11 ms·

GitHub CLI now collects pseudoanonymous telemetry

464 points by ingve 6mo ago

slackfan 6mo ago
pseudoanonymous means not anonymous. /thread
embedding-shape 6mo ago
Love it when a PR is brief: https://github.com/cli/cli/pull/13254 https://github.com/cli/cli/pull/13254 > Removes the env var that gates telemetry, so it will be on by default.
- kevincox 6mo ago
  Not only on by default, it also isn't possible to disable it seems. It's forced on (other than enterprise it seems)
  - dfc 6mo ago
    There is a "How to opt out" section in TFA.
neobrain 6mo ago
tl;dr for opt-out as per https://cli.github.com/telemetry#how-to-opt-out https://cli.github.com/telemetry#how-to-opt-out (any of these work individually): export GH_TELEMETRY=false export DO_NOT_TRACK=true gh config set telemetry disabled (starting from version 2.91.0, which this announcement refers to)
- fenaer 6mo ago
  $ gh --version gh version 2.90.0 (2026-04-16) https://github.com/cli/cli/releases/tag/v2.90.0 https://github.com/cli/cli/releases/tag/v2.90.0 $ gh config set telemetry disabled ! warning: 'telemetry' is not a known configuration key
  - rethab 6mo ago
    v2.91.0 is the one that's going to introduce it: https://github.com/cli/cli/releases/tag/v2.91.0 https://github.com/cli/cli/releases/tag/v2.91.0 Also note that even though you get a warning about an unknown config key, the value is actually set so you're future-proof. Check `grep telemetry ~/.config/gh/config.yml`
- NeckBeardPrince 6mo ago
  > gh config set telemetry false > ! warning: 'telemetry' is not a known configuration key What's strange is if you check your `~/.config/gh/config.yml` it will put `telemetry: disabled` in there. But it will put anything in that `config.yml` lol. > gh config set this-is-some-random-bullshit aww-shucks > ! warning: 'this-is-some-random-bullshit' is not a known configuration key But in my config.yml is this-is-some-random-bullshit: aww-shucks
- deleted 6mo ago
  [deleted]
- nottorp 6mo ago
  ... don't forget to recheck this info every update, restore flags that have been "accidentally" reset and set any new flags that they added for "different" telemetry
Kim_Bruning 6mo ago
what's the last version before telemetry... will want to pin there.
- herpdyderp 6mo ago
  According to their releases page: 2.90.0
wild_pointer 6mo ago
pseudoanonymous, meaning not anonymous? lol
- inetknght 6mo ago
  Yes, that's exactly what pseudoanonymous means. It's fake-anonymous. It can be trivially de-anonymized.
  - ButlerianJihad 6mo ago
    [flagged]
delf 6mo ago
Creator of GitSocial here, check it out if you'd like to have better control of your data and be protected from such things: https://github.com/gitsocial-org/gitsocial https://github.com/gitsocial-org/gitsocial
bugrasan 6mo ago
doesn't this need to be opt-in according to EU GDPR?
msla 6mo ago
I wonder how robust they are against people sending them fake data.
sammy2255 6mo ago
Today I learned GitHub has a CLI. I guess that's like Pornhub having a CLI
- embedding-shape 6mo ago
  Before GitHub had a CLI, I used cURL (via zsh alises/functions) to open PRs and find what remote/branch a PR is associated with. Today I use a Golang CLI made with ~200K LOC to do essentially the same thing. Yay, efficiency?
- falcor84 6mo ago
  Seeing how annoying their website interfaces are, I'd actually be open to paying for API/CLI access to porn.
- chris_money202 6mo ago
  Gh cli is one of the most powerful tools you can give a coding agent imo
a2128 6mo ago
Why we collect telemetry ...our team needs visibility into how features are being used in practice. We use this data to prioritize our work and evaluate whether features are meeting real user needs. I'm curious why corporate development teams always feel the need to spy on their users? Is it not sufficient to employ good engineering and design practices? Git has served us well for 20+ years without detailed analytics over who exactly is using which features and commands. Would Git have been significantly better if it had collected telemetry, or would the data not have just been a distraction?
- embedding-shape 6mo ago
  > Is it not sufficient to employ good engineering and design practices? It's not that it's insufficient, new developers, product people and designers literally don't know how to make tasteful and useful decisions without first "asking users" by experimenting on them. Used to be you built up an intuition for your user base, but considering everyone is changing jobs every year, I guess people don't have time for that anymore, so literally every decision is "data driven" and no user is super happy or not anymore, everyone is just "OK, that's fine".
- j_maffe 6mo ago
  > Would Git have been significantly better if it had collected telemetry, or would the data not have just been a distraction? I'm not sure if you're implying it's obvious but it's not obvious to me that it would be unhelpful.
  - a2128 6mo ago
    Just anecdotally, I get the feeling telemetry often does more harm than good, because it's too easy to misinterpret or lie with statistics. There needs to be proper statistical methodology and biases need to be considered, but this doesn't always happen. Maybe a contrived example, but someone wants to show high impact on their next performance review? Implement the new feature in such a way that everyone easily misclicks it, then show the extremely high engagement as demonstration that their work is a huge success. For Git, I'm not sure it would be widely adopted today if the development process was mainly telemetry-driven rather than Torvalds developing it based solely on his expertise and intuition.
djdillon 6mo ago
FWIW, looks to remain disabled by default for enterprise users.
traceroute66 6mo ago
I suggest anyone who cares, and certainly anybody in the EU mails privacy@github.com and also opens a support ticket to let them know exactly what you think
- binaryturtle 6mo ago
  Wouldn't telemetry solve this problem automatically? I mean: they should get some signal back when people opt-out no? :)
mghackerlady 6mo ago
can someone explain why github has a CLI? why wouldn't you just use git?
- bakies 6mo ago
  PRs, and managing repos, and other things that aren't git features. You can use it to auth with GITHUB_TOKEN instead of ssh or http. Which is how my agents get access. I've switched to gitea, it's got all the same features.
  - mghackerlady 6mo ago
    ah, that's probably why I've never had any use for it. I don't really contribute to any large open source projects and prefer the sourcehut/lkml style of using git
- chris_money202 6mo ago
  gh is insanely powerful, especially if you let your coding agent use it. It’s one of my top tools. Gh lets you use GitHub features such as issues, pull request, reading CI pipelines, creating CI pipelines, etc. git is just for code version control.
- Atreiden 6mo ago
