6 ms·

> Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want t

> Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate. Homebrew lead maintainer here. We're chronically understaffed and underfunded. We have analytics so we can make Homebrew better by figuring out how to prioritise security, maintenance and bug fixes on packages based on how much they are used and how often they fail. I've been working on making regular dumps of this data and have been trying to find people who will provide us with non-Google hosting but: we're chronically understaffed and underfunded. One of our CI machines burnt out last night so I'm now trying to plan vacation time to drive for a 14 hour round trip and pick it up. While I'm doing that someone points out there's someone on Hacker News threatening to sue me. This is for working on software (mostly) in my free time that's used by people (mostly) for their employment and obtained for free. After the last thread on this (https://news.ycombinator.com/item?id=11566720 https://news.ycombinator.com/item?id=11566720) I had people emailing me to tell me I'm a nazi and should kill myself for weeks. Everyone here who objects to the analytics is well within their rights to do so (and should either opt-out or stop using Homebrew) but we need to start asking ourselves as a community whether we think treating open-source maintainers like this is more or less likely to encourage more people to work on the open-source software you rely on to do your job.

froh42 10y ago
Mike, I'm just saying that you're putting yourself on risky ground, not that I want to do something personally. In fact I'd even consider keeping GA enabled IF BEING NOTIFIED. The current notification is the problem, as it is close to invisble. Hiding output in a long log message is a dark pattern, I think it did not happen out of spite (you just used your normal shell output mechanism to show that). However: Such a chage of policy is more important than the list of files being removed by git. Even opt out is OK IF THE USER IS INFORMED. Currently it's like arthur dent being informed about the highway being built ... yeah we did display the notice. I know building an open source project is no fun and I can really relate to your desire to know more about installations and deinstallations. Personally I don't even object to using google GA, just to the way it feels being snuck beside the radar.
- mikemcquaid 10y ago
  You were notified, I'm sorry if it was not as clear as it could have been. We're always open to PRs to improve the visibility. That said, I still don't appreciate threats or ideas to sue me as an individual. That's a massively disproportionate threat to me and my family.
- josegonzalez 10y ago
  > Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate. This certainly sounds like you're advocating for people to - at the very least - harass him.
- deleted 10y ago
  [deleted]
OskarS 10y ago
Hear, hear
Chris2048 10y ago
How does the status of the project, or your personal affairs, affect design decisions?
- andrewguenther 10y ago
  A well funded, well staffed project looks very different than an under staffed, under funded one. They have to make harder decisions about what work to prioritize. I think what Mike is saying just emphasizes why they made this choice. What little work is able to be put into homebrew needs to be as targeted and helpful as possible. Analytics help then do that. So to answer your question, the status of the project and his personal affairs have a huge impact on design decisions.
  - Chris2048 10y ago
    > They have to make harder decisions about what work to prioritize Priority isn't a design decision. Analytics help, but the choice to not opt-in is not excused by "but we need them"
danpalmer 10y ago
I realise it's difficult to remember when faced with messages like this, but there are many of us that use Homebrew, accept the tracking, saw the message, and greatly appreciate all of the work you and the team put in. Keep up the good work.
blub 10y ago
It's surprising to hear that a package manager needs local analytics to figure out which packages are used. On the other hand it was likewise surprising to hear that homebrew was using github as its CDN. I don't rely on homebrew to do anything, but I am concerned about the normalisation of surveilance and will point that out in a reasonably polite manner.
- justinclift 10y ago
  > On the other hand it was likewise surprising to hear that homebrew was using github as its CDN. That sounds a bit weird to me. Homebrew gets developed on GitHub... so using GitHub as a CDN doesn't seem wrong (to me).
