6 ms·

They'd be well advised to make this opt-in only for legal reasons. This is not going to go down well in a lot of places and they might get exposed to law suits.

pimterry 4y ago
As in the post: they're intending to drop the GA part entirely within 90 days, and it sounds like the new metrics are entirely anonymous, and so not covered by GDPR etc. IANAL but as far as I can tell that should avoid all legal concerns once GA is gone.
- capitol_ 4y ago
  It's hard to send stuff over the Internet without exposing some personal information, like your ip number. I guess they might send it over TOR to get around that.
  - prepend 4y ago
    Isn’t it GDPR compliant if you never store the source ip at all? So from a GDPR perspective there’s no user data to track and remove. I’m not sure how organizations get audited to prove that they actually do that and that there’s no other way to reidentify users (eg, I download the prepend package every day and that’s unusual enough to link that it’s me, prepend, the author of that package, etc etc).
  - mnot 4y ago
    This is exactly the use case that Oblivious HTTP is being built for in he IETF.
- ianai 4y ago
  Why does a package manager need to track their users at all? If you want usage statistics for packages just track how often individual packages are downloaded on the server side. A maintainer has no need to know who's installing what.
  - cassianoleal 4y ago
    Assuming their claims of anonymity are true, they won't be tracking users at all. I imagine they can get much richer metrics through this as opposed to only tracking downloads on the server side. I'm not saying I like it. In fact, I plan to keep it disabled. I'm just saying it's a bit naïve to think client-side analytics are the same as server-side download tracking.
    - ianai 4y ago
      Richer how, exactly? I fundamentally don't 'get' what richness they actually need. If anything they need money, of course, and to know their software works for their users. Prior to release have a test system install the full base, test those packages work, and you know anything less will work too.
      - cassianoleal 4y ago
        I haven't looked at what they're actually collecting, but here's a few things that come to mind: - Time to install packages - Versions of things - Has the compilation (when required) failed? What dependency versions are installed? - CPU architecture - OS version ... There's a lot more that can be sent from the client that's not available on the server side. > I fundamentally don't 'get' what richness they actually need. That's fine. Perhaps you could ask them instead of ranting about what you don't know or don't 'get' in a public forum? > to know their software works for their users Sounds like you're not very far from understanding why they want better telemetry. > Prior to release (...) and you know anything less will work too. Things break in unexpected ways. OSs are complex systems and there's a lot of interactions between components. Homebrew's user base is enormous and very diverse. There's 2 different architectures, many OS versions, lots of environment variables that might be set differently in each user's systems, different versions of libraries, ... I could go on but I think you get the picture. Edit: s/collected/collecting/
        grugagag 4y ago
        Im okay with sending data to the server if things break and be asked each time to okay it. Is it safe to assume that if no errors or exceptions are encountered nothing should be sent back home?
- pdimitar 4y ago
  We only have their pinky promise that the new analytics are anonymous. For all we know this might be a PR operation because people increasingly dislike Google, and they'll sell the "anonymous" analytics to Google under the table. I'll make it a goal to stop all their tracking on the level of my router.
  - derstander 4y ago
    > We only have their pinky promise that the new analytics are anonymous. Isn’t Homebrew open source? One could audit the source themselves. If you’re talking about what happens on the server side yes, but I don’t see the difference with any other computer I connect with over the internet. [1] https://github.com/Homebrew/brew https://github.com/Homebrew/brew
woodruffw 4y ago
Homebrew is not a custodian of any personally identifiable data.
- pdntspa 4y ago
  Does that include IP addresses? Because I think that is considered PII
  - woodruffw 4y ago
    Homebrew does not store IP addresses, so yes. You can see the totality of the information stored on the Homebrew website[1]. [1]: https://formulae.brew.sh/analytics/ https://formulae.brew.sh/analytics/
  - eddieroger 4y ago
    From the post: > Our self-hosted InfluxDB instance does not store either anonymised IP addresses or an anonymised user token so it has additional privacy benefits over Google Analytics.
pancrufty 4y ago
Opt-in analytics are useless, unless a large part of your userbase just clicks through the entire wizard without thinking; there’s little overlap with Homebrew’s userbase
- mola 4y ago
  Ok, so don't do analytics.
  - hardware2win 4y ago
    Then have worse product for the users?
    - closewith 4y ago
      Yes, you don't get to decide to violate your users' rights and surveil them because you think it will improve your product.
      - hardware2win 4y ago
        1 it is their choice what soft they use, isnt it? Its not like chromium on android being pushed on you 2 there is "reasonable" / "good faith" data that in my opinion can be sent e.g crash log, stats like e.g package popularity etc. You just create drama over nothing. Ive used data like this to improve my soft countless times and there is nothing shady at all, everything is about what you collect. Theres difference between keylogger or stealing nudes and tech data
        drivers99 4y ago
        > it is their choice what soft they use, isnt it Yes. More evidence for an observation I've been having that ultimately the software is always about what the creator of the software wants, and not the user. I'm working on moving to running only my own software for that reason.
    - 4y ago

pimterry 4y ago

As in the post: they're intending to drop the GA part entirely within 90 days, and it sounds like the new metrics are entirely anonymous, and so not covered by GDPR etc. IANAL but as far as I can tell that should avoid all legal concerns once GA is gone.

