15 ms·

Brew commands send data to Google Analytics

268 points by jeena 10y ago

tfeldmann 10y ago
To disable this, execute brew analytics off
- opk 10y ago
  Any idea what to block if I want to just completely block google analytics at the firewall level?
  - troels 10y ago
    /etc/hosts should do it, I suppose?
  - hasperdi 10y ago
    The way I accomplish this is by setting up an dnsmasq DNS forwarder service. Find domains list for ad blocking / privacy on the internet and add these entries in dnsmasq's config. The entries look like this: address=/doubleclick.net/0.0.0.0 address=/gravity.com/0.0.0.0 address=/outbrain.com/0.0.0.0 ... Then set up the router's DHCP to use this server.
  - jbg_ 10y ago
    Little Snitch is excellent for this. I remember running brew at some point and being asked by Little Snitch if it could connect to Google. I said "deny forever" and have never worried about it since.
  - driverdan 10y ago
    https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- aq3cn 10y ago
  How do you turn it off for brew cask? Anyway this option should have been available in their man page. But anyway they have clearly mentioned it. https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics.... If they want data, I will happily fill up their survey form but please don't take it for granted that my personal data is yours otherwise I may go to China for their great wall.
peteretep 10y ago
I was aware, because I run Little Snitch. If you care, you should be too.
- aorth 10y ago
  You're right, we probably should be using Little Snitch — just know that it's not a golden ticket! There has been some research about bypassing Little Snitch, for example this one from 2016: https://speakerdeck.com/patrickwardle/defcon-2016-i-got-99-problems-but-little-snitch-aint-one https://speakerdeck.com/patrickwardle/defcon-2016-i-got-99-p...
  - JoachimS 10y ago
    And that has been fixed. It could have been announced in a better way, but is fixed. Are you suggesting people should not use Little Snitch at all? Has the tool lost all credibility forever?
libeclipse 10y ago
With companies like Google having their fingers in every pie, we're losing the privacy war.
- MawNicker 10y ago
  People just get ratfucked by whoever controls the media.
  - unixhero 10y ago
    Better become they then.
    - deleted 10y ago
      [deleted]
  - true_religion 10y ago
    What are double binds?
mook 10y ago
Relevant previous discussion, in case people want more details: https://news.ycombinator.com/item?id=11566720 https://news.ycombinator.com/item?id=11566720
CJefferson 10y ago
I knew, and I was prompted. I can understand why this might upset people, but for me I hope it will make brew a better product. I'm sure we all know as developers how annoying it can be to not know the problems users have, and what they are using your software for -- that's why most websites have analytics. I'm hoping to add something similar to software I work on, with an opt-out of course. I believe it will help me serve my users better.
- yoran 10y ago
  I agree with this. Also note that GA's terms disallow the sending of personable identifiable information so the data they collect has to be anonymous (see https://support.google.com/analytics/answer/2795983?hl=en https://support.google.com/analytics/answer/2795983?hl=en).
- hueving 10y ago
  Please make it opt in. If you truly believe people closely read the prompts for having their data harvested, a default to "No" should not impact you at all. If you don't believe they read the prompts closely, you're an asshole for stealing data by default.
  - andybak 10y ago
    'Stealing' data? Is that like 'stealing' by downloading a movie?
    - TeMPOraL 10y ago
      "Exfiltrating" would be a better word here. (Also, downloading a movie is a different thing - there you're not stealing nor exfiltrating anything, you're downloading data as intended by uploader, who may or may not have the copyrights for that data.) (INB4, ripping a DVD and uploading it is not data theft. Exfiltrating a pre-release copy from movie company's servers would be data theft.)
      - rocqua 10y ago
rcarmo 10y ago
There has been a prominent warning for this (that sadly most people miss) for months now.
- joosters 10y ago
  Obviously it's not prominent enough then.
  - rcarmo 10y ago
    Or people simply don't pay attention to a change of color in terminal output anymore :)
    - mrmondo 10y ago
      Thanks to craplications like NPM etc... I'm sure that certainly has been the case. As I mentioned elsewhere, I can't remember being prompted for this on any of my three machines, but I bet I was and forgot.
pimpek 10y ago
I agree that it should be opt-in instead of opt-out but worrying what they do else behind the scenes is paranoid. You can check it out: https://github.com/Homebrew/brew https://github.com/Homebrew/brew
ronreiter 10y ago
Data is being sent to Google on probably every page you browse over the internet. And to 50 other data websites as well.
- hueving 10y ago
  Data isn't being sent when I use most of my developer tooling. When I visit a website, I expect it's going to be inundated with garbage analytics so I use things like ublock and noscript. What I don't expect is a package manager siphoning off data to Google.
  - a3n 10y ago
    It's the new frontier.
ronreiter 10y ago
Data is being sent to Google on probably every page you browse over the internet. And to 50 other data websites as well.
STRiDEX 10y ago
I've seen this crop up a few times recently and a vocal minority seems to panic every time. I ran into it the other day installing pm2 w/ npm which downloads an optional package that they use for analytics https://github.com/Unitech/pm2/blob/master/package.json#L184 https://github.com/Unitech/pm2/blob/master/package.json#L184 Is the problem that they are using google's service? Is it the tracking that people don't like? Is it the messaging/copy to the users? I'm sure there's plenty of people on hacker news that build analytics software for a living. I've worked on email click and open tracking. Doesn't seem terrible if it helps them build their product.
- djsumdog 10y ago
  You know...you can already get analytics if your mirrors just agree to share logs. It may not be as detailed or complete, for sure, but using another analytical tools does feel a little superfluous. > Is the problem that they are using google's service? This is part of it I think. The brew devs get stats, but so does Google which they can aggregate across everything. Standing up your own analytics server/cluster, especially for a project the size of brew, wouldn't be trivial and I can see why they leverage Google's service. But I can understand people not wanting to have data sent to Google. I moved everything off Gmail to my own E-mail server back in 2013 and moved search to DuckDuckGo.
  - true_religion 10y ago
    Does google simply have access to you analytics data to do whatever they want? I was under the impression that they could only use it in ways that you the account holder defines.
    - skylark 10y ago
      It depends on what you mean by "access to your analytics data." Anonymized, aggregated data is being used to inform product decisions, but engineers don't have direct access to the production database to query whatever they want. There are almost no cases where you'll be granted approval to look at real user data, and if you are granted access, 100% of your activity is monitored. As a side note, this has been the case at every big company I've worked at, not just Google.
cygned 10y ago
This topic has been discussed on The Changelog recently: https://changelog.com/podcast/223 https://changelog.com/podcast/223 If I recall correctly, opt-out was chosen because they really want/need some analytics data and most of the users would not opt-in.
- hueving 10y ago
  They are blatantly admitting they are stealing user data then if they realize most users aren't reading the prompts and accept the defaults (data harvesting in this case).
- tdkl 10y ago
  > and most of the users would not opt-in Which means users have chosen what they prefer and silently extracting despite that choice isn't exactly trustful.
- anc84 10y ago
  What would they need it for?
  - cygned 10y ago
    It's outlined here: https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....
- Udo_Schmitz 10y ago
  “they really want/need some analytics data” Why? For what?
  - cygned 10y ago
    It's outlined here: https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....
