3 ms·

Devenv Telemetry Warning

40 points by todsacerdoti 2y ago

orf 2y ago
It sends the output of “git ls-files” to the telemetry server?!?! Who thought this is appropriate.
- aftbit 2y ago
  No even worse, it sends the actual file content to the server. Linked in the post: https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L226-L257 https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4...
turtleyacht 2y ago
Be sure to put your env vars next to the invocation and not at the start, or it won't apply. Like for npm, correct way is "./bin/do.sh && NO_TELEMETRY=1 vendor build" Incorrect: "NO_TELEMETRY=1 ./bin/do.sh && vendor build" With the latter, the environment variable to disable telemetry doesn't get passed in to the vendor script.
- 1oooqooq 2y ago
  you missed the part this still sends all the data regadless
  - turtleyacht 2y ago
    Yes, still sending the data is bad. Their docs [1] do not mention the generate command can take an exclusion argument [2]. Maybe the dot (.) for current directory will exclude everything, but that may defeat the purpose. If the current directory were the default, and on first run an error message like "Please include files first" appeared--and users also must enter "Y" at a disclaimer message--they could explicitly opt in instead. And that should be placed before the tar-n-upload piece. The pull request was also merged before approval. Github branch protection could have been set to require at least one approver. [1] https://devenv.sh/blog/2025/02/13/devenv-14-generating-nix-developer-environments-using-ai/ https://devenv.sh/blog/2025/02/13/devenv-14-generating-nix-d... [2] https://github.com/cachix/devenv/blob/main/devenv/src/cli.rs#L197 https://github.com/cachix/devenv/blob/main/devenv/src/cli.rs...
SunlitCat 2y ago
Okay honestly, at what point in time creeped that telemetry "I need all your data for totally no reason but I feel like I should collect it anyways to satisfy my desire to spy on you" fetish (generally) into software? My first (broad) contact with something like that was in the early 2000 with a certain operating system, which decided it needs to check an ID online before allowing me to use it.
mpalmer 2y ago
I'm out, that's it for using devenv in my stuff. I was already put off by the way devenv uses direnv to pull down its nix logic. The latest version I'm willing to use (1.3?) at least hardcodes a permalink to a file in GitHub. The latest version apparently just sets your .envrc to run a non-deterministic devenv command to download and run god-knows-what. devenv suddenly wresting control of what happens when I cd to my project is unacceptable, especially given this new insistence on telemetry.
b0afc375b5 2y ago
Anyone can recommend an alternative? My use case is to simply setup the development environment when I cd into the folder (e.g., compiler, language server). It seems to me that manually creating a flake.nix is the most sensible approach.
- mootoday 2y ago
  I've used Devbox by Jetify for two years. Never looked back. https://github.com/jetify-com/devbox https://github.com/jetify-com/devbox
aiiizzz 2y ago
Devenv got pointless after LLMs. "Enable JavaScript in my flake.nix" outputs whatever basic packages I need, without the magic.

40 points by todsacerdoti 2y ago

orf 2y ago

It sends the output of “git ls-files” to the telemetry server?!?! Who thought this is appropriate.

aftbit 2y ago
No even worse, it sends the actual file content to the server. Linked in the post: https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L226-L257 https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4...

turtleyacht 2y ago

Be sure to put your env vars next to the invocation and not at the start, or it won't apply. Like for npm, correct way is "./bin/do.sh && NO_TELEMETRY=1 vendor build" Incorrect: "NO_TELEMETRY=1 ./bin/do.sh && vendor build" With the latter, the environment variable to disable telemetry doesn't get passed in to the vendor script.

1oooqooq 2y ago
you missed the part this still sends all the data regadless
- turtleyacht 2y ago
  Yes, still sending the data is bad. Their docs [1] do not mention the generate command can take an exclusion argument [2]. Maybe the dot (.) for current directory will exclude everything, but that may defeat the purpose. If the current directory were the default, and on first run an error message like "Please include files first" appeared--and users also must enter "Y" at a disclaimer message--they could explicitly opt in instead. And that should be placed before the tar-n-upload piece. The pull request was also merged before approval. Github branch protection could have been set to require at least one approver. [1] https://devenv.sh/blog/2025/02/13/devenv-14-generating-nix-developer-environments-using-ai/ https://devenv.sh/blog/2025/02/13/devenv-14-generating-nix-d... [2] https://github.com/cachix/devenv/blob/main/devenv/src/cli.rs#L197 https://github.com/cachix/devenv/blob/main/devenv/src/cli.rs...

SunlitCat 2y ago

Okay honestly, at what point in time creeped that telemetry "I need all your data for totally no reason but I feel like I should collect it anyways to satisfy my desire to spy on you" fetish (generally) into software? My first (broad) contact with something like that was in the early 2000 with a certain operating system, which decided it needs to check an ID online before allowing me to use it.

mpalmer 2y ago

I'm out, that's it for using devenv in my stuff. I was already put off by the way devenv uses direnv to pull down its nix logic. The latest version I'm willing to use (1.3?) at least hardcodes a permalink to a file in GitHub. The latest version apparently just sets your .envrc to run a non-deterministic devenv command to download and run god-knows-what. devenv suddenly wresting control of what happens when I cd to my project is unacceptable, especially given this new insistence on telemetry.

b0afc375b5 2y ago

Anyone can recommend an alternative? My use case is to simply setup the development environment when I cd into the folder (e.g., compiler, language server). It seems to me that manually creating a flake.nix is the most sensible approach.

mootoday 2y ago
I've used Devbox by Jetify for two years. Never looked back. https://github.com/jetify-com/devbox https://github.com/jetify-com/devbox

aiiizzz 2y ago

Devenv got pointless after LLMs. "Enable JavaScript in my flake.nix" outputs whatever basic packages I need, without the magic.