5 ms·

For anyone wondering: Homebrew sends data to Google Analytics (https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics) on installs, build breaks, and oth

For anyone wondering: Homebrew sends data to Google Analytics (https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics) on installs, build breaks, and other events. It's an opt-out setting. Google Analytics violates the European privacy laws (GDPR). Although Homebrew sends a random Homebrew-only analytics user ID, Google gets access to the user's IP and behavioral data. Although Google claims to anonymize the user's IP address, laws like the GDPR intend to protect our private data even in the face of accidental leaking, hacking, and state-actors who could force Google's hand at storing and disclosing it.

aliqot 4y ago
Go does this too :/
- pdimitar 4y ago
  Do you happen to know if it's possible to deny-list a host/IP in my PiHole setup so Golang tools keep working fine but can't send analytics?
  - akerl_ 4y ago
    You don’t need anything that complex; just set GOPROXY to direct in your environment. More details here: https://proxy.golang.org/ https://proxy.golang.org/
    - pdimitar 4y ago
      It already is set to the official host plus the direct option, but does that mean it sends analytics?
      - sneak 4y ago
        It doesn’t send any analytics. He is talking about proxy logs.
- sneak 4y ago
  No, it does not.
  - akerl_ 4y ago
    Yes, it does: https://proxy.golang.org/ https://proxy.golang.org/
    - sethammons 4y ago
      I don't see anything saying you are correct, just a list of proxy resources. What did I miss?
      - deleted 4y ago
        [deleted]
      - justinclift 4y ago
        Hmmm, is the wording of the 2nd paragraph there unclear? A super short summary is that when you install Go modules, by default it'll grab them via a Google controlled proxy solution. Naturally this means your IP addresses, exact modules your projects use, (etc) are all information available to Google.
        sethammons 4y ago
        Thanks for engaging. I still don't see Google Analytics referenced. Second paragraph reproduced below. > Since Go 1.13, the go command by default downloads and authenticates modules using the Go module mirror and Go checksum database. See proxy.golang.org/privacy for privacy information about these services and the go command documentation for configuration details including how to disable the use of these servers or use different ones. If you depend on non-public modules, see the documentation for configuring your environment. Nothing about GA. Of course, or naturally as you wrote, they will have server logs. I can't imagine anyone in good faith arguing they should not have server logs and those that do can host their own proxy.
cinntaile 4y ago
GA doesn't violate GDPR. It's used on pretty much any site in the EU, this wouldn't be the case if it did.
- elondaits 4y ago
  Unfortunately a lot of sites are mis-adviced about the GDPR. In fact, a good percentage (most?) of the cookie pop-ups are illegal under the GDPR. European Data Protection Authorities (DPAs)in Austria, France, and Italy have ruled that Google Analytics violates the law: https://www.natlawreview.com/article/google-analytics-runs-afoul-gdpr https://www.natlawreview.com/article/google-analytics-runs-a... France’s data watchdog warns over illegal use of Google Analytics: https://techcrunch.com/2022/06/08/google-analytics-gdpr-breach-cnil/ https://techcrunch.com/2022/06/08/google-analytics-gdpr-brea... Italy Bans Google Analytics Over Improper EU-US Data Transfers: https://www.cpomagazine.com/data-protection/italy-bans-google-analytics-over-improper-eu-us-data-transfers/ https://www.cpomagazine.com/data-protection/italy-bans-googl... Austrian website’s use of Google Analytics found to breach GDPR: https://techcrunch.com/2022/01/12/austrian-dpa-schrems-ii/ https://techcrunch.com/2022/01/12/austrian-dpa-schrems-ii/ ... all this from a quick Google search.
  - cinntaile 4y ago
    Those decisions are all from 2022. GDPR has existed since 2016 and GA wasn't an issue then so a recent ruling must have happened that changed this. But sure enough, it means I am wrong.
    - elondaits 4y ago
      The GDPR came in effect in 2018 (May 25). When it did, most companies scrambled to comply. Back then I researched the analytics situation and can say from what I remember (and my POV): - It was super clear it was a touchy subject, because you're basically disclosing private information (IP, tech capabilities, some browsing history, etc.) to a third party who may or may not comply with GDPR's basic requirements about data protection, right to be forgotten, etc. - It was super clear there were some minimum requirements, like anonymizing IPs, limiting storage of data, storing the data in Europe, or making sure URLs didn't disclose personal information. - Google didn't say much about compliance of GA. Their text was more about shifting the responsibility to web admins. Possibly because there were some doubts, like the validity of the Privacy Shield, which eventually was deemed invalid. - Other analytics tools, like Matomo, offered configuration settings for anonymizing visitors and limiting storage. - It was often suggested you could solve the issues by having users opt-in to analytics. e.g. "This tool by itself is not in violation, you are in violation if you didn't ask for consent before using it". The "guns don't kill people" argument. However, anyone would agree that if you can only track consenting people your analytics get super skewed, maybe to the point of being useless. One of the main issues back then was that the GDPR doesn't talk about cookies at all, because a separate legislation (updating the existing ones) was going to cover that afterwards. This created a lot of doubts of whether an analytics solution based on cookies (without opt-in) could even be compliant at all. Current understanding is that certain cookies (e.g. login cookies) are and will be OK, while others (cross-site tracking) are absolutely not. I think the reason decisions started coming as late as 2022 is because implementation was super late, and people are still learning about these things. There are still a lot of touchy subjects, like how to deal with YouTube embeds, Google Maps, etc.
JohnFen 4y ago
That's not great, but so long as it's clearly disclosed, it's hard to object too much. Being able to disable it is even better. Too bad it's opt-out and not opt-in.

