5 ms·

Homebrew has really wonderful maintainers. I'm mystified why anyone would get into conflict with them, but I can imagine the kind of entitled personalities who

by trpro 4y ago

Homebrew has really wonderful maintainers. I'm mystified why anyone would get into conflict with them, but I can imagine the kind of entitled personalities who would do that. The article gives a hint: "Ironically, this is often worse coming from employed developers’ large tech companies with fantastic profit margins." This is exactly the main OSS problem right now. Entitled $BigCorp employees who churn around 1000 LOC (in OSS) per year for $250,000, engage in activism and high profile issues that will be talked about on Twitter and take credit for actually valuable contributions from idealistic individuals.

sneak 4y ago
I am in conflict with them because they have similar toxic entitlement: in their case, to private user data that does not belong to them. Homebrew embeds nonconsensual Google spyware that phones home with a unique identifier supercookie every time you use it. This correlates client IPs (geolocation) and allows Google to know your travel history. Rather than asking for consent, it is on by default. They close issues about it without discussion, despite opt-out surveillance like this being deeply unethical (which is why Debian et al do not do it).
- Etheryte 4y ago
  I think you need to check yourself here. Homebrew is giving something to the world for free, that they do it on their terms is not entitlement, it's their right. If you don't like it you can go elsewhere. You thinking that you should have some input on what terms they give their work away for free is what's nose up entitlement here.
  - sneak 4y ago
    - ehutch79 4y ago
      How exactly is it spyware? When you say that, i'm expecting to hear about keystroke loggers, or hoovering up session cookies or something.
      - capableweb 4y ago
        > Spyware is software with malicious behavior that aims to gather information about a person or organization and send it to another entity in a way that harms the user—for example, by violating their privacy or endangering their device's security Definitions vary, of course. But generally I think GA could be seen as spyware unless you tweak it by removing information.
        akerl_ 4y ago
        > malicious behavior What’s the malicious behavior here? They’re tracking how much usage each homebrew formula has.
        capableweb 4y ago
        The malicious behavior is gathering information about a person or organization. Opt-out makes this not great for user privacy, while opt-in would.
  - elondaits 4y ago
    For anyone wondering: Homebrew sends data to Google Analytics (https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics) on installs, build breaks, and other events. It's an opt-out setting. Google Analytics violates the European privacy laws (GDPR). Although Homebrew sends a random Homebrew-only analytics user ID, Google gets access to the user's IP and behavioral data. Although Google claims to anonymize the user's IP address, laws like the GDPR intend to protect our private data even in the face of accidental leaking, hacking, and state-actors who could force Google's hand at storing and disclosing it.
    - aliqot 4y ago
      Go does this too :/
      - pdimitar 4y ago
        Do you happen to know if it's possible to deny-list a host/IP in my PiHole setup so Golang tools keep working fine but can't send analytics?
        akerl_ 4y ago
        You don’t need anything that complex; just set GOPROXY to direct in your environment. More details here: https://proxy.golang.org/ https://proxy.golang.org/
        pdimitar 4y ago
        It already is set to the official host plus the direct option, but does that mean it sends analytics?
        sneak 4y ago
        It doesn’t send any analytics. He is talking about proxy logs.
      - sneak 4y ago
  - jeltz 4y ago
    Just because you are giving away something for free does not entitle you to break the law in Europe. I am more forgiving to people who give away something for free but it is not a carte blanche, morally or legally, to act like an asshole and break the law. Spyware vendors also give away their work for free and your Facebook account is also free. Does that mean these entities can do whatever they like?
    - hk__2 4y ago
      > Spyware vendors also give away their work for free and your Facebook account is also free. Does that mean these entities can do whatever they like? Yes. (as long as they respect the law, like anybody)
