9 ms·

Disagree. Google Analytics is a network of companies that has agreed to privately collection information about users without their permission or even knowledge.

by Touche 11y ago

Disagree. Google Analytics is a network of companies that has agreed to privately collection information about users without their permission or even knowledge. It is malware that should not be included in Homebrew. The only ethical decision we can make as developers is not to use it.

fit2rule 11y ago
Yeah, I'll confess that this is a real deal breaker for me personally .. I'll be having a closer look at ports and maybe fink soon. Maybe after all its time to get off OSX and back to Linux, where these sorts of things happen less frequently ..
- oh_sigh 11y ago
  Or you could just say HOMEBREW_NO_ANALYTICS=1 and be done with it.
  - 0x0 11y ago
    Until next month when we might need to set HOMEBREW_NO_PIWIK=1337...
    - mikeryan 11y ago
      I'd assume "NO_ANALYTICS" would mean "no analytics" not "no google analytics?
      - Touche 11y ago
        I'd assume that software that wasn't sending analytics wouldn't start doing so without at least informing me first, but I'd be wrong. I think the parents point is that we can't trust Homebrew to do the right thing, because they've now chosen not to.
      - 0x0 11y ago
        Who knows!? This marks quite a change in attitude where the end user is suddenly responsible for staying on top of newly silently introduced opt-out settings. I'm pretty disappointed and feel the amount of trust I've had in the maintainers have dropped considerably. Sneakily sending random HTTP requests to third party analytics services and stuffing my dotfiles with unique identifiers for tracking purposes is not what I expected from a friendly open source project. This could have been handled much better with some sort of opt-in prompt like the debian installer does for its popcon usage tracker.
        fit2rule 11y ago
        >This marks quite a change in attitude where the end user is suddenly responsible for staying on top of newly silently introduced opt-out settings. I'm pretty disappointed and feel the amount of trust I've had in the maintainers have dropped considerably. I agree with you. I'd much rather have this be out in the open - like, ever 5th time I run 'brew' or something, it asks me for permission to send analytics, and the options are "YES-once, YES-Always, NO-NEVER", and if I say NO, NEVER, it never asks me again. If spying on me can be automated, so can not spying on me.
      - hk__2 11y ago
        Yep, and as you can see if you read the code there are as few references to GA as possible so that it’d be easy to change the service we use without editing code everywhere.
- ARussell 11y ago
  Maybe try out Nix while you're at it, too! I'm using NixOS, and I'm pretty happy with it so far. The standalone package manager fills the same niche as Homebrew, I think.
  - Juan1 11y ago
    I only use Linux, so what do I know, but... is the highly interesting Nix package manager a full alternative to Homebrew ?
- throwanem 11y ago
  If it means that much to you, why not add host file entries to point GA's DNS records at 0.0.0.0 or something else invalid? If you don't trust that either, supplement it with packet filter rules to drop traffic heading to the IP addresses to which those names (currently) resolve. Switching platforms seems like a major overreaction here.
  - mortenlarsen 11y ago
    Privacy should be the default.
    - toomuchtodo 11y ago
      Only if you're willing to pay for it. Otherwise, you trade privacy for convenience, or some other benefit. Its, of course, always your choice if you're willing to trade it for something.
      - mortenlarsen 11y ago
        There is a lot of free, open and convenient software that respects my privacy. Do you think money or privacy violations must be part of the equation to make good software? That is like the old argument against free/open software that I heard from a lot of people, back in the 90's. I thought we were past that.
  - fit2rule 11y ago
    Its a huge hassle, and I don't want to have to keep fighting the battle against this policy. So I'll just rather switch.
- engiqueer 11y ago
  Have fun with a shittier product that may actually collect data on you but isn't open enough to tell you about it. Don't let the door hit you on the way out. No one will miss you!
jldugger 11y ago
Would be somehow more ethical if they set up their own piwik instance to collect the same data?
- fabulist 11y ago
