Hacker News Reader

Comment by LeoPanthera | Hacker News Reader

Set HOMEBREW_NO_ANALYTICS=1 to opt out.

The right thing to do would be to make it opt in, not opt out. (Which would not be without precedent. Debian's popcon is opt-in.)

View on HN

Disagree. Google Analytics is a network of companies that has agreed to privately collection information about users without their permission or even knowledge. It is malware that should not be included in Homebrew. The only ethical decision we can make as developers is not to use it.

Yeah, I'll confess that this is a real deal breaker for me personally .. I'll be having a closer look at ports and maybe fink soon. Maybe after all its time to get off OSX and back to Linux, where these sorts of things happen less frequently ..

Or you could just say HOMEBREW_NO_ANALYTICS=1 and be done with it.

Until next month when we might need to set HOMEBREW_NO_PIWIK=1337...

I'd assume "NO_ANALYTICS" would mean "no analytics" not "no google analytics?

I'd assume that software that wasn't sending analytics wouldn't start doing so without at least informing me first, but I'd be wrong. I think the parents point is that we can't trust Homebrew to do the right thing, because they've now chosen not to.

Who knows!? This marks quite a change in attitude where the end user is suddenly responsible for staying on top of newly silently introduced opt-out settings. I'm pretty disappointed and feel the amount of trust I've had in the maintainers have dropped considerably. Sneakily sending random HTTP requests to third party analytics services and stuffing my dotfiles with unique identifiers for tracking purposes is not what I expected from a friendly open source project.

This could have been handled much better with some sort of opt-in prompt like the debian installer does for its popcon usage tracker.

>This marks quite a change in attitude where the end user is suddenly responsible for staying on top of newly silently introduced opt-out settings. I'm pretty disappointed and feel the amount of trust I've had in the maintainers have dropped considerably.

I agree with you. I'd much rather have this be out in the open - like, ever 5th time I run 'brew' or something, it asks me for permission to send analytics, and the options are "YES-once, YES-Always, NO-NEVER", and if I say NO, NEVER, it never asks me again.

If spying on me can be automated, so can not spying on me.

Yep, and as you can see if you read the code there are as few references to GA as possible so that it’d be easy to change the service we use without editing code everywhere.

Maybe try out Nix while you're at it, too! I'm using NixOS, and I'm pretty happy with it so far. The standalone package manager fills the same niche as Homebrew, I think.

I only use Linux, so what do I know, but... is the highly interesting Nix package manager a full alternative to Homebrew ?

If it means that much to you, why not add host file entries to point GA's DNS records at 0.0.0.0 or something else invalid? If you don't trust that either, supplement it with packet filter rules to drop traffic heading to the IP addresses to which those names (currently) resolve. Switching platforms seems like a major overreaction here.

Privacy should be the default.

Only if you're willing to pay for it. Otherwise, you trade privacy for convenience, or some other benefit.

Its, of course, always your choice if you're willing to trade it for something.

There is a lot of free, open and convenient software that respects my privacy.

Do you think money or privacy violations must be part of the equation to make good software?

That is like the old argument against free/open software that I heard from a lot of people, back in the 90's. I thought we were past that.

Its a huge hassle, and I don't want to have to keep fighting the battle against this policy. So I'll just rather switch.

Would be somehow more ethical if they set up their own piwik instance to collect the same data?

Collecting telemetry is reasonably, but it seems inappropriate for Google to get a copy and to be able to identify which of their users installed a particular piece of software from the IP address.

So yes. Running their own server would be much preferable.

For Homebrew:

> The Google Analytics anonymous IP setting is enabled i.e. 1 (https://developers.google.com/analytics/devguides/collection...)

It's worth noting that AIP's functionality requires you to trust Google -- the data is received by them, but their design specifies that they mask it before it's processed or stored.

Or so they claim.

While I feel we should all treat Google with skepticism here, I didn't realize they (and so failed to acknowledge) that Homebrew was attempting to remedy that, so I apologize for speaking out of turn.

I think it would be, yes. At least, it would not get into the hands of an external 3rd party (that as we know, lives from selling / using data they gather from people).

Google does not use GA data unless the webmaster chooses to share it with them.

