12 ms·
Homebrew's analytics have moved to the EU and away from Google
- dbg31415 3y agoUpdate : There's nothing wrong with using GA. https://arstechnica.com/tech-policy/2023/07/big-tech-can-transfer-europeans-data-to-us-in-win-for-facebook-and-google/ https://arstechnica.com/tech-policy/2023/07/big-tech-can-tra...
- philshem 3y ago> Homebrew's analytics have entirely moved to our InfluxDB instance in the EU. > We gather less data than before and have destroyed all Google Analytics data: > https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics just noticed this morning, running some updates $ brew analytics InfluxDB analytics are disabled. Google Analytics were destroyed.
- ilyt 3y agoWeird they are specifying a database technology used, it's kinda irrelevant to the whole thing
- IanCal 3y agoIt goes to the hosted influxdb services provided by influxdata.
- gortok 3y agoMaybe they get a discount/free hosting by mentioning it?
- jimmychoozyx 3y agoWhile it is true that it's just an implementation detail-- Personally I think it's a cool thing. - I like knowing the tech stack used. - I like knowing where my data lives - And on InfluxDB: It's well documented, & it was easy to get a PoC running.
- woodruffw 3y agoInfluxDB refers to the hosted service, not the DB technology. The fact that it’s also probably InfluxDB-the-technology is incidental.
- ilyt 3y ago....so it is going to US company. That makes it worse...
- illiac786 3y agoworse than?… Worse than google analytics?
- woodruffw 3y agoAre you operating under the impression that the previous solution (Google) isn't a US company? (More generally, if you're going to be a paranoiac about these things: the US intelligence community loves it when things are provided by non-US entities. No warrants are required!)
- ilyt 3y agoWhat a non-sequitor lmao. The title is that analytics moved to EU. Which might be true technically but still goes to US company
- woodruffw 3y agoThe title of the announcement on the Homebrew site is "Anonymous Analytics." It doesn't even mention the EU. I'd recommend not reading into others' editorializations. Homebrew doesn't control them.
- user_named 3y agoNo, the title of the thread is them moving analytics to EU
- bastardoperator 3y agoWhy wouldn't an OSS project provide details of the underlying technology? People seem to get miffed about anything these days. Weird.
- WirelessGigabit 3y agoThat is because you have `HOMEBREW_NO_ANALYTICS 1`. Removing that one will turn on the InfluxDB analytics.
- TekMol 3y agoI'm still not sure if we (here in Europe) gain anything from all this work the GDPR causes. For myself, Google never seemed to pick up which websites I visit. At least ads never followed me around. Probably because of my surfing habits: I open websites in a new browser instance and then close the instance. So no cookies stick around. Because I have set Firefox to delete cookies when closed. They could have tracked me via fingerprinting, but I have not noticed that happening. Others surely have other browsing habbits. Keep cookies around forever, and Google knows most of the websites they visit. So when they google for a new fridge, they see fridge ads everywhere for a week. But is that really a problem? What are the real world negative consequences? Tech companies now seem to geo-fence their new products and keep European users out right from the start. Which makes us even less productive by having less and less tools available. Is it worth it? Or are we just shooting ourselfes in the knee, having to crawl instead of walk, and turn into a 3rd world continent?
- robin_reala 3y agoOut of interest, if you don’t worry about privacy infringement why do you clear cookies?
- Fnoord 3y agoEasy usage of paywalls which provide X free articles per Y time, for example.
- grozzle 3y agoWhat is fenced off for Europeans? Admittedly I've been living outside of Europe for some time, but some of my self hosted stuff is still based there, and a lot of friends, and I haven't had or heard of a problem with being "kept out" of new products.
- TekMol 3y agoLet's go for an unbiased list. You name the 10 most important tech products of the year so far. And then we go through them and see if they are available in Europe.
- lannisterstark 3y agoI'm not exactly sure I trust EU either tbf. They haven't really shown themselves to be good stewards of understanding how internet works with their previous resolutions.
