4 ms·

I wish we could get the industry to understand that when you build-in analytics and make it hard for people to opt out, you're using their resources. Sure, peo

by aa-jv 4y ago

I wish we could get the industry to understand that when you build-in analytics and make it hard for people to opt out, you're using their resources. Sure, people don't pay for things like Homebrew (can they even?) - but this is no reason to extract resources from end users without their consent or agency. I have to work very hard to get something like Homebrew installed and in-use in my organization - the IT guys detest it, since they don't have the wherewithal to understand it (or else they'd be higher-paid developers) so when I finally do get it installed and in use (because it is a very productive tool), having it phone home just makes the situation worse. IT guys have asked for my blood on more than one occasion, just because they see something 'uncontrollable' phoning home .. this does a lot more harm than good. That said, homebrew has been absolutely responsible for making MacOS usable for development purposes in this ol' hackers lab, so I'll keep using it - but I sure do wish they'd care a little more about the position they put us in, having to justify the use of it to IT guys .. EDIT: Thinking about it, I'm actually not averse to phoning-home, just the automatic/hidden nature of it. If brew asked me, every 5 or so times that I ran it, if I would like to participate in sending anonymized analytics to the brew devs, and showed me what was being sent (instead of obfuscating it), I'd be a lot more inclined to click "[Yes] - this one time" almost every single time ..

modernerd 4y ago
> people don't pay for things like Homebrew (can they even?) They can and should! https://github.com/homebrew/brew#donations https://github.com/homebrew/brew#donations
- aa-jv 4y ago
  Thanks for the link, I've now donated. :)
Mystery-Machine 4y ago
Isn't it illegal, under GDPR, to track users without their consent?
- Gigachad 4y ago
  Only if it’s personally identifiable information. You can track anonymous statistics as much as you want without requiring permission.
  - emsixteen 4y ago
    … which is also why the cookie banner scourge shows how nefarious companies are these days. They don't need identifiable information for their analytics, they're just all super greedy.
eesmith 4y ago
How is it hidden or hard to opt-out? From https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics you can opt out using: export HOMEBREW_NO_ANALYTICS=1 -or- brew analytics off The installer gives a warning message before sending the first analytics, with a pointer to the above URL for how to disable analytics. From install.sh: ring_bell # Use an extra newline and bold to avoid this being missed. ohai "Homebrew has enabled anonymous aggregate formulae and cask analytics." echo "$( cat <<EOS ${tty_bold}Read the analytics documentation (and how to opt-out) here: ${tty_underline}https://docs.brew.sh/Analytics${tty_reset} No analytics data has been sent yet (nor will any be during this ${tty_bold}install${tty_reset} run). EOS ) " > and showed me what was being sent (instead of obfuscating it), According to that https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics page, to see what it sends: You can also view all the information that is sent by Homebrew’s analytics by setting HOMEBREW_ANALYTICS_DEBUG=1 in your environment. Please note this will also stop any analytics from being sent. I verified that using it dumps JSON analytics to the terminal, and it didn't seem that obfuscated, given the documentation in that Analytics page.
- aa-jv 4y ago
  None of this is user-friendly - all of it is obfuscated. I have to add resources to my system (env vars) in order to opt-out - and that is the issue! There are no hints/tips about this produced to educate a new user - if it weren't for your help, I wouldn't have known. The non-resource-using method I propose is that homebrew merely ask the user if its okay, after 5 or 10 runs, to send some info - and then shows me the info. No, I don't want to add resources to my environment to get this info - I want homebrew developers to be honest about it, up front, and overt. They are being sly, using dark patterns to make it unfeasible to disable analytics, because they know this is an unpopular feature of their software.
  - acdha 4y ago
    > None of this is user-friendly - all of it is obfuscated This is a message which is printed with very clear instructions the first time you run any command. It’s a simple command and there’s no noticeable difference in resource usage compared to the actual package management system, which also needs environmental variables to be set. The big thing you’re missing is that the Homebrew maintainers are freely giving you the product of many thousands of hours of skilled work, the kind of service developers used to pay money for. In exchange, they ask for some non-personal statistics to help them avoid mistakes which could cause problems for you. I don’t think it’s fair to act like they’re tricking you when you’re getting so much out of the deal and it’s all disclosed publicly. They could be tracking stats on the package distribution infrastructure without your knowledge at all but instead chose to be fully above board about what the system does and why, and offer a trivial opt-out mechanism.
bdsa 4y ago
> the IT guys detest it, since they don't have the wherewithal to understand it (or else they'd be higher-paid developers) seems like an unfair characterisation (having been both!)
- aa-jv 4y ago
  If glib IT policy gets in the way of development, its a fair characterization imho. Both the Homebrew developers obfuscating their analytics, and IT guys wanting to lock everything down, suffer from the same malady: glibness. Too many times IT has had authority over development to the detriment of the project. Developers must resist this.
d12bb 4y ago
> EDIT: Thinking about it, I'm actually not averse to phoning-home, just the automatic/hidden nature of it. If brew asked me, every 5 or so times that I ran it, if I would like to participate in sending anonymized analytics to the brew devs, and showed me what was being sent (instead of obfuscating it), I'd be a lot more inclined to click "[Yes] - this one time" almost every single time .. I'd take a minute to rip the fckng line of code bugging me every 5 installs out of the code. Thing is, if you make telemetry opt-in, it's the same as just not adding it in the first place. Only a handful of users will opt in, rendering the data pretty much useless, especially as it's install and install-fail counts. If they included any personal data, it'd be opt-in by law (at least here in EU). As they don't, they don't have to, and I'm fine with it.