  - blub 10y ago
    Github offers source control services, it's not a package server. The CDN stunt was impacting other customers and they had to restrict brew's access.
    - justinclift 10y ago
      Interesting, hadn't heard about it. :) Sounds like they weren't using GitHub's Releases approach for binaries, instead doing something else. :/
    - mikemcquaid 10y ago
      As both a GitHub engineer and Homebrew lead maintainer: that's not true. You're perhaps thinking of CocoaPods where there was some problems which have been addressed through repository reorganisation work on CocoaPods side and a new API that I added to GitHub for Homebrew that makes it easier to avoid no-op `git fetch` runs now.
bartread 10y ago
Couldn't agree more: the shoot first and ask questions later treatment of OSS maintainers needs to stop right now. People who make use of OSS projects need to check their sense of entitlement at the door. People don't realise that a lot of these really valuable projects are run on next to zero budget but one, or a very small handful, of core contributors, who give up their own time to do so. If things you don't like happen with a project, start a dialogue, fork it, or use something else instead. Don't just wade in making threats. (Sadly, this has been going on for a very long time: I remember the debacle over .NET 2.0 support in NDoc where the author had some difficult personal circumstances coupled with people constantly hurling abuse at him. Net result: he understandably quit, not just NDoc but all OSS involvement, nobody else wanted to pick up the project, and the project died. This must have been 11 years ago now but it seems like, since then, the problem has if anything become worse.)
marioflach 10y ago
> we need to start asking ourselves as a community whether we think treating open-source maintainers like this is more or less likely to encourage more people to work on the open-source software you rely on to do your job. Exactly this. The homebrew team has done an amazing job for the past 7 years, all free and volunteer work. People threatening with suing the maintainer are poison for the open-source community. But hey, haters gonna hate. If I understand correctly, the data is anonymized before it is sent to Google [1]. How may people worrying about privacy download from Github using a proxy/vpn solution to hide their IP? I've listened to the Changelog podcast about Homebrew and first learned about Google Analytics there. I think people do not realize how big homebrew is (in form of usage and traffic). At this scale, the maintainer opted for collecting data anonymously in order to find bottlenecks and improving the entire software stack. You can disable that feature in the same way you would disable cookies in your web browser. [1]: https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....
fit2rule 10y ago
Treating your users as idiots is one thing. Users treating you as an idiot is another thing. Neither one of these conditions is acceptable. As a long-term homebrew user, I am very appreciative of your hard work (and have even contributed here and there), but in that light I am also very disappointed that I have to manually disable analytics and now have a lot less trust in the homebrew project. In the same way that I would complain if I were to see a bug in your code that radically effects my production, I consider this invasion of privacy - whatever the justification - worthy of complaint, too. Whatever the justification for this, its not an acceptable path to take, and I strongly urge you to consider making Analytics opt-in, and not opt-out. I have no problem with my next 'brew update' pausing, explaining the situation rationally as you have in this post, and giving me a y/n opportunity to proceed with participating in analytics. I do have a serious problem with you assuming that this is okay, not informing me of it in a fashion that makes me aware of the tracking, and just letting it slip in during an update, which I am now even more suspicious of, even though I do them religiously every week, and have done so for years. You've just made your product less attractive to me as a developer and user. That's a sad state of affairs, and I hope you fix this bug.
lentil 10y ago