  Collecting telemetry is reasonably, but it seems inappropriate for Google to get a copy and to be able to identify which of their users installed a particular piece of software from the IP address. So yes. Running their own server would be much preferable.
  - estel 11y ago
    For Homebrew: > The Google Analytics anonymous IP setting is enabled i.e. 1 (https://developers.google.com/analytics/devguides/collection/protocol/v1/parameters#aip https://developers.google.com/analytics/devguides/collection...)
    - dogecoinbase 11y ago
      It's worth noting that AIP's functionality requires you to trust Google -- the data is received by them, but their design specifies that they mask it before it's processed or stored.
      - creshal 11y ago
        Or so they claim.
    - fabulist 11y ago
      While I feel we should all treat Google with skepticism here, I didn't realize they (and so failed to acknowledge) that Homebrew was attempting to remedy that, so I apologize for speaking out of turn.
- iagooar 11y ago
  I think it would be, yes. At least, it would not get into the hands of an external 3rd party (that as we know, lives from selling / using data they gather from people).
bitmapbrother 11y ago
I'm always amused by the way some people try to extend the definition of malware beyond its scope. This isn't malware. It's just anonymous usage tracking. If you don't like it you can turn it off. I hope you don't use a smartphone because the amount of intrinsic "malware" you must be subjected to must be unbearable. "Malware" is an umbrella term used to refer to a variety of forms of hostile or intrusive software, including computer viruses, worms, trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software.
- Touche 11y ago
  I didn't say that this usage of GA is malware, I said that GA, the network, is a malware. So while Homebrew may (or may not) be protecting their users identities while using a malware service, they are still choosing to use a malware service. Tracking people's online activity through a large percentage of the internet, without their consent or even knowledge qualifies as malicious to me.
- LeoPanthera 11y ago
  But surely you can see the similarity here. The tracking software wasn't in Homebrew before, is added without asking you when you update, and is completely useless to you as a user but builds information about you and sends it to a third party. If it's not malware, it's certainly really similar to it.
  - TheLogothete 11y ago
    It is used to improve the product, why is this useless to the user?
    - Touche 11y ago
      Software that ships Ask Toolbar in their installer say it's to improve the product as well.
      - deleted 11y ago
cpeterso 11y ago
Does Homebrew's UUID linked with the user's Google Analytics ID in their browser cookies?
- x0x0 11y ago
  It certainly appears not. They're using curl and reporting a UID they generate. A Homebrew analytics user ID e.g. 1BAB65CC-FE7F-4D8C-AB45-B7DB5A6BA9CB. This is generated by uuidgen and stored in ~/.homebrew_analytics_user_uuid. This does not allow us to track individual users but does enable us to accurately measure user counts vs. event counts https://github.com/Homebrew/brew/blob/master/share/doc/homebrew/Analytics.md https://github.com/Homebrew/brew/blob/master/share/doc/homeb... Of course, you have to trust homebrew, but hell, you're already running their software, so it's a little late.
  - hk__2 11y ago
    You can always even check the code that’s running on your own computer. If you installed Homebrew in /usr/local the relevant files are /usr/local/Library/Homebrew/utils/analytics.sh and /usr/local/Library/Homebrew/utils/analytics.rb.
erpellan 11y ago
Indeed! Feel free to demand a refund or refer to the contract you signed... Nobody's forcing anyone to use it.
- bpchaps 11y ago
  This is the sort of defeatist and way-too-easy attitude that turns things to garbage all around. In many ways, bringing up issues that affect many opinionated people's core values is how things get fixed. If this was said for everything that was free, then we wouldn't have anything. For example: "Linux has issues" "It's free. Nobody's forcing you to use it." or "FreeBSD has issues.." "It's Free. Nobody's forcing you to use it." or "I had a hard time installing Gentoo because of bad documentation. Somebody should fix that. No, seriously, metaland." "It's Free. Nobody's forcing you to use it." I'm all for "beggars can't be choosers", but when there's nothing else to choose, of course people are going to complain.
- sneak 11y ago
  The usage license we agreed to means we can fork it and remove this nonsense spyware.