aliqot 4y ago

Go does this too :/

pdimitar 4y ago
Do you happen to know if it's possible to deny-list a host/IP in my PiHole setup so Golang tools keep working fine but can't send analytics?
- akerl_ 4y ago
  You don’t need anything that complex; just set GOPROXY to direct in your environment. More details here: https://proxy.golang.org/ https://proxy.golang.org/
  - pdimitar 4y ago
    It already is set to the official host plus the direct option, but does that mean it sends analytics?
    - sneak 4y ago
      It doesn’t send any analytics. He is talking about proxy logs.
sneak 4y ago
No, it does not.
- akerl_ 4y ago
  Yes, it does: https://proxy.golang.org/ https://proxy.golang.org/
  - sethammons 4y ago
    I don't see anything saying you are correct, just a list of proxy resources. What did I miss?
    - deleted 4y ago
      [deleted]
    - justinclift 4y ago
      Hmmm, is the wording of the 2nd paragraph there unclear? A super short summary is that when you install Go modules, by default it'll grab them via a Google controlled proxy solution. Naturally this means your IP addresses, exact modules your projects use, (etc) are all information available to Google.
      - sethammons 4y ago
        Thanks for engaging. I still don't see Google Analytics referenced. Second paragraph reproduced below. > Since Go 1.13, the go command by default downloads and authenticates modules using the Go module mirror and Go checksum database. See proxy.golang.org/privacy for privacy information about these services and the go command documentation for configuration details including how to disable the use of these servers or use different ones. If you depend on non-public modules, see the documentation for configuring your environment. Nothing about GA. Of course, or naturally as you wrote, they will have server logs. I can't imagine anyone in good faith arguing they should not have server logs and those that do can host their own proxy.

cinntaile 4y ago

GA doesn't violate GDPR. It's used on pretty much any site in the EU, this wouldn't be the case if it did.

elondaits 4y ago
Unfortunately a lot of sites are mis-adviced about the GDPR. In fact, a good percentage (most?) of the cookie pop-ups are illegal under the GDPR. European Data Protection Authorities (DPAs)in Austria, France, and Italy have ruled that Google Analytics violates the law: https://www.natlawreview.com/article/google-analytics-runs-afoul-gdpr https://www.natlawreview.com/article/google-analytics-runs-a... France’s data watchdog warns over illegal use of Google Analytics: https://techcrunch.com/2022/06/08/google-analytics-gdpr-breach-cnil/ https://techcrunch.com/2022/06/08/google-analytics-gdpr-brea... Italy Bans Google Analytics Over Improper EU-US Data Transfers: https://www.cpomagazine.com/data-protection/italy-bans-google-analytics-over-improper-eu-us-data-transfers/ https://www.cpomagazine.com/data-protection/italy-bans-googl... Austrian website’s use of Google Analytics found to breach GDPR: https://techcrunch.com/2022/01/12/austrian-dpa-schrems-ii/ https://techcrunch.com/2022/01/12/austrian-dpa-schrems-ii/ ... all this from a quick Google search.
- cinntaile 4y ago
  Those decisions are all from 2022. GDPR has existed since 2016 and GA wasn't an issue then so a recent ruling must have happened that changed this. But sure enough, it means I am wrong.
  - elondaits 4y ago
    The GDPR came in effect in 2018 (May 25). When it did, most companies scrambled to comply. Back then I researched the analytics situation and can say from what I remember (and my POV): - It was super clear it was a touchy subject, because you're basically disclosing private information (IP, tech capabilities, some browsing history, etc.) to a third party who may or may not comply with GDPR's basic requirements about data protection, right to be forgotten, etc. - It was super clear there were some minimum requirements, like anonymizing IPs, limiting storage of data, storing the data in Europe, or making sure URLs didn't disclose personal information. - Google didn't say much about compliance of GA. Their text was more about shifting the responsibility to web admins. Possibly because there were some doubts, like the validity of the Privacy Shield, which eventually was deemed invalid. - Other analytics tools, like Matomo, offered configuration settings for anonymizing visitors and limiting storage. - It was often suggested you could solve the issues by having users opt-in to analytics. e.g. "This tool by itself is not in violation, you are in violation if you didn't ask for consent before using it". The "guns don't kill people" argument. However, anyone would agree that if you can only track consenting people your analytics get super skewed, maybe to the point of being useless. One of the main issues back then was that the GDPR doesn't talk about cookies at all, because a separate legislation (updating the existing ones) was going to cover that afterwards. This created a lot of doubts of whether an analytics solution based on cookies (without opt-in) could even be compliant at all. Current understanding is that certain cookies (e.g. login cookies) are and will be OK, while others (cross-site tracking) are absolutely not. I think the reason decisions started coming as late as 2022 is because implementation was super late, and people are still learning about these things. There are still a lot of touchy subjects, like how to deal with YouTube embeds, Google Maps, etc.

JohnFen 4y ago

That's not great, but so long as it's clearly disclosed, it's hard to object too much. Being able to disable it is even better. Too bad it's opt-out and not opt-in.