I'm not sure if they use it to improve their ad products, but I wouldn't be surprised if the answer is no.

Firstly, this is a decision that should be up to the user, not the webmaster.

Secondly, do you have a source for that? I find that a very dubious claim, from a business perspective.

"We use the information we collect from all of our services to provide, maintain, protect and improve them, to develop new ones, and to protect Google and our users. We also use this information to offer you tailored content – like giving you more relevant search results and ads."

https://www.google.com/intl/en/policies/privacy/

"When you visit a website that uses our advertising products (like AdSense), social products (like the +1 button) or analytics tools (Google Analytics), your web browser automatically sends certain information to Google... When you visit websites or use apps that use Google technologies, we may use the information we receive from those websites and apps..."

https://www.google.com/policies/privacy/partners/

It should be noted this does not directly contradict what GP claims.

Also related:

"""

Google Analytics protects the confidentiality of Google Analytics data in several ways:

Google Analytics data may not be shared without customer consent, except under certain limited circumstances, such as when required by law.

Security-dedicated engineering teams at Google guard against external threats to data. Internal access to data (e.g., by employees) is regulated and subject to the Employee Access Controls and Procedures.

"""

https://support.google.com/analytics/answer/6004245?hl=en

That seems to say Google won't share your Analytics data without making any guarantee that they won't _use_ your analytics data.

> protects the confidentiality

For their definition of "confidential", which they can change at any time.

> certain limited circumstances

If they only intended the "required by law" example, they wouldn't use such a broad - and completely undefined - set of circumstances.

> guard against external threats

Google may have good security practices now, but an continually growing collection of highly-revealing tracking data is a very tempting target for many businesses, governments, etc. If Google (or anybody else) wants to claim that they are protecting your data, they should indemnify the subjects of their spying against any damages those caused by those "external threats".

>they should indemnify the subjects of their spying against any damages those caused by those "external threats"

I despise GA as much as the next guy, but you'd have to be pretty crazy to expect any business to provide such a guarantee. Google isn't your insurance company.

I don't really expect that anyone would make that kind of guarantee; I'm arguing in the style of a proof by contradiction. These businesses shouldn't be making this kind of claim, and they shouldn't be holding onto data beyond what is necessary. Data should be expunged as soon as possible, because then there isn't anything to protect.

Businesses are acting like there is no risk in holding personal information. When people complain, they respond with claims that the data is safe. When businesses act like they are secured and that we should trust them, we should be asking them to stand behind those claims. I agree, this is crazy, but businesses really want to make strong claims but not be bound by those claims. An honest business that actually believed in their own promises shouldn't have problem putting those promises into a formal guarantee.

>I don't really expect that anyone would make that kind of guarantee

Yet you do seem to expect that guarantee:

> An honest business that actually believed in their own promises shouldn't have problem putting those promises into a formal guarantee.

You can't use such guarantees to vet businesses because no sane company would meet your requirements!

> this is a decision that should be up to the user, not the webmaster.

This may be a dumb example, but if I get someone (I don't know very well) a glass of water from the kitchen, I won't take a little sip from it on the way. Yes, they might not care, and it's super unlikely that I would infect them with anything. But it's still not my call, and you only need to see someone not get something so basic once to lose a lot of trust in them, certainly if they actually start arguing about it. It's more than optional courtesy, it's a respect for boundaries and personal choices.

And it doesn't matter at all how much they are doing otherwise for you, that is orthogonal. By that I mean: nobody asked anyone to make something for free, we're just asking people to not unwittingly have them feed GA if they don't want to. If there are too many things to fix and too few developers, fix fewer things. It's just homebrew, not cancercure. If enough users disagree with that, let them all opt-in and/or volunteer their own time, problem solved either way.

If enough users disagree with that, let them take over maintenance of homebrew.

But nobody actually cares that much, only enough to complain. At length.

Everyone who has signed up for GA knows it. When you sign up you are asked 2 questions:

Do you want to share data with google to imrpove our products?

Do you want to pool your data for benchmarking purposes?

