe link.
- khc 11y ago
  How should this be handled if the software in question is a server daemon? I want the users to make an explicit choice but it's not obvious what's the best way to do that.
  - Touche 11y ago
    On install.
    - _asummers 11y ago
      I feel like on update would be better. Answering a yes/no/never isn't that much of an ask, I don't think. And that way you get a chance to use the software before you have to make a decision.
    - stock_toaster 11y ago
      Or if you want to cover existing users, just ask during the first interactive invocation, when there is no prior user chosen setting (works for new installs too)... pseudocode: choice = no if $brew_prefix/etc/homebrew.yaml: choice = read analytics $brew_prefix/etc/homebrew.yaml else: if interactive-tty and cmd != "--prefix": choice = ask-user "enable anonymous analytics (it helps us!)? Y/N: " write analytics=<choice> $brew_prefix/etc/homebrew.yaml if choice == yes: enable-analytics
merqurio 11y ago
seems like not, yet https://github.com/Homebrew/brew/issues/142 https://github.com/Homebrew/brew/issues/142
- isomorphic 11y ago
  I am confirming that Homebrew silently starts talking to Google with no warning after a "brew upgrade".
  - tsujamin 11y ago
    I was prompted with a warning during my most recent brew update...
    - Rebelgecko 11y ago
      I brew updated a few times today and finally got that message. By the time that message showed up, the file ~/.homebrew_analytics_user_uuid was already 4 hours old, which makes me wonder when they actually started doing the analytics
      - sirn 11y ago
        I updated Homebrew almost daily and my .homebrew_analytics_user_uuid shown that it was created on Apr 24[1], which means I have been sending the analytics data without knowing for two days already (UTC+7) :-\ [1]: https://files.grid.in.th/plBnTi.png https://files.grid.in.th/plBnTi.png
atmosx 11y ago
Get littlesnitch on Mac and you won't need to rely on third parties alerting about outgoing connections, although I recon the when we're talking about something like homebrew it's not easy to vet every single outgoing connection. Still littlesnitch is really awesome for the privacy conscious users.
- isomorphic 11y ago
  For posterity, Homebrew is using curl to talk to Google Analytics. You will have to selectively block curl by destination in Little Snitch (or only allow the various other hosts Homebrew uses).
- makeitsuckless 11y ago
  LittleSnitch also makes you totally paranoid about how almost every piece of software is spying on you without explicit consent. Also, Microsoft really needs to clean up their domain usage, because it takes 999 permission rules to run Office.
  - _asummers 11y ago
    In a similar vein, installing uMatrix makes you (rightfully) paranoid about what web pages are collecting from you. "Wait I can disable 28 Javascript scripts and iframes and the page loads OK?"
  - K-Wall 11y ago
    Skype is even more fun to watch in Little Snitch with all of its p2p connections. I regularly have 2k+ connections being opened to sync online state.
- andrei_says_ 11y ago
  I have little snitch and can verify that everything talks to the Internet all of the time :(
  - Matt3o12_ 11y ago
    Only if you let them. I have installed little snitch and the only applications that have unlimited access to the Internet (all servers on port 80/443) are my web browsers. The other applications barely have access to their on servers (only if I find it necessary for them to auto-check for updates) let alone google analytics. To achieve the best security, you should disable most bultin rules or customize them yourself.
trollingineeer 11y ago
Then don't use their product if you're going to whine so much.
Forbo 11y ago
I get the following: % brew update ==> Homebrew has enabled anonymous aggregate user behaviour analytics

joepie91_ 11y ago

The fact that it's opt-out rather than opt-in... yeah, well. I don't think I need to finish that sentence.