  - deleted 4y ago
    [deleted]
- wilde 4y ago
  Then don’t use it?
  - jeltz 4y ago
    I did not know about this issue until now. But, sure, if you let me borrow your time machine.
    - akerl_ 4y ago
      The first time you run homebrew, it tells you it’s going to record usage analytics, with details on how to find out more or disable that behavior.
      - JohnFen 4y ago
        But does it tell you it's using GA?
        akerl_ 4y ago
        It tells you it’s recording usage data, and links you to the docs that show where it goes, how to view the data yourself, how to opt out, and why the collect the data: https://github.com/Homebrew/brew/blob/68e895ad4d374b4a0022613a20bd046d6487dfd9/Library/Homebrew/cmd/update-report.rb#L95 https://github.com/Homebrew/brew/blob/68e895ad4d374b4a002261... https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
- mikemcquaid 4y ago
  Personally, I find it toxic that you insist on posting this on literally every thread I see about Homebrew. Ironically, you demonstrate my point from the article. You feel entitled to Homebrew having different analytics behaviour and in demanding the time and effort from myself or other maintainers to make it behave how you want it to.
  - sneak 4y ago
    - yakubin 4y ago
      What do you use in place of Homebrew?
      - sneak 4y ago
        Nixpkgs.
  - ctrlmeta 4y ago
    I don't see the parent comment as necessarily an entitlement. They are not demanding anything in particular from Homebrew project maintainers. They are informing us -- the readers -- about the analytics behavior in Homebrew so that we can make an informed decision about whether we should continue to use Homebrew or choose an alternative like macports or nix. It read more like a public service announcement to me.
    - mikemcquaid 4y ago
      Homebrew informs you about our analytics behaviour before we send any data with a link to the documentation (https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics) which in turn links to the code on new installations and on existing ones if you haven't updated since we enabled analytics.
  - watwut 4y ago
    Personally, I find it useful when people let me know about spyware features of software - whether in open source or not.
- zach_garwood 4y ago
j1elo 4y ago
But then don't try to keep those Entitled $BigCorps out of the way, because the definition of OSS was clearly and strictly written to keep them in, otherwise you're straying out of the golden path and your software is not technically "OSS" any more... it's a complex world.
- capableweb 4y ago
  > because the definition of OSS was clearly and strictly written to keep them in, What? No definition of OSS I know of forces you to engage with anyone at all, unless you want to. You can slap MIT on random code you write, host it on a HTML page with no further information available or interaction allowed, and that's perfectly fine OSS.
  - tpxl 4y ago
    Parent is referring to people saying licenses like SSPL are not Open Source (and they are not by some definitions).
    - ZeroGravitas 4y ago
      I think they are referring to "open source" being a corporate friendly rebranding of "Free Software". At the time it was drama about GPL which proprietary software forms didn't like but in the modern server world that isn't as relevant.
    - ensignavenger 4y ago
      The SSPL is being promoted and used by big tech companies that are selling software to other big tech companies. If it was about keeping big tech out, I think it is failing. And it isn't open source, it promotes vendor lock in and discourages successful forking. It is the antithesis of FOSS.
  - j1elo 4y ago
    The definition of OSS doesn't force you to bring someone into your house, but it does very clearly forbid you from keeping them outside.
KronisLV 4y ago
> Entitled $BigCorp employees who churn around 1000 LOC (in OSS) per year for $250,000, engage in activism and high profile issues that will be talked about on Twitter and take credit for actually valuable contributions from idealistic individuals. Surely one can conceivably picture a way for letting said wealthy individuals express: "I care about this issue enough to support someone's effort that might go into fixing it." Whether that happens with a beer after the issue has been fixed, or an escrow payment of X USD with a non-refundable downpayment of Y% feels like an implementation detail.
- deleted 4y ago
  [deleted]