Both are unchecked by default. But here you go, I will search for "google analytics data sharing" for you.

https://support.google.com/analytics/answer/1011397?hl=en

We don’t have the resources for this. If you have any suggestion for a service that doesn’t require us time to manage we’d be very grateful. Homebrew have a dozen maintainers for >30 PRs & issues per day plus maintaining our own CI infrastructure plus normal development; and all of this is on our spare time.

As a Homebrew user, thanks for your efforts. I'm totally fine with the change myself, and I apologize for everyone else in here who cares about their privacy, but doesn't really care about the time volunteers are committing, nor the time savings from this feature.

I concur, thank you for wanting to do a better job with readily available tools that are widely used and easy to implement. I support your use of GA.

So the project is short-handed, but wants to take on scouring analytics to start packaging common things people are doing with the software.

If you're too busy to do this "right" why bother? Are you hoping making more shortcuts will increase adoption?

Current employer doesn't much care about these things, but last employer did. Having shared this thread with their IT folks, they've decided to cut people off from homebrew while they figure it out.

I guess costing yourself users is one way to free up some time.

As I wrote we’d be very grateful if you had any suggestion.

Have you tried getting donations for the project? Have you tried joining a foundation that supports open source projects (like Apache)?

Yes we recently joined the Software Freedom Conservancy so we can now accept donations.

Add a feature where users can opt-in for periodic reports to be uploaded as a private gist, and a link is transmitted to you. GitHub is already a trusted party where Homebrew is concerned, so the loss of privacy is minimal. Users control their own GitHub accounts, so they control of the permanence of the data you collect on them. You can use Google Forms to transmit the links, so your infrastructure is cheap-to-free. For bonus points, encrypt the links with your public key.

How does that sound?

We don’t want personal data; we only care about aggregation. Being able to link each gist to its owner would be a privacy issue here.

Excellent point, I should've thought of that.

I'm always amused by the way some people try to extend the definition of malware beyond its scope. This isn't malware. It's just anonymous usage tracking. If you don't like it you can turn it off. I hope you don't use a smartphone because the amount of intrinsic "malware" you must be subjected to must be unbearable.

"Malware" is an umbrella term used to refer to a variety of forms of hostile or intrusive software, including computer viruses, worms, trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software.

I didn't say that this usage of GA is malware, I said that GA, the network, is a malware. So while Homebrew may (or may not) be protecting their users identities while using a malware service, they are still choosing to use a malware service.

Tracking people's online activity through a large percentage of the internet, without their consent or even knowledge qualifies as malicious to me.

But surely you can see the similarity here. The tracking software wasn't in Homebrew before, is added without asking you when you update, and is completely useless to you as a user but builds information about you and sends it to a third party.

If it's not malware, it's certainly really similar to it.

It is used to improve the product, why is this useless to the user?

Software that ships Ask Toolbar in their installer say it's to improve the product as well.

never underestimate people's principled paranoia rofl

Definitions vary, but I once wrote these notes for the definition in a security policy. It is probably more broad than what some people would write.

    Malware
    -------
    - Any software that actively attempts to do any of the following:
	- Do harm to the system, applications or data
	- Deliberately weakens system security
	    - By changing system or user security settings
	    - Contains or installs backdoors
	    - Downloads updates as executables
	    - Use executables to wrap otherwise readable data
	    - Expects higher or more privileges than is needed by it's function.
	- Circumvent the wishes or intention of the user
	    - Makes it self the default application for file-types that already have an application assigned to them
	    - Inserts itself into other applications against the users expectation (eg. as a plugin)
	    - Uses the privileges of other applications to circumvent system policy
	- Hide its activity from inspection
	    - Anti-debugging, and other rootkit like behaviour
	- Use "dark patterns" to trick the user into performing or agreeing to some action
	    - Installs toolbars, etc.
	- Compromise the privacy of the user
	    - Phones home, access data irrelevant to it's function
	- Resists removal

I don't see how GA can be classified as malware according to this.

Phones home...

It does not compromise the user's privacy in any way. GA prohibits PII. Also, the webmaster has to opt-in to share the data with Google in the first place.

Some people disagree. If they didn't, why is this on HN with a lot of comments from people who a unhappy with this change?

If software compromises my privacy, I feel that I have been betrayed and lost something that I can not take back.