pvinis 10y ago
Yes we know. brew tells you that. And you can disable it. Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what? Some of the times it's to make the product better, or better targeted. Some other times it's just for spying on the users. Let's stop complaining about stuff that someone does and tell you they do it. There are many more that do the same things without telling you. Furthermore, now that you know, for brew specifically, will you opt out? Is your brew command history so secret that you care more about noone looking at it than helping making brew better? Chances are you use brew quite often. Chances are brew is not perfect. Will you choose to make its progress slower because of no real security reason? How do we expect open source to become better if everyone is being a crybaby because brew got a history of how often they do brew update?
- wheelerwj 10y ago
  We have to start somewhere. Opt in should always be the standard.
  - mrmondo 10y ago
    This. Exactly this, thank you.
  - pvinis 10y ago
    Sure. Opt in would be nice. But only if it was opt in always and everywhere, and all users, technical or otherwise, knew the reasons why analytics are gathered for a product they use. I think in that case, many people would still opt in. I would. And I would hope users of my products would too.
    - wheelerwj 10y ago
      Yes, and maybe it's okay if we don't have perfect visibility. We've been building things for thousands of years without Javascript event notifications, I'm sure we will do just fine with a little less data
  - tomfluff 10y ago
andrewguenther 10y ago
While factual, the title is a bit misleading. Brew uses Google Analytics and prompts you to inform you that it does so.
- lispm 10y ago
  What does it send? What does it use it for?
  - andrewguenther 10y ago
    https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics.... (This link is provided in the initial notification)
    - lispm 10y ago
      Notification or prompt? There is no way that I would want to have this data and this amount of data, recorded and transferred to google. Especially not about software installation on my computers or computers of friends or clients.
      - andrewguenther 10y ago
        I recall it being a prompt when I saw it, but others are saying it was a notification.
      - andromeduck 10y ago
        Then just turn it off
andrewguenther 10y ago
People advocate so fervently for privacy, but can't be bothered to read a prompt...
- TeMPOraL 10y ago
  Privacy-respecting defaults should be there so that you don't have to spend your whole day reading prompts and ToS looking for that one sentence that fucks you over.
  - andrewguenther 10y ago
    Genuine curiosity question: Are all analytics a violation of privacy? If brew simply sent a message that said "brew was used" with no PII, would that matter? At what point is it an issue?
    - tremon 10y ago
      Are all analytics a violation of privacy? No, only the ones without active informed consent. Privacy is the embodiment of personal choice, after all.
    - TeMPOraL 10y ago
      Honestly, my reaction to that would be "why the fuck is it doing that", possibly followed by a firewall rule or a comment in the source code and rebuild. I'm annoyed when an application connects to the Internet for reasons unrelated to the task it's performing for me. That said, even a ping to the mothership is an identifying information - at minimum, it already contains your IP address. Whatever additional data may be added to that ping will likely also reveal details about the machine you're using. Personally, I'm not a privacy nut; I mostly don't care - I leave plenty of information about myself around. But the thing is, I'm doing it voluntarily and as a primary function of some service. I don't like when applications exfiltrate data for reasons not related to their purpose.
rkachowski 10y ago
This is google analytics. It's a bit different than google directly taking the data and using it for google purposes (e.g. streetview cars gathering SSID information for location pinpointing). The data (afaik) is used only by the homebrew team instead of Google. A more accurate summary would be "Brew is sending usage data to a google owned analytics service".
- opk 10y ago
  The data still goes to google. While the expectation would be that the data is only used by homebrew, there's no actual way of knowing that google isn't gratefully helping itself. And given the entire way Google's business works, they probably are.
  - pbiggar 10y ago
    Given the number of people who work for Google, and Google's internal culture of openness, I find it extremely unlikely that Google is violating its customers' privacy. That would almost certainly get whistleblown.
    - wingless 10y ago
      Like how the PRISM program got whistleblown by Googlers? Oh wait, that never happened.
      - rocqua 10y ago
        Threat of jail / treason conviction is a lot stronger than the threat of being fired by google. I can totally see someone caving for the one and not the other.
      - kyrra 10y ago
        Google never cooperated with PRISM. As soon as news came out that the NSA was tapping Google's intra-datacenter dedicated lines, Google announced they would accelerate encrypting all that traffic. https://www.google.com/amp/arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/%3Famp%3D1?client=safari https://www.google.com/amp/arstechnica.com/information-techn...
mrmondo 10y ago
I went to log a bug for this and was given "You can't perform that action at this time."
- moonbug 10y ago
  github pitches that error all the damn time. Wish I knew why.
froh42 10y ago
As I didn't update brew for a long time I did not have the analytics version. So I upgraded to see what happens. In fact it did NOT prompt me when enabling analytics, but it did display a notice (hidden in several hundred lines of output during brew upgrade): ------------------- + 5a9e19f...7f13b37 master -> origin/master (forced update) * [new tag] 0.1 -> 0.1 HEAD is now at 7f13b37 Merge pull request #1562 from woodruffw/check-admin-group ==> Homebrew has enabled anonymous aggregate user behaviour analytics Read the analytics documentation (and how to opt-out) here: https://git.io/brew-analytics https://git.io/brew-analytics ==> Tapping homebrew/core Cloning into '/usr/local/Library/Taps/homebrew/homebrew-core'... remote: Counting objects: 3765, done. remote: Compressing objects: 100% (3654/3654), done. ------------------- I do not consider this a prominent warning. Rather it is sneaking analytics silently in the back door. Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate. If I'd were a contributor I'd not want to have my name associated to something like this, even if it just happened out of stupidity not out of malice.
- mrmondo 10y ago
  This is why I think I missed it on all my machines, it really isn't noticable but it's a _big deal_. *Edit: I run brew update; brew upgrade; brew clean on at least two of my three machines at least once a day, while I should be more vigilant opt-out is really something I'd expect from Microsoft or Google themselves and not an open source project such as Brew.
- hueving 10y ago
  The whole point of opt out systems is to bury this info. That was very much intentional.
- Tepix 10y ago
  There you have it. Stop claiming there is a "prompt". It's the same as the "3rd party cookies enabled by default" setting on Firefox. It's the wrong default if you really care about your user's privacy as Firefox claims to do. It's hard to even find the setting unless you know where it is. And it's Google who is paying so it stays the way it is and patches that change it are rejected.
mrmondo 10y ago
Quite honestly, I don't remember brew asking me this on any of my 3 macOS machines, I'm not saying it didn't, but the fact that I'm a 'techie' person and didn't notice or forgot about it worries me greatly.
- ProbabilityMoon 10y ago
  It probably didn't. I run brew regularly on my machine, and I did not get any prompt asking me to enable analytics. From reading other comments, I see lots of users are in the same position, and homebrew sneaked this in with just a two line notice buried in the verbose output. This worries me deeply, to the point where I'm considering removing this software from my machine.
  - mrmondo 10y ago
    While I obviously feel the same way, I'd take a step back and see what Brew's response is to this thread / the backlash of what people want / don't want, because it has, overall been a good thing of macOS.