  Creating PRs, reading PRs, creating/reading Issues, triggering actions, to name a few
- none2585 6mo ago
  My last job they used gh features heavily - pull requests, issues, and gha most of all. So having the cli made automating (or interacting with agents) github-specific tasks possible.
- cerved 6mo ago
  You use gh to interact with the forge, git to interact with the repo. For example gh pr checks --watch will run and poll the CI checks of a PR and exit 0 once they all pass
- 6mo ago
bakies 6mo ago
So happy I deployed gitea to my homelab last month. It's got an import feature from github and honestly just faster and better uptime that github. Claude can use it just fine with tea cli and git. It's pretty much a knockoff github, but I think it's better so far.
- huijzer 6mo ago
  I’m running Forgejo which has the same core code and yeah it’s amazing. Faster and better uptime indeed. It even works when my internet goes down because it’s on a Pi 4 here in the cabinet next to my desk Backups are done with borg and syncthing to offsite location. It takes a bit of work setting it up but after that maintenance time is near zero. I just manually SSH in once every two weeks to check SSD space, RAM usage and run apt update and upgrade, and major version bumps
ImJasonH 6mo ago
Do people think that GitHub isn't already collecting and aggregating all the requests sent to their servers, which is after all the entire point of the gh CLI? If you don't want your requests tracked, you're going to have to opt out of a lot more than this one setting.
- pixel_popping 6mo ago
  Data is on their server, so obviously they are already doing it, they just want to increase tracking by knowing what transit as well to Gitlab, Codeberg and such by having additional client-side metrics.
  - ImJasonH 6mo ago
    I did not get that impression from these docs or from a brief look through the gh CLI codebase. Can you point to evidence that makes you believe this is used to collect metrics about requests to other services?
- Xiaoher-C 6mo ago
  [dead]
alex1sa 6mo ago
[dead]
grugdev42 6mo ago
Remember that thing Microsoft does? Embrace, extend, extinguish. The first two have been done. I give it five years before the GH CLI is the only way to interact with GitHub repos. Then the third will also be done, and the cycle is complete.
- square_usual 6mo ago
  > I give it five years before the GH CLI is the only way to interact with GitHub repos. I'll take that bet. How much are you willing to put on it?
- naikrovek 6mo ago
  people that say things like this are exhausting. exhausting. You make it so very easy to classify you straight into the "looney" bin. People said that WSL was EEE for Linux. when that didn't happen, people said that WSL gaining GPU support was EEE. When that didn't happen, people said that WSLg was EEE for Linux. People said that Powershell was EEE for Windows. None of these happened. none of them even appear to have happened, and none of them appear to have even been planned. It's all a hallucination by people that talk like this. It's all imaginary. Show me any evidence of anything like this. ANY AT ALL. Not a hunch, not something that could be interpreted that way, show me the very clear and repeatable steps that Microsoft used in the 90s to EEE something in anything they're doing today. They're too busy copiloting everything and arguing with each other to do this. Show me Microsoft Git with extra features over the open source version. Show me Microsoft Linux with extra features over the open source version. Show me Microsoft ANYTHING with extra features over the open source version they copied, and show me the doors slowly closing behind me. You can't. Because it isn't happening. git repos can't be locked up in the way you're describing. github is a wrapper around git. it would take an enormous amount of work for microsoft to change this fundamental decision in the design of github. GitHub is a git server, over both HTTP and SSH. These are core decisions of the software that everything else sits on top of. If pulling git repos over HTTP or SSH ever stops being supported, so many things are going to stop being supported, that it just won't be useful at all after that point. the gh cli makes api calls, that's all. it just makes api calls easier. it exposes a lot of api calls as friendly commands. it's not something that most of github users are even aware of, much less use. gh is not going to lock someone into a github "ecosystem" A) because such a thing doesn't exist and B) again, most people don't use it. Microsoft is far more likely to kill GitHub because of people with MBAs (aka "morons") who somehow call the shots in business these days. They are not going to pilot into the ground by EEE. They are going to pilot it into the ground because they don't know what they're doing, and they don't know what users want or what they like. That will be the fate of GitHub; incompetence will kill it, not cold, calculating, nefarious competence.
varispeed 6mo ago
pseudoanonymous = euphemism for not anonoymous. Regulators should wake up and fine them hard, so hard to become existential. Make an example for others not to follow.
- xpe 6mo ago
  Being a good regulator is about solving a nearly impossible satisficing problem. You have to follow the law and achieve achieve results with a limited budget and political constraints. Given the priorities of say the FTC or state AGs or the SEC, I don't think GitHub is even a blip on their radar. Of any of the regulators I would hazard to guess that maybe the California Privacy Protection Agency is the most likely to prioritize a look, but I still doubt it. I know lots of idealists -- I went to a public policy school. And in some areas, I am one myself. We need them; they can push for their causes. But if you ever find yourself working as a regulator, you'll find the world is complicated and messy. Regulators that overreach often make things worse for their very causes they support. If you haven't yet, go find some regulators that have to take companies all the way to court and win. I have know some in certain fields. Learn from them. Some would probably really enjoy getting to talk to a disinterested third-party to learn the domain. There are even ways to get involved as a sort of citizen journalist if you want. But these sort of blanket calls for "make an example of GitHub" are probably a waste of time. I think a broader view is needed here. Think about the causal chain of problems and find a link where you have leverage. Then focus your effort on that link. I live in the DC area, where ignorance of how the government works leads to people walking away and not taking you seriously. When tech people put comparable effort into understanding the machinery of government that they do into technology, that is awesome. There are some amazing examples of this if you look around. There are no excuses. Tech people readily accept that they have to work around the warts of their infrastructure. (We are often lucky because we get to rebuild so much software ourselves.) But we forget what it's like to work with systems that have to resist change because they are coordination points between multiple stakeholders. The conflict is by design! Anyhow, we have no excuse to blame the warts in our governmental system. You either fix them or work around them or both. The world is a big broken machine. Almost no individual person is to blame. You just have to understand where to turn the wrench.