by trpro 4y ago

sneak 4y ago

I am in conflict with them because they have similar toxic entitlement: in their case, to private user data that does not belong to them. Homebrew embeds nonconsensual Google spyware that phones home with a unique identifier supercookie every time you use it. This correlates client IPs (geolocation) and allows Google to know your travel history. Rather than asking for consent, it is on by default. They close issues about it without discussion, despite opt-out surveillance like this being deeply unethical (which is why Debian et al do not do it).

Etheryte 4y ago
I think you need to check yourself here. Homebrew is giving something to the world for free, that they do it on their terms is not entitlement, it's their right. If you don't like it you can go elsewhere. You thinking that you should have some input on what terms they give their work away for free is what's nose up entitlement here.
- sneak 4y ago
  - ehutch79 4y ago
    How exactly is it spyware? When you say that, i'm expecting to hear about keystroke loggers, or hoovering up session cookies or something.
    - capableweb 4y ago
      > Spyware is software with malicious behavior that aims to gather information about a person or organization and send it to another entity in a way that harms the user—for example, by violating their privacy or endangering their device's security Definitions vary, of course. But generally I think GA could be seen as spyware unless you tweak it by removing information.
      - akerl_ 4y ago
        > malicious behavior What’s the malicious behavior here? They’re tracking how much usage each homebrew formula has.
        capableweb 4y ago
        The malicious behavior is gathering information about a person or organization. Opt-out makes this not great for user privacy, while opt-in would.
- elondaits 4y ago
  For anyone wondering: Homebrew sends data to Google Analytics (https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics) on installs, build breaks, and other events. It's an opt-out setting. Google Analytics violates the European privacy laws (GDPR). Although Homebrew sends a random Homebrew-only analytics user ID, Google gets access to the user's IP and behavioral data. Although Google claims to anonymize the user's IP address, laws like the GDPR intend to protect our private data even in the face of accidental leaking, hacking, and state-actors who could force Google's hand at storing and disclosing it.
  - aliqot 4y ago
    Go does this too :/
    - pdimitar 4y ago
      Do you happen to know if it's possible to deny-list a host/IP in my PiHole setup so Golang tools keep working fine but can't send analytics?
      - akerl_ 4y ago
        You don’t need anything that complex; just set GOPROXY to direct in your environment. More details here: https://proxy.golang.org/ https://proxy.golang.org/
        pdimitar 4y ago
        It already is set to the official host plus the direct option, but does that mean it sends analytics?
        sneak 4y ago
        It doesn’t send any analytics. He is talking about proxy logs.
    - sneak 4y ago
- jeltz 4y ago
  Just because you are giving away something for free does not entitle you to break the law in Europe. I am more forgiving to people who give away something for free but it is not a carte blanche, morally or legally, to act like an asshole and break the law. Spyware vendors also give away their work for free and your Facebook account is also free. Does that mean these entities can do whatever they like?
  - hk__2 4y ago
    > Spyware vendors also give away their work for free and your Facebook account is also free. Does that mean these entities can do whatever they like? Yes. (as long as they respect the law, like anybody)
- deleted 4y ago
  [deleted]
wilde 4y ago
Then don’t use it?
- jeltz 4y ago
  I did not know about this issue until now. But, sure, if you let me borrow your time machine.
  - akerl_ 4y ago
    The first time you run homebrew, it tells you it’s going to record usage analytics, with details on how to find out more or disable that behavior.
    - JohnFen 4y ago
      But does it tell you it's using GA?
      - akerl_ 4y ago
        It tells you it’s recording usage data, and links you to the docs that show where it goes, how to view the data yourself, how to opt out, and why the collect the data: https://github.com/Homebrew/brew/blob/68e895ad4d374b4a0022613a20bd046d6487dfd9/Library/Homebrew/cmd/update-report.rb#L95 https://github.com/Homebrew/brew/blob/68e895ad4d374b4a002261... https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
mikemcquaid 4y ago
Personally, I find it toxic that you insist on posting this on literally every thread I see about Homebrew. Ironically, you demonstrate my point from the article. You feel entitled to Homebrew having different analytics behaviour and in demanding the time and effort from myself or other maintainers to make it behave how you want it to.
- sneak 4y ago
  - yakubin 4y ago
    What do you use in place of Homebrew?
    - sneak 4y ago
      Nixpkgs.
- ctrlmeta 4y ago
  I don't see the parent comment as necessarily an entitlement. They are not demanding anything in particular from Homebrew project maintainers. They are informing us -- the readers -- about the analytics behavior in Homebrew so that we can make an informed decision about whether we should continue to use Homebrew or choose an alternative like macports or nix. It read more like a public service announcement to me.
  - mikemcquaid 4y ago
    Homebrew informs you about our analytics behaviour before we send any data with a link to the documentation (https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics) which in turn links to the code on new installations and on existing ones if you haven't updated since we enabled analytics.
- watwut 4y ago
  Personally, I find it useful when people let me know about spyware features of software - whether in open source or not.
zach_garwood 4y ago

j1elo 4y ago

But then don't try to keep those Entitled $BigCorps out of the way, because the definition of OSS was clearly and strictly written to keep them in, otherwise you're straying out of the golden path and your software is not technically "OSS" any more... it's a complex world.

capableweb 4y ago
> because the definition of OSS was clearly and strictly written to keep them in, What? No definition of OSS I know of forces you to engage with anyone at all, unless you want to. You can slap MIT on random code you write, host it on a HTML page with no further information available or interaction allowed, and that's perfectly fine OSS.
- tpxl 4y ago
  Parent is referring to people saying licenses like SSPL are not Open Source (and they are not by some definitions).
  - ZeroGravitas 4y ago
    I think they are referring to "open source" being a corporate friendly rebranding of "Free Software". At the time it was drama about GPL which proprietary software forms didn't like but in the modern server world that isn't as relevant.
  - ensignavenger 4y ago
    The SSPL is being promoted and used by big tech companies that are selling software to other big tech companies. If it was about keeping big tech out, I think it is failing. And it isn't open source, it promotes vendor lock in and discourages successful forking. It is the antithesis of FOSS.
- j1elo 4y ago
  The definition of OSS doesn't force you to bring someone into your house, but it does very clearly forbid you from keeping them outside.

KronisLV 4y ago

> Entitled $BigCorp employees who churn around 1000 LOC (in OSS) per year for $250,000, engage in activism and high profile issues that will be talked about on Twitter and take credit for actually valuable contributions from idealistic individuals. Surely one can conceivably picture a way for letting said wealthy individuals express: "I care about this issue enough to support someone's effort that might go into fixing it." Whether that happens with a beer after the issue has been fixed, or an escrow payment of X USD with a non-refundable downpayment of Y% feels like an implementation detail.

deleted 4y ago
[deleted]