4 ms·

TLDR: they turned on Google Analytics.

by Gaelan 8y ago

sneak 8y ago
...without consent or opt-in.
- coldtea 8y ago
  Because most other websites/services ask for consent for their analytics?
  - saagarjha 8y ago
    "Because everyone else does it" isn't a very good excuse.
  - sneak 8y ago
    Important consideration: homebrew is neither a website nor a service. It is a local software, a package manager, and quietly enabling phone-home analytics in an update after previously not doing such has a different threshold for “informed consent”.
    - Hackbraten 8y ago
      How exactly is Homebrew not a service? We donate hours of work each week in an honest effort to make the best package manager we can for our users. Analytics help us decide how to prioritize our work. It’s also literally the opposite of quietly enabled [1] [2]. [1] https://github.com/Homebrew/brew/blob/e32c1515432a938093d5ef1d8c4b4408991873df/Library/Homebrew/cmd/update-report.rb#L53-L62 https://github.com/Homebrew/brew/blob/e32c1515432a938093d5ef... [2] https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
      - wl 8y ago
        > How exactly is Homebrew not a service? Is youtube-dl a service because it needs to be constantly updated, at great effort, to deal with new countermeasures and the like? Still looks like software to me. If you were running the software for me (e.g. Gmail), then maybe Homebrew would qualify as a service. > It’s also literally the opposite of quietly enabled I discovered it when my firewall showed me an outbound connection to Google analytics. Homebrew spews so much stuff to the console, it's not something a regular user would read unless they looked for it. That was hardly sufficient disclosure. You guys could have prompted for consent. You didn't. You still refuse to. And you won't entertain any suggestions that you do so unless it comes from a contributor. As I said in my original comment, your collective lack of judgement and refusal to consider the opinions of users is why I don't find you guys to be trustworthy anymore. I encourage everyone to find alternatives.
        Hackbraten 8y ago
        > If you were running the software for me I’m not sure on whose systems you believe packages are built and tested, and from whose systems you feel Homebrew downloads bottles. > it's not something a regular user would read unless they looked for it. That was hardly sufficient disclosure. That notice was colored, it was typeset in bold, it was surrounded by newlines, and it sounded an audible bell. Blaming Homebrew for the fact that you missed that message says more about you than about Homebrew.
        deleted 8y ago
        [deleted]
        wl 8y ago
        > I’m not sure on whose systems you believe packages are built and tested, and from whose systems you feel Homebrew downloads bottles. Is Ubuntu a service because Canonical builds and tests packages and hosts package repositories? I don't think many people would make that claim. > That notice was colored, it was typeset in bold, it was surrounded by newlines, and it sounded an audible bell. That's not the notice I got. "Anonymous aggregate user behaviour analytics documentation: https://git.io/brew-analytics" https://git.io/brew-analytics". No bold. No bell. The notice you linked to was added in reaction to the outcry. The bold and bell were added at a later date. The Homebrew maintainers continue to refuse to do the only ethical thing and PROMPT THE USER instead of making assumptions one way or another.
pmarreck 8y ago
So pretty much like every other website on the Internet. Got it.
- wl 8y ago
  I don't expect my package manager to require uBlock Origin. I actually caught it with my firewall, which was an unpleasant surprise.
  - Corrado 8y ago
    Doesn't apt track installs?
    - wl 8y ago
      Popcon in Debian and Ubuntu is opt-in. They ask you at install time whether or not you'd like to participate.
  - pmarreck 8y ago
    What is the best argument for anonymized tracking being malicious? I don't understand the alarm over this, and I'm a guy who has passed around Martin Fowler's great essay on privacy https://www.martinfowler.com/articles/bothersome-privacy.html https://www.martinfowler.com/articles/bothersome-privacy.htm...
    - wl 8y ago
      I don't know what Google does with those packets. Also, I've seen far too many examples of deanonymization to trust claims that data is properly anonomyzed. When it comes down to it, principle of least privilege applies here. Homebrew doesn't need to phone home to Google to install packages, so it shouldn't.