If you don't get to automatically participate in a "anonymous" usage survey, have you lost something you can not undo?

That in my opinion, is why software should always err on the side of privacy.

People just LOOVE to be outraged. For example in this thread people rage about google getting hands on their data. When I point out that the webmaster has to explicitly chose to share the data with google, I get downvoted. When I say that GA prohibits the use of PII, I get downvoted. It doesn't matter that I'm right. People WANT to be outraged. Reason, no reason, doesn't matter.

Chill, dude. Most of us dislike GA and its monopoly on web/mobile tracking. Why trust GA to respect webmaster options when you don't have to?

...anyway, complaining about getting downvoted is a surefire way to keep getting downvoted :P

Automatically opting a user into data collection, without explicitly asking the user, is a dark pattern.

Requiring the user to set an environment variable to opt out is smarmy.

Does Homebrew's UUID linked with the user's Google Analytics ID in their browser cookies?

It certainly appears not. They're using curl and reporting a UID they generate.

   A Homebrew analytics user ID e.g. 1BAB65CC-FE7F-4D8C-AB45-B7DB5A6BA9CB. This 
   is generated by uuidgen and stored in ~/.homebrew_analytics_user_uuid. This 
   does not allow us to track individual users but does enable us to accurately 
   measure user counts vs. event counts

https://github.com/Homebrew/brew/blob/master/share/doc/homeb...

Of course, you have to trust homebrew, but hell, you're already running their software, so it's a little late.

You can always even check the code that’s running on your own computer. If you installed Homebrew in /usr/local the relevant files are /usr/local/Library/Homebrew/utils/analytics.sh and /usr/local/Library/Homebrew/utils/analytics.rb.

Indeed! Feel free to demand a refund or refer to the contract you signed... Nobody's forcing anyone to use it.

This is the sort of defeatist and way-too-easy attitude that turns things to garbage all around. In many ways, bringing up issues that affect many opinionated people's core values is how things get fixed. If this was said for everything that was free, then we wouldn't have anything.

For example: "Linux has issues" "It's free. Nobody's forcing you to use it."

"FreeBSD has issues.." "It's Free. Nobody's forcing you to use it."

"I had a hard time installing Gentoo because of bad documentation. Somebody should fix that. No, seriously, metaland." "It's Free. Nobody's forcing you to use it."

I'm all for "beggars can't be choosers", but when there's nothing else to choose, of course people are going to complain.

The usage license we agreed to means we can fork it and remove this nonsense spyware.

That's probably true, but then no one would opt-in.

This is software, they can just ask instead!

Which might break some scripts that expect home brew not to require user input. The right way to do it would be to ask if a terminal was available but in reality, scripts are not careful enough to tell applications that they are in fact headless. I've seen some scripts break under that assumption.

Did it print a warning when upgrading on terminal?

They could have a prompt with a countdown, you opt in it you don't say 'no' after a minute.

That's kinda the point.

...which is very telling.

As in, people want privacy at the expense of volunteer time.

Simple solution: Charge people for using Homebrew who don't want to send analytics in, fund Homebrew development with those funds. Otherwise, its an external cost being foisted on the volunteers by developers who want privacy at the cost of additional volunteer time.

EDIT: The tone of this thread is the exact problem with open source projects and participation. "I want a say, but I'm not willing to contribute in any way except use your tool you're providing for free." Sad, but expected.

I think most people aren't concerned so much about sharing usage data. The problem is specifically the way it's being shared via a third party. Other apps ask if I mind sharing some data (e.g., Firefox), and I don't have a problem with that.

Okay. Is everyone going to pony up for a self-hosted analytics box and the time to manage it? No? Of course not. Everyone wants to complain, no one would contribute resources to do it though. Privacy has a high moral value (its free to want it and complain about it), but small economic value (you use Chrome? It sends everything you do back to Google. You'll still use it, because its better than not).

a HN thread is not the appropriate place to ask for resources for a project.

There are many OS projects out there with larger needs than an analytics server that have managed to get the support they need. If resources are an ongoing problem you even have the option of applying to join a free software foundation like Apache that has resources.