- deleted 3y ago[deleted]
- ranguna 3y agoLeast worse option probably.
- lannisterstark 3y agoidk about 'least worse.' Better than US, probably, but EU and US aren't the only two places in the world.
- hardware2win 3y agoe.g?
- lannisterstark 3y ago>Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market and amending Directives 96/9/EC and 2001/29/EC >Digital Services Act
- viraptor 3y ago> with their previous resolutions. That's so vague it can apply to anything in any country... Wanna add specific examples?
- lannisterstark 3y agotwo: Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market and amending Directives 96/9/EC and 2001/29/EC Digital Services Act
- laserlight 3y agoCongratulations to Homebrew team for keeping their promise to move away from Google Analytics.
- raverbashing 3y agoWow you mean a free service can do a better job of GDPR compliance than the endless and nagging popups the other sites put out there? Almost sounds like the annoying popups are in spite and not out of need
- flaminHotSpeedo 3y agoOf course, it's trivial for a system that retains very little personal data (and really shouldn't be storing any) to comply with gdpr. Besides the obvious "less data, fewer problems" angle there's also the bureaucracy angle - last time I worked on gdpr compliance I got stuck in the middle of a fight with security (who wants to store all the data for ever), the legal team specifically in charge of figuring out what's in scope for GDPR, and another more generic legal team (this one was the worst - they had no idea what the system does and ignored any attempts at explaining it, plus they kept pushing for unrelated often contradictory retention changes)
- ilyt 3y agoWe did had some of the talks with lawyer about security (in particular logs) and general consensus was that as long as they are stored explicitly for that purpose and only that purpose it isn't a problem, they just have to be properly secured. Logs like that fall under 6.1.b-f, basically "making sure malicious actor can't fuck with site" overrides needing to get permission to process that. Again, if they are used ONLY for that and are stored securely. Same reason why security footage (which also falls under GDPR) doesn't need consent, only information visible onto property entrance informing who is processing that info.
- PeterisP 3y agoA non-profit service should be expected to have better compliance than a service which has a strong monetary motivation to exploiting users data as much as possible and thus comply with privacy requirements as little as possible.
- ilyt 3y agoCompliance with GDPR is extremely easy: just don't gather PII in the first place. And if you want to gather data it's also not too hard, just ask for it and tell user exactly what you're going to do with it. It's when you want to cajole user into agreeing for gathering way more data than they would consent to if someone explained the extent to them plainly, and to send it to a bunch of 3rd parties too, that's where the difficulty starts and you have to use the blackest of black of techniques to cheat user while still being technically compliant to law.
- sneak 3y agoHow about Homebrew's analytics move to an ethical, opt-in model (like Debian) instead of this silent surveillance of its users who have never explicitly consented to such data collection? This thing drops a supercookie on your device that persists forever, and they close every issue raised discussing the privacy implications of same. Anyone who runs the analytics service can see the approximate travel history over time of every Homebrew user (by geolocating the source IP). It's not a for-profit project. There is no legitimate purpose for tracking installs.
- orf 3y ago> It's not a for-profit project. There is no legitimate purpose for tracking installs. From the very top of the linked page: > Homebrew is provided free of charge and run entirely by volunteers in their spare time. > As a result, we do not have the resources to do detailed user studies of Homebrew users to decide on how best to design future features and prioritise current work. > Anonymous analytics allow us to prioritise fixes and features based on how, where and when people use Homebrew It then goes on to list some examples. Opt in renders this useless.
- tpxl 3y agoThe classic "doing the right thing takes resources, so we'll do the wrong thing".
- orf 3y agoThe classic “I won’t ever pay for those resources, but I complain when others also don’t”.