TLDR: they turned on Google Analytics.

by Gaelan 8y ago

TLDR: they turned on Google Analytics.

sneak 8y ago

...without consent or opt-in.

coldtea 8y ago
Because most other websites/services ask for consent for their analytics?
- saagarjha 8y ago
  "Because everyone else does it" isn't a very good excuse.
- sneak 8y ago
  Important consideration: homebrew is neither a website nor a service. It is a local software, a package manager, and quietly enabling phone-home analytics in an update after previously not doing such has a different threshold for “informed consent”.
  - Hackbraten 8y ago
    How exactly is Homebrew not a service? We donate hours of work each week in an honest effort to make the best package manager we can for our users. Analytics help us decide how to prioritize our work. It’s also literally the opposite of quietly enabled [1] [2]. [1] https://github.com/Homebrew/brew/blob/e32c1515432a938093d5ef1d8c4b4408991873df/Library/Homebrew/cmd/update-report.rb#L53-L62 https://github.com/Homebrew/brew/blob/e32c1515432a938093d5ef... [2] https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
    - wl 8y ago
      > How exactly is Homebrew not a service? Is youtube-dl a service because it needs to be constantly updated, at great effort, to deal with new countermeasures and the like? Still looks like software to me. If you were running the software for me (e.g. Gmail), then maybe Homebrew would qualify as a service. > It’s also literally the opposite of quietly enabled I discovered it when my firewall showed me an outbound connection to Google analytics. Homebrew spews so much stuff to the console, it's not something a regular user would read unless they looked for it. That was hardly sufficient disclosure. You guys could have prompted for consent. You didn't. You still refuse to. And you won't entertain any suggestions that you do so unless it comes from a contributor. As I said in my original comment, your collective lack of judgement and refusal to consider the opinions of users is why I don't find you guys to be trustworthy anymore. I encourage everyone to find alternatives.
      - Hackbraten 8y ago
        > If you were running the software for me I’m not sure on whose systems you believe packages are built and tested, and from whose systems you feel Homebrew downloads bottles. > it's not something a regular user would read unless they looked for it. That was hardly sufficient disclosure. That notice was colored, it was typeset in bold, it was surrounded by newlines, and it sounded an audible bell. Blaming Homebrew for the fact that you missed that message says more about you than about Homebrew.
        deleted 8y ago
        [deleted]
        wl 8y ago
        > I’m not sure on whose systems you believe packages are built and tested, and from whose systems you feel Homebrew downloads bottles. Is Ubuntu a service because Canonical builds and tests packages and hosts package repositories? I don't think many people would make that claim. > That notice was colored, it was typeset in bold, it was surrounded by newlines, and it sounded an audible bell. That's not the notice I got. "Anonymous aggregate user behaviour analytics documentation: https://git.io/brew-analytics" https://git.io/brew-analytics". No bold. No bell. The notice you linked to was added in reaction to the outcry. The bold and bell were added at a later date. The Homebrew maintainers continue to refuse to do the only ethical thing and PROMPT THE USER instead of making assumptions one way or another.

pmarreck 8y ago

So pretty much like every other website on the Internet. Got it.

wl 8y ago
I don't expect my package manager to require uBlock Origin. I actually caught it with my firewall, which was an unpleasant surprise.
- Corrado 8y ago
  Doesn't apt track installs?
  - wl 8y ago
    Popcon in Debian and Ubuntu is opt-in. They ask you at install time whether or not you'd like to participate.
- pmarreck 8y ago
  What is the best argument for anonymized tracking being malicious? I don't understand the alarm over this, and I'm a guy who has passed around Martin Fowler's great essay on privacy https://www.martinfowler.com/articles/bothersome-privacy.html https://www.martinfowler.com/articles/bothersome-privacy.htm...
  - wl 8y ago
    I don't know what Google does with those packets. Also, I've seen far too many examples of deanonymization to trust claims that data is properly anonomyzed. When it comes down to it, principle of least privilege applies here. Homebrew doesn't need to phone home to Google to install packages, so it shouldn't.