> join a free software foundation like Apache that has resources

There's a reciprocal arrangement here. One of the requirements of joining the Apache Software Foundation is using "Apache" when refering to the name of the software product for the first time in a new context, e.g. first mention on a webpage. Apache Groovy was promoted from Apache's incubator last November (2015), so I've been doing just that ever since. Unfortunately, many of the developers who work on Groovy don't bother, availing themselves of those resources but not giving back to the foundation the small amount asked.

Just like open-source doesn't come with warranties from the creator, it also doesn't come with obligations to the end user other than to abide by the license.

You use Homebrew. In return, you send anonymous stats to save the developers time. If you'd prefer not to, set the env var or stop using Homebrew.

Alternatively, fork it, take out the modifications, and run your own version of Homebrew. But that takes time, and effort; that same time and effort homebrew devs are trying to save with a feature. Why is your time as a user valuable but the Homebrew dev's time not?

Not necessarily. Opting in takes effort, and people aren't really seeing any reward, so they would be less likely to take the effort.

You can make it so that opting in and out takes equal effort.

I'd consider it less strong opinions and more power of defaults.

Although if Homebrew wasn't using Google Analytics, maybe people would. It could just be a "Do you mind sending us anonymous usage data? [y/N]" prompt. Many other apps do something equivalent, and I don't mind giving it to them. The fact that those apps ask in the first place makes me much more amenable to the idea.

"Do you mind" would be counterintuitive. I see analytics and want to respond "n", for no analytics

... which, if true, tells you something about the value of this 'feature' to the user.

Or, even worse, there'd be a selection effect where the distribution of people who opt in is skewed from the total distribution of Homebrew users, ruining the dataset for any analysis one might want to do to it. There's a reason that Nielson Ratings collection isn't opt-in.

Funny, it's been quite a few years, but I remember being a Nielson family for a few months, and it was absolutely opt-in. We had to fill out a little booklet with what we were watching and data about ourselves.

You can't opt in to Nielson because they choose who to give the boxes to. Of course it's optional to do it if they do ask you if you want a box.

At 193,622 submissions, I wouldn't say "nobody" opts in to popcon:

http://popcon.debian.org/

Or, you could edit /usr/local/Library/Homebrew/utils/analytics.rb to send Google Analytics garbage (from random UUIDs) until Homebrew makes this feature opt-in.

This is a great idea.

Any rubyists want to provide a patch to do this?

trashing the telemetry data they're using to figure out what OS/ver people are using and bugs they are hitting makes you a real jerk

use their opt-out if you want

Fair point, the public shaming that is happening now is probably punishment enough.

Frankly I don't trust the opt-out code to be (and remain) bug-free. There are, as far as I can tell from searching, no tests. So I feel more comfortable maintaining a patched version with the calls nooped instead.

You can also submit a pull-request to add tests or fix any bug you can find.

Collecting telemetry data without letting users even know about it (much less opt in) isn't cool, either.

I'm really having trouble understanding this (and I appear to be in a very very tiny minority). Why would it bother you if homebrew devs and Google knew which packages you had installed?

Totally agree. I don't feel too comfortable bout google knowing everything about me... Should be opt in.

Did you read the link? Your actions cannot be tied specifically to you.

Says the company that offers the service? There's traces , ips, etc. everywhere, not impossible to correlate...

Then stop using Homebrew.

1) Homebrew is not a company. 2) It's open source.

1) Google the company. 2) GA is not open source nor does it matter when it's your data on someone else's server.

What makes you trust Homebrew over Google? What makes you trust anyone with your data online?

Well, up until now, Homebrew wasn't specifically collecting any information.

You may also want to "rm ~/.homebrew_analytics_user_uuid"

You could really screw with their statistics by regularly changing the contents of that file.

Homebrew maintainer here. Remember that we didn’t put these analytics in place to get rich or get free beer at the local pub. Screwing up the stats won’t help anyone.

We currently don’t have any overview of our userbase; we don’t even know how many people use Homebrew. More importantly, Homebrew currently only bottles the default options but we know some people use some options that cause the formulae to build from source. If tomorrow we see that e.g. `brew install foo --with-bar` is run by hundreds of people everyday we could start bottling it and saving time to everyone. But right now that’s completely dark; the only insights we have about the usage is people opening issues/PRs.

