5 ms·

What's interesting is that this was created by Max Howell, creator of Homebrew who made waves a little while back for getting rejected by Google despite Homebre

What's interesting is that this was created by Max Howell, creator of Homebrew who made waves a little while back for getting rejected by Google despite Homebrew's success. He talks about that here: https://www.quora.com/Whats-the-logic-behind-Google-rejecting-Max-Howell-the-author-of-Homebrew-for-not-being-able-to-invert-a-binary-tree https://www.quora.com/Whats-the-logic-behind-Google-rejectin...

sneak 3y ago
To his credit, he didn’t let being rejected by the largest advertising surveillance company stop him from shipping surveillance software to millions of end-user workstations anyway, in the form of the nonconsensual spyware built into Homebrew.
- yellow_lead 3y ago
  It seems like youve mentioned this before, but googling about this only brings up your other comments. Can you elaborate on what the spyware is?
  - inyourtenement 3y ago
    He’s talking about analytics. https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
    - userbinator 3y ago
      It's an euphemism, just like "telemetry" and "metrics".
      - ccorcos 3y ago
        Do you really feel like what they’re collecting is “spying on you” though? They’re collecting errors and statistics to make the product better. It’s all anonymous and you can turn it off. If it were Facebook ads, I’d be more sympathetic. But it’s automated bug reporting…
        sneak 3y ago
        It’s not anonymous, it includes the client IP address as well as a permanent supercookie unique identifier. Coupled along with client IP geolocation, this leaks your travel history to the server. It does so silently when you install packages, just like any other spyware. The problem is an ethical one: just because they made software does not entitle them to the information about what does or does not happen on a machine that they do not own without the informed consent of the owner or operator of that machine. Assuming consent and opting the user in automatically is the issue. Anything other than advance, informed consent is just spying. Debian has figured it out. Why do other open source projects have such a hard time understanding consent?
        inyourtenement 3y ago
        And by supercookie, do you mean this UUID? https://github.com/Homebrew/brew/commit/57844530a94d5686029c6770d97583f2bc7b4e9c https://github.com/Homebrew/brew/commit/57844530a94d5686029c...
        mikemcquaid 3y ago
        Yes, he does and, as you noted: it was removed. We also always requested for Google to never store the IP address and now we run our own analytics infrastructure we definitely do not store it at all. sneak just has a grudge against Homebrew because we blocked them for going on and on about this so they resort to ranting on Hacker News instead every time Homebrew is mentioned.
        sneak 3y ago
        You are confused, despite my having explained many times. Your misrepresentation seems like bad faith. The Upton Sinclair quote comes to mind. My issue is with all people who ship spyware; it is unethical. It’s nothing specific to Homebrew (sadly) and it’s not a grudge. Lots of people would turn it off if they realized it was spying on them. The problem is people who assume consent and co-opt computers that do not belong to them to spy on users and exfiltrate data that isn’t theirs. They think that being volunteers or making f/oss entitles them to act unethically. Opt-in consent is fine. These authors don’t use it because they secretly know that if they asked outright, most people would say no. Seriously, it’s not any personal grudge against your project (and didn’t know until this moment that you had blocked me): Mattermost, VSCode, NetData, CapRover, and a thousand others also behave in such an unethical manner. It’s shameful, and it should be illegal. Many people don’t know about it (as evidenced by sibling comments in this thread) and obviously should. This is a failure of the project that spreading public awareness about helps. I would love to see the f/oss community abandon projects that are run in such an unethical manner. Nixpkgs on macOS, for example, doesn’t spy on you. (Neither do the package managers in the Linuxen you can replace macOS with.)
    - x-cmd 3y ago
      [dead]

sneak 3y ago

To his credit, he didn’t let being rejected by the largest advertising surveillance company stop him from shipping surveillance software to millions of end-user workstations anyway, in the form of the nonconsensual spyware built into Homebrew.

yellow_lead 3y ago
It seems like youve mentioned this before, but googling about this only brings up your other comments. Can you elaborate on what the spyware is?
- inyourtenement 3y ago
  He’s talking about analytics. https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
  - userbinator 3y ago
    It's an euphemism, just like "telemetry" and "metrics".
    - ccorcos 3y ago
      Do you really feel like what they’re collecting is “spying on you” though? They’re collecting errors and statistics to make the product better. It’s all anonymous and you can turn it off. If it were Facebook ads, I’d be more sympathetic. But it’s automated bug reporting…
      - sneak 3y ago
        It’s not anonymous, it includes the client IP address as well as a permanent supercookie unique identifier. Coupled along with client IP geolocation, this leaks your travel history to the server. It does so silently when you install packages, just like any other spyware. The problem is an ethical one: just because they made software does not entitle them to the information about what does or does not happen on a machine that they do not own without the informed consent of the owner or operator of that machine. Assuming consent and opting the user in automatically is the issue. Anything other than advance, informed consent is just spying. Debian has figured it out. Why do other open source projects have such a hard time understanding consent?
        inyourtenement 3y ago
        And by supercookie, do you mean this UUID? https://github.com/Homebrew/brew/commit/57844530a94d5686029c6770d97583f2bc7b4e9c https://github.com/Homebrew/brew/commit/57844530a94d5686029c...
        mikemcquaid 3y ago
        Yes, he does and, as you noted: it was removed. We also always requested for Google to never store the IP address and now we run our own analytics infrastructure we definitely do not store it at all. sneak just has a grudge against Homebrew because we blocked them for going on and on about this so they resort to ranting on Hacker News instead every time Homebrew is mentioned.
        sneak 3y ago
        You are confused, despite my having explained many times. Your misrepresentation seems like bad faith. The Upton Sinclair quote comes to mind. My issue is with all people who ship spyware; it is unethical. It’s nothing specific to Homebrew (sadly) and it’s not a grudge. Lots of people would turn it off if they realized it was spying on them. The problem is people who assume consent and co-opt computers that do not belong to them to spy on users and exfiltrate data that isn’t theirs. They think that being volunteers or making f/oss entitles them to act unethically. Opt-in consent is fine. These authors don’t use it because they secretly know that if they asked outright, most people would say no. Seriously, it’s not any personal grudge against your project (and didn’t know until this moment that you had blocked me): Mattermost, VSCode, NetData, CapRover, and a thousand others also behave in such an unethical manner. It’s shameful, and it should be illegal. Many people don’t know about it (as evidenced by sibling comments in this thread) and obviously should. This is a failure of the project that spreading public awareness about helps. I would love to see the f/oss community abandon projects that are run in such an unethical manner. Nixpkgs on macOS, for example, doesn’t spy on you. (Neither do the package managers in the Linuxen you can replace macOS with.)
  - x-cmd 3y ago
    [dead]