by Touche 11y ago

fit2rule 11y ago

Yeah, I'll confess that this is a real deal breaker for me personally .. I'll be having a closer look at ports and maybe fink soon. Maybe after all its time to get off OSX and back to Linux, where these sorts of things happen less frequently ..

oh_sigh 11y ago
Or you could just say HOMEBREW_NO_ANALYTICS=1 and be done with it.
- 0x0 11y ago
  Until next month when we might need to set HOMEBREW_NO_PIWIK=1337...
  - mikeryan 11y ago
    I'd assume "NO_ANALYTICS" would mean "no analytics" not "no google analytics?
    - Touche 11y ago
      I'd assume that software that wasn't sending analytics wouldn't start doing so without at least informing me first, but I'd be wrong. I think the parents point is that we can't trust Homebrew to do the right thing, because they've now chosen not to.
    - 0x0 11y ago
      Who knows!? This marks quite a change in attitude where the end user is suddenly responsible for staying on top of newly silently introduced opt-out settings. I'm pretty disappointed and feel the amount of trust I've had in the maintainers have dropped considerably. Sneakily sending random HTTP requests to third party analytics services and stuffing my dotfiles with unique identifiers for tracking purposes is not what I expected from a friendly open source project. This could have been handled much better with some sort of opt-in prompt like the debian installer does for its popcon usage tracker.
      - fit2rule 11y ago
        >This marks quite a change in attitude where the end user is suddenly responsible for staying on top of newly silently introduced opt-out settings. I'm pretty disappointed and feel the amount of trust I've had in the maintainers have dropped considerably. I agree with you. I'd much rather have this be out in the open - like, ever 5th time I run 'brew' or something, it asks me for permission to send analytics, and the options are "YES-once, YES-Always, NO-NEVER", and if I say NO, NEVER, it never asks me again. If spying on me can be automated, so can not spying on me.
    - hk__2 11y ago
      Yep, and as you can see if you read the code there are as few references to GA as possible so that it’d be easy to change the service we use without editing code everywhere.
ARussell 11y ago
Maybe try out Nix while you're at it, too! I'm using NixOS, and I'm pretty happy with it so far. The standalone package manager fills the same niche as Homebrew, I think.
- Juan1 11y ago
  I only use Linux, so what do I know, but... is the highly interesting Nix package manager a full alternative to Homebrew ?
throwanem 11y ago
If it means that much to you, why not add host file entries to point GA's DNS records at 0.0.0.0 or something else invalid? If you don't trust that either, supplement it with packet filter rules to drop traffic heading to the IP addresses to which those names (currently) resolve. Switching platforms seems like a major overreaction here.
- mortenlarsen 11y ago
  Privacy should be the default.
  - toomuchtodo 11y ago
    Only if you're willing to pay for it. Otherwise, you trade privacy for convenience, or some other benefit. Its, of course, always your choice if you're willing to trade it for something.
    - mortenlarsen 11y ago
      There is a lot of free, open and convenient software that respects my privacy. Do you think money or privacy violations must be part of the equation to make good software? That is like the old argument against free/open software that I heard from a lot of people, back in the 90's. I thought we were past that.
- fit2rule 11y ago
  Its a huge hassle, and I don't want to have to keep fighting the battle against this policy. So I'll just rather switch.
engiqueer 11y ago
Have fun with a shittier product that may actually collect data on you but isn't open enough to tell you about it. Don't let the door hit you on the way out. No one will miss you!

jldugger 11y ago

Would be somehow more ethical if they set up their own piwik instance to collect the same data?