by aa-jv 4y ago

modernerd 4y ago

> people don't pay for things like Homebrew (can they even?) They can and should! https://github.com/homebrew/brew#donations https://github.com/homebrew/brew#donations

aa-jv 4y ago
Thanks for the link, I've now donated. :)

Mystery-Machine 4y ago

Isn't it illegal, under GDPR, to track users without their consent?

Gigachad 4y ago
Only if it’s personally identifiable information. You can track anonymous statistics as much as you want without requiring permission.
- emsixteen 4y ago
  … which is also why the cookie banner scourge shows how nefarious companies are these days. They don't need identifiable information for their analytics, they're just all super greedy.

eesmith 4y ago

How is it hidden or hard to opt-out? From https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics you can opt out using: export HOMEBREW_NO_ANALYTICS=1 -or- brew analytics off The installer gives a warning message before sending the first analytics, with a pointer to the above URL for how to disable analytics. From install.sh: ring_bell # Use an extra newline and bold to avoid this being missed. ohai "Homebrew has enabled anonymous aggregate formulae and cask analytics." echo "$( cat <<EOS ${tty_bold}Read the analytics documentation (and how to opt-out) here: ${tty_underline}https://docs.brew.sh/Analytics${tty_reset} No analytics data has been sent yet (nor will any be during this ${tty_bold}install${tty_reset} run). EOS ) " > and showed me what was being sent (instead of obfuscating it), According to that https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics page, to see what it sends: You can also view all the information that is sent by Homebrew’s analytics by setting HOMEBREW_ANALYTICS_DEBUG=1 in your environment. Please note this will also stop any analytics from being sent. I verified that using it dumps JSON analytics to the terminal, and it didn't seem that obfuscated, given the documentation in that Analytics page.

aa-jv 4y ago
None of this is user-friendly - all of it is obfuscated. I have to add resources to my system (env vars) in order to opt-out - and that is the issue! There are no hints/tips about this produced to educate a new user - if it weren't for your help, I wouldn't have known. The non-resource-using method I propose is that homebrew merely ask the user if its okay, after 5 or 10 runs, to send some info - and then shows me the info. No, I don't want to add resources to my environment to get this info - I want homebrew developers to be honest about it, up front, and overt. They are being sly, using dark patterns to make it unfeasible to disable analytics, because they know this is an unpopular feature of their software.
- acdha 4y ago
  > None of this is user-friendly - all of it is obfuscated This is a message which is printed with very clear instructions the first time you run any command. It’s a simple command and there’s no noticeable difference in resource usage compared to the actual package management system, which also needs environmental variables to be set. The big thing you’re missing is that the Homebrew maintainers are freely giving you the product of many thousands of hours of skilled work, the kind of service developers used to pay money for. In exchange, they ask for some non-personal statistics to help them avoid mistakes which could cause problems for you. I don’t think it’s fair to act like they’re tricking you when you’re getting so much out of the deal and it’s all disclosed publicly. They could be tracking stats on the package distribution infrastructure without your knowledge at all but instead chose to be fully above board about what the system does and why, and offer a trivial opt-out mechanism.

bdsa 4y ago

> the IT guys detest it, since they don't have the wherewithal to understand it (or else they'd be higher-paid developers) seems like an unfair characterisation (having been both!)

aa-jv 4y ago
If glib IT policy gets in the way of development, its a fair characterization imho. Both the Homebrew developers obfuscating their analytics, and IT guys wanting to lock everything down, suffer from the same malady: glibness. Too many times IT has had authority over development to the detriment of the project. Developers must resist this.

d12bb 4y ago

> EDIT: Thinking about it, I'm actually not averse to phoning-home, just the automatic/hidden nature of it. If brew asked me, every 5 or so times that I ran it, if I would like to participate in sending anonymized analytics to the brew devs, and showed me what was being sent (instead of obfuscating it), I'd be a lot more inclined to click "[Yes] - this one time" almost every single time .. I'd take a minute to rip the fckng line of code bugging me every 5 installs out of the code. Thing is, if you make telemetry opt-in, it's the same as just not adding it in the first place. Only a handful of users will opt in, rendering the data pretty much useless, especially as it's install and install-fail counts. If they included any personal data, it'd be opt-in by law (at least here in EU). As they don't, they don't have to, and I'm fine with it.