4 ms·

> not brew, that one is also spyware how is brew spyware?

by thwave 5y ago

sneak 5y ago
It transmits your on-device activity to Google without consent. It includes a unique tracking identifier generated on install that never changes, like a supercookie. Every time you run brew, it transmits this to Google, which allows Google to assemble a city-level tracklog of your device based on client IP geolocation, along with a list of all the packages you have installed, and when. It does this silently, and without obtaining any sort of consent, which is why most people are unaware that homebrew is spying on them.
- sofixa 5y ago
  Why to Google?
  - sneak 5y ago
    You'd have to ask the homebrew developers that. Every time I've ever seen anyone question their decision to embed Google spyware in their product, however, the GitHub issues are closed and locked, so I don't know if you'll have very good luck. I stopped trying to convince them to behave ethically and simply use nixpkgs now instead (which incidentally in my experience works better) and do my best to inform people about the facts so they can make their own decisions (something I wish homebrew would do, instead of deciding for them to use their computer to spy).
    - deleted 5y ago
      [deleted]
  - ratww 5y ago
    It uses Google Analytics.
    - sofixa 5y ago
      So the GP is wildly overblown? How is Google Analytics spyware?
      - ratww 5y ago
        What is spyware to you? If it's spying on me without consent and sending private information about my computer it is definitely spyware, regardless of the database they use. Since they don't ask for consent and uses PII, it is illegal under GDPR, probably CCPA and other laws too. It's also Not Nice™.
        sofixa 5y ago
        What private information about your computer is it sending? Browser, OS, screen size, location, ISP. Under GDPR, and the way i see things, none of that is PII.
        sneak 5y ago
        It generates a unique identifier which it transmits on each invocation. The identifier uniquely identifies the installation of homebrew, linking all of those other bits of data together across time and space.
- yunohn 5y ago
  I’m not sure where you get your facts? > You will be notified the first time you run brew update or install Homebrew. Analytics are not enabled until after this notice is shown, to ensure that you can opt out without ever sending analytics data. - https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
  - sneak 5y ago
    Yes, it says this once at install time, and does not obtain any form of consent to spying. Then, at runtime, it proceeds to silently transmit the data each time you run brew.
    - wildrhythms 5y ago
      I'm confused- the brew developers say you can run `brew analytics off` to "prevent analytics from ever being sent" [1]. Is this not accurate? Are analytics still being sent? Is your concern with the consent, or are the brew developers lying when they say this command prevents analytics from being sent? 1: https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
      - yladiz 5y ago
        I think what he means is that there isn't explicit consent given for the analytics, as in opt-in rather than opt-out. You can disable it but that's not the same.
    - deleted 5y ago
      [deleted]
    - wl 5y ago
      When they implemented it, they opted everyone in and buried the notice in a wall of text. I only caught it when Little Snitch notified me that brew was reaching out to Google. The project still doesn't seem to understand how bad of a mistake this was and how bad their response to it was. But as the project lead told us while playing the victim, if we're not contributors, our opinions on the matter mean nothing.

> not brew, that one is also spyware how is brew spyware?

by thwave 5y ago

> not brew, that one is also spyware how is brew spyware?

It transmits your on-device activity to Google without consent. It includes a unique tracking identifier generated on install that never changes, like a supercookie. Every time you run brew, it transmits this to Google, which allows Google to assemble a city-level tracklog of your device based on client IP geolocation, along with a list of all the packages you have installed, and when. It does this silently, and without obtaining any sort of consent, which is why most people are unaware that homebrew is spying on them.

sofixa 5y ago
Why to Google?
- sneak 5y ago
  You'd have to ask the homebrew developers that. Every time I've ever seen anyone question their decision to embed Google spyware in their product, however, the GitHub issues are closed and locked, so I don't know if you'll have very good luck. I stopped trying to convince them to behave ethically and simply use nixpkgs now instead (which incidentally in my experience works better) and do my best to inform people about the facts so they can make their own decisions (something I wish homebrew would do, instead of deciding for them to use their computer to spy).
  - deleted 5y ago
    [deleted]
- ratww 5y ago
  It uses Google Analytics.
  - sofixa 5y ago
    So the GP is wildly overblown? How is Google Analytics spyware?
    - ratww 5y ago
      What is spyware to you? If it's spying on me without consent and sending private information about my computer it is definitely spyware, regardless of the database they use. Since they don't ask for consent and uses PII, it is illegal under GDPR, probably CCPA and other laws too. It's also Not Nice™.
      - sofixa 5y ago
        What private information about your computer is it sending? Browser, OS, screen size, location, ISP. Under GDPR, and the way i see things, none of that is PII.
        sneak 5y ago
        It generates a unique identifier which it transmits on each invocation. The identifier uniquely identifies the installation of homebrew, linking all of those other bits of data together across time and space.
yunohn 5y ago
I’m not sure where you get your facts? > You will be notified the first time you run brew update or install Homebrew. Analytics are not enabled until after this notice is shown, to ensure that you can opt out without ever sending analytics data. - https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
- sneak 5y ago
  Yes, it says this once at install time, and does not obtain any form of consent to spying. Then, at runtime, it proceeds to silently transmit the data each time you run brew.
  - wildrhythms 5y ago
    I'm confused- the brew developers say you can run `brew analytics off` to "prevent analytics from ever being sent" [1]. Is this not accurate? Are analytics still being sent? Is your concern with the consent, or are the brew developers lying when they say this command prevents analytics from being sent? 1: https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
    - yladiz 5y ago
      I think what he means is that there isn't explicit consent given for the analytics, as in opt-in rather than opt-out. You can disable it but that's not the same.
  - deleted 5y ago
    [deleted]
  - wl 5y ago
    When they implemented it, they opted everyone in and buried the notice in a wall of text. I only caught it when Little Snitch notified me that brew was reaching out to Google. The project still doesn't seem to understand how bad of a mistake this was and how bad their response to it was. But as the project lead told us while playing the victim, if we're not contributors, our opinions on the matter mean nothing.