0x3o3 6mo ago
just use Radicle and never look back with centralised platforms.
jimmypk 6mo ago
[flagged]
CMay 6mo ago
If you have 3 of your developers spending 80% of their time in an area of the codebase that gets no usage and you don't see a path forward that realistically is likely to increase usage, it can be a better use of developer time to focus them elsewhere or even rethink the feature. The problem I have with a lot of these analytics is that while there are harmless ways to use it, there is this understanding that they could be tying your unique identifier to behavioral patterns which could be used to reconstruct your identity with machine learning. It's even worse if they include timestamps. Why not just expose exactly what telemetry is being sent when it's sent? Like add an option that makes telemetry verbose, but doesn't send it unless you enable it. That way you can evaluate it before you decide to turn it on. Whenever you do the Steam Hardware survey it'll show you what gets sent. This is the right way to do it.
- deleted 6mo ago
  [deleted]
raverbashing 6mo ago
Do you know what doesn't collect telemetry? the old git command in your terminal I think I'll keep using that
Kim_Bruning 6mo ago
dev tools and especially libraries must not have telemetry unless absolutely strictly necessary (and even then!). * Dev tools because you need to be able to trust they don't leak while you're working. Not all sites/locations/customers/projects allow leaks, and it's easier to just blacklist anything that does leak, so you know you can trust your tools, and the same habits, justfiles, etc work everywhere. * libraries that leak deserve a special kind of hell. You add a library to your project, and now it might be leaking without warning. If a lot of libraries decide to leak, your application is now an unmanageable sieve. If you do need to run telemetry, make it opt in or end user only. But if you as developer don't even have control then that's the worst.
tornikeo 6mo ago
Good for GitHub. All companies need this. Some use it to improve products, some use it for less commendable goals. I know HN crowd is allergic to telemetry but if you've ever developed a software as a service, telemetry is indispensable.
- isoprophlex 6mo ago
  God forbid you talk to your users
  - deleted 6mo ago
    [deleted]
  - tornikeo 6mo ago
    Talking is a must. But just like quantum particles, users behave and talk very differently. Just look at gamers - most of them say they _hate_ AI in games, yet they are actively behaving differently, buying games made with AI, using AI, etc.
    - user3939382 6mo ago
      It’s okay if I spy on you without your consent, it’s for your own good. Or my own good. Something like that, is that your point? The ends justify the means? How about respect as a feature, that one you don’t need telemetry to determine.
- Citizen_Lame 6mo ago
  All AI bros are the same. P.S. You look like villain from Temu.
- xpe 6mo ago
  Thinking out loud: what are the best practices to vet a tools' telemetry details? The devil is in the details. A quick summary of my Claude-assisted research at the Gist below. Top of mind is some kind of trusted intermediary service with a vested interest in striking a definable middle ground that is good enough for both sides (users and product-builders) Gist: WIP 31 minutes in still cookin'
greatgib 6mo ago
The current century is the one of enshitification, like a cancer, now there is a whole generation of PM that it is totally ok and legitimate to update your product to add spying of your user's usage. It might seems legit from them, but I'm quite sure that just listening to your user is enough. It is not like they lack an user base ready to interact with them or that they lack of bugs or features to work on. In most cases, the telemetry is more a vanity metric that is rarely used. "Congratz to this team that did the flag that is the most used in the cli". But even for product decision, it is hard to extract conclusions from current usage because what you can and will do today is already dependent on the way the cli is done. A feature might not be used a lot because it is not convenient to do, or not available in a good way compared to an alternative, but usage report will not tell if it was useful or not. In the same way, when I buy a product, often there are a lot of features that I will never use, but that I'm happy to have. And I might not have bought the product, or bought another one if it was not available. But the worse would have the manufacturer remove or disable the feature because it is not used...
lukewarm707 6mo ago
#Telemetry FUCK OFF export DOTNET_CLI_TELEMETRY_OPTOUT=1 export ASTRO_TELEMETRY_DISABLED=1 export GATSBY_TELEMETRY_DISABLED=1 export HOMEBREW_NO_ANALYTICS=1 export NEXT_TELEMETRY_DISABLED=1 export DISABLE_ZAPIER_ANALYTICS=1 export TELEMETRY_DISABLED=1 export GH_TELEMETRY=false
- throwaranay4933 6mo ago
  Also: # Atlas export DISABLE_TELEMETRY=1 # CloudFlare export WRANGLER_SEND_METRICS=false export VERCEL_PLUGIN_TELEMETRY=off # AWS export SAM_CLI_TELEMETRY=0 export CDK_DISABLE_CLI_TELEMETRY=true # ??? export DO_NOT_TRACK=true
  - feelamee 6mo ago
    Also.. Easily opt-out from telemetry collection https://github.com/beatcracker/toptout https://github.com/beatcracker/toptout (last commit 3ya)
lo1tuma 6mo ago
This wouldn’t have happened with Nat Friedman.
ryanshrott 6mo ago
> you're going to have to opt out of a lot more than this one setting The opt-out situation for gh CLI telemetry is actually trickier than it sounds. gh runs in CI/CD pipelines and server environments where you may not want any outbound connections to github.com at all, not because of privacy but because of networking constraints. In those environments, the telemetry being on by default means your CI fails or your Bastion host can't reach GitHub at all. Compare this to git itself, which is entirely local until you explicitly push. The trust model is different: git will never phone home unless you configure it to. gh, being a wrapper around the GitHub API, has to make those calls to function - but that's separate from whether it should also be collecting and uploading your command patterns.
- tensegrist 6mo ago