> I'm now trying to plan vacation time to drive for a 14 hour round trip and pick it up From a happy and grateful Homebrew user, thank you for all the work you are doing. It's really easy for folks to underestimate how much effort is involved in running a project like this. Details like the above should be a reminder that it's clearly a very significant amount of hard, sometimes thankless, work; work which you are in no way obligated to do. There are large numbers of people who owe you a massive debt of gratitude for all the time and hassle that your effort has saved them. And it's quite sad that we (people) tend not to speak up when we are happy, and only make noise when we're upset about something. Thanks for continuing to work on this project!!
obj-g 10y ago
Just wanted to say thanks for all your hard work, it's appreciated by many. Maybe this wasn't the best choice, but missteps happen. Sadly, we'll never know how it might have been dealt with if people were able to take a deep breath and open a real, constructive dialogue about it rather than immediately freak out and make threats against you, forgetting (or simply not caring) that, by and large, people like you have been doing them huge favors while demanding nothing in return. Pathetic.
erikrothoff 10y ago
It's easy to get lost in all the hate, as those groups tend to be more vocal. So I'm writing this here just to what I reasonably can to stand up against all the negativity. I feel so helpless just reading all these comments. Homebrew is excellent software, and the malice expressed in this and similar threads does in no way reflect (my) real world experience of people's perception of Homebrew. I would go so far to say it's probably the best piece of software that I know, it's really easy to use, always works and helpful if something goes wrong. Good software is pretty rare to find, especially open source software with no commercial backing.
codedokode 10y ago
There is some kind of dispute about privacy, with commercial companies wanting to collect as much data as possible and some people opposing to it. Is not your project picking the wrong side here? This can be used as an argument later: "see, even popular open source projects do this". I think that giving up on user's privacy is not an acceptable solution. If you don't have enough time to fix all the bugs and nobody is willing to help then nothing can be done. What I expect from open source software is that an application should not collect and send home any data by default (I understand that it is not written in the license but still expect this). Breaking this expectation makes me and maybe not only me a little disappointed.
- mikemcquaid 10y ago
  > There is some kind of dispute about privacy, with commercial companies wanting to collect as much data as possible and some people opposing to it. Is not your project picking the wrong side here? As we're not providing information to any commercial company or selling it I don't think this is a reasonable comparison. If we were collecting information to sell and raise funds for the project I'd object to that, too.
  - ryukafalz 10y ago
    I'm not sure it would be as contentious if you were running your own analytics software. But some more privacy-aware users (myself included) have serious reservations about Google's increasingly pervasive data collection. The fact that Homebrew uses Google Analytics means that it provides Google with more data, even if you don't hand that data over to other companies after the fact.
    - mikemcquaid 10y ago
      We've tried extremely hard to ensure that Google cannot tie this information to other information. It uses a randomly generated UUID that you can change at any time and we request IPs be anonymised using the documented method (and I see no evidence that Google lies about this). When there's an alternative that is provided to us for free, can handle our load and stores similar or less personal information to Google Analytics we'll consider it. So far there's been a few offers of help but none of them have met those requirements.
tn6o 10y ago
Haters will always hate. Keep up the good work guys! People seem to think they are entitled to something when using open-source software, but they're not. It's still the people working and maintaining it who get to take the decisions, and if you guys think you need analytics to provide a better tool, go for it. I also completely understand the need for default opt-in. I probably wouldn't check the prompt and leave the default, but for a project like this, I honestly don't mind sending usage data. If you're not happy with the direction taken by the maintainers, find another tool.