- justusw 3y agoIf opt in renders it useless then I dare question whether modern open source as a mode of development and operation is feasible at all, if the underlying foundation is snooping based on uninformed consent. Yes, many tools give you an option to opt out nowadays, but then again do you want to learn how to do that dance every single time? It’s almost like we need some kind of… DNT, but for the console. And even that misses the point: with the German concept of Datensparsamkeit, there shouldn’t be any data collected at all, unless it is absolutely necessary to conduct your business. Popularity contest in Debian comes to mind when talking about informed consent. The point is not InfluxDB or GA. That just sounds like good guy with a gun/analytics vs. bad guy with a gun/analytics logic. The point is: the combined genius of the computing world, and all we could come up with even after the 100th iteration is “Analytics go brrr”.
- zorrotorro 3y agoIt's just lovely that even command line tools ping home telemetry. There's no place for non-spyware.
- aequitas 3y agoI don't understand how command line makes the distinction here. Maybe if it where just a simple tool that doesn't require an internet connection for its functionality. But since Homebrew is not just the command line tool, but also a repository and build system in constant motion. I understand that as a developer you might want to have insights into how certain changes (will) impact the user experience.
- zorrotorro 3y agoTrue, the open source world never before had a repository and build systems in constant motion. Homebrew is the innovation we needed to make things in software.
- brasic 3y agoThe conflation of “spyware” ie tracking for monetization purposes with telemetry used by developers to ensure the health of production systems is foolish and harmful. Homebrew is a complex system that can break in lots of ways, and it’s being developed on an entirely open source basis, with no company behind it. Having some visibility into the operation of a running system is table stakes. You’re asking the developers donating their time to this very useful project to tie a hand behind their back because you are paranoid. More often than not, if people like you got their way OSS software just wouldn’t be built, or would be taken over by a for profit entity that has much less benign ideas about spyware. This is literally a story about the homebrew project listening to the community and migrating to privacy-preserving self-hosted analytics. People like you will never be happy, so they should be entirely ignored.
- zorrotorro 3y agoWell aren't you a sunshine.
- Varqu 3y agoWhy does a package manager need to collect analytics? The data that is collected could still be identifiable via device fingerprinting.
- whalesalad 3y agoIt’s hard to improve a product if you don’t know how it’s being used.
- eptcyka 3y agoIs it a product?
- oddevan 3y agoAn Open Source or not-for-profit product is still a product, and we do ourselves no favors pretending otherwise.
- bendiksolheim 3y agoWhat is a product? They make something that is used by others, and if they follow a product development mindset, calling it a product is fair in my opinion.
- whalesalad 3y agos/product/tool … the meaning remains the same.
- bastardoperator 3y agoBy literal definition, yes.
- grishka 3y agoWhat if a product is finished and needs no further improvements? And even if it isn't, isn't it better to talk do your users and find out their pain points with your product directly, instead of trying to guess at them from analytics data? The only improvement I personally want for Homebrew is for library packages to never include version numbers in the dynamic library file names.
- nilespotter 3y ago`brew analytics off`
- jamil7 3y agoThanks
- deleted 3y ago[deleted]
- dbg31415 3y agoI find moving away from GA to be really cringe. It's not like Google can't get all the data it wants from the people using Chrome. All GA really does is ensure the non-Chrome users get captured by Google. And -- more importantly -- give you insight into what Google sees on your site. So if you turn off GA... sure you sort of hinder Google... in that Google gets maybe 10% less usage data from your users (at most 10%). But you take away your ability to see what they see about you. Google is still 90%+ of search traffic. So moving away from GA just feels like putting your head in the sand. So I don't know, I mean I get that you don't want to be tracked, and have your data shared, but that's not what moving away from GA solves. I don't know what moving away from GA solves.
- itslennysfault 3y agoThis is analytics for a command line tool so google sees 0% of the data unless it is intentionally sent to google.