  > In those environments, the telemetry being on by default means your CI fails or your Bastion host can't reach GitHub at all. i'd be surprised if the inability to submit telemetry is a hard error that crashes the program
  - rtpg 6mo ago
    There are definitely slightly annoying variants of this of "ah the program does its job in 200ms but takes 5s to shutdown timing out trying to send telemetry data". Especially annoying on CLI programs. I have been unpleasantly surprised by several programs outright crashing when not being able to send telemetry data consistently. Though this has usually been when the connection is a bit odd and it is able to send through _some_ stuff but then crashes when it fails later.
    - kippinsula 6mo ago
      ran into this flavor once with a different tool, not gh. our deploy job was consistently about 8s longer than it should've been, turned out a fire-and-forget telemetry POST wasn't actually fire-and-forget when the endpoint got slow. NO_PROXY plus blackholing the host fixed it, but probably the kind of thing you shouldn't have to find via flame graph.
- 6mo ago
deathanatos 6mo ago
I mean, make sense, of course. How else could they possibly know what users want? Run a bug tracker? Use their own software? Have more than one 9 of uptime? /s Corporations can and will do every scummy thing permitted to them by law, so here we are. Until the US grows a backbone on issues of privacy, we shouldn't be surprised, I suppose. But the US won't be growing such a backbone anytime in the near future.
- moi2388 6mo ago
  Use their own software? Microsoft?!
minraws 6mo ago
Fuck Github man, Fuck em'. I mean what even is the point. You lost the AI whatever it was, build a good product and features for developers like you tried to once. And less social media shit, maybe adding better LFS alternative similar to huggingface and stuff. Git isn't the popular choice in game dev because of this assets in tree hosting nonsense, why haven't we fixed it yet. Similarly many edge cases, also finally they built stacked prs but man does it feel a under baked, and what it's like 2+ years late. Please just improve Github, make me feel like I will be missing out if I am not on Github because of the features not because I have to be because of work.
NietTim 6mo ago
There is no such thing as "pseudoanonymous" it's not a thing it does not exist it's an oxymoron.
ConceptJunkie 6mo ago
Do they mean "pseudonymous" telemetry meaning "non-identifying telemetry", or do they mean "pseudoanonymous" telemetry meaning telemetry is that not really anonymous? Those two words have almost exactly opposite meanings, and as stated, they are literally saying they are collecting identifiable data.
- naikrovek 6mo ago
  it means they can see all the telemetry from a single machine, but the identity of the machine is not tied to any human identity or github account. each machine appears to get its own UUID and that's how they "identify" machines.
- layer8 6mo ago
  The page only uses the term “pseudonymous”. “Pseudoanonymous” seems to be an invention of the HN submitter.
Datagenerator 6mo ago
Don't confuse GIT(1) the protocol with this (keep in active memory the EEE tactics).
jw_cook 6mo ago
TL;DR: gh config set telemetry disabled
layer8 6mo ago
*pseudonymous The article doesn’t use the word “pseudoanonymous”, only “pseudonymous”.
goosejuice 6mo ago
This should be opt-in. Force their employees to opt-in if they want. That's plenty of data to make informed decisions.
ptx 6mo ago
Well, that validates my decision not to install it. Of course Microsoft will eventually abuse any trust you place in them and any access you give them. They always do. Don't let Microsoft run code on your machine and don't give them your data.
natas 6mo ago
Soon there will be ads on Github, you'll see.
shevy-java 6mo ago
Microsoft really wants people to stop using GitHub. Hopfully the codeberg people can improve their UI - the UI is the single reason I still use github (and filing issues is super-simple). I could never handle gitlab because I hate their UI. Note that GitHub is in the news in the last some months, negatively. I think we are seeing first wear-and-tear signs. If people are smart, this would be a time where real competition to Microsoft GitHub could work. GitHub without users would be dead. Microsoft seems unable to care - they sold their soul to AI. It is make-it-or-break-it for them now.
- theNotFractured 6mo ago
  Codeberg is just a forgejo server. https://forgejo.org/ https://forgejo.org/
m3kw9 6mo ago
aka, you "anonymous" code will now be trained on our next coding models.
sureglymop 6mo ago
Why does github need a CLI? Some people just seem to want to make their own lives harder...
tpsvca 6mo ago
[flagged]
Henchman21 6mo ago
Doesn't the github cli only utilize their API? As in, the tool is useless without that API? So couldn't they analyze the API instead?
azalemeth 6mo ago
One thing I noticed is that github's "clone" drop down menu used to include instructions on how to do so via git git (i.e. `git clone /path/to/repo`). Now there are only instructions provided by default for `gh`, their client. I can't help but guess if these are related.
deleted 6mo ago
[deleted]
brown9-2 6mo ago
What’s confusing about this is that every gh command is just a wrapper around their API.
TranspectiveDev 6mo ago
[dead]
ZetsuBouKyo 6mo ago
One day, I hope to see servers walking around with cameras, recording customers' reactions to the food for the chefs' feedback.
raxxorraxor 6mo ago
I would very much recommend Gitea here. It is just a better GitHub. Can be integrated in corpo networks just fine, you can have ci/deployment pipeline you completely control. Sure, if you want your repos to be public, you need a host. But honestly they aren't too pricey for offering code, even if prices are currently very high.
mrt181 6mo ago
We need actual usage data. Meanwhile users use frontends on top of gh-cli to not be bothered using gh-cli
nikhilpareek13 6mo ago
[flagged]
yamajun93 6mo ago
The distinction between anonymous and pseudoanonymous matters a lot in practice, even with a unique machine ID hash, there are patterns can still identify users across sessions. Would be good to see a clearer breakdown of whats collected and how it is anonymized.
- ButlerianJihad 6mo ago
  the distinction is that the former is a real word, and the latter is a nonexistent word with no meaning. Are you an LLM?
  - cindyllm 6mo ago
    [dead]
  - yamajun93 6mo ago
    How come pseudoanonymous does not exist? There are definitely some data that can trace the user without factual data https://www.ru.nl/en/staff/researchers/research-data/personal-data-in-research/data-anonymisation https://www.ru.nl/en/staff/researchers/research-data/persona... And well, if I'm an LLM, I'm not, but nowadays that's hard to demonstrate, isn't it?