thinkindie 10y ago
this blog post is pretty naive, it was well advertised few months ago
- froh42 10y ago
  “But the plans were on display…” “On display? I eventually had to go down to the cellar to find them.” “That’s the display department.” “With a flashlight.” “Ah, well, the lights had probably gone.” “So had the stairs.” “But look, you found the notice, didn’t you?” “Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”
- messel 10y ago
  I hadn't known until today. Need to think over a dev tool analytics with (mostly hidden) prompt. Looking at apt get analytics now as a comparison
tomlong 10y ago
I distinctly remember being asked about this ages ago, and finding it easy to disable, or is this something else? Is it still using google analytics when you've asked it not to?
- andromeduck 10y ago
  No
TeMPOraL 10y ago
"It's easier to ask forgiveness than it is to get permission." I feel I need something like uMatrix, but for the entire OS. Is it time to familiarize myself with netstat and firewall rules?
- cdubzzz 10y ago
  I had a spare Pi lying around and installed pi-hole[0] on it a while back. It has worked like a charm with almost no up keep for months now. [0] https://pi-hole.net/ https://pi-hole.net/
kinkdr 10y ago
Try "Little snitch", apart from sublime, it is the best $40 I ever spent. Edit: the best $40..
- Tepix 10y ago
  "best"?
  - kinkdr 10y ago
    Ooops. Thanks :D
appelza 10y ago
Being sent
Lazare 10y ago
This seems like a somewhat extreme reaction to google analytics.
- froh42 10y ago
  Im extremely pissed off by the way they snuck the prompt in between several hundred lines of shell output on update. This is NOT being prompted. I can live with the analytics. I'd might even consider to leave it on IF BEING ASKED PROPERLY. All previous discussion says "oh you get notified". The point is, you don't get properly notified. And this is, why this is news again over the old discussion on HN.
lispm 10y ago
In German we have a word called 'Datensparsamkeit': http://martinfowler.com/bliki/Datensparsamkeit.html http://martinfowler.com/bliki/Datensparsamkeit.html It's a principle for good software design. This principle is also written down in German law: https://de.wikipedia.org/wiki/Datenvermeidung_und_Datensparsamkeit https://de.wikipedia.org/wiki/Datenvermeidung_und_Datenspars... >Damit gilt in Deutschland der Grundsatz, dass die Erhebung, Verarbeitung und Nutzung personenbezogener Daten und die Auswahl und Gestaltung von Datenverarbeitungssystemen an dem Ziel auszurichten sind, so wenig personenbezogene Daten wie möglich zu erheben, zu verarbeiten oder zu nutzen. Rough translation: Thus in Germany we have there principle, that the collection, processing and using of person related data and the selection and design of data processing systems have to be guided by the aim to collect, process or use as few as possible person related data as possible. Here, now someone has a list of software installed on various machines and the versions of that software, and whatever else information. It may be enough data to identify me or other users, the computers and the installed software. It may also allow other uses, which I have no idea of. It's likely that this information spreads to unintended places. I don't think this is a good idea. I never liked the idea of using Homebrew, and this makes it even more suspicious.
- majewsky 10y ago
  For example, data about installed software versions can be used to automatically find systems that are vulnerable to certain exploits.
  - TeMPOraL 10y ago
    Data about installed software can also be used to profile you for headhunters or marketers in general.
deleted 10y ago
[deleted]
izacus 10y ago
If you listen to Changelog #223 podcast[0], both Mike and the podcast author showed quite a lot of derision and condescension to the people caring about analytics upload, so I don't think it's getting fixed. [0]: https://changelog.com/podcast/223 https://changelog.com/podcast/223
- hueving 10y ago
  Awesome, so not only does he not care about privacy, he feels the need to deride people that do? Maybe the reason they needed analytics in the first place is because of this myopic perspective. If you assume everyone who disagrees with you is an idiot, you're going to stall really quickly.
andrewvijay 10y ago
Its looking a bit hyprocitical here to be honest. If you use websites in the web today, you are sending data for sure unless you use a adblocker that blocks analytics as well. Brew collecting data this way is unethical but complaining about these things these days is not going to do any change to be honest. I would be glad if the people who complain about this dont use any websites that collect data without giving any control to the user. But we all know the real deal.
- blub 10y ago
  Sure, let's not complain. Because being a pushover is the secret to success in life. All the benefits and rights we have today were gained because our ancestors didn't fight for them and shrug their shoulders.
  - andrewvijay 10y ago
    No dont take it the wrong way. But what are you fighting against? The entire web? You can but you have to understand that the scale is so massive that we can't do anything unless its becomes a massive movement throughout the world. But really? A movement for privacy? No chance. Its simply a first world problem. In my country we have around 22,000 people dying everyday in hunger. Privacy wont even be heard here. So its near impossible.
- svens_ 10y ago
  > unless you use a adblocker that blocks analytics as well Who on Hacker News doesn't? At least on the desktop (where you use brew) this is a matter of a few clicks and an essential security measure.
  - andrewvijay 10y ago
    I don't think we can assume that. My colleague sitting right next to me uses HN often and brew as well. He doesn't have an adblocker and watches youtube with ads. FFS!!
ainiriand 10y ago
As far as I know, Brew can be cloned, right? Can we mantain a fork? Is this reasonable? Thanks.
- andrewguenther 10y ago
  Maintain a fork that no one will use? Sure. Or just turn off analytics.
antouank 10y ago
Opting out [0] Homebrew analytics helps us maintainers and leaving it on is appreciated. However, if you want to opt out of Homebrew's analytics, you can set this variable in your environment: export HOMEBREW_NO_ANALYTICS=1 Alternatively, this will prevent analytics from ever being sent: brew analytics off [0]: https://github.com/Homebrew/brew/blob/master/docs/Analytics.md#opting-out https://github.com/Homebrew/brew/blob/master/docs/Analytics....
jakebasile 10y ago
This really doesn't concern me at all. I don't feel I am harmed by Google possibly knowing what software I install, because if anyone wants to look I keep the script that installs it in my public dotfile repo on GitHub. Can anyone explain to me how this could be used against someone? I'm asking completely seriously as I don't see any harm in this no matter how hard I try. Edit: I do agree that the notice should be more visible for those that are concerned about this. It should require user input even if it is just waiting for a key press to give you a chance to read it along with info on how to opt out.
- jakobegger 10y ago
  Oh... so you're installing Tor? And a Bitcoin client? You're starting to look a lot like a drug dealer. Let's send a SWAT team and confiscate all your stuff just to make sure.
- blub 10y ago
  It harms everyone because it's one more actor trying to make collection of data look normal, as can be seem from the multiple misguided posts wondering why this is a problem. It's not normal that software is sending data to some server somwhere by itself by default. Devs used to have some decency and left this opt-in. They see there's little push-back and they're making it opt-out. Almost all mobile apps and a significant number of desktop apps have analytics now.
- yoo1I 10y ago