Amazing. I've been using --with-python3 a lot, having a bottled option would be great.

I'll leave analytics turned on, but the blog post says it'll strip arguments. Your example above seems to conflict with what the post says, no?

Yeah it’s not implemented yet. We’re doing it incrementally and actually started shipping the first bits one month ago (but it was opt-in for tests). Bottling the most used options is something we’re really excited both as maintainers and users and is IMO the number 1 reason these analytics will benefit everyone. We’re currently looking how it behaves and will add them soon.

The biggest benefit of this change is getting people to reconsider their usage of homebrew. For example, now I'm looking into Nix. These sorts of changes fuel competition and innovation.

I'm reminded of when Adblock Plus went sour, and we got uBlock Origin. There are lots of examples of this.

Out of curiosity, would the homebrew maintainers be open to replacing google analytics with an open source setup if the infrastructure was sponsored?

I can’t speak for all the team here but yes that’s something we’d consider. Someone suggested Keen IO on the issues tracker which is not open-source but it’s the only viable alternative that has been proposed so far, and it’s not from Google so some people would be more happy with that.

its better to create am empty ~/.homebrew_analytics_user_uuid and remove write permissions

Where's your reasoning? Homebrew gave theirs.

Keep in mind that no personal info is ever sent. Just a random UUID.

> no personal info

> Just your universally unique id

...

"oconnore" is a perfectly valid unique identifier on HackerNews that doesn't tie to anything about you if you don't have your email address in your profile. This is no different.

he does have the email, though

The difference is, it's a choice to post on a public website. homebrew is a package management tool, there is no expectation that it will send information about you to Google.

>is a package management tool

This. The reasons they articulate for suddenly deciding on performing this data collection, and for doing it via GA are laughable. I am sufficiently annoyed at this because of the generation of yet another outbound data stream from my system, but the fact that in all likelihood the project will do nothing with this data really annoys me. There is zero need for this in a package system.

> > Just your universally unique id

How is a Homebrew UUID personal info?

It's on my PC.

They send more than that, have you checked out the code? Every time you do an install Google gets to know about it: https://github.com/Homebrew/brew/blob/acc9a7ca8554bc2413dee2...

Maybe this is sufficiently private, maybe not. I'm not a security expert.

Maybe GA's fingerprinting heuristics are advanced enough to know that because user 1034324234 installed spacemacs at 4:01 and I visited the spacemacs documentation at 4:01 that there's a decent chance I'm user 1034324234.

Decent enough to see if the pattern happens again. After a few rounds of this, it's close enough to serve me ads based on user 1034324234's install patterns.

:shrug: doesn't sound crazy to me.

Ads which you'll no doubt block anyway. Not seeing the issue here.

One decent reason would be that existing installs arguably shouldn't change their privacy considerations without a hoop to jump through.

My reasoning? Because it's good to respect the privacy and choices of your users. Homebrew never called home to Google in the past, most people would not reasonably expect it to suddenly start doing so without letting them know.

Agreed.

I expect that if it was opt-in most people wouldn't take the active step to do so. And if given a choice on first-run, a large proportion of users would choose to disable the analytics reporting.

Making it opt-out seems deceitful - an attempt to trick users into leaving it enabled.

And the Homebrew developer responses thus far on the GitHub issue (users should be watching the documentation and Twitter feed - they'd have seen the announcement) seem unrealistic and unfair.

This should have been opt-in from day one, not opt-out. Especially if it's changing existing behaviour (having never automatically reported telemetry in the past).

I block Google Analytics in my web browser, too...

What is the mechanism in which Homebrew inserts itself into every shell session anyway? I had expected it to be loaded somewhere in some shell initialization script, such as .bashrc or .bash_profile, but I couldn't find anything.

It doesn't — by default, Homebrew lives in /usr/local/bin/, which is already in the default $PATH on OS X.

But then, by which mechanism does Homebrew notify GA that I have opened a terminal tab? There is a curl command executed every time, and I see a connection to GA with Little Snitch.

Is there some way to see the caller of a process? htop displays no parent in the tree view.

You probably have something in your .bashrc, or shell equivalent, that is launching brew.

Reply on news.ycombinator.com