464 points by ingve 6mo ago

pseudoanonymous means not anonymous. /thread

Love it when a PR is brief: https://github.com/cli/cli/pull/13254 https://github.com/cli/cli/pull/13254 > Removes the env var that gates telemetry, so it will be on by default.

kevincox 6mo ago
Not only on by default, it also isn't possible to disable it seems. It's forced on (other than enterprise it seems)
- dfc 6mo ago
  There is a "How to opt out" section in TFA.

neobrain 6mo ago

tl;dr for opt-out as per https://cli.github.com/telemetry#how-to-opt-out https://cli.github.com/telemetry#how-to-opt-out (any of these work individually): export GH_TELEMETRY=false export DO_NOT_TRACK=true gh config set telemetry disabled (starting from version 2.91.0, which this announcement refers to)

fenaer 6mo ago
$ gh --version gh version 2.90.0 (2026-04-16) https://github.com/cli/cli/releases/tag/v2.90.0 https://github.com/cli/cli/releases/tag/v2.90.0 $ gh config set telemetry disabled ! warning: 'telemetry' is not a known configuration key
- rethab 6mo ago
  v2.91.0 is the one that's going to introduce it: https://github.com/cli/cli/releases/tag/v2.91.0 https://github.com/cli/cli/releases/tag/v2.91.0 Also note that even though you get a warning about an unknown config key, the value is actually set so you're future-proof. Check `grep telemetry ~/.config/gh/config.yml`
NeckBeardPrince 6mo ago
> gh config set telemetry false > ! warning: 'telemetry' is not a known configuration key What's strange is if you check your `~/.config/gh/config.yml` it will put `telemetry: disabled` in there. But it will put anything in that `config.yml` lol. > gh config set this-is-some-random-bullshit aww-shucks > ! warning: 'this-is-some-random-bullshit' is not a known configuration key But in my config.yml is this-is-some-random-bullshit: aww-shucks
deleted 6mo ago
[deleted]
nottorp 6mo ago
... don't forget to recheck this info every update, restore flags that have been "accidentally" reset and set any new flags that they added for "different" telemetry

Kim_Bruning 6mo ago

what's the last version before telemetry... will want to pin there.

herpdyderp 6mo ago
According to their releases page: 2.90.0

wild_pointer 6mo ago

pseudoanonymous, meaning not anonymous? lol

inetknght 6mo ago
Yes, that's exactly what pseudoanonymous means. It's fake-anonymous. It can be trivially de-anonymized.
- ButlerianJihad 6mo ago
  [flagged]

delf 6mo ago

Creator of GitSocial here, check it out if you'd like to have better control of your data and be protected from such things: https://github.com/gitsocial-org/gitsocial https://github.com/gitsocial-org/gitsocial

bugrasan 6mo ago

doesn't this need to be opt-in according to EU GDPR?

msla 6mo ago

I wonder how robust they are against people sending them fake data.

sammy2255 6mo ago

Today I learned GitHub has a CLI. I guess that's like Pornhub having a CLI

embedding-shape 6mo ago
Before GitHub had a CLI, I used cURL (via zsh alises/functions) to open PRs and find what remote/branch a PR is associated with. Today I use a Golang CLI made with ~200K LOC to do essentially the same thing. Yay, efficiency?
falcor84 6mo ago
Seeing how annoying their website interfaces are, I'd actually be open to paying for API/CLI access to porn.
chris_money202 6mo ago
Gh cli is one of the most powerful tools you can give a coding agent imo

a2128 6mo ago

Why we collect telemetry ...our team needs visibility into how features are being used in practice. We use this data to prioritize our work and evaluate whether features are meeting real user needs. I'm curious why corporate development teams always feel the need to spy on their users? Is it not sufficient to employ good engineering and design practices? Git has served us well for 20+ years without detailed analytics over who exactly is using which features and commands. Would Git have been significantly better if it had collected telemetry, or would the data not have just been a distraction?

embedding-shape 6mo ago
> Is it not sufficient to employ good engineering and design practices? It's not that it's insufficient, new developers, product people and designers literally don't know how to make tasteful and useful decisions without first "asking users" by experimenting on them. Used to be you built up an intuition for your user base, but considering everyone is changing jobs every year, I guess people don't have time for that anymore, so literally every decision is "data driven" and no user is super happy or not anymore, everyone is just "OK, that's fine".
j_maffe 6mo ago
> Would Git have been significantly better if it had collected telemetry, or would the data not have just been a distraction? I'm not sure if you're implying it's obvious but it's not obvious to me that it would be unhelpful.
- a2128 6mo ago
  Just anecdotally, I get the feeling telemetry often does more harm than good, because it's too easy to misinterpret or lie with statistics. There needs to be proper statistical methodology and biases need to be considered, but this doesn't always happen. Maybe a contrived example, but someone wants to show high impact on their next performance review? Implement the new feature in such a way that everyone easily misclicks it, then show the extremely high engagement as demonstration that their work is a huge success. For Git, I'm not sure it would be widely adopted today if the development process was mainly telemetry-driven rather than Torvalds developing it based solely on his expertise and intuition.

djdillon 6mo ago

FWIW, looks to remain disabled by default for enterprise users.

traceroute66 6mo ago

I suggest anyone who cares, and certainly anybody in the EU mails privacy@github.com and also opens a support ticket to let them know exactly what you think

binaryturtle 6mo ago
Wouldn't telemetry solve this problem automatically? I mean: they should get some signal back when people opt-out no? :)

mghackerlady 6mo ago

can someone explain why github has a CLI? why wouldn't you just use git?