  > Can anyone explain to me how this could be used against someone? I'm asking completely seriously as I don't see any harm in this no matter how hard I try. This is called the "nothing to hide" argument. If you currently have no foes and are generally closer to the elite of a society than to the margins, then these few little data points collected on you (pseudo-anonymously or not) cannot really hurt your. But as your digital shadow grows (and with google analytics et al being used to extensively, it certainly is) and you drift to the margins of society, possibly developing some foes in the elites in the process, the information about you that is now available to people in power becomes more threatening for you. Say, you're now a black, female, delivery driver in Detroit instead of a Silicon Valley software engineer. Once you give cause for scrutiny, say, a conflict with your employer, the digital shadow of data-points can be searched to find anything that, taken out of context or not, can be used against you. Or, put differently in famous exaggeration by Cardinal Richelieu: If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.
deleted 10y ago
[deleted]
blub 10y ago
"Your privacy has been trampled by pretty much everyone, why not accept one more? They're cute cuddly and open source, how could you refuse them access to your machine?" This is essentially your pathetic argument. You should be ashamed of yourself, because you know that defaults matter, people don't read a small line of warning text in the console and this is ultimately yet another stab in the back. Chad and Brad merrily screwing things up for the noble goal of improving their software through analytics: idlewords.com/talks/robot_armies.htm
- tomchristie 10y ago
  > Your pathetic argument. You should be ashamed of yourself I'm not giving a free pass simply because it's open source. Rather it's an informed decision that I'm able to make because they're completely transparent about what limited metrics they aggregate. Personally, I'm in broadly favour of them collecting basic metrics, their motivations for doing so, and the approach they've taken.
- dang 10y ago
  > This is essentially your pathetic argument. You should be ashamed of yourself This breaches HN's civility rules badly. You can't comment like this here, and we ban users that do it, so please don't do it again. Arguing this way is an old internet trope, but it's one that we need to be vigilant about not reviving here, if we want to have civil, substantive discourse instead of decadence. If you have a good point to make, it's not only possible to make it civilly, it will be stronger for it. Calling another user a "useful idiot" is also not ok (https://news.ycombinator.com/item?id=13035349 https://news.ycombinator.com/item?id=13035349), euphemism or no. It's clear that you feel strongly about this issue, but not allowing strong feelings to trump civil interaction is the essence of civil interaction. We detached this subthread from https://news.ycombinator.com/item?id=13035387 https://news.ycombinator.com/item?id=13035387 and marked it off-topic.
tbarbugli 10y ago
Sounds quite reasonable to me when you read it: https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....
mikebay 10y ago
Giving "free" analytics by Google. We can call spying of people or they activity with many names. Privacy is simply not existing in Google services at all. - Google ? No thanks.
agounaris 10y ago
OMG grow up, you use google every day, you have facebook, twitter and maps on your phone but suddenly you worry because the developer of brew who needs some metrics! The only thing missing now is the Snowden guy to make a blog post about it.
- arm 10y ago
  I think you should grow up and realize that not everyone conforms to your worldview. As an example, I don’t use Google every day (I use DuckDuckGo), I don’t use Facebook, Twitter, or Google Maps, nor do I have a phone (can’t justify the expense when I have Wi-Fi access most of the times I need it). As echoed by many others above, I never gave Homebrew consent to send any information to Google; it should be opt-in. Frankly, I was quite annoyed after updating Homebrew and found it already trying to connect to Google Analytics immediately after. Thankfully, I was able to block the request with Little Snitch and then opt-out of the analytics, but it certainly left a bad taste in my mouth that they’d start collecting data before even letting me opt-out first!
agounaris 10y ago
OMG grow up, you use google every day, you have facebook, twitter and maps on your phone but suddenly you worry because the developer of brew who needs some metrics! The only thing missing now is the Snowden guy to make a blog post about it.
rurban 10y ago
Switch to macports. This is a professional ports system, not the spying amateurism of brew.
mcgirr 10y ago
There are many good reasons to run macOS. But if you run Linux, instead of macOS, you will get a package manager (one supported by your distro) that performs most (if not all) of the functionality of brew. I find it frustrating to see people use macOS and rely/complain about brew.
hmans 10y ago
"brew install" installs executable code on your system
ttflee 10y ago
How would it go in China, where Google IP ranges are totally blocked?
ciraci_nicolo 10y ago
You can disable it by setting the ENV variable HOMEBREW_NO_ANALYTICS. https://github.com/Homebrew/brew/blob/master/Library/Homebrew/utils/analytics.rb#L16 https://github.com/Homebrew/brew/blob/master/Library/Homebre...
Nursie 10y ago
The point here is that, like that Ubuntu search we all hated, this is not behaviour we expect from well behaved FOSS application, notice or otherwise. Google collect obscene amounts of info on everything from government interactions to software preferences. So far it's largely been confined to the web and could be blocked by using an ad or tracker blocker. Now that software may or may not do this stuff too... it ups the game and the threat. This will make me less likely to use Brew. Likely no great loss to the team I'm sure.
lorenzfx 10y ago
pkg.src is available for Mac OS X and might be a good alternative (disclaimer: I have never seriously used it, certainly not on OS X). https://www.pkgsrc.org/ https://www.pkgsrc.org/ http://pkgsrc.joyent.com/install-on-osx/ http://pkgsrc.joyent.com/install-on-osx/
hoers 10y ago
Being open source they should just make their analytics data public.
tobiastom 10y ago
For what it's worth: I don't think Homebrew is evil. It's all about a technical decision they made, which I'm not ok with. I wrote a follow up here: https://tobiastom.name/notes/4cda7d7b https://tobiastom.name/notes/4cda7d7b
eternalban 10y ago
Time to break up Google.
dictum 10y ago
From https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....: > As far as we can tell it would be impossible for Google to match the randomly generated Homebrew-only analytics user ID to any other Google Analytics user ID. If Google turned evil the only thing they could do would be to lie about anonymising IP addresses and attempt to match users based on IP addresses. Look, by now Google knows my whole stack and what I'm doing with each project, and Homebrew using Google Analytics doesn't bother me much. I still disabled it a while ago and after reading "if Google turned evil" put like a remote possibility I won't turn it back on. There are two extremes in tech — paranoia about everything and magical optimism about everything. This is an example of the latter. A corporation of Google's scale and relevance to different industries simply cannot afford to not be evil. Doesn't mean they're absolutely evil and just waiting for an opportunity to partner with a hypothetical fascist government — just that you can't assume the best.
cs02rm0 10y ago
I didn't know about this. Serves me right for running it via cron I guess.
deleted 10y ago
[deleted]
golanggeek 10y ago
Unbelievable.. anyway, you can look up your current settings using # brew analytics state and switch it off # brew analytics off More info - https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....
draw_down 10y ago
You know... not everyone is spying on you all the time. People do use data like this for non-nefarious purposes.
KKKKkkkk1 10y ago
A bit offtopic: I'm a recent convert to Brew and I was a bit surprised that it is missing two features that I am used to seeing in a package manager. The first is that there is no way to upgrade casks, and the other one is that there's no way to autoremove dependencies when a package is uninstalled. Since Brew is at this point a mature project, I am guessing these features are not in the plans, which is too bad.
hashhar 10y ago
They do prompt for this. And the document that details this if very descriptive. They have also specifically called out the files used for analytics and even have an environment variable to echo the analytics information. I think this is paranoia. And thanks a lot to Max for making this great piece of software.