- alophawen 3y ago> I find moving away from GA to be really cringe. GA was found to not comply with GDPR, so unless you want EU ban you have to leave GA https://usercentrics.com/knowledge-hub/google-analytics-and-gdpr-compliance-rulings/ https://usercentrics.com/knowledge-hub/google-analytics-and-... A Swedish company just got a huge fine: https://techcrunch.com/2023/07/03/google-analytics-sweden-gdpr-fines/ https://techcrunch.com/2023/07/03/google-analytics-sweden-gd...
- dbg31415 3y agoMaybe GDKP is just a set of overly broad, poorly written rules? Here's an article that linked from the one you sent. Even the EU Parliament is in violation of GDPR. =P * European parliament found to have broken EU rules on data transfers and cookie consents | TechCrunch | https://techcrunch.com/2022/01/10/edps-decision-european-parliament-covid-19-test-website/ https://techcrunch.com/2022/01/10/edps-decision-european-par... I wear a tinfoil hat as much as the next guy, and I have studied up on GDPR rules at work, and all I can say is they are designed to basically give any country the ability to say, "We don't like you, Americans. You are bad and we don't like you." Like it or not, we're all connected. You can look at websites in France, or Germany, or America. Having different rules for the data makes sense at the company-level, or server-level. "Here are the rules for Norwegian companies..." But it just doesn't make a lot of sense for French laws to apply to US-servers. Where does that end? If Alabama passes a law saying "You have to have just English on your website..." but Canada says, "You have to have your website in French and English..." who wins? What do the developers use as the source of truth for their requirements? And if we have to have one version of the website for each and every state and country... isn't that problematic... I mean you get that's problematic, right? I think these courts ruling against Google are small courts, I think it'll get overturned. I think it likely has more to do with finding different ways to punish Google / Apple / other tech companies for not paying more taxes inside of those countries. EU nations set up a lot of taxes, then get upset when global companies don't choose to build offices there. All of the regulation around data just feels like another "what can we do to be petty in response for them not paying us more taxes?" Exactly like the USB-C adapter thing. Anyway, just my 2 cents. Google is skeezy, I get it... but fragmenting the web into a different set of rules for viewers in every nation... that's not the answer. It really can't be the answer.
- WirelessGigabit 3y agoI have the following settings: HOMEBREW_NO_GOOGLE_ANALYTICS 1 HOMEBREW_NO_ANALYTICS 1 If you run the `brew analytics state` command like this it shows: InfluxDB analytics are disabled. Google Analytics were destroyed. Then you do `brew update`: brew update Warning: HOMEBREW_NO_GOOGLE_ANALYTICS is now a no-op so can be unset. All Homebrew Google Analytics code and data was destroyed. ==> Homebrew's analytics have entirely moved to our InfluxDB instance in the EU. We gather less data than before and have destroyed all Google Analytics data: https://docs.brew.sh/Analytics Please reconsider re-enabling analytics to help our volunteer maintainers with: brew analytics on Installing from the API is now the default behaviour! You can save space and time by running: brew untap homebrew/core brew untap homebrew/cask You'll still want to keep the HOMEBREW_NO_ANALYTICS 1 Otherwise the InfluxDB one turns on.
- Drblessing 3y agoThanks I'll add this
- Drblessing 3y agoHomebrew keeps me on MacOS, without it I'd just use apt on Linux. Does anyone know if there's a site like brew.sh for searching apt packages? I know that ubuntu has an apt page but it's really confusing.
- teddyh 3y agoWhat do you mean by “searching apt packages”? I usually use “apt-cache search”.
- bithaze 3y agoI'm not sure if this is the "apt page" they're referring to, but there's https://packages.ubuntu.com/ https://packages.ubuntu.com/ for Ubuntu. It's helpful for searching package versions across releases, especially if I don't have an Ubuntu server handy. Other distributions have similar pages too, I believe.
- teddyh 3y agoI often use <https://tracker.debian.org/ https://tracker.debian.org/>.
- nektro 3y agohttps://packages.debian.org/search?keywords= https://packages.debian.org/search?keywords= put anything you want after the =