bakies 6mo ago
PRs, and managing repos, and other things that aren't git features. You can use it to auth with GITHUB_TOKEN instead of ssh or http. Which is how my agents get access. I've switched to gitea, it's got all the same features.
- mghackerlady 6mo ago
  ah, that's probably why I've never had any use for it. I don't really contribute to any large open source projects and prefer the sourcehut/lkml style of using git
chris_money202 6mo ago
gh is insanely powerful, especially if you let your coding agent use it. It’s one of my top tools. Gh lets you use GitHub features such as issues, pull request, reading CI pipelines, creating CI pipelines, etc. git is just for code version control.
Atreiden 6mo ago
Creating PRs, reading PRs, creating/reading Issues, triggering actions, to name a few
none2585 6mo ago
My last job they used gh features heavily - pull requests, issues, and gha most of all. So having the cli made automating (or interacting with agents) github-specific tasks possible.
cerved 6mo ago
You use gh to interact with the forge, git to interact with the repo. For example gh pr checks --watch will run and poll the CI checks of a PR and exit 0 once they all pass
6mo ago

bakies 6mo ago

So happy I deployed gitea to my homelab last month. It's got an import feature from github and honestly just faster and better uptime that github. Claude can use it just fine with tea cli and git. It's pretty much a knockoff github, but I think it's better so far.

huijzer 6mo ago
I’m running Forgejo which has the same core code and yeah it’s amazing. Faster and better uptime indeed. It even works when my internet goes down because it’s on a Pi 4 here in the cabinet next to my desk Backups are done with borg and syncthing to offsite location. It takes a bit of work setting it up but after that maintenance time is near zero. I just manually SSH in once every two weeks to check SSD space, RAM usage and run apt update and upgrade, and major version bumps

ImJasonH 6mo ago

Do people think that GitHub isn't already collecting and aggregating all the requests sent to their servers, which is after all the entire point of the gh CLI? If you don't want your requests tracked, you're going to have to opt out of a lot more than this one setting.

pixel_popping 6mo ago
Data is on their server, so obviously they are already doing it, they just want to increase tracking by knowing what transit as well to Gitlab, Codeberg and such by having additional client-side metrics.
- ImJasonH 6mo ago
  I did not get that impression from these docs or from a brief look through the gh CLI codebase. Can you point to evidence that makes you believe this is used to collect metrics about requests to other services?
Xiaoher-C 6mo ago
[dead]

alex1sa 6mo ago

[dead]

grugdev42 6mo ago

Remember that thing Microsoft does? Embrace, extend, extinguish. The first two have been done. I give it five years before the GH CLI is the only way to interact with GitHub repos. Then the third will also be done, and the cycle is complete.

square_usual 6mo ago
> I give it five years before the GH CLI is the only way to interact with GitHub repos. I'll take that bet. How much are you willing to put on it?
naikrovek 6mo ago
people that say things like this are exhausting. exhausting. You make it so very easy to classify you straight into the "looney" bin. People said that WSL was EEE for Linux. when that didn't happen, people said that WSL gaining GPU support was EEE. When that didn't happen, people said that WSLg was EEE for Linux. People said that Powershell was EEE for Windows. None of these happened. none of them even appear to have happened, and none of them appear to have even been planned. It's all a hallucination by people that talk like this. It's all imaginary. Show me any evidence of anything like this. ANY AT ALL. Not a hunch, not something that could be interpreted that way, show me the very clear and repeatable steps that Microsoft used in the 90s to EEE something in anything they're doing today. They're too busy copiloting everything and arguing with each other to do this. Show me Microsoft Git with extra features over the open source version. Show me Microsoft Linux with extra features over the open source version. Show me Microsoft ANYTHING with extra features over the open source version they copied, and show me the doors slowly closing behind me. You can't. Because it isn't happening. git repos can't be locked up in the way you're describing. github is a wrapper around git. it would take an enormous amount of work for microsoft to change this fundamental decision in the design of github. GitHub is a git server, over both HTTP and SSH. These are core decisions of the software that everything else sits on top of. If pulling git repos over HTTP or SSH ever stops being supported, so many things are going to stop being supported, that it just won't be useful at all after that point. the gh cli makes api calls, that's all. it just makes api calls easier. it exposes a lot of api calls as friendly commands. it's not something that most of github users are even aware of, much less use. gh is not going to lock someone into a github "ecosystem" A) because such a thing doesn't exist and B) again, most people don't use it. Microsoft is far more likely to kill GitHub because of people with MBAs (aka "morons") who somehow call the shots in business these days. They are not going to pilot into the ground by EEE. They are going to pilot it into the ground because they don't know what they're doing, and they don't know what users want or what they like. That will be the fate of GitHub; incompetence will kill it, not cold, calculating, nefarious competence.

varispeed 6mo ago

pseudoanonymous = euphemism for not anonoymous. Regulators should wake up and fine them hard, so hard to become existential. Make an example for others not to follow.

xpe 6mo ago
Being a good regulator is about solving a nearly impossible satisficing problem. You have to follow the law and achieve achieve results with a limited budget and political constraints. Given the priorities of say the FTC or state AGs or the SEC, I don't think GitHub is even a blip on their radar. Of any of the regulators I would hazard to guess that maybe the California Privacy Protection Agency is the most likely to prioritize a look, but I still doubt it. I know lots of idealists -- I went to a public policy school. And in some areas, I am one myself. We need them; they can push for their causes. But if you ever find yourself working as a regulator, you'll find the world is complicated and messy. Regulators that overreach often make things worse for their very causes they support. If you haven't yet, go find some regulators that have to take companies all the way to court and win. I have know some in certain fields. Learn from them. Some would probably really enjoy getting to talk to a disinterested third-party to learn the domain. There are even ways to get involved as a sort of citizen journalist if you want. But these sort of blanket calls for "make an example of GitHub" are probably a waste of time. I think a broader view is needed here. Think about the causal chain of problems and find a link where you have leverage. Then focus your effort on that link. I live in the DC area, where ignorance of how the government works leads to people walking away and not taking you seriously. When tech people put comparable effort into understanding the machinery of government that they do into technology, that is awesome. There are some amazing examples of this if you look around. There are no excuses. Tech people readily accept that they have to work around the warts of their infrastructure. (We are often lucky because we get to rebuild so much software ourselves.) But we forget what it's like to work with systems that have to resist change because they are coordination points between multiple stakeholders. The conflict is by design! Anyhow, we have no excuse to blame the warts in our governmental system. You either fix them or work around them or both. The world is a big broken machine. Almost no individual person is to blame. You just have to understand where to turn the wrench.