268 points by jeena 10y ago

tfeldmann 10y ago

To disable this, execute brew analytics off

opk 10y ago
Any idea what to block if I want to just completely block google analytics at the firewall level?
- troels 10y ago
  /etc/hosts should do it, I suppose?
- hasperdi 10y ago
  The way I accomplish this is by setting up an dnsmasq DNS forwarder service. Find domains list for ad blocking / privacy on the internet and add these entries in dnsmasq's config. The entries look like this: address=/doubleclick.net/0.0.0.0 address=/gravity.com/0.0.0.0 address=/outbrain.com/0.0.0.0 ... Then set up the router's DHCP to use this server.
- jbg_ 10y ago
  Little Snitch is excellent for this. I remember running brew at some point and being asked by Little Snitch if it could connect to Google. I said "deny forever" and have never worried about it since.
- driverdan 10y ago
  https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
aq3cn 10y ago
How do you turn it off for brew cask? Anyway this option should have been available in their man page. But anyway they have clearly mentioned it. https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics.... If they want data, I will happily fill up their survey form but please don't take it for granted that my personal data is yours otherwise I may go to China for their great wall.

peteretep 10y ago

I was aware, because I run Little Snitch. If you care, you should be too.

aorth 10y ago
You're right, we probably should be using Little Snitch — just know that it's not a golden ticket! There has been some research about bypassing Little Snitch, for example this one from 2016: https://speakerdeck.com/patrickwardle/defcon-2016-i-got-99-problems-but-little-snitch-aint-one https://speakerdeck.com/patrickwardle/defcon-2016-i-got-99-p...
- JoachimS 10y ago
  And that has been fixed. It could have been announced in a better way, but is fixed. Are you suggesting people should not use Little Snitch at all? Has the tool lost all credibility forever?

libeclipse 10y ago

With companies like Google having their fingers in every pie, we're losing the privacy war.

MawNicker 10y ago
People just get ratfucked by whoever controls the media.
- unixhero 10y ago
  Better become they then.
  - deleted 10y ago
    [deleted]
- true_religion 10y ago
  What are double binds?

mook 10y ago

Relevant previous discussion, in case people want more details: https://news.ycombinator.com/item?id=11566720 https://news.ycombinator.com/item?id=11566720

CJefferson 10y ago

I knew, and I was prompted. I can understand why this might upset people, but for me I hope it will make brew a better product. I'm sure we all know as developers how annoying it can be to not know the problems users have, and what they are using your software for -- that's why most websites have analytics. I'm hoping to add something similar to software I work on, with an opt-out of course. I believe it will help me serve my users better.

yoran 10y ago
I agree with this. Also note that GA's terms disallow the sending of personable identifiable information so the data they collect has to be anonymous (see https://support.google.com/analytics/answer/2795983?hl=en https://support.google.com/analytics/answer/2795983?hl=en).
hueving 10y ago
Please make it opt in. If you truly believe people closely read the prompts for having their data harvested, a default to "No" should not impact you at all. If you don't believe they read the prompts closely, you're an asshole for stealing data by default.
- andybak 10y ago
  'Stealing' data? Is that like 'stealing' by downloading a movie?
  - TeMPOraL 10y ago
    "Exfiltrating" would be a better word here. (Also, downloading a movie is a different thing - there you're not stealing nor exfiltrating anything, you're downloading data as intended by uploader, who may or may not have the copyrights for that data.) (INB4, ripping a DVD and uploading it is not data theft. Exfiltrating a pre-release copy from movie company's servers would be data theft.)
    - rocqua 10y ago

rcarmo 10y ago

There has been a prominent warning for this (that sadly most people miss) for months now.

joosters 10y ago
Obviously it's not prominent enough then.
- rcarmo 10y ago
  Or people simply don't pay attention to a change of color in terminal output anymore :)
  - mrmondo 10y ago
    Thanks to craplications like NPM etc... I'm sure that certainly has been the case. As I mentioned elsewhere, I can't remember being prompted for this on any of my three machines, but I bet I was and forgot.

pimpek 10y ago

I agree that it should be opt-in instead of opt-out but worrying what they do else behind the scenes is paranoid. You can check it out: https://github.com/Homebrew/brew https://github.com/Homebrew/brew

ronreiter 10y ago

Data is being sent to Google on probably every page you browse over the internet. And to 50 other data websites as well.

hueving 10y ago
Data isn't being sent when I use most of my developer tooling. When I visit a website, I expect it's going to be inundated with garbage analytics so I use things like ublock and noscript. What I don't expect is a package manager siphoning off data to Google.
- a3n 10y ago
  It's the new frontier.

ronreiter 10y ago

Data is being sent to Google on probably every page you browse over the internet. And to 50 other data websites as well.

STRiDEX 10y ago

I've seen this crop up a few times recently and a vocal minority seems to panic every time. I ran into it the other day installing pm2 w/ npm which downloads an optional package that they use for analytics https://github.com/Unitech/pm2/blob/master/package.json#L184 https://github.com/Unitech/pm2/blob/master/package.json#L184 Is the problem that they are using google's service? Is it the tracking that people don't like? Is it the messaging/copy to the users? I'm sure there's plenty of people on hacker news that build analytics software for a living. I've worked on email click and open tracking. Doesn't seem terrible if it helps them build their product.

djsumdog 10y ago
You know...you can already get analytics if your mirrors just agree to share logs. It may not be as detailed or complete, for sure, but using another analytical tools does feel a little superfluous. > Is the problem that they are using google's service? This is part of it I think. The brew devs get stats, but so does Google which they can aggregate across everything. Standing up your own analytics server/cluster, especially for a project the size of brew, wouldn't be trivial and I can see why they leverage Google's service. But I can understand people not wanting to have data sent to Google. I moved everything off Gmail to my own E-mail server back in 2013 and moved search to DuckDuckGo.
- true_religion 10y ago
  Does google simply have access to you analytics data to do whatever they want? I was under the impression that they could only use it in ways that you the account holder defines.
  - skylark 10y ago
    It depends on what you mean by "access to your analytics data." Anonymized, aggregated data is being used to inform product decisions, but engineers don't have direct access to the production database to query whatever they want. There are almost no cases where you'll be granted approval to look at real user data, and if you are granted access, 100% of your activity is monitored. As a side note, this has been the case at every big company I've worked at, not just Google.

cygned 10y ago

This topic has been discussed on The Changelog recently: https://changelog.com/podcast/223 https://changelog.com/podcast/223 If I recall correctly, opt-out was chosen because they really want/need some analytics data and most of the users would not opt-in.

hueving 10y ago
They are blatantly admitting they are stealing user data then if they realize most users aren't reading the prompts and accept the defaults (data harvesting in this case).
tdkl 10y ago
> and most of the users would not opt-in Which means users have chosen what they prefer and silently extracting despite that choice isn't exactly trustful.
anc84 10y ago
What would they need it for?
- cygned 10y ago
  It's outlined here: https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....
Udo_Schmitz 10y ago
“they really want/need some analytics data” Why? For what?
- cygned 10y ago
  It's outlined here: https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....