capitol_ 4y ago
It's hard to send stuff over the Internet without exposing some personal information, like your ip number. I guess they might send it over TOR to get around that.
- prepend 4y ago
  Isn’t it GDPR compliant if you never store the source ip at all? So from a GDPR perspective there’s no user data to track and remove. I’m not sure how organizations get audited to prove that they actually do that and that there’s no other way to reidentify users (eg, I download the prepend package every day and that’s unusual enough to link that it’s me, prepend, the author of that package, etc etc).
- mnot 4y ago
  This is exactly the use case that Oblivious HTTP is being built for in he IETF.
ianai 4y ago
Why does a package manager need to track their users at all? If you want usage statistics for packages just track how often individual packages are downloaded on the server side. A maintainer has no need to know who's installing what.
- cassianoleal 4y ago
  Assuming their claims of anonymity are true, they won't be tracking users at all. I imagine they can get much richer metrics through this as opposed to only tracking downloads on the server side. I'm not saying I like it. In fact, I plan to keep it disabled. I'm just saying it's a bit naïve to think client-side analytics are the same as server-side download tracking.
  - ianai 4y ago
    Richer how, exactly? I fundamentally don't 'get' what richness they actually need. If anything they need money, of course, and to know their software works for their users. Prior to release have a test system install the full base, test those packages work, and you know anything less will work too.
    - cassianoleal 4y ago
      I haven't looked at what they're actually collecting, but here's a few things that come to mind: - Time to install packages - Versions of things - Has the compilation (when required) failed? What dependency versions are installed? - CPU architecture - OS version ... There's a lot more that can be sent from the client that's not available on the server side. > I fundamentally don't 'get' what richness they actually need. That's fine. Perhaps you could ask them instead of ranting about what you don't know or don't 'get' in a public forum? > to know their software works for their users Sounds like you're not very far from understanding why they want better telemetry. > Prior to release (...) and you know anything less will work too. Things break in unexpected ways. OSs are complex systems and there's a lot of interactions between components. Homebrew's user base is enormous and very diverse. There's 2 different architectures, many OS versions, lots of environment variables that might be set differently in each user's systems, different versions of libraries, ... I could go on but I think you get the picture. Edit: s/collected/collecting/
      - grugagag 4y ago
        Im okay with sending data to the server if things break and be asked each time to okay it. Is it safe to assume that if no errors or exceptions are encountered nothing should be sent back home?
pdimitar 4y ago
We only have their pinky promise that the new analytics are anonymous. For all we know this might be a PR operation because people increasingly dislike Google, and they'll sell the "anonymous" analytics to Google under the table. I'll make it a goal to stop all their tracking on the level of my router.
- derstander 4y ago
  > We only have their pinky promise that the new analytics are anonymous. Isn’t Homebrew open source? One could audit the source themselves. If you’re talking about what happens on the server side yes, but I don’t see the difference with any other computer I connect with over the internet. [1] https://github.com/Homebrew/brew https://github.com/Homebrew/brew

woodruffw 4y ago

Homebrew is not a custodian of any personally identifiable data.

pdntspa 4y ago
Does that include IP addresses? Because I think that is considered PII
- woodruffw 4y ago
  Homebrew does not store IP addresses, so yes. You can see the totality of the information stored on the Homebrew website[1]. [1]: https://formulae.brew.sh/analytics/ https://formulae.brew.sh/analytics/
- eddieroger 4y ago
  From the post: > Our self-hosted InfluxDB instance does not store either anonymised IP addresses or an anonymised user token so it has additional privacy benefits over Google Analytics.

pancrufty 4y ago

Opt-in analytics are useless, unless a large part of your userbase just clicks through the entire wizard without thinking; there’s little overlap with Homebrew’s userbase

mola 4y ago
Ok, so don't do analytics.
- hardware2win 4y ago
  Then have worse product for the users?
  - closewith 4y ago
    Yes, you don't get to decide to violate your users' rights and surveil them because you think it will improve your product.
    - hardware2win 4y ago
      1 it is their choice what soft they use, isnt it? Its not like chromium on android being pushed on you 2 there is "reasonable" / "good faith" data that in my opinion can be sent e.g crash log, stats like e.g package popularity etc. You just create drama over nothing. Ive used data like this to improve my soft countless times and there is nothing shady at all, everything is about what you collect. Theres difference between keylogger or stealing nudes and tech data
      - drivers99 4y ago
        > it is their choice what soft they use, isnt it Yes. More evidence for an observation I've been having that ultimately the software is always about what the creator of the software wants, and not the user. I'm working on moving to running only my own software for that reason.
  - 4y ago