froh42 10y ago

Mike, I'm just saying that you're putting yourself on risky ground, not that I want to do something personally. In fact I'd even consider keeping GA enabled IF BEING NOTIFIED. The current notification is the problem, as it is close to invisble. Hiding output in a long log message is a dark pattern, I think it did not happen out of spite (you just used your normal shell output mechanism to show that). However: Such a chage of policy is more important than the list of files being removed by git. Even opt out is OK IF THE USER IS INFORMED. Currently it's like arthur dent being informed about the highway being built ... yeah we did display the notice. I know building an open source project is no fun and I can really relate to your desire to know more about installations and deinstallations. Personally I don't even object to using google GA, just to the way it feels being snuck beside the radar.

mikemcquaid 10y ago
You were notified, I'm sorry if it was not as clear as it could have been. We're always open to PRs to improve the visibility. That said, I still don't appreciate threats or ideas to sue me as an individual. That's a massively disproportionate threat to me and my family.
josegonzalez 10y ago
> Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate. This certainly sounds like you're advocating for people to - at the very least - harass him.
deleted 10y ago
[deleted]

OskarS 10y ago

Hear, hear

Chris2048 10y ago

How does the status of the project, or your personal affairs, affect design decisions?

andrewguenther 10y ago
A well funded, well staffed project looks very different than an under staffed, under funded one. They have to make harder decisions about what work to prioritize. I think what Mike is saying just emphasizes why they made this choice. What little work is able to be put into homebrew needs to be as targeted and helpful as possible. Analytics help then do that. So to answer your question, the status of the project and his personal affairs have a huge impact on design decisions.
- Chris2048 10y ago
  > They have to make harder decisions about what work to prioritize Priority isn't a design decision. Analytics help, but the choice to not opt-in is not excused by "but we need them"

danpalmer 10y ago

I realise it's difficult to remember when faced with messages like this, but there are many of us that use Homebrew, accept the tracking, saw the message, and greatly appreciate all of the work you and the team put in. Keep up the good work.

blub 10y ago

It's surprising to hear that a package manager needs local analytics to figure out which packages are used. On the other hand it was likewise surprising to hear that homebrew was using github as its CDN. I don't rely on homebrew to do anything, but I am concerned about the normalisation of surveilance and will point that out in a reasonably polite manner.

justinclift 10y ago
> On the other hand it was likewise surprising to hear that homebrew was using github as its CDN. That sounds a bit weird to me. Homebrew gets developed on GitHub... so using GitHub as a CDN doesn't seem wrong (to me).
- blub 10y ago
  Github offers source control services, it's not a package server. The CDN stunt was impacting other customers and they had to restrict brew's access.
  - justinclift 10y ago
    Interesting, hadn't heard about it. :) Sounds like they weren't using GitHub's Releases approach for binaries, instead doing something else. :/
  - mikemcquaid 10y ago
    As both a GitHub engineer and Homebrew lead maintainer: that's not true. You're perhaps thinking of CocoaPods where there was some problems which have been addressed through repository reorganisation work on CocoaPods side and a new API that I added to GitHub for Homebrew that makes it easier to avoid no-op `git fetch` runs now.

bartread 10y ago

Couldn't agree more: the shoot first and ask questions later treatment of OSS maintainers needs to stop right now. People who make use of OSS projects need to check their sense of entitlement at the door. People don't realise that a lot of these really valuable projects are run on next to zero budget but one, or a very small handful, of core contributors, who give up their own time to do so. If things you don't like happen with a project, start a dialogue, fork it, or use something else instead. Don't just wade in making threats. (Sadly, this has been going on for a very long time: I remember the debacle over .NET 2.0 support in NDoc where the author had some difficult personal circumstances coupled with people constantly hurling abuse at him. Net result: he understandably quit, not just NDoc but all OSS involvement, nobody else wanted to pick up the project, and the project died. This must have been 11 years ago now but it seems like, since then, the problem has if anything become worse.)

marioflach 10y ago

> we need to start asking ourselves as a community whether we think treating open-source maintainers like this is more or less likely to encourage more people to work on the open-source software you rely on to do your job. Exactly this. The homebrew team has done an amazing job for the past 7 years, all free and volunteer work. People threatening with suing the maintainer are poison for the open-source community. But hey, haters gonna hate. If I understand correctly, the data is anonymized before it is sent to Google [1]. How may people worrying about privacy download from Github using a proxy/vpn solution to hide their IP? I've listened to the Changelog podcast about Homebrew and first learned about Google Analytics there. I think people do not realize how big homebrew is (in form of usage and traffic). At this scale, the maintainer opted for collecting data anonymously in order to find bottlenecks and improving the entire software stack. You can disable that feature in the same way you would disable cookies in your web browser. [1]: https://github.com/Homebrew/brew/blob/master/docs/Analytics.md https://github.com/Homebrew/brew/blob/master/docs/Analytics....

fit2rule 10y ago

Treating your users as idiots is one thing. Users treating you as an idiot is another thing. Neither one of these conditions is acceptable. As a long-term homebrew user, I am very appreciative of your hard work (and have even contributed here and there), but in that light I am also very disappointed that I have to manually disable analytics and now have a lot less trust in the homebrew project. In the same way that I would complain if I were to see a bug in your code that radically effects my production, I consider this invasion of privacy - whatever the justification - worthy of complaint, too. Whatever the justification for this, its not an acceptable path to take, and I strongly urge you to consider making Analytics opt-in, and not opt-out. I have no problem with my next 'brew update' pausing, explaining the situation rationally as you have in this post, and giving me a y/n opportunity to proceed with participating in analytics. I do have a serious problem with you assuming that this is okay, not informing me of it in a fashion that makes me aware of the tracking, and just letting it slip in during an update, which I am now even more suspicious of, even though I do them religiously every week, and have done so for years. You've just made your product less attractive to me as a developer and user. That's a sad state of affairs, and I hope you fix this bug.