pvinis 10y ago

Yes we know. brew tells you that. And you can disable it. Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what? Some of the times it's to make the product better, or better targeted. Some other times it's just for spying on the users. Let's stop complaining about stuff that someone does and tell you they do it. There are many more that do the same things without telling you. Furthermore, now that you know, for brew specifically, will you opt out? Is your brew command history so secret that you care more about noone looking at it than helping making brew better? Chances are you use brew quite often. Chances are brew is not perfect. Will you choose to make its progress slower because of no real security reason? How do we expect open source to become better if everyone is being a crybaby because brew got a history of how often they do brew update?

wheelerwj 10y ago
We have to start somewhere. Opt in should always be the standard.
- mrmondo 10y ago
  This. Exactly this, thank you.
- pvinis 10y ago
  Sure. Opt in would be nice. But only if it was opt in always and everywhere, and all users, technical or otherwise, knew the reasons why analytics are gathered for a product they use. I think in that case, many people would still opt in. I would. And I would hope users of my products would too.
  - wheelerwj 10y ago
    Yes, and maybe it's okay if we don't have perfect visibility. We've been building things for thousands of years without Javascript event notifications, I'm sure we will do just fine with a little less data
- tomfluff 10y ago

andrewguenther 10y ago

While factual, the title is a bit misleading. Brew uses Google Analytics and prompts you to inform you that it does so.

lispm 10y ago
What does it send? What does it use it for?
- andrewguenther 10y ago
  https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics.... (This link is provided in the initial notification)
  - lispm 10y ago
    Notification or prompt? There is no way that I would want to have this data and this amount of data, recorded and transferred to google. Especially not about software installation on my computers or computers of friends or clients.
    - andrewguenther 10y ago
      I recall it being a prompt when I saw it, but others are saying it was a notification.
    - andromeduck 10y ago
      Then just turn it off

andrewguenther 10y ago

People advocate so fervently for privacy, but can't be bothered to read a prompt...

TeMPOraL 10y ago
Privacy-respecting defaults should be there so that you don't have to spend your whole day reading prompts and ToS looking for that one sentence that fucks you over.
- andrewguenther 10y ago
  Genuine curiosity question: Are all analytics a violation of privacy? If brew simply sent a message that said "brew was used" with no PII, would that matter? At what point is it an issue?
  - tremon 10y ago
    Are all analytics a violation of privacy? No, only the ones without active informed consent. Privacy is the embodiment of personal choice, after all.
  - TeMPOraL 10y ago
    Honestly, my reaction to that would be "why the fuck is it doing that", possibly followed by a firewall rule or a comment in the source code and rebuild. I'm annoyed when an application connects to the Internet for reasons unrelated to the task it's performing for me. That said, even a ping to the mothership is an identifying information - at minimum, it already contains your IP address. Whatever additional data may be added to that ping will likely also reveal details about the machine you're using. Personally, I'm not a privacy nut; I mostly don't care - I leave plenty of information about myself around. But the thing is, I'm doing it voluntarily and as a primary function of some service. I don't like when applications exfiltrate data for reasons not related to their purpose.

rkachowski 10y ago

This is google analytics. It's a bit different than google directly taking the data and using it for google purposes (e.g. streetview cars gathering SSID information for location pinpointing). The data (afaik) is used only by the homebrew team instead of Google. A more accurate summary would be "Brew is sending usage data to a google owned analytics service".

opk 10y ago
The data still goes to google. While the expectation would be that the data is only used by homebrew, there's no actual way of knowing that google isn't gratefully helping itself. And given the entire way Google's business works, they probably are.
- pbiggar 10y ago
  Given the number of people who work for Google, and Google's internal culture of openness, I find it extremely unlikely that Google is violating its customers' privacy. That would almost certainly get whistleblown.
  - wingless 10y ago
    Like how the PRISM program got whistleblown by Googlers? Oh wait, that never happened.
    - rocqua 10y ago
      Threat of jail / treason conviction is a lot stronger than the threat of being fired by google. I can totally see someone caving for the one and not the other.
    - kyrra 10y ago
      Google never cooperated with PRISM. As soon as news came out that the NSA was tapping Google's intra-datacenter dedicated lines, Google announced they would accelerate encrypting all that traffic. https://www.google.com/amp/arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/%3Famp%3D1?client=safari https://www.google.com/amp/arstechnica.com/information-techn...

mrmondo 10y ago

I went to log a bug for this and was given "You can't perform that action at this time."

moonbug 10y ago
github pitches that error all the damn time. Wish I knew why.

froh42 10y ago

As I didn't update brew for a long time I did not have the analytics version. So I upgraded to see what happens. In fact it did NOT prompt me when enabling analytics, but it did display a notice (hidden in several hundred lines of output during brew upgrade): ------------------- + 5a9e19f...7f13b37 master -> origin/master (forced update) * [new tag] 0.1 -> 0.1 HEAD is now at 7f13b37 Merge pull request #1562 from woodruffw/check-admin-group ==> Homebrew has enabled anonymous aggregate user behaviour analytics Read the analytics documentation (and how to opt-out) here: https://git.io/brew-analytics https://git.io/brew-analytics ==> Tapping homebrew/core Cloning into '/usr/local/Library/Taps/homebrew/homebrew-core'... remote: Counting objects: 3765, done. remote: Compressing objects: 100% (3654/3654), done. ------------------- I do not consider this a prominent warning. Rather it is sneaking analytics silently in the back door. Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate. If I'd were a contributor I'd not want to have my name associated to something like this, even if it just happened out of stupidity not out of malice.

mrmondo 10y ago
This is why I think I missed it on all my machines, it really isn't noticable but it's a _big deal_. *Edit: I run brew update; brew upgrade; brew clean on at least two of my three machines at least once a day, while I should be more vigilant opt-out is really something I'd expect from Microsoft or Google themselves and not an open source project such as Brew.
hueving 10y ago
The whole point of opt out systems is to bury this info. That was very much intentional.
Tepix 10y ago
There you have it. Stop claiming there is a "prompt". It's the same as the "3rd party cookies enabled by default" setting on Firefox. It's the wrong default if you really care about your user's privacy as Firefox claims to do. It's hard to even find the setting unless you know where it is. And it's Google who is paying so it stays the way it is and patches that change it are rejected.

mrmondo 10y ago

Quite honestly, I don't remember brew asking me this on any of my 3 macOS machines, I'm not saying it didn't, but the fact that I'm a 'techie' person and didn't notice or forgot about it worries me greatly.