0x3o3 6mo ago

just use Radicle and never look back with centralised platforms.

jimmypk 6mo ago

[flagged]

CMay 6mo ago

If you have 3 of your developers spending 80% of their time in an area of the codebase that gets no usage and you don't see a path forward that realistically is likely to increase usage, it can be a better use of developer time to focus them elsewhere or even rethink the feature. The problem I have with a lot of these analytics is that while there are harmless ways to use it, there is this understanding that they could be tying your unique identifier to behavioral patterns which could be used to reconstruct your identity with machine learning. It's even worse if they include timestamps. Why not just expose exactly what telemetry is being sent when it's sent? Like add an option that makes telemetry verbose, but doesn't send it unless you enable it. That way you can evaluate it before you decide to turn it on. Whenever you do the Steam Hardware survey it'll show you what gets sent. This is the right way to do it.

deleted 6mo ago
[deleted]

raverbashing 6mo ago

Do you know what doesn't collect telemetry? the old git command in your terminal I think I'll keep using that

Kim_Bruning 6mo ago

dev tools and especially libraries must not have telemetry unless absolutely strictly necessary (and even then!). * Dev tools because you need to be able to trust they don't leak while you're working. Not all sites/locations/customers/projects allow leaks, and it's easier to just blacklist anything that does leak, so you know you can trust your tools, and the same habits, justfiles, etc work everywhere. * libraries that leak deserve a special kind of hell. You add a library to your project, and now it might be leaking without warning. If a lot of libraries decide to leak, your application is now an unmanageable sieve. If you do need to run telemetry, make it opt in or end user only. But if you as developer don't even have control then that's the worst.

tornikeo 6mo ago

Good for GitHub. All companies need this. Some use it to improve products, some use it for less commendable goals. I know HN crowd is allergic to telemetry but if you've ever developed a software as a service, telemetry is indispensable.

isoprophlex 6mo ago
God forbid you talk to your users
- deleted 6mo ago
  [deleted]
- tornikeo 6mo ago
  Talking is a must. But just like quantum particles, users behave and talk very differently. Just look at gamers - most of them say they _hate_ AI in games, yet they are actively behaving differently, buying games made with AI, using AI, etc.
  - user3939382 6mo ago
    It’s okay if I spy on you without your consent, it’s for your own good. Or my own good. Something like that, is that your point? The ends justify the means? How about respect as a feature, that one you don’t need telemetry to determine.
Citizen_Lame 6mo ago
All AI bros are the same. P.S. You look like villain from Temu.
xpe 6mo ago
Thinking out loud: what are the best practices to vet a tools' telemetry details? The devil is in the details. A quick summary of my Claude-assisted research at the Gist below. Top of mind is some kind of trusted intermediary service with a vested interest in striking a definable middle ground that is good enough for both sides (users and product-builders) Gist: WIP 31 minutes in still cookin'

greatgib 6mo ago

The current century is the one of enshitification, like a cancer, now there is a whole generation of PM that it is totally ok and legitimate to update your product to add spying of your user's usage. It might seems legit from them, but I'm quite sure that just listening to your user is enough. It is not like they lack an user base ready to interact with them or that they lack of bugs or features to work on. In most cases, the telemetry is more a vanity metric that is rarely used. "Congratz to this team that did the flag that is the most used in the cli". But even for product decision, it is hard to extract conclusions from current usage because what you can and will do today is already dependent on the way the cli is done. A feature might not be used a lot because it is not convenient to do, or not available in a good way compared to an alternative, but usage report will not tell if it was useful or not. In the same way, when I buy a product, often there are a lot of features that I will never use, but that I'm happy to have. And I might not have bought the product, or bought another one if it was not available. But the worse would have the manufacturer remove or disable the feature because it is not used...

lukewarm707 6mo ago

#Telemetry FUCK OFF export DOTNET_CLI_TELEMETRY_OPTOUT=1 export ASTRO_TELEMETRY_DISABLED=1 export GATSBY_TELEMETRY_DISABLED=1 export HOMEBREW_NO_ANALYTICS=1 export NEXT_TELEMETRY_DISABLED=1 export DISABLE_ZAPIER_ANALYTICS=1 export TELEMETRY_DISABLED=1 export GH_TELEMETRY=false

throwaranay4933 6mo ago
Also: # Atlas export DISABLE_TELEMETRY=1 # CloudFlare export WRANGLER_SEND_METRICS=false export VERCEL_PLUGIN_TELEMETRY=off # AWS export SAM_CLI_TELEMETRY=0 export CDK_DISABLE_CLI_TELEMETRY=true # ??? export DO_NOT_TRACK=true
- feelamee 6mo ago
  Also.. Easily opt-out from telemetry collection https://github.com/beatcracker/toptout https://github.com/beatcracker/toptout (last commit 3ya)

lo1tuma 6mo ago

This wouldn’t have happened with Nat Friedman.

ryanshrott 6mo ago

> you're going to have to opt out of a lot more than this one setting The opt-out situation for gh CLI telemetry is actually trickier than it sounds. gh runs in CI/CD pipelines and server environments where you may not want any outbound connections to github.com at all, not because of privacy but because of networking constraints. In those environments, the telemetry being on by default means your CI fails or your Bastion host can't reach GitHub at all. Compare this to git itself, which is entirely local until you explicitly push. The trust model is different: git will never phone home unless you configure it to. gh, being a wrapper around the GitHub API, has to make those calls to function - but that's separate from whether it should also be collecting and uploading your command patterns.