fabulist 11y ago
Collecting telemetry is reasonably, but it seems inappropriate for Google to get a copy and to be able to identify which of their users installed a particular piece of software from the IP address. So yes. Running their own server would be much preferable.
- estel 11y ago
  For Homebrew: > The Google Analytics anonymous IP setting is enabled i.e. 1 (https://developers.google.com/analytics/devguides/collection/protocol/v1/parameters#aip https://developers.google.com/analytics/devguides/collection...)
  - dogecoinbase 11y ago
    It's worth noting that AIP's functionality requires you to trust Google -- the data is received by them, but their design specifies that they mask it before it's processed or stored.
    - creshal 11y ago
      Or so they claim.
  - fabulist 11y ago
    While I feel we should all treat Google with skepticism here, I didn't realize they (and so failed to acknowledge) that Homebrew was attempting to remedy that, so I apologize for speaking out of turn.
iagooar 11y ago
I think it would be, yes. At least, it would not get into the hands of an external 3rd party (that as we know, lives from selling / using data they gather from people).

bitmapbrother 11y ago

I'm always amused by the way some people try to extend the definition of malware beyond its scope. This isn't malware. It's just anonymous usage tracking. If you don't like it you can turn it off. I hope you don't use a smartphone because the amount of intrinsic "malware" you must be subjected to must be unbearable. "Malware" is an umbrella term used to refer to a variety of forms of hostile or intrusive software, including computer viruses, worms, trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software.

Touche 11y ago
I didn't say that this usage of GA is malware, I said that GA, the network, is a malware. So while Homebrew may (or may not) be protecting their users identities while using a malware service, they are still choosing to use a malware service. Tracking people's online activity through a large percentage of the internet, without their consent or even knowledge qualifies as malicious to me.
LeoPanthera 11y ago
But surely you can see the similarity here. The tracking software wasn't in Homebrew before, is added without asking you when you update, and is completely useless to you as a user but builds information about you and sends it to a third party. If it's not malware, it's certainly really similar to it.
- TheLogothete 11y ago
  It is used to improve the product, why is this useless to the user?
  - Touche 11y ago
    Software that ships Ask Toolbar in their installer say it's to improve the product as well.
    - deleted 11y ago

cpeterso 11y ago

Does Homebrew's UUID linked with the user's Google Analytics ID in their browser cookies?

x0x0 11y ago
It certainly appears not. They're using curl and reporting a UID they generate. A Homebrew analytics user ID e.g. 1BAB65CC-FE7F-4D8C-AB45-B7DB5A6BA9CB. This is generated by uuidgen and stored in ~/.homebrew_analytics_user_uuid. This does not allow us to track individual users but does enable us to accurately measure user counts vs. event counts https://github.com/Homebrew/brew/blob/master/share/doc/homebrew/Analytics.md https://github.com/Homebrew/brew/blob/master/share/doc/homeb... Of course, you have to trust homebrew, but hell, you're already running their software, so it's a little late.
- hk__2 11y ago
  You can always even check the code that’s running on your own computer. If you installed Homebrew in /usr/local the relevant files are /usr/local/Library/Homebrew/utils/analytics.sh and /usr/local/Library/Homebrew/utils/analytics.rb.

erpellan 11y ago

Indeed! Feel free to demand a refund or refer to the contract you signed... Nobody's forcing anyone to use it.

bpchaps 11y ago
This is the sort of defeatist and way-too-easy attitude that turns things to garbage all around. In many ways, bringing up issues that affect many opinionated people's core values is how things get fixed. If this was said for everything that was free, then we wouldn't have anything. For example: "Linux has issues" "It's free. Nobody's forcing you to use it." or "FreeBSD has issues.." "It's Free. Nobody's forcing you to use it." or "I had a hard time installing Gentoo because of bad documentation. Somebody should fix that. No, seriously, metaland." "It's Free. Nobody's forcing you to use it." I'm all for "beggars can't be choosers", but when there's nothing else to choose, of course people are going to complain.
sneak 11y ago
The usage license we agreed to means we can fork it and remove this nonsense spyware.