ProbabilityMoon 10y ago
It probably didn't. I run brew regularly on my machine, and I did not get any prompt asking me to enable analytics. From reading other comments, I see lots of users are in the same position, and homebrew sneaked this in with just a two line notice buried in the verbose output. This worries me deeply, to the point where I'm considering removing this software from my machine.
- mrmondo 10y ago
  While I obviously feel the same way, I'd take a step back and see what Brew's response is to this thread / the backlash of what people want / don't want, because it has, overall been a good thing of macOS.

thinkindie 10y ago

this blog post is pretty naive, it was well advertised few months ago

froh42 10y ago
“But the plans were on display…” “On display? I eventually had to go down to the cellar to find them.” “That’s the display department.” “With a flashlight.” “Ah, well, the lights had probably gone.” “So had the stairs.” “But look, you found the notice, didn’t you?” “Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”
messel 10y ago
I hadn't known until today. Need to think over a dev tool analytics with (mostly hidden) prompt. Looking at apt get analytics now as a comparison

tomlong 10y ago

I distinctly remember being asked about this ages ago, and finding it easy to disable, or is this something else? Is it still using google analytics when you've asked it not to?

andromeduck 10y ago
No

TeMPOraL 10y ago

"It's easier to ask forgiveness than it is to get permission." I feel I need something like uMatrix, but for the entire OS. Is it time to familiarize myself with netstat and firewall rules?

cdubzzz 10y ago
I had a spare Pi lying around and installed pi-hole[0] on it a while back. It has worked like a charm with almost no up keep for months now. [0] https://pi-hole.net/ https://pi-hole.net/

kinkdr 10y ago

Try "Little snitch", apart from sublime, it is the best $40 I ever spent. Edit: the best $40..

Tepix 10y ago
"best"?
- kinkdr 10y ago
  Ooops. Thanks :D

appelza 10y ago

Being sent

Lazare 10y ago

This seems like a somewhat extreme reaction to google analytics.

froh42 10y ago
Im extremely pissed off by the way they snuck the prompt in between several hundred lines of shell output on update. This is NOT being prompted. I can live with the analytics. I'd might even consider to leave it on IF BEING ASKED PROPERLY. All previous discussion says "oh you get notified". The point is, you don't get properly notified. And this is, why this is news again over the old discussion on HN.

lispm 10y ago

In German we have a word called 'Datensparsamkeit': http://martinfowler.com/bliki/Datensparsamkeit.html http://martinfowler.com/bliki/Datensparsamkeit.html It's a principle for good software design. This principle is also written down in German law: https://de.wikipedia.org/wiki/Datenvermeidung_und_Datensparsamkeit https://de.wikipedia.org/wiki/Datenvermeidung_und_Datenspars... >Damit gilt in Deutschland der Grundsatz, dass die Erhebung, Verarbeitung und Nutzung personenbezogener Daten und die Auswahl und Gestaltung von Datenverarbeitungssystemen an dem Ziel auszurichten sind, so wenig personenbezogene Daten wie möglich zu erheben, zu verarbeiten oder zu nutzen. Rough translation: Thus in Germany we have there principle, that the collection, processing and using of person related data and the selection and design of data processing systems have to be guided by the aim to collect, process or use as few as possible person related data as possible. Here, now someone has a list of software installed on various machines and the versions of that software, and whatever else information. It may be enough data to identify me or other users, the computers and the installed software. It may also allow other uses, which I have no idea of. It's likely that this information spreads to unintended places. I don't think this is a good idea. I never liked the idea of using Homebrew, and this makes it even more suspicious.

majewsky 10y ago
For example, data about installed software versions can be used to automatically find systems that are vulnerable to certain exploits.
- TeMPOraL 10y ago
  Data about installed software can also be used to profile you for headhunters or marketers in general.

deleted 10y ago

[deleted]

izacus 10y ago

If you listen to Changelog #223 podcast[0], both Mike and the podcast author showed quite a lot of derision and condescension to the people caring about analytics upload, so I don't think it's getting fixed. [0]: https://changelog.com/podcast/223 https://changelog.com/podcast/223

hueving 10y ago
Awesome, so not only does he not care about privacy, he feels the need to deride people that do? Maybe the reason they needed analytics in the first place is because of this myopic perspective. If you assume everyone who disagrees with you is an idiot, you're going to stall really quickly.

andrewvijay 10y ago

Its looking a bit hyprocitical here to be honest. If you use websites in the web today, you are sending data for sure unless you use a adblocker that blocks analytics as well. Brew collecting data this way is unethical but complaining about these things these days is not going to do any change to be honest. I would be glad if the people who complain about this dont use any websites that collect data without giving any control to the user. But we all know the real deal.

blub 10y ago
Sure, let's not complain. Because being a pushover is the secret to success in life. All the benefits and rights we have today were gained because our ancestors didn't fight for them and shrug their shoulders.
- andrewvijay 10y ago
  No dont take it the wrong way. But what are you fighting against? The entire web? You can but you have to understand that the scale is so massive that we can't do anything unless its becomes a massive movement throughout the world. But really? A movement for privacy? No chance. Its simply a first world problem. In my country we have around 22,000 people dying everyday in hunger. Privacy wont even be heard here. So its near impossible.
svens_ 10y ago
> unless you use a adblocker that blocks analytics as well Who on Hacker News doesn't? At least on the desktop (where you use brew) this is a matter of a few clicks and an essential security measure.
- andrewvijay 10y ago
  I don't think we can assume that. My colleague sitting right next to me uses HN often and brew as well. He doesn't have an adblocker and watches youtube with ads. FFS!!

ainiriand 10y ago

As far as I know, Brew can be cloned, right? Can we mantain a fork? Is this reasonable? Thanks.

andrewguenther 10y ago
Maintain a fork that no one will use? Sure. Or just turn off analytics.

antouank 10y ago

Opting out [0] Homebrew analytics helps us maintainers and leaving it on is appreciated. However, if you want to opt out of Homebrew's analytics, you can set this variable in your environment: export HOMEBREW_NO_ANALYTICS=1 Alternatively, this will prevent analytics from ever being sent: brew analytics off [0]: https://github.com/Homebrew/brew/blob/master/docs/Analytics.md#opting-out https://github.com/Homebrew/brew/blob/master/docs/Analytics....

jakebasile 10y ago

This really doesn't concern me at all. I don't feel I am harmed by Google possibly knowing what software I install, because if anyone wants to look I keep the script that installs it in my public dotfile repo on GitHub. Can anyone explain to me how this could be used against someone? I'm asking completely seriously as I don't see any harm in this no matter how hard I try. Edit: I do agree that the notice should be more visible for those that are concerned about this. It should require user input even if it is just waiting for a key press to give you a chance to read it along with info on how to opt out.

jakobegger 10y ago
Oh... so you're installing Tor? And a Bitcoin client? You're starting to look a lot like a drug dealer. Let's send a SWAT team and confiscate all your stuff just to make sure.
blub 10y ago
It harms everyone because it's one more actor trying to make collection of data look normal, as can be seem from the multiple misguided posts wondering why this is a problem. It's not normal that software is sending data to some server somwhere by itself by default. Devs used to have some decency and left this opt-in. They see there's little push-back and they're making it opt-out. Almost all mobile apps and a significant number of desktop apps have analytics now.
yoo1I 10y ago
> Can anyone explain to me how this could be used against someone? I'm asking completely seriously as I don't see any harm in this no matter how hard I try. This is called the "nothing to hide" argument. If you currently have no foes and are generally closer to the elite of a society than to the margins, then these few little data points collected on you (pseudo-anonymously or not) cannot really hurt your. But as your digital shadow grows (and with google analytics et al being used to extensively, it certainly is) and you drift to the margins of society, possibly developing some foes in the elites in the process, the information about you that is now available to people in power becomes more threatening for you. Say, you're now a black, female, delivery driver in Detroit instead of a Silicon Valley software engineer. Once you give cause for scrutiny, say, a conflict with your employer, the digital shadow of data-points can be searched to find anything that, taken out of context or not, can be used against you. Or, put differently in famous exaggeration by Cardinal Richelieu: If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.

