4 ms·

This reminds of the internet explorer toolbars which counted installs, collected other stats and phoned that home. Those companies put wrappers around installs.

by mmgutz 7y ago

This reminds of the internet explorer toolbars which counted installs, collected other stats and phoned that home. Those companies put wrappers around installs. Scarf also installs a wrapper around your package. Imagine if every npm package did this in a single project. You'd have 100s of sub-sub dependencies phoning home. > [captured data] Sub-commands and flags that are passed on the command line So it's parsing the command line which can have environment variables with passwords. eg `foo run -e CONTAINER_PASSWORD=""`

aviaviavi 7y ago
> You'd have 100s of sub-sub dependencies phoning home. This isn't implemented yet but Scarf will batch up the telemetry metrics calls so it won't actually be sending 100's of requests in that case. > So it's parsing the command line which can have environment variables with passwords. eg `foo run -e CONTAINER_PASSWORD=""` Yes, but the actual arguments to those flags are not sent to Scarf, so in this example it would only send "run", "-e", and "CONTAINER_PASSWORD". It's straightforward to also detect things like url's, file paths, certificates, and other sensitive data, so that's not sent either. All of the CLI code is open source (https://github.com/aviaviavi/scarf https://github.com/aviaviavi/scarf) so there is full transparency to what data is captured and sent.