4 ms·

> When our package managers weren't linked to data aggregators watching our every move? I haven't heard of this before (other than TFA's bare question-raising)

• spicybright 4y ago
  Same here. Doesn't even sound like a problem, it's not like you have to make an identifying account to access it. I'd imagine having the data lets you detect/fix issues faster and flag malicious packages much easier.
• chomp 4y ago
  Golang out of the box aggregates and analyzes usage metrics of modules whenever they are downloaded.
  • mseepgood 4y ago
    Which package management system doesn't do this?
    • crtc 4y ago
      True, I quickly checked https://rubygems.org/ https://rubygems.org/ https://www.nuget.org/packages https://www.nuget.org/packages https://crates.io/ https://crates.io/ ... they all show download statistics of their packages.
      • HideousKojima 4y ago
        Which also serves a useful purpose for devs, it's an easy way to avoid typosquatting by making sure you're not looking at a package with a similar name to the one you want but with only 2,000 views instead of 2,000,000
    • jeltz 4y ago
      On top of my head: CPAN and Debian's since both are distributed with mirrors not controlled by the the main project. It is possible that some mirrors save statistics but there is no aggregation of it. But, yes, most package manager servers track download statistics and as long as they throw away the IP addresses I do not see any harm.
  • jeltz 4y ago
    As long as they only store aggregates I cannot say that I see that issue.