tensegrist 6mo ago
> In those environments, the telemetry being on by default means your CI fails or your Bastion host can't reach GitHub at all. i'd be surprised if the inability to submit telemetry is a hard error that crashes the program
- rtpg 6mo ago
  There are definitely slightly annoying variants of this of "ah the program does its job in 200ms but takes 5s to shutdown timing out trying to send telemetry data". Especially annoying on CLI programs. I have been unpleasantly surprised by several programs outright crashing when not being able to send telemetry data consistently. Though this has usually been when the connection is a bit odd and it is able to send through _some_ stuff but then crashes when it fails later.
  - kippinsula 6mo ago
    ran into this flavor once with a different tool, not gh. our deploy job was consistently about 8s longer than it should've been, turned out a fire-and-forget telemetry POST wasn't actually fire-and-forget when the endpoint got slow. NO_PROXY plus blackholing the host fixed it, but probably the kind of thing you shouldn't have to find via flame graph.
6mo ago

deathanatos 6mo ago

I mean, make sense, of course. How else could they possibly know what users want? Run a bug tracker? Use their own software? Have more than one 9 of uptime? /s Corporations can and will do every scummy thing permitted to them by law, so here we are. Until the US grows a backbone on issues of privacy, we shouldn't be surprised, I suppose. But the US won't be growing such a backbone anytime in the near future.

moi2388 6mo ago
Use their own software? Microsoft?!

minraws 6mo ago

Fuck Github man, Fuck em'. I mean what even is the point. You lost the AI whatever it was, build a good product and features for developers like you tried to once. And less social media shit, maybe adding better LFS alternative similar to huggingface and stuff. Git isn't the popular choice in game dev because of this assets in tree hosting nonsense, why haven't we fixed it yet. Similarly many edge cases, also finally they built stacked prs but man does it feel a under baked, and what it's like 2+ years late. Please just improve Github, make me feel like I will be missing out if I am not on Github because of the features not because I have to be because of work.

NietTim 6mo ago

There is no such thing as "pseudoanonymous" it's not a thing it does not exist it's an oxymoron.

ConceptJunkie 6mo ago

Do they mean "pseudonymous" telemetry meaning "non-identifying telemetry", or do they mean "pseudoanonymous" telemetry meaning telemetry is that not really anonymous? Those two words have almost exactly opposite meanings, and as stated, they are literally saying they are collecting identifiable data.

naikrovek 6mo ago
it means they can see all the telemetry from a single machine, but the identity of the machine is not tied to any human identity or github account. each machine appears to get its own UUID and that's how they "identify" machines.
layer8 6mo ago
The page only uses the term “pseudonymous”. “Pseudoanonymous” seems to be an invention of the HN submitter.

Datagenerator 6mo ago

Don't confuse GIT(1) the protocol with this (keep in active memory the EEE tactics).

jw_cook 6mo ago

TL;DR: gh config set telemetry disabled

layer8 6mo ago

*pseudonymous The article doesn’t use the word “pseudoanonymous”, only “pseudonymous”.

goosejuice 6mo ago

This should be opt-in. Force their employees to opt-in if they want. That's plenty of data to make informed decisions.

ptx 6mo ago

Well, that validates my decision not to install it. Of course Microsoft will eventually abuse any trust you place in them and any access you give them. They always do. Don't let Microsoft run code on your machine and don't give them your data.

natas 6mo ago

Soon there will be ads on Github, you'll see.

shevy-java 6mo ago

Microsoft really wants people to stop using GitHub. Hopfully the codeberg people can improve their UI - the UI is the single reason I still use github (and filing issues is super-simple). I could never handle gitlab because I hate their UI. Note that GitHub is in the news in the last some months, negatively. I think we are seeing first wear-and-tear signs. If people are smart, this would be a time where real competition to Microsoft GitHub could work. GitHub without users would be dead. Microsoft seems unable to care - they sold their soul to AI. It is make-it-or-break-it for them now.

theNotFractured 6mo ago
Codeberg is just a forgejo server. https://forgejo.org/ https://forgejo.org/

m3kw9 6mo ago

aka, you "anonymous" code will now be trained on our next coding models.

sureglymop 6mo ago

Why does github need a CLI? Some people just seem to want to make their own lives harder...

tpsvca 6mo ago

[flagged]

Henchman21 6mo ago

Doesn't the github cli only utilize their API? As in, the tool is useless without that API? So couldn't they analyze the API instead?

azalemeth 6mo ago

One thing I noticed is that github's "clone" drop down menu used to include instructions on how to do so via git git (i.e. `git clone /path/to/repo`). Now there are only instructions provided by default for `gh`, their client. I can't help but guess if these are related.

deleted 6mo ago

[deleted]

brown9-2 6mo ago

What’s confusing about this is that every gh command is just a wrapper around their API.

TranspectiveDev 6mo ago

[dead]

ZetsuBouKyo 6mo ago

One day, I hope to see servers walking around with cameras, recording customers' reactions to the food for the chefs' feedback.

raxxorraxor 6mo ago

I would very much recommend Gitea here. It is just a better GitHub. Can be integrated in corpo networks just fine, you can have ci/deployment pipeline you completely control. Sure, if you want your repos to be public, you need a host. But honestly they aren't too pricey for offering code, even if prices are currently very high.

mrt181 6mo ago

We need actual usage data. Meanwhile users use frontends on top of gh-cli to not be bothered using gh-cli

nikhilpareek13 6mo ago

[flagged]

yamajun93 6mo ago

The distinction between anonymous and pseudoanonymous matters a lot in practice, even with a unique machine ID hash, there are patterns can still identify users across sessions. Would be good to see a clearer breakdown of whats collected and how it is anonymized.

ButlerianJihad 6mo ago
the distinction is that the former is a real word, and the latter is a nonexistent word with no meaning. Are you an LLM?
- cindyllm 6mo ago
  [dead]
- yamajun93 6mo ago
  How come pseudoanonymous does not exist? There are definitely some data that can trace the user without factual data https://www.ru.nl/en/staff/researchers/research-data/personal-data-in-research/data-anonymisation https://www.ru.nl/en/staff/researchers/research-data/persona... And well, if I'm an LLM, I'm not, but nowadays that's hard to demonstrate, isn't it?