deleted 10y ago

[deleted]

blub 10y ago

"Your privacy has been trampled by pretty much everyone, why not accept one more? They're cute cuddly and open source, how could you refuse them access to your machine?" This is essentially your pathetic argument. You should be ashamed of yourself, because you know that defaults matter, people don't read a small line of warning text in the console and this is ultimately yet another stab in the back. Chad and Brad merrily screwing things up for the noble goal of improving their software through analytics: idlewords.com/talks/robot_armies.htm

tomchristie 10y ago
> Your pathetic argument. You should be ashamed of yourself I'm not giving a free pass simply because it's open source. Rather it's an informed decision that I'm able to make because they're completely transparent about what limited metrics they aggregate. Personally, I'm in broadly favour of them collecting basic metrics, their motivations for doing so, and the approach they've taken.
dang 10y ago
> This is essentially your pathetic argument. You should be ashamed of yourself This breaches HN's civility rules badly. You can't comment like this here, and we ban users that do it, so please don't do it again. Arguing this way is an old internet trope, but it's one that we need to be vigilant about not reviving here, if we want to have civil, substantive discourse instead of decadence. If you have a good point to make, it's not only possible to make it civilly, it will be stronger for it. Calling another user a "useful idiot" is also not ok (https://news.ycombinator.com/item?id=13035349 https://news.ycombinator.com/item?id=13035349), euphemism or no. It's clear that you feel strongly about this issue, but not allowing strong feelings to trump civil interaction is the essence of civil interaction. We detached this subthread from https://news.ycombinator.com/item?id=13035387 https://news.ycombinator.com/item?id=13035387 and marked it off-topic.

tbarbugli 10y ago

Sounds quite reasonable to me when you read it: https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....

mikebay 10y ago

Giving "free" analytics by Google. We can call spying of people or they activity with many names. Privacy is simply not existing in Google services at all. - Google ? No thanks.

agounaris 10y ago

OMG grow up, you use google every day, you have facebook, twitter and maps on your phone but suddenly you worry because the developer of brew who needs some metrics! The only thing missing now is the Snowden guy to make a blog post about it.

arm 10y ago
I think you should grow up and realize that not everyone conforms to your worldview. As an example, I don’t use Google every day (I use DuckDuckGo), I don’t use Facebook, Twitter, or Google Maps, nor do I have a phone (can’t justify the expense when I have Wi-Fi access most of the times I need it). As echoed by many others above, I never gave Homebrew consent to send any information to Google; it should be opt-in. Frankly, I was quite annoyed after updating Homebrew and found it already trying to connect to Google Analytics immediately after. Thankfully, I was able to block the request with Little Snitch and then opt-out of the analytics, but it certainly left a bad taste in my mouth that they’d start collecting data before even letting me opt-out first!

agounaris 10y ago

rurban 10y ago

Switch to macports. This is a professional ports system, not the spying amateurism of brew.

mcgirr 10y ago

There are many good reasons to run macOS. But if you run Linux, instead of macOS, you will get a package manager (one supported by your distro) that performs most (if not all) of the functionality of brew. I find it frustrating to see people use macOS and rely/complain about brew.

hmans 10y ago

"brew install" installs executable code on your system

ttflee 10y ago

How would it go in China, where Google IP ranges are totally blocked?

ciraci_nicolo 10y ago

You can disable it by setting the ENV variable HOMEBREW_NO_ANALYTICS. https://github.com/Homebrew/brew/blob/master/Library/Homebrew/utils/analytics.rb#L16 https://github.com/Homebrew/brew/blob/master/Library/Homebre...

Nursie 10y ago

The point here is that, like that Ubuntu search we all hated, this is not behaviour we expect from well behaved FOSS application, notice or otherwise. Google collect obscene amounts of info on everything from government interactions to software preferences. So far it's largely been confined to the web and could be blocked by using an ad or tracker blocker. Now that software may or may not do this stuff too... it ups the game and the threat. This will make me less likely to use Brew. Likely no great loss to the team I'm sure.

lorenzfx 10y ago

pkg.src is available for Mac OS X and might be a good alternative (disclaimer: I have never seriously used it, certainly not on OS X). https://www.pkgsrc.org/ https://www.pkgsrc.org/ http://pkgsrc.joyent.com/install-on-osx/ http://pkgsrc.joyent.com/install-on-osx/

hoers 10y ago

Being open source they should just make their analytics data public.

tobiastom 10y ago

For what it's worth: I don't think Homebrew is evil. It's all about a technical decision they made, which I'm not ok with. I wrote a follow up here: https://tobiastom.name/notes/4cda7d7b https://tobiastom.name/notes/4cda7d7b

eternalban 10y ago

Time to break up Google.

dictum 10y ago

From https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....: > As far as we can tell it would be impossible for Google to match the randomly generated Homebrew-only analytics user ID to any other Google Analytics user ID. If Google turned evil the only thing they could do would be to lie about anonymising IP addresses and attempt to match users based on IP addresses. Look, by now Google knows my whole stack and what I'm doing with each project, and Homebrew using Google Analytics doesn't bother me much. I still disabled it a while ago and after reading "if Google turned evil" put like a remote possibility I won't turn it back on. There are two extremes in tech — paranoia about everything and magical optimism about everything. This is an example of the latter. A corporation of Google's scale and relevance to different industries simply cannot afford to not be evil. Doesn't mean they're absolutely evil and just waiting for an opportunity to partner with a hypothetical fascist government — just that you can't assume the best.

cs02rm0 10y ago

I didn't know about this. Serves me right for running it via cron I guess.

deleted 10y ago

[deleted]

golanggeek 10y ago

Unbelievable.. anyway, you can look up your current settings using # brew analytics state and switch it off # brew analytics off More info - https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....

draw_down 10y ago

You know... not everyone is spying on you all the time. People do use data like this for non-nefarious purposes.

KKKKkkkk1 10y ago

A bit offtopic: I'm a recent convert to Brew and I was a bit surprised that it is missing two features that I am used to seeing in a package manager. The first is that there is no way to upgrade casks, and the other one is that there's no way to autoremove dependencies when a package is uninstalled. Since Brew is at this point a mature project, I am guessing these features are not in the plans, which is too bad.

hashhar 10y ago

They do prompt for this. And the document that details this if very descriptive. They have also specifically called out the files used for analytics and even have an environment variable to echo the analytics information. I think this is paranoia. And thanks a lot to Max for making this great piece of software.