lentil 10y ago

> I'm now trying to plan vacation time to drive for a 14 hour round trip and pick it up From a happy and grateful Homebrew user, thank you for all the work you are doing. It's really easy for folks to underestimate how much effort is involved in running a project like this. Details like the above should be a reminder that it's clearly a very significant amount of hard, sometimes thankless, work; work which you are in no way obligated to do. There are large numbers of people who owe you a massive debt of gratitude for all the time and hassle that your effort has saved them. And it's quite sad that we (people) tend not to speak up when we are happy, and only make noise when we're upset about something. Thanks for continuing to work on this project!!

obj-g 10y ago

Just wanted to say thanks for all your hard work, it's appreciated by many. Maybe this wasn't the best choice, but missteps happen. Sadly, we'll never know how it might have been dealt with if people were able to take a deep breath and open a real, constructive dialogue about it rather than immediately freak out and make threats against you, forgetting (or simply not caring) that, by and large, people like you have been doing them huge favors while demanding nothing in return. Pathetic.

erikrothoff 10y ago

It's easy to get lost in all the hate, as those groups tend to be more vocal. So I'm writing this here just to what I reasonably can to stand up against all the negativity. I feel so helpless just reading all these comments. Homebrew is excellent software, and the malice expressed in this and similar threads does in no way reflect (my) real world experience of people's perception of Homebrew. I would go so far to say it's probably the best piece of software that I know, it's really easy to use, always works and helpful if something goes wrong. Good software is pretty rare to find, especially open source software with no commercial backing.

codedokode 10y ago

There is some kind of dispute about privacy, with commercial companies wanting to collect as much data as possible and some people opposing to it. Is not your project picking the wrong side here? This can be used as an argument later: "see, even popular open source projects do this". I think that giving up on user's privacy is not an acceptable solution. If you don't have enough time to fix all the bugs and nobody is willing to help then nothing can be done. What I expect from open source software is that an application should not collect and send home any data by default (I understand that it is not written in the license but still expect this). Breaking this expectation makes me and maybe not only me a little disappointed.

mikemcquaid 10y ago
> There is some kind of dispute about privacy, with commercial companies wanting to collect as much data as possible and some people opposing to it. Is not your project picking the wrong side here? As we're not providing information to any commercial company or selling it I don't think this is a reasonable comparison. If we were collecting information to sell and raise funds for the project I'd object to that, too.
- ryukafalz 10y ago
  I'm not sure it would be as contentious if you were running your own analytics software. But some more privacy-aware users (myself included) have serious reservations about Google's increasingly pervasive data collection. The fact that Homebrew uses Google Analytics means that it provides Google with more data, even if you don't hand that data over to other companies after the fact.
  - mikemcquaid 10y ago
    We've tried extremely hard to ensure that Google cannot tie this information to other information. It uses a randomly generated UUID that you can change at any time and we request IPs be anonymised using the documented method (and I see no evidence that Google lies about this). When there's an alternative that is provided to us for free, can handle our load and stores similar or less personal information to Google Analytics we'll consider it. So far there's been a few offers of help but none of them have met those requirements.

tn6o 10y ago

Haters will always hate. Keep up the good work guys! People seem to think they are entitled to something when using open-source software, but they're not. It's still the people working and maintaining it who get to take the decisions, and if you guys think you need analytics to provide a better tool, go for it. I also completely understand the need for default opt-in. I probably wouldn't check the prompt and leave the default, but for a project like this, I honestly don't mind sending usage data. If you're not happy with the direction taken